Privacy policy

1. Controller

A & D Media und Data GbR, Hedwig-Porschütz-Straße 30, 10557 Berlin, Germany. Represented by the partners Anastasiia Pylypenko and Denys Drobotov. Email: info@halvista.com.

We have not appointed a data protection officer because the legal requirements for doing so are not met. Please send any data protection questions to the email address above.

2. Two roles: controller and processor

For visitors to our website, prospective customers and the user accounts of our customers, we are the controller within the meaning of the GDPR. This policy covers that processing.

Data our customers process with Halvista (for example messages from their own customers via chat, WhatsApp, Instagram, Telegram or email) we process as a processor under Art. 28 GDPR on behalf of the customer. The customer is the controller; our data processing agreement (DPA) applies. End customers should direct questions and requests to the business they were writing to.

3. Visiting the website

The website runs on servers of Hetzner Online GmbH in Germany. To deliver a page, the server necessarily processes your IP address. We do not keep access logs with IP addresses beyond delivery.

We use no cookies, no analytics or tracking tools and no advertising pixels on halvista.com. Fonts and scripts are loaded from our own server, not from third parties.

The legal basis is our legitimate interest in a secure and working service (Art. 6(1)(f) GDPR).

4. Contact by email and contact form

The contact form opens your own email program; the website itself does not transmit any form data. When you write to us, we process your details (name, email address, company, content of the message) to answer your request.

Our mailboxes are operated by IONOS SE in Germany. The legal basis is Art. 6(1)(b) GDPR (pre-contractual steps) or (f) (answering general enquiries). We delete enquiries once they are settled unless statutory retention periods apply.

5. User account in the application

For an account at app.halvista.com we process name, business email address, password (only as a secure hash), team role, sign-in times and workspace settings.

To keep you signed in we set a strictly necessary session cookie. It becomes invalid when you sign out or the session expires (§ 25(2) no. 2 TDDDG).

The legal basis is performance of the contract (Art. 6(1)(b) GDPR). We delete account data after the contract ends unless statutory retention periods apply.

6. Payments and invoices

Payments are processed by Stripe Payments Europe, Limited, 1 Grand Canal Street Lower, Dublin 2, Ireland. Stripe processes name, billing address, VAT ID, email address and payment details for this purpose. We do not receive full card data.

Stripe may transfer data to third countries, in particular the USA, on the basis of the EU-US Data Privacy Framework or the European Commission’s standard contractual clauses. For its own purposes, such as fraud prevention, Stripe acts as an independent controller.

The legal basis is Art. 6(1)(b) and (c) GDPR. We keep invoices for up to ten years under German tax and commercial law (§ 147 AO, § 257 HGB).

7. Artificial intelligence

For suggested and automatic replies we use the Mistral AI API (Mistral AI SAS, 15 rue des Halles, 75001 Paris, France) through its EU endpoint, with processing in EU data centres. Only the content needed for the reply is sent (conversation history, the customer’s knowledge base, order data).

We use the paid service; the content is not used to train AI models. AI replies are labelled as such in the widget and in the inbox (Art. 50 EU AI Act).

8. Chat widget on our customers’ websites

The widget stores nothing on the visitor’s device until the visitor opens the chat. After that it stores only a session identifier so that the conversation can continue. The operator of the website is responsible for the content of the conversation.

9. Recipients and location

We use the following processors; the current list with purpose and location is on the “Subprocessors” page:

• Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany — hosting, database and backups in Germany
• Mistral AI SAS, 15 rue des Halles, 75001 Paris, France — AI processing in the EU
• Stripe Payments Europe, Limited, 1 Grand Canal Street Lower, Dublin 2, Ireland — payment processing
• IONOS SE, Elgendorfer Str. 57, 56410 Montabaur, Germany — email mailboxes

Channels such as WhatsApp, Instagram, Messenger or Telegram are connected by the customer with its own accounts. Their terms and privacy notices apply to transmission via these services, and their providers may process data outside the EU.

10. Your rights

You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21 GDPR). You may withdraw consent at any time with effect for the future.

To exercise these rights, write to info@halvista.com.

You may also lodge a complaint with a data protection authority. The authority responsible for us is the Berlin Commissioner for Data Protection and Freedom of Information (Berliner Beauftragte für Datenschutz und Informationsfreiheit), Alt-Moabit 59–61, 10555 Berlin, Germany.

11. Deleting your data

Halvista account: write from the account owner's email address to info@halvista.com and ask for deletion. We confirm receipt and delete the account with all its data within 30 days; until then you can ask for an export of your data. Access credentials of connected channels (for example Meta tokens for WhatsApp and Instagram) are deleted with it. We keep invoice data as long as tax and commercial law require (up to 10 years). Backups are overwritten in the regular cycle.

Data from conversations with our customers’ customers: the respective business is the controller and deletes this data itself in Halvista – a single customer with all conversations, messages and files from the customer card ("Delete customer and conversations"), and automatically after the configured retention period (by default 12 months without a new message, changeable under "Data retention").

If you wrote to a business through Halvista and want your data deleted, please contact that business. Requests that reach us are forwarded to the business without delay, and we help it with the deletion.

12. Security

Connections are encrypted with TLS. We store credentials for channels and integrations encrypted. Email addresses, phone numbers and message content are masked in logs.

13. Changes

We update this policy when our processing or the law changes. The version published here applies.