HAILEVEL

Legal

Privacy Policy

English courtesy translation of our German privacy policy. In case of doubt or legal dispute, the German version is the legally binding one.

1. Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) is:

Zero-Point Computer GmbH
Prinzenallee 1
40549 Düsseldorf
Germany
Email: hallo@hailevel.ai

We are not legally required to appoint a data protection officer (§ 38 BDSG) and have therefore not appointed one. If you have any questions about data protection, you can reach us at any time at the email address above.

2. General information on data processing

We process personal data only to the extent necessary to provide this website, to handle your inquiries or to fulfil contractual obligations. Personal data is any information relating to an identified or identifiable natural person (e.g. name, email address, IP address).

The legal bases for processing are in particular:

  • Art. 6 (1) (a) GDPR – consent
  • Art. 6 (1) (b) GDPR – performance of a contract and pre-contractual measures
  • Art. 6 (1) (c) GDPR – legal obligations
  • Art. 6 (1) (f) GDPR – legitimate interests (e.g. secure and stable operation of the website)

3. Hosting, server log files and locally served content

This website is hosted via the Lovable platform (Lovable Labs Incorporated) and delivered through the network of Cloudflare, Inc. Data processing agreements (Art. 28 GDPR) are being concluded with these providers. Where data is transferred to the USA, this is based on the EU-U.S. Data Privacy Framework or the EU Standard Contractual Clauses (Art. 45, 46 GDPR). When you access the website, the hosting provider automatically records information in so-called server log files, in particular IP address, date and time of access, page accessed, browser type and version, operating system and referrer URL.

Processing is based on Art. 6 (1) (f) GDPR; our legitimate interest lies in ensuring trouble-free and secure operation of the website. Log data is deleted automatically after 7 days at the latest, unless longer retention is required for security reasons (e.g. to defend against ongoing attacks).

No external content networks: all fonts, icons, logos and images on this website are served exclusively via our hosting infrastructure and are bundled locally. In particular, no Google Fonts, no external icon or script libraries (CDN) and no embedded third-party videos are loaded. Apart from our hosting providers named above, who act on our behalf, simply visiting this website therefore does not create a connection to third-party servers.

No third-party tracking: we do not use any third-party analytics, advertising or tracking services. Our own pseudonymous measurement of individual form steps only runs with your consent (see section 9, category “Statistics”). No tracking pixels, social media plugins or fingerprinting techniques are used.

4. Database and backend services

To store the details submitted through our inquiry form we use an application we operate with a connected database (backend platform: Lovable Cloud based on Supabase, Inc.; data processing under Art. 28 GDPR, third-country transfers based on the EU Standard Contractual Clauses). The connection to the database is established only when you submit the form, not when merely visiting the website.

We process the form data you enter as well as technical metadata (time of receipt, selected language version and a non-reversible checksum of your IP address for spam protection, see section 6). The legal basis is Art. 6 (1) (b) GDPR (pre-contractual measures) and Art. 6 (1) (f) GDPR (legitimate interest in handling business inquiries). A data processing agreement pursuant to Art. 28 GDPR is being concluded with the backend platform provider. Where processing takes place outside the EU/EEA, it is based on appropriate safeguards pursuant to Art. 44 et seq. GDPR.

5. Overview of services used

  • Hosting (Lovable Labs Incorporated, USA; Cloudflare, Inc., USA, incl. DNS/domain management): delivery of the website, server log files – Art. 6 (1) (f) GDPR. Used on every page view. Lovable privacy policy · Cloudflare privacy policy
  • Database/backend (Lovable Cloud based on Supabase, Inc., USA): storage of inquiries from the intro call form and of consent-based statistics – Art. 6 (1) (a), (b) and (f) GDPR. Used only when the form is submitted or after consent. Supabase privacy policy
  • Appointment booking (Cal.com, Inc., USA): after you submit an inquiry, we offer a link to book an appointment via Cal.com. The link is shown only after your express consent (Art. 6 (1) (a) GDPR); clicking it takes you to the Cal.com website. Art. 6 (1) (b) GDPR applies to a booking you make there. Without a click, this website does not transmit data to Cal.com. Cal.com privacy policy
  • Email communication (Microsoft 365 / Exchange Online, Microsoft Ireland Operations Ltd., Ireland; parent company Microsoft Corporation, USA): handling inquiries by email (receiving, sending, mailbox storage) – Art. 6 (1) (b) and (f) GDPR. Microsoft privacy statement
  • Automated emails (Lovable email service, Lovable Labs Incorporated, USA; sent via notify.hailevel.ai): confirmation to you and internal notification to us after the inquiry form is submitted – Art. 6 (1) (b) and (f) GDPR. Used only when the form is submitted. Lovable privacy policy
  • Not used: analytics and tracking services, ad networks, social media plugins, external font and icon services, embedded videos, map services, chat widgets.

6. Inquiry form (intro call)

If you use our inquiry form, we process the data you provide – in particular your last name, optionally your first name and preferred form of address (Mr, Ms or no title), email address, company, your request as well as your details about your project and current situation – in order to handle your inquiry, pre-qualify it and prepare the intro call, and to contact you.

Submission is possible only if you confirm in the form that you have read this privacy notice and agree to the processing for handling the inquiry and contacting you. This confirmation is independent of your cookie and statistics settings. Without the checked box, no inquiry is stored and no email is sent. The legal basis is Art. 6 (1) (b) GDPR (pre-contractual steps taken at your request) and Art. 6 (1) (f) GDPR (legitimate interest in answering business inquiries). Data is not shared with further recipients unless required for handling the inquiry and technical email delivery.

Mandatory details: we need your last name, email address and the details about your project marked as required in order to handle your inquiry and reply to you. There is no statutory or contractual obligation to provide them; without them, however, we cannot accept your inquiry. Your first name, preferred form of address and all other details not marked as required are voluntary.

Processing chain at a glance: your details pass through the following stages:

  1. Entry in your browser: until you submit, your details exist only in the memory of the open page. Nothing is transmitted or stored locally; reloading or closing the page discards them.
  2. Consent: only with the checked box and a click on “Submit” does your inquiry leave the browser. Without consent, nothing is transmitted, stored or sent.
  3. Transmission: the details are sent to our server encrypted (TLS). Automated checks run there (spam protection using a checksum of your IP address, minimum completion time, rate limits).
  4. Storage: the inquiry is stored in our database (Lovable Cloud based on Supabase, Inc.; processing agreement under Art. 28 GDPR) – consisting of your form details, the time of receipt, the chosen language version and the IP checksum. Access is restricted to our staff handling the inquiry; public or anonymous access is technically impossible.
  5. Email delivery: you receive a confirmation email summarising your details, and we receive an internal notification at hallo@hailevel.ai (sent via the Lovable email service, sender notify.hailevel.ai; subsequent handling in Microsoft 365 / Exchange Online).
  6. Handling and deletion: we use the details solely to handle your inquiry and prepare the intro call. Once handling is complete, the data is deleted as soon as it is no longer needed and no statutory retention obligations apply. You can request deletion at any time via hallo@hailevel.ai or object to the processing (Art. 21 GDPR).

Email confirmation: after submitting, you receive an automated confirmation summarising your details; at the same time we receive a notification at hallo@hailevel.ai. Emails are sent via the Lovable email service (Lovable Labs Incorporated) using our sender address notify.hailevel.ai. Name, email address, company and your form details are processed. Addresses that permanently bounce, complain or unsubscribe are blocked automatically by the service. The legal basis is Art. 6 (1) (b) GDPR and Art. 6 (1) (f) GDPR (legitimate interest in a traceable confirmation).

Spam protection: to protect against abusive and automated inquiries we use a field that is invisible to humans, a minimum completion time and a limit on inquiries per IP address and per email address. Your IP address is not stored in plain text but only as a non-reversible checksum (hash), used solely for rate limiting and deleted together with the inquiry. The legal basis is Art. 6 (1) (f) GDPR (legitimate interest in a secure, abuse-free form).

Inquiries from the intro-call form and messages from the contact form are automatically deleted 6 months after receipt unless they lead to an engagement. Deletion runs daily and automatically in our database. If an engagement results, we store the data for the duration of the business relationship and beyond that only where statutory retention obligations apply. Emails in our mailbox are deleted according to the same principles.

Contact form: On our contact page you can send us a message. We process your name, email address, topic, message and, optionally, company and phone number. Submitting is only possible after confirming this privacy notice; the legal basis is Art. 6(1)(f) GDPR (legitimate interest in answering inquiries) and, where a contract is concerned, Art. 6(1)(b) GDPR. Required fields are name, email address, topic and message; without them we cannot accept the message. For spam protection we store an irreversible hash of your IP address. The message is stored in our database, forwarded to hallo@hailevel.ai and you receive a confirmation – delivery and deletion as described for the inquiry form.

7. Email communication

If you contact us by email, we process the data transmitted (name, email address, content of the message) to handle your inquiry on the basis of Art. 6 (1) (b) or (f) GDPR. Email traffic runs via Microsoft 365 (Exchange Online) ; the contracting party is Microsoft Ireland Operations Ltd., Ireland, which acts as processor pursuant to Art. 28 GDPR in this respect. Where data is transferred to Microsoft Corporation in the USA, it is certified under the EU-U.S. Data Privacy Framework (cf. Art. 45 GDPR). The Microsoft privacy statement provides details on further data processing. The data is deleted as soon as it is no longer required for the purpose of collection and no statutory retention obligations apply.

8. Appointment booking

Appointment booking runs via a link to Cal.com, Inc., USA. The link is shown only after your express consent to “External media & booking”; without consent, no data is transmitted to Cal.com. Clicking the link transmits in particular your IP address, browser information and time of access to Cal.com. A subsequent booking additionally processes your name, email address, selected slot and any further details. The legal basis is Art. 6 (1) (a) GDPR for your consent and Art. 6 (1) (b) GDPR for the booking you initiate. Further information: https://cal.com/privacy.

9. Cookies, local storage and consent

We group storage mechanisms and embedded services into categories. Technically necessary storage is based on Sec. 25(2) TDDDG and Art. 6(1)(f) GDPR (legitimate interest in operating this website reliably). All other categories are activated only after your explicit consent (Sec. 25(1) TDDDG, Art. 6(1)(a) GDPR).

  • Necessary (always on): in your browser's local storage we save the selected language and your cookie choice together with the time and version of the consent text. These details remain stored for up to 12 months. Before submission, intro-call form entries are held only in the open page's memory and are discarded on reload; they are not stored persistently in your browser.
  • Statistics (off by default): pseudonymous measurement of key funnel steps (click on an intro-call button, step reached in the pre-qualification form, submission of the inquiry, click on the booking link). Server-side we store the event name, optional step number or label, language, page path, event time, a random key valid only for the current session, and the version and time of your statistics consent. We do not store an IP address or contact details and do not create a cross-session profile. The data stays in our own database (no external analytics service). Legal basis: consent under Section 25(1) TDDDG and Art. 6(1)(a) GDPR. Retention is 6 months, followed by automatic deletion; measurement starts only after consent and stops recording new events immediately upon withdrawal. Events already stored lawfully are not automatically erased by withdrawal; you may request deletion at hallo@hailevel.ai.
  • External media and booking (off by default): your choice is stored locally. The Cal.com booking link is shown only after consent; when you click it, in particular your IP address, browser information and time of access are transmitted to Cal.com. Without consent the booking link remains blocked.

On your first visit you receive a consent banner where you can accept all categories, allow only necessary storage, or choose categories granularly. Declining is just as easy as accepting; without a decision no services requiring consent are loaded.

Withdrawal: you can change or fully withdraw your consent at any time with effect for the future by clicking “Cookie settings” in the footer. After withdrawal, non-necessary services are no longer loaded. The lawfulness of processing carried out until withdrawal remains unaffected.

For documentation purposes we store the time and version of the consent text together with your decision locally in your browser. If you allow statistics, the version and time of that consent are also stored with each pseudonymous statistics event in our database. If you decline or consent only to external media, the consent choice is not transmitted to our statistics database.

10. Recipients and transfers to third countries

Your data is only transferred to third parties where this is necessary to perform a contract, where we are legally obliged to do so, or where you have consented. Where we use service providers outside the EU/EEA (Lovable Labs Incorporated, Cloudflare, Inc., Supabase, Inc., Microsoft Corporation and Cal.com, Inc., each based in or also processing data in the USA), the transfer takes place on the basis of appropriate safeguards pursuant to Art. 44 et seq. GDPR, in particular standard contractual clauses or an adequacy decision (e.g. the EU-US Data Privacy Framework).

11. Retention period

We store personal data only for as long as required for the respective processing purposes or as long as statutory retention obligations exist (e.g. commercial and tax law periods under § 257 HGB, § 147 AO). Once the purpose no longer applies or the periods expire, the data is deleted. Specifically: inquiries and contact messages without an engagement, as well as statistics events, are deleted automatically after 6 months; server log data is stored by the hosting provider for no longer than 7 days and then deleted automatically; contract and invoice records are retained for 6 or 10 years (§ 257 HGB, § 147 AO).

12. Your rights

You have the following rights regarding the personal data concerning you:

  • Right of access (Art. 15 GDPR)
  • Right to rectification (Art. 16 GDPR)
  • Right to erasure (Art. 17 GDPR)
  • Right to restriction of processing (Art. 18 GDPR)
  • Right to data portability (Art. 20 GDPR)
  • Right to object to processing (Art. 21 GDPR)
  • Right to withdraw consent given (Art. 7 (3) GDPR) with effect for the future

Right to object under Art. 21 GDPR: where we process data on the basis of legitimate interests (Art. 6 (1) (f) GDPR), you may object to this processing at any time on grounds relating to your particular situation. We will then no longer process the data unless we can demonstrate compelling legitimate grounds that override your interests, or the processing serves the establishment, exercise or defence of legal claims. You can object informally via hallo@hailevel.ai.

An email to hallo@hailevel.ai is enough to exercise your rights. You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), in particular in the Member State of your habitual residence, place of work or place of the alleged infringement. The supervisory authority competent for us is the State Commissioner for Data Protection and Freedom of Information North Rhine-Westphalia (LDI NRW).

13. Data security

We use technical and organisational measures to protect your data against accidental or intentional manipulation, loss, destruction or access by unauthorised persons. This website uses encrypted transmission via SSL/TLS (visible from “https://” in the address bar).

14. EU AI Act and automated decision-making

No AI systems within the meaning of Regulation (EU) 2024/1689 (the “AI Act”) are used on this website that interact directly with you – in particular, there is no AI chatbot and no automated handling of inquiries. Your inquiries are reviewed and answered by us personally. In particular, no solely automated decision-making within the meaning of Art. 22 GDPR takes place.

Some illustrations and graphics on this website were created with AI support. They serve solely to illustrate our services and contain no personal data and no deceptive depictions of real people or events.

For AI software projects with our clients, our General Terms and Conditions (section “AI-supported services”) govern the classification under the AI Act and the allocation of duties between provider and deployer. These provisions concern the contractual cooperation and not the operation of this website.

15. Validity and changes

This privacy policy is currently valid and dated September 2026. As our website develops further or due to changed legal requirements, adjustments may become necessary. You can always find the current version on this page.