Privacy Policy

1. Data Controller

The entity responsible for data processing on this website within the meaning of the General Data Protection Regulation (GDPR) is:

PAD GmbH
Auf dem Bruch 52b,
45475 Mülheim an der Ruhr,
Germany

Managing Director: Edgar Masch
Phone: +49 (0) 6241 857 986-0
Email: company@iqbid.ai
Commercial Register: HRB 31821, District Court Duisburg

2. Contact Details of the Data Protection Officer

Edgar Masch / Managing Director
c/o PAD GmbH, Auf dem Bruch 52b · 45475 Mülheim an der Ruhr
Email: company@iqbid.ai

3. General Information on Data Processing

We generally process personal data of our users only to the extent necessary to provide a functional website and our content and services. Processing is typically carried out only with the user's consent or based on statutory permission.

4. Legal Basis for Processing

Personal data is processed—depending on the purpose—on the following legal bases:

• Art. 6(1)(a) GDPR (Consent) – e.g., cookies/tracking, newsletters
• Art. 6(1)(b) GDPR (Contract) – e.g., registration, contract performance, payment processing
• Art. 6(1)(c) GDPR (Legal Obligation) – e.g., retention obligations under tax and commercial law
• Art. 6(1)(f) GDPR (Legitimate Interest) – e.g., IT security, abuse prevention, reach measurement

5. Provision of the Website and Server Log Files

Each time the website is accessed, information is automatically transmitted by the user's browser to our hosting server. The following data is temporarily stored in log files:

• User's IP address
• Date and time of access
• Requested content (specific pages)
• Volume of data transferred
• Notification of successful retrieval
• Browser type and version
• User's operating system
• Referrer URL

Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest lies in ensuring seamless connection establishment, system security, and analysis for administrative purposes.

Storage period: Generally no longer than 30 days, unless longer storage is required to investigate attacks or abuse.

6. Hosting (Amazon Web Services / AWS)

We host our website and the IQBID AI platform with the provider:

Amazon Web Services EMEA SARL,
38 Avenue John F. Kennedy, L-1855 Luxembourg ("AWS").

AWS processes personal data of website visitors and users on our behalf.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in reliable and secure operation). A data processing agreement (DPA) pursuant to Art. 28 GDPR has been concluded with AWS.

If data is processed in data centers outside the EU/EEA, such processing is based on the EU Standard Contractual Clauses (Art. 46(2) GDPR) as well as supplementary technical and organizational measures.

7. Registration and User Account

Registration with a user account is required to use the paid or free functionality. The following data is collected:

• Email address
• Password (stored encrypted)
• Optional: Name, address, phone number (for paid plans, for invoicing purposes)
• For businesses: Company name, VAT identification number

Legal basis: Art. 6(1)(b) GDPR (contract initiation and performance); for invoicing purposes, additionally Art. 6(1)(c) GDPR.

Storage period: For the duration of the contractual relationship plus statutory retention periods (in particular, 6 or 10 years pursuant to the German Commercial Code (HGB) and Fiscal Code (AO)).

8. Use of AI Features (Prompts, Generations)

When using AI features, we process content entered by the user ("prompts"), uploaded files, and results generated by AI models ("output"). This content is transmitted to the following third-party AI providers to deliver the service:

Notice on Transfers to Third Countries

Transfers of data to third countries (in particular, USA, United Kingdom, and where applicable, China) are based on the following:

• USA: EU-US Data Privacy Framework (DPF), where the specific provider is certified (Adequacy Decision of the European Commission dated July 10, 2023);
• Additionally or alternatively: EU Standard Contractual Clauses pursuant to Art. 46(2)(c) GDPR;
• For China (DeepSeek): The P.R. China does not provide an adequate level of data protection within the meaning of the GDPR. Transfers occur only based on your explicit consent pursuant to Art. 49(1)(a) GDPR, after separate information about the associated risks. You may disable this model at any time in the settings.

Notice on Use of Prompts by AI Providers

We have selected API configurations with integrated AI providers that, to the extent possible, exclude the use of input data for training third-party models. However, certain providers, particularly DeepSeek, reserve the right under their terms to use transmitted content in whole or in part for training purposes. Please refer to the respective privacy notices of the providers.

9. Payment Processing via Stripe

For payment processing, we use the payment service provider:

Stripe Payments Europe, Ltd.,
1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland.

Stripe processes the data required for payment processing under its own responsibility. This includes, in particular, payment data (e.g., card details, IBAN), name, address, email address, IP address, transaction data, and device information. Payment data (especially credit card details) is processed exclusively on Stripe's servers; we do not store this data ourselves.

Legal basis: Art. 6(1)(b) GDPR (contract performance) and Art. 6(1)(f) GDPR (fraud prevention).

Data may be transferred to the USA to the parent company; such transfers are based on the EU Standard Contractual Clauses and—where certified—the EU-US Data Privacy Framework.

Further information on data processing by Stripe is available at: https://stripe.com/de/privacy

10. Cookies and Similar Technologies

We use cookies and similar technologies (e.g., localStorage) on our website. Cookies are small text files stored in the user's browser.

We distinguish between:

• Technically necessary cookies, which are essential for the operation of the website and, in particular, for login, security, and saving preferences. Legal basis: § 25(2) No. 2 TTDSG in conjunction with Art. 6(1)(f) GDPR.
• Non-essential cookies (in particular for analytics, marketing, tracking), which are set only after the user's explicit consent via our consent management tool. Legal basis: § 25(1) TTDSG in conjunction with Art. 6(1)(a) GDPR.

Consent may be withdrawn at any time via the cookie settings on the website.

11. Web Analytics

We use Google Analytics 4 by Google Ireland Limited to analyze user behavior. Processing is carried out exclusively based on prior consent obtained pursuant to Art. 6(1)(a) GDPR and § 25(1) TTDSG. IP anonymization is applied. Further information: https://policies.google.com/privacy

12. Communication via Email and Support

When contacting support or via email, we process the transmitted data to handle your inquiry.

Legal basis: Art. 6(1)(b) GDPR (pre-contractual or contractual measures) or Art. 6(1)(f) GDPR (legitimate interest in responding to inquiries).

Storage period: Until final processing of the inquiry, unless statutory retention obligations require otherwise.

13. Recipients / Processors

In addition to the AI providers and Stripe mentioned above, we transfer personal data to the following recipients:

• AWS (hosting) – see Section 6
• Tax advisors and auditors (within the scope of statutory obligations)
• IT service providers and developers (data processing pursuant to Art. 28 GDPR)
• Authorities, courts, and law enforcement agencies to the extent required by law

14. Storage Period

Personal data is stored only for as long as necessary for the respective purposes. Once the purpose ceases to apply, the data is deleted or anonymized, unless retention obligations under commercial or tax law require otherwise (generally 6 or 10 years).

15. Rights of Data Subjects

Regarding your personal data, you have the following rights vis-à-vis us:

• Right of access (Art. 15 GDPR)
• Right to rectification (Art. 16 GDPR)
• Right to erasure ("right to be forgotten", Art. 17 GDPR)
• Right to restriction of processing (Art. 18 GDPR)
• Right to data portability (Art. 20 GDPR)
• Right to object to processing (Art. 21 GDPR)
• Right to withdraw consent given, with effect for the future (Art. 7(3) GDPR)

To exercise your rights, please contact: company@iqbid.ai

Right to Lodge a Complaint with a Supervisory Authority

You have the right to lodge a complaint with a data protection supervisory authority regarding the processing of your personal data (Art. 77 GDPR). The competent authority includes, inter alia:

[Specify the competent state data protection authority depending on the location of PAD GmbH, e.g., The Hessian Commissioner for Data Protection and Freedom of Information, P.O. Box 3163, 65021 Wiesbaden]

16. Obligation to Provide Data

The provision of personal data is neither required by law nor by contract. You are not obligated to provide us with data. However, without the data required for contract performance, we may be unable to offer our services to you or may only be able to offer them in a limited capacity.

17. Automated Decision-Making and Profiling

Automated decision-making with legal effects pursuant to Art. 22 GDPR does not take place. Where AI models generate content, this serves exclusively to respond to user inputs; no automated decision concerning the user is made in this process.

18. Changes to this Privacy Policy

We reserve the right to adapt this Privacy Policy to reflect changes in legislation or modifications to our service. The current version is always available at: https://iqbid.ai/privacy-policy