Privacy Policy

When you access our website or use our online services, technical information is automatically transmitted to our servers and infrastructure providers.

Depending on the service and technical configuration, the following personal data may be processed:

• IP address
• Date and time of access
• Browser type and version
• Operating system
• Pages and resources accessed
• Amount of data transmitted
• Access status and technical error information
• Technical information necessary to identify unauthorized access or suspicious activities

The processing serves to provide our website and online services, ensure their functionality and security, identify technical errors, and prevent misuse.

The legal basis is Art. 6 (1) sentence 1 lit. f GDPR. Our legitimate interest lies in the secure, stable, and reliable operation of our website and online services.

We use Google Firebase App Hosting for hosting and delivering the frontend of our online services.

The primary configured hosting region is the Netherlands (europe-west4).

In this context, technical information such as IP addresses, request metadata, access information, and server logs may be processed.

The processing serves to ensure the availability, functionality, and security of our website and online services.

The legal basis is Art. 6 (1) sentence 1 lit. f GDPR, reflecting our legitimate interest in providing our services in a technically reliable manner.

We use Render to operate our application backend and database infrastructure.

Our application backend is currently hosted in Virginia, United States. Our primary PostgreSQL database is hosted in Frankfurt, Germany.

Depending on the functionality used, the following personal data may be processed:

• IP addresses and technical connection information
• Application requests and technical logs
• Account and authentication-related information
• Information transmitted through our online services
• Personal data stored in our application database

The processing serves to provide and operate our applications, manage data storage, ensure application functionality, and maintain system security.

The legal basis is Art. 6 (1) sentence 1 lit. b GDPR, insofar as processing is necessary for contractual performance involving the data subject, or Art. 6 (1) sentence 1 lit. f GDPR, reflecting our legitimate interest in secure and reliable service operation.

Where SHER DeepAI acts as a processor for business customers, the processing is governed by the applicable Data Processing Agreement.

International Data Transfers

As our application backend is hosted in the United States, personal data may be transferred to and processed in the USA. Render participates in the EU–US Data Privacy Framework (DPF) and provides for the use of the European Commission’s Standard Contractual Clauses (SCCs) where applicable.

We use Redis-based caching infrastructure hosted on Amazon Web Services (AWS) in Frankfurt, Germany.

Depending on the functionality used, temporary application data, session-related information, technical identifiers, and other information necessary for the operation of our services may be processed.

The processing serves to improve application performance, reduce response times, and ensure reliable service operation.

The legal basis is Art. 6 (1) sentence 1 lit. b GDPR, insofar as processing is necessary for contractual performance involving the data subject, or Art. 6 (1) sentence 1 lit. f GDPR, reflecting our legitimate interest in operating efficient and reliable services.

We use Cloudflare for DNS management, content delivery, network performance, and security.

In this context, Cloudflare may process IP addresses, connection information, browser-related information, and security-relevant technical data.

The processing serves to protect our website and online services against unauthorized access, cyberattacks, and technical disruptions and to ensure reliable content delivery.

The legal basis is Art. 6 (1) sentence 1 lit. f GDPR. Our legitimate interest lies in the secure and reliable operation of our website and online services.

We provide the possibility to contact us through our website or by e-mail.

When you submit an inquiry, we process the personal data provided by you and the technical information necessary to receive and respond to your request.

The following personal data may be processed:

• Name and e-mail address
• Company name and professional contact information
• Content of the inquiry
• Date and time of communication
• Technical information necessary to process the communication

The processing serves to respond to inquiries, communicate with prospective customers and business partners, and manage existing business relationships.

The legal basis is Art. 6 (1) sentence 1 lit. b GDPR, insofar as the inquiry relates to contractual or pre-contractual measures involving the data subject.

Otherwise, the legal basis is Art. 6 (1) sentence 1 lit. f GDPR. Our legitimate interest lies in responding to inquiries and maintaining business communications.

5.2.1 General Information

We use cookies and similar technologies on our website and online services for user authentication and web analytics. Cookies are small text files stored on your device that enable certain functions and help us understand how our services are used.

We distinguish between technically necessary cookies, which do not require consent, and non-essential cookies, which are used only with your prior consent.

5.2.2 Cookie Banner

When you visit our website or a subpage containing cookies for the first time, a cookie banner is displayed. The banner provides information about the individual cookies we use, including their names, providers, purposes, and storage periods.

Our cookie banner allows you to decide whether to consent to the use of non-essential cookies. You can accept or reject these cookies and withdraw or change your consent at any time through the cookie settings.

The following data may be processed in this context:

• Usage data (e.g., pages visited and time of access)
• Meta and communication data (e.g., IP address)
• Cookie preferences and consent choices
• Technical information necessary to manage and document consent

The legal basis for processing personal data in connection with the cookie banner is Art. 6 (1) sentence 1 lit. f GDPR. Our legitimate interest lies in obtaining and documenting legally required consent for non-essential cookies and fulfilling our information obligations.

The cookie banner and consent management functionality are operated directly by SHER DeepAI. Your cookie preferences are stored for as long as necessary to manage and document your choices, unless you change or reset them earlier.

5.2.3 Necessary Cookies

We use technically necessary cookies to authenticate users, manage login sessions, and provide secure access to our online services.

These cookies are required for the proper functioning and security of our services and therefore cannot be disabled through our cookie banner.

The legal basis for storing or accessing information on your device is Section 25 (2) No. 2 TDDDG. Where personal data is processed, the legal basis is Art. 6 (1) sentence 1 lit. b or f GDPR, depending on the processing purpose.

5.2.4 Analytics Cookies

We use Google Analytics , a web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, to understand how visitors interact with our website, analyze website usage, and improve our services.

In this context, personal data such as IP addresses, device and browser information, pages visited, and usage statistics may be processed. Google Analytics uses cookies and similar technologies to collect information about website usage.

Analytics cookies are used only with your prior consent. The legal basis for storing or accessing information on your device is Section 25 (1) TDDDG and, where personal data is processed, Art. 6 (1) sentence 1 lit. a GDPR.

You may withdraw your consent at any time with effect for the future through our cookie settings.

5.2.5 Cookie Storage Period

We distinguish between session cookies, which are generally deleted when the browser session ends, and persistent cookies, which remain stored for a defined period.

The storage period depends on the purpose and configuration of the respective cookie. Information about individual cookies, including their providers, purposes, and storage periods, is available through our cookie settings.

We process personal data when communicating with prospective customers, existing customers, business partners, and other professional contacts.

Data Processing

The following personal data may be processed:

• Name and professional contact information
• Company name and professional position
• E-mail correspondence and other communication content
• Information relating to inquiries, offers, and contractual relationships
• Appointment and meeting-related information

Purpose and Legal Basis

The processing serves to respond to business inquiries, prepare offers, manage contractual relationships, and communicate with customers and business partners.

The legal basis is Art. 6 (1) sentence 1 lit. b GDPR, insofar as processing is necessary for contractual or pre-contractual measures involving the data subject.

Otherwise, the legal basis is Art. 6 (1) sentence 1 lit. f GDPR, reflecting our legitimate interest in maintaining business relationships and organizing business communications.

We use Google Meet and Microsoft Teams to conduct audio and video conferences with customers, business partners, and other external parties.

Data Processing

Depending on the functions used, the following personal data may be processed:

• Name and e-mail address
• IP address and device information
• Meeting date, time, and duration
• Participant information and meeting identifiers
• Audio and video data
• Chat messages and shared content

Purpose and Legal Basis

The processing serves to enable and conduct audio and video conferences and facilitate communication and cooperation with customers, business partners, and other external parties.

The legal basis is Art. 6 (1) sentence 1 lit. b GDPR, insofar as the conferences are conducted in connection with contractual or pre-contractual measures involving the data subject.

Otherwise, the legal basis is Art. 6 (1) sentence 1 lit. f GDPR. Our legitimate interest lies in efficient communication and cooperation with customers, business partners, and other external parties.

Service Providers

We use the following services:

Google Meet, provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

Microsoft Teams, provided by Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland.

We use Google Calendar and Calendly to organize and schedule appointments with customers, business partners, and other external parties.

Data Processing

When scheduling an appointment, the following personal data may be processed:

• Name and e-mail address
• Company name and professional contact information, where provided
• Appointment date, time, and duration
• Information voluntarily provided in connection with the appointment
• Technical information required for scheduling and managing appointments

Purpose and Legal Basis

The processing serves to organize, coordinate, and manage appointments with customers, business partners, and other external parties.

The legal basis is Art. 6 (1) sentence 1 lit. b GDPR, insofar as the appointment is arranged in connection with contractual or pre-contractual measures involving the data subject.

Otherwise, the legal basis is Art. 6 (1) sentence 1 lit. f GDPR. Our legitimate interest lies in the efficient organization of appointments and communication with customers, business partners, and other external parties.

Service Providers

We use the following services:

Google Calendar, provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

Calendly, provided by Calendly, LLC, 115 E Main St., Ste A1B, Buford, GA 30518, United States.

5.6.1 E-mail Communication

We use Resend to send transactional and service-related e-mails, including account notifications, authentication messages, and other communications necessary for the operation of our services.

Data Processing

The following personal data may be processed:

• Name and e-mail address
• Message content
• Sending and delivery information
• Technical information necessary for e-mail delivery

Purpose and Legal Basis

The processing serves to send contractual, technical, and service-related communications.

The legal basis is Art. 6 (1) sentence 1 lit. b GDPR, insofar as processing is necessary for contractual performance involving the data subject.

Otherwise, the legal basis is Art. 6 (1) sentence 1 lit. f GDPR, reflecting our legitimate interest in reliable service communication.

5.6.2 Social Networks – LinkedIn

SHER DeepAI maintains a corporate presence on LinkedIn to provide information about our company, technologies, services, and professional activities and to communicate with interested parties.

Data Processing

When users interact with our LinkedIn presence, personal data may be processed by LinkedIn and, depending on the interaction, by SHER DeepAI.

This may include:

• Profile and contact information
• Information contained in messages and comments
• Interactions with posts and company content
• Technical and usage information processed by LinkedIn

Purpose and Legal Basis

We process personal data to communicate with interested parties, maintain professional relationships, and provide information about our company and services.

The legal basis is Art. 6 (1) sentence 1 lit. f GDPR, reflecting our legitimate interest in corporate communication and professional networking.

Where an inquiry relates to contractual or pre-contractual measures involving the data subject, Art. 6 (1) sentence 1 lit. b GDPR may apply.

For certain platform statistics and insights, joint controllership under Art. 26 GDPR may apply, depending on the specific functions used.

Certain SHER DeepAI services require users to register or authenticate themselves. We use Google OAuth 2.0 for user authentication.

Data Processing

Depending on the permissions granted, the following personal data may be processed:

• Name
• E-mail address
• Google account identifier
• Authentication-related information
• Account and session information

Purpose and Legal Basis

The processing serves to authenticate users, manage access to registered services, and protect user accounts against unauthorized access.

The legal basis is Art. 6 (1) sentence 1 lit. b GDPR, insofar as processing is necessary for contractual performance involving the data subject.

Otherwise, the legal basis is Art. 6 (1) sentence 1 lit. f GDPR, reflecting our legitimate interest in secure account management.

SHER DeepAI provides AI-powered services, including AI assistants and applications that process user-submitted information and generate AI-based responses, analyses, and recommendations.

Depending on the functionality used, the following categories of personal data may be processed:

• User inputs, including prompts, questions, and messages
• Conversation histories and contextual information
• Uploaded documents and other submitted content
• AI-generated responses, analyses, and results

Purpose and Legal Basis

Personal data is processed to provide our AI-powered services and perform the functions requested by users.

Where SHER DeepAI acts as controller, processing is based on Art. 6 (1) sentence 1 lit. b GDPR, where necessary for the performance of a contract with the data subject, or Art. 6 (1) sentence 1 lit. f GDPR, where necessary for our legitimate interests in providing and securely operating our services.

Where SHER DeepAI processes personal data on behalf of business customers, the customer acts as controller and SHER DeepAI as processor under the applicable Data Processing Agreement pursuant to Art. 28 GDPR.

Use of External AI Model Providers

To provide our AI-powered services, we use external AI model providers. We currently use Google Gemini via the Gemini API.

Depending on the functionality used, information submitted by users may be transmitted to Google for processing and the generation of AI-based responses.

The processing of such information by Google is governed by the applicable contractual terms and service configuration.

Our AI-powered services may generate information, analyses, explanations, or recommendations. Such functionality does not necessarily constitute automated individual decision-making within the meaning of Art. 22 GDPR. Where applicable, further information about automated decision-making will be provided in accordance with legal requirements.

AI-generated information, analyses, explanations, and recommendations may contain errors, inaccuracies, or incomplete information. Such outputs should therefore be subject to appropriate human review and plausibility checks and should not be relied upon as the sole basis for important decisions.

If you submit personal data relating to other individuals through our services, you are responsible for ensuring that you have an appropriate legal basis or other authorization to provide such data, where required by applicable data protection law.