Privacy policy

This is a translation of the German privacy policy. In case of discrepancies, the German version prevails.

This privacy policy explains, in accordance with Art. 13 and 14 GDPR, which personal data Creativate Technologies GmbH processes when you visit our websites, contact us, create an account or use c:node, and which rights you have.

It applies to:

• the websites creativate.tech, c-node.ai and graph.c-node.ai,
• the c:node application (app.c-node.ai, the trial environment try.c-node.ai, desktop and mobile app), the central account auth.c-node.ai, billing at billing.c-node.ai and the c:node interfaces (API, MCP).

1. Controller and data protection contact

Creativate Technologies GmbH Lahnstraße 65, 60326 Frankfurt am Main, Germany

Represented by its managing director Leonardo Bornhäußer.

• Email: contact@creativate.tech
• Data protection contact: privacy@creativate.tech

2. Our role: controller or processor

• We are the controller for our websites, enquiries, newsletters, demo and trial offerings, the c:node account, billing, the operation and security of our services, and the data set of the c:node Graph (section 4.13).
• We are a processor where organisations (customers) provide c:node to their staff and process content in it: chats, files, memory, data from connected services (connectors), routines and drafts. The organisation is then the controller; we process this content only on its instructions under our data processing agreement (DPA). Please address questions about such content to your organisation first; we support it in answering them.

The following sections also describe the processing we carry out as a processor, so that you can see what happens to your data.

3. Principles

• Hosting in the EU. Our servers, databases and files are hosted by Amazon Web Services in Frankfurt am Main (region eu-central-1).
• No training on your data. We do not use your content to train AI models and do not make it available to model providers for training purposes.
• Nothing external without approval. c:node does not send emails, create appointments, documents or tasks in connected services or write anything externally unless an authorised person explicitly approves the draft.
• No tracking. On c-node.ai, in the app, in the account and in billing we use no analytics, advertising or tracking tools. Fonts and libraries are served from our own servers.

4. Processing in detail

4.1 Visiting our websites

When you open a page, the delivering server processes technically necessary data: IP address, date and time, requested address, referrer, browser and operating system details. The websites are delivered via Amazon CloudFront and Amazon S3.

• Purpose: delivering the website, stability and security (e.g. defending against attacks).
• Legal basis: Art. 6(1)(f) GDPR (legitimate interest in a secure, functioning website).
• Retention: where access logs are created, we delete them as soon as they are no longer needed for these purposes.

We store on your device only what is needed for it to work (e.g. chosen language and theme, your cookie choice). Details are in the Cookie Policy. The legal basis for storing and reading this information is Section 25(2) No. 2 TDDDG (German Telecommunications Digital Services Data Protection Act), and Art. 6(1)(f) GDPR for the subsequent processing.

For content such as the c:node Graph statistics, c-node.ai fetches data from our own services (graph.c-node.ai, auth.c-node.ai for the "signed in" display, contract.c-node.ai for the demo). No data is transferred to third parties in doing so.

4.2 Contact and enquiry forms, email, appointment booking

When you write to us via a form, we process first name, last name, email address, company, your message, the topic, the language, the page you write from and your consent statement. The forms run through our own form service (forms.creativate.tech) and are stored in our self-hosted contact management system (Mautic). To prevent spam we use ALTCHA: your browser solves a small computation; no cookies are set and no data is transferred to third parties.

Emails to us go to mailboxes at Google Workspace (Google Ireland Limited). For appointment booking we link to Google Calendar (calendar.app.google); Google's privacy notices apply there as well, and you enter your data directly with Google.

• Purpose: handling your enquiry and communicating with you.
• Legal basis: Art. 6(1)(b) GDPR where the enquiry concerns or prepares a contract, otherwise Art. 6(1)(f) GDPR (answering enquiries).
• Retention: until your enquiry has been dealt with and then up to 3 years (standard limitation period) if no business relationship results; for contracts, the periods in section 7 apply.

4.3 Newsletter

On creativate.tech and when creating an account you can subscribe to news by email. We process your email address, language, and the time and wording of your consent. On creativate.tech we send a confirmation email (double opt-in); you only receive the newsletter after confirming.

• Legal basis: Art. 6(1)(a) GDPR (consent).
• Withdrawal: at any time via the unsubscribe link in every issue, in the account settings (auth.c-node.ai) or by email to privacy@creativate.tech.
• Retention: until withdrawal; we keep proof of consent for up to 3 years afterwards (Art. 7(1) GDPR, limitation period).

4.4 Situation report demo on c-node.ai and trial environment try.c-node.ai

On c-node.ai you can have a "situation report" (Lagebild) on a company created without signing in. You enter a web address (domain) and optionally a question. c:node then retrieves up to a few dozen public pages of that website (including imprint and team pages), compares them with public sources (e.g. register data, EU tenders, legal sources) and has the text summarised by an AI language model (Google Gemini). The result is an AI-generated draft that may contain errors.

If you request the report as a PDF by email, we additionally process your email address and your consent, send you the link and may contact you once about the report.

• Data: entered domain and question, language, technical data (IP address for usage limits and abuse prevention), a session cookie (cn_demo, 24 hours), and for PDF requests your email address and consent.
• Legal basis: Art. 6(1)(f) GDPR for the demo (presenting our product, preventing misuse); Art. 6(1)(a) GDPR for sending the email and contacting you.
• Recipients: Google (Gemini API, see section 5) for the summary; our email delivery service (Resend) for sending.
• Retention: PDF link 7 days; demo session 24 hours; email address, domain and question until you withdraw consent. The IP address may be kept in the usage log for up to 400 days. Results created for a domain may be cached so that repeated requests can be answered faster; we delete them on request to privacy@creativate.tech.

Note for persons whose website is analysed: we only process publicly accessible pages. Names from imprint or team pages may be contained in the text passed to the language model; the report itself does not list persons. You may object to this processing under Art. 21 GDPR (section 10).

In the trial environment try.c-node.ai you can try c:node with a free trial account. There, the AI processes your input with Google Gemini; sections 4.6 to 4.8 apply. Please do not enter confidential or particularly sensitive data in the trial environment.

4.5 Feedback

Using the feedback icon on our pages you can send us a rating, a message and, if you wish, your email address and up to three screenshots. We also store the page, the language and the browser type.

• Purpose: fixing errors and improving the product.
• Legal basis: Art. 6(1)(f) GDPR.
• Retention: until the feedback has been dealt with, at most 12 months.

4.6 Account and sign-in

For c:node, the account and billing you use one central account (auth.c-node.ai). We process email address, name, optionally company, language, profile picture, password (only as a hash), roles and memberships in organisations, sign-in times, consents and acceptance of the terms and privacy notices (with version and time), and security-relevant events (e.g. sign-ins, with a truncated hash of the IP address).

You can sign in with a code or link by email, with a password, or via Google or Microsoft. When you sign in with Google or Microsoft, we receive your email address, name, an identifier and possibly your profile picture (permissions "openid", "email", "profile"); the provider's privacy notices apply as well. A profile picture obtained this way may be loaded directly from the provider's servers when displayed; the provider then receives your IP address.

• Purpose: providing the account, secure sign-in, managing organisations and roles, proof of consents.
• Legal basis: Art. 6(1)(b) GDPR (user agreement); Art. 6(1)(c) in conjunction with Art. 7(1) GDPR for proof of consent; Art. 6(1)(f) GDPR for security events.
• Retention: for as long as the account exists. Security events 90 days, expired sign-in codes and links after 1 day, ended sessions after 7 days. If you delete your account, it is deleted after a waiting period of 30 days, during which you can cancel the deletion. Afterwards only a placeholder without reference to you remains; we keep invoice data as described in section 4.14.

You can deactivate or delete your account and export your data (Art. 20 GDPR) yourself in the account settings.

4.7 Using c:node: chats, files and memory

When you use c:node, we process the content you enter or upload and the results: questions and answers (chats), files in the library, notes and entries in memory, drafts, calculations, approvals and usage data (e.g. quotas used).

Memory has three scopes: personal (default, only you), team and organisation. Nobody else sees personal content, not even administrators. Content only enters team or organisation memory after explicit approval. The public knowledge of the c:node Graph is kept separate and is not changed by your use.

Files are stored encrypted in Amazon S3 (Frankfurt); because of versioning, deleted files remain in a backup version for up to 30 days.

• Legal basis: Art. 6(1)(b) GDPR; when used via an organisation, we process the content as its processor (Art. 28 GDPR).
• Retention: until you or your organisation delete the content, at the latest when the account is deleted or 30 days after the end of the contract (DPA). Content in the team or organisation scope belongs to the organisation and is retained when your account is deleted.

4.8 AI processing

c:node is an AI system. Answers, summaries and drafts are generated by AI language models and marked as AI results in the application; supported statements carry their source. AI results may contain errors. Please check them before using them. Details are in the AI Transparency Notice.

To produce an answer, we send your question, the chat history so far and the content required for it (e.g. excerpts from files, memory or connected services) to a language model. Which model is used depends on the plan, the task and your organisation's settings:

Organisations can choose an "EU only" policy; then only models processing in the EU or our own models are used. If an organisation uses its own API keys ("bring your own key"), its contract with the provider applies.

Pseudonymisation. For some model calls, we replace recognisable personal details (e.g. email addresses, phone numbers, IBANs, addresses, names) with placeholders before transmission and re-insert them only in the answer. We are extending this protection layer step by step to all model calls. Pseudonymised data remains personal data; the safeguards in sections 5 and 6 therefore continue to apply.

Special categories. Please do not enter health data or other special categories (Art. 9 GDPR) unless your organisation has set rules for this. If c:node detects such data, it processes it only with models in the EU or on our own servers.

No automated individual decisions. c:node does not make decisions producing legal effects or similarly significant effects within the meaning of Art. 22 GDPR. It proposes; people must decide and approve.

• Legal basis: as in section 4.7.
• Retention at the model providers: the providers process the data to generate the answer. Whether and for how long they additionally store data for a short period, e.g. for abuse detection, depends on the respective provider's API terms.
• Usage log: for billing, cost control and quality assurance we log, per model call, organisation, plan, task, provider, model, token count, cost and duration — without content. Retention: 400 days.

4.9 Connected services (connectors)

You or your organisation can connect c:node to other services, e.g. Google (Gmail, Drive, Calendar, Docs, Sheets, Tasks), Microsoft 365 (Outlook, Calendar, OneDrive, SharePoint, To Do, Teams), Atlassian (Jira, Confluence), Slack, Notion, Asana, GitHub, Nextcloud, DATEV, Lexware Office, sevDesk, Personio, EspoCRM and others. A current list is available in the application.

• What happens: only once you connect a service does c:node receive the permissions you grant (e.g. read Gmail and create drafts, read calendars and create events, read files). c:node then reads the content needed for your question or routine and may pass excerpts to the language model (section 4.8). With synchronisation enabled, we store metadata (e.g. subject, sender, file name, time) and, if you choose so, full texts so that c:node can find them.
• Writing only after approval: c:node creates or sends emails, drafts, events, documents, tasks and messages in connected services only when you explicitly approve the respective draft. Sending an email is a second, separate approval step.
• Credentials: we store the services' access tokens encrypted. You can disconnect a service in c:node at any time and revoke access with the provider. Data already synchronised is kept after disconnecting until you delete it or your account is deleted.
• Legal basis: Art. 6(1)(b) GDPR; when used via an organisation, as its processor. The using organisation is responsible for persons whose data appear in your emails, calendars or files.
• Retention: synchronised data follows the source (content deleted in the service is also deleted with us), otherwise until you delete it or the account is deleted. Auxiliary data of synchronisation jobs is deleted after 14 days.

4.10 Routines

With routines you can hand recurring tasks to c:node, e.g. "summarise the open quotes every Monday". A routine runs at the time you choose, on your behalf and with your permissions, over the sources you selected (e.g. email, calendar, files, memory, web search). The result is always a draft marked as created by a routine; nothing is sent or saved without your approval. A routine pauses after three consecutive errors.

Routines are currently available for selected organisations and will be enabled for all instances with one of the next releases.

• Data: name, instruction, schedule, selected sources and targets of the routine, and a log per run (time, status, draft created). Processing by language models follows section 4.8; special categories (Art. 9 GDPR) are processed in routines only with our own models, otherwise not at all.
• Legal basis: as in section 4.7.
• Retention: until you delete the routine; we keep run logs for as long as they are needed to trace the routine's activity.

4.11 Push notifications

If you turn on push notifications, we store the push address of your browser or device and a device label. Notifications are delivered encrypted via the push service of your browser or operating system (e.g. Google Firebase Cloud Messaging, Mozilla, Microsoft, Apple) and contain only a generic title, no content.

• Legal basis: Art. 6(1)(a) GDPR and Section 25(1) TDDDG (consent via the browser prompt); withdraw at any time in c:node or in your browser settings.
• Retention: until you turn off push or the push service reports the address as invalid.

4.12 Web search and research

For questions that need current information from the internet, c:node sends the search term to a search service: Google Gemini with Google Search, SerpApi (SerpApi LLC, USA) or our own search instance. For scholarly research c:node queries the open directories OpenAlex and Crossref. Only the search term is transmitted, no account data. Please do not use confidential personal details in search queries.

If you open a specific website via c:node, c:node reads that page from our servers.

• Legal basis: Art. 6(1)(b) GDPR.

4.13 Public data in the c:node Graph

The c:node Graph is a body of knowledge from public sources (e.g. laws and regulations, court decisions, EU legal acts, statistics, registers of companies and organisations, funding programmes, public tenders). It serves to support answers with verifiable sources. Most sources contain no personal data; where they do, we minimise it (e.g. we omit party names in court decisions, user accounts on code platforms and natural persons as contract award winners).

Some officially published sources contain names of natural persons in their professional or public role, in particular officers of companies in the commercial register (detailed below), interest representatives in the German Bundestag lobby register, operators of energy installations in the Marktstammdatenregister, applicants for EU trade marks and persons on the EU sanctions list. The source is in each case the official source named; we take over only the details needed as evidence, do not process special categories (Art. 9 GDPR) and offer no search for persons and no profiling.

• Legal basis: Art. 6(1)(f) GDPR (legitimate interest in verifiable information from publicly accessible sources); for the sanctions list also our users' interest in complying with sanctions rules.
• Your right to object: as described below, to privacy@creativate.tech.

Officers of companies from the commercial register (information under Art. 14 GDPR)

This section is addressed to persons who are or were entered in the German commercial register (Handelsregister) as an officer or representative of a company, and provides the information required by Art. 14 GDPR. It does not concern users of our platform.

Source. The c:node Graph contains a set of German commercial register data from the open dataset published by OffeneRegister.de (Open Knowledge Foundation Germany) and OpenCorporates under the Creative Commons Attribution 4.0 licence (CC BY 4.0). We do not collect this data from you, from the register portal or by automated reading of websites.

Historical snapshot. The dataset reflects the register as of 2018/2019 and is not updated continuously. Every answer that names officers marks this state as historical and refers to the official commercial register (handelsregister.de) for the current state.

Purpose. Signed-in users of enabled c:node workspaces can ask, for one specific company, who is registered there as managing director, board member or in another officer role. The answer states its source and register date so that it can be verified (business due diligence such as customer, supplier and partner checks). We do not offer searches for persons, profiling of persons or bulk exports.

Legal basis. Art. 6(1)(f) GDPR. Our legitimate interest, and that of our users, is a verifiable business enquiry based on data that the law makes public to inform business dealings (Section 9 German Commercial Code, HGB). The data concerns only your professional role.

Categories of personal data. Name, role (e.g. managing director, board member, authorised signatory (Prokurist), liquidator, general partner), start and end of the entry, and the link to the company (company name, legal form, registered office, register court, register number). We do not store place of residence, date of birth, address or contact details. We do not process special categories of personal data (Art. 9 GDPR).

No processing by AI models. Answers about officers are produced by fixed rules from the register data. Names are not transmitted to language model providers and are not used to train models.

Recipients. Only the signed-in users who ask a specific question about a company. Hosting is provided by Amazon Web Services in Frankfurt am Main (eu-central-1) as processor; there is no transfer to third countries.

Storage and deletion. The data is kept in a separate, read-only index, apart from the rest of the graph. It is replaced in full on every rebuild; backups of an earlier state are deleted after 30 days at the latest. Names appear only in the relevant answer, not in technical logs. Answers in chats follow the deletion periods of the respective workspace. We keep the data for as long as we offer the feature.

No individual notification. The dataset comprises several million register entries. Notifying every registered person would involve a disproportionate effort (Art. 14(5)(b) GDPR). We therefore make this information publicly available here.

Your right to object (Art. 21 GDPR). You may object at any time, on grounds relating to your particular situation, to the processing of your register data in the c:node Graph. Write to privacy@creativate.tech and state your name and the company concerned (ideally with register court and register number). After a justified objection we add you to a block list: your name is then no longer returned for the company concerned (or for all companies), not even as a count of hidden entries. The block takes effect immediately and also applies to every future rebuild of the data. Your other rights (access, rectification, erasure, restriction, complaint to a supervisory authority) remain unaffected, see section 10. Corrections of the register content itself are made by the competent register court.

4.14 Billing and payments

You book paid plans via billing.c-node.ai. Payments are processed by Stripe (Stripe Payments Europe, Limited, Ireland). Stripe collects, on its own pages, name, billing address, VAT ID where applicable and payment details; we do not receive card details. We send Stripe your email address, an account identifier and the chosen plan. Stripe generates invoices; we send them to you by email (Resend) and, as accounting records, to our bookkeeping (Lexware Office, Haufe-Lexware GmbH & Co. KG, Freiburg, Germany) and our tax advisors.

• Legal basis: Art. 6(1)(b) GDPR (contract), Art. 6(1)(c) GDPR (retention under tax and commercial law).
• Retention: invoices and accounting records 10 years, business letters 6 years (Section 147 AO, Section 257 HGB), each from the end of the calendar year; they are deleted afterwards.

We also inform our customers about their contract (e.g. quotas, renewals) and keep contract data (email, plan, status) in our contact management system; legal basis Art. 6(1)(b) GDPR.

4.15 Sending emails

We send service emails (sign-in codes and links, invitations, notices about account, quotas and invoices, approval notices) via Resend (Plus Five Five, Inc., USA). Resend receives the recipient address, subject and content of the email.

• Legal basis: Art. 6(1)(b) GDPR.

4.16 Operation, security and abuse prevention

To operate securely, our services log technical events (time, function or address called, status code, errors); server access logs may also contain the IP address. We mask email addresses and credentials in application logs. For usage limits (e.g. in the trial environment) we process the IP address. We run monitoring (Grafana, Loki, Prometheus) ourselves in Frankfurt.

• Legal basis: Art. 6(1)(f) GDPR (security and stability), Art. 32 GDPR.
• Retention: central logs and metrics 30 days; we delete local logs of the individual services as soon as they are no longer needed for operation and security.

4.17 Interfaces (API and MCP)

Organisations can connect c:node to their own applications and AI assistants (e.g. Claude, ChatGPT, Microsoft Copilot) via an API or the Model Context Protocol (MCP). Answers then go to those applications; the organisation is responsible for their processing. Per call we log time, tool and a hashed identifier, no questions and no content. Nothing can be approved via MCP or the API; approvals are only possible in c:node itself.

4.18 Customer and prospect management

We keep contact details of prospects, customers and partners (name, company, role, email, phone, communication history, contract status) in self-hosted systems (Mautic, EspoCRM) on our servers in Frankfurt.

• Legal basis: Art. 6(1)(b) and (f) GDPR; advertising by email only with consent or within Section 7(3) UWG (then with an option to object in every email).
• Retention: up to 3 years after the last contact; for customers, for the duration of the business relationship plus statutory periods.

5. Recipients and processors

We only disclose personal data where there is a legal basis. Service providers that process data on our behalf act as processors under a contract pursuant to Art. 28 GDPR. Some recipients process data partly as independent controllers, for example Stripe for payment processing, fraud prevention and legal obligations.

Self-hosted on our servers at AWS in Frankfurt (no further recipients): databases (PostgreSQL, SQLite), form service with ALTCHA, Mautic, EspoCRM, speech recognition, embedding models, monitoring (Grafana, Loki, Prometheus).

Connected services (section 4.9) are not our recipients: you or your organisation decide which services c:node may read and write.

6. Transfers to third countries

Some recipients are based or process data in the USA. We only transfer data there if an adequate level of protection is ensured: on the basis of the European Commission's adequacy decision for the EU-US Data Privacy Framework (Art. 45 GDPR) where the recipient is certified, otherwise on the basis of the European Commission's Standard Contractual Clauses (Art. 46(2)(c) GDPR, Implementing Decision (EU) 2021/914) with supplementary measures. You can obtain a copy of the safeguards on request from privacy@creativate.tech.

If you or your organisation choose the "EU only" policy, no third-country transfer takes place for AI processing.

7. Retention overview

8. Obligation to provide data

For the account and the contract we need at least your email address; without it we cannot create an account. All other details are voluntary. There is no legal obligation to provide us with data.

9. Automated decisions

We do not make solely automated decisions within the meaning of Art. 22 GDPR and do not carry out profiling with legal or similarly significant effects.

10. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to withdraw consent with effect for the future (Art. 7(3)). You can exercise many rights directly in the account settings (export, deactivation, deletion, consents). Otherwise write to privacy@creativate.tech. We respond within one month (extendable under Art. 12(3) GDPR) and may ask for proof of identity.

Right to object (Art. 21 GDPR)

Where we process data on the basis of Art. 6(1)(f) GDPR (legitimate interest), you may object at any time on grounds relating to your particular situation. We will then no longer process the data unless we demonstrate compelling legitimate grounds that override your interests, or the processing serves the establishment, exercise or defence of legal claims.

You may object to processing for direct marketing purposes at any time without giving reasons; we will then no longer use your data for this purpose.

No form is required; the easiest way is an email to privacy@creativate.tech.

11. Right to lodge a complaint

You may lodge a complaint with a data protection supervisory authority, in particular in the Member State of your habitual residence, place of work or of the alleged infringement. The authority responsible for us is:

Der Hessische Beauftragte für Datenschutz und Informationsfreiheit (HBDI), Gustav-Stresemann-Ring 1, 65189 Wiesbaden, Germany, https://datenschutz.hessen.de

12. Data security

We protect data with technical and organisational measures under Art. 32 GDPR, including: encryption in transit (TLS), encrypted storage of files and access tokens, hosting in the EU, separation of data by organisation with access rules in the database, role and permission concept, mandatory approval for any external effect, masking of personal details in application logs, abuse and spam protection, backups and documented recovery. Details are set out in Annex 2 of the data processing agreement.

13. Changes

We update this privacy policy when our services or the law change. Earlier versions are available on request; we inform signed-in users in advance about material changes.

Last updated: 21 October 2026 (version 3.0.0) Creativate Technologies GmbH