Last updated: 24.10.2026
This Privacy Policy informs you, in accordance with Articles 13 and 14 of Regulation (EU) 2016/679 (General Data Protection Regulation – GDPR), about the processing of personal data in connection with the use of the “ChatiTec” platform (hereinafter the “Platform” or the “Service”).
ChatiTec is an AI/LLM platform hosted in Germany that has been developed specifically for professionals bound by professional secrecy – in particular lawyers and physicians. All processing takes place primarily on our own infrastructure in a data centre in Augsburg (own Proxmox infrastructure). The guiding principle of the Service: “Legally Secure & Data-Protection-Compliant AI from Augsburg”.
The controller within the meaning of Art. 4(7) GDPR is:
Sat-iTec Systemhaus GmbH Heisinger Straße 21, 87437 Kempten (Allgäu) Germany
Represented by: Günther Löb (Managing Director) Telephone: +49 (0) 8334 9999060 E-mail: info@sat-itec.de Commercial register: Local Court (Amtsgericht) Kempten, HRB 18508 VAT ID No.: DE457863343
Note on the allocation of roles: Where the Platform is used by a law firm, a medical practice or any other undertaking subject to professional secrecy, the respective customer (law firm/practice) is, as a rule, the controller for the client, patient or other third-party data subject data processed on its behalf; to that extent, Sat-iTec acts as a processor on the basis of a data processing agreement (Art. 28 GDPR) (see the separate document “Data Processing Agreement”). This Privacy Policy concerns the processing for which Sat-iTec itself is the controller (e.g. contract administration, Platform accounts, billing, technical operation of the Platform website).
You can reach our data protection officer at:
Stefanie Löb · datenschutz@sat-itec.de Heisinger Straße 21, 87437 Kempten (Allgäu)
ChatiTec is designed in such a way that personal data and professional secrets receive special protection. The central protection concept is as follows:
PII_FORCE_FOR_EXTERNAL=true).We process personal data for the purposes listed below on the legal bases indicated in each case.
Payments: You pay for subscriptions and token packages via our payment service provider Stripe (Stripe Payments Europe Ltd., Dublin, Ireland). You enter your payment data (e.g. card number) exclusively with Stripe; we receive only a customer or payment identifier, the amount and the payment status. Legal basis: Art. 6(1)(b) GDPR (performance of a contract) and point (c) GDPR (tax-law retention obligations). Stripe is an independent controller for payment processing; the Stripe privacy policy applies additionally.
Sales partners: If your account was created via one of our sales partners, we process the information that the partner transmitted when creating it (company, contact person, e-mail address, selected plan). If you register via a partner’s referral link, we assign your account to that partner; the referral code is read only from the address called up and is not stored in your browser. So that the partner can verify its commission, it sees in the partner portal exclusively the company name, customer number, plan, billing month as well as invoice and commission amounts. The partner never receives the content of your use (chats, documents, images). The legal basis is our legitimate interest in a traceable commission settlement (Art. 6(1)(f) GDPR) and the statutory obligation to provide statements of account to commercial agents (§ 87c HGB, Art. 6(1)(c) GDPR). You may object to this disclosure on grounds relating to your particular situation (Art. 21 GDPR).
Partners themselves: We process contact, tax and billing data of sales partners for the performance of the partner agreement (Art. 6(1)(b) GDPR).
If Memory is switched on (default; can be switched off under “Memory”), ChatiTec stores persistent, professional facts about you or your company (e.g. industry, software used, preferences regarding format and style) so that you do not have to explain them repeatedly. The facts are detected exclusively by a local model in our data centre, stored in encrypted form using a key derived for each customer, and used as context only for matching requests; before any processing by external AI providers they are anonymised like all content (§ 3). Facts from client mode are never passed on to external providers. No automatic detection takes place for law firm accounts. Passwords, banking and health data as well as information about third parties are not stored. You can view all entries at any time, delete them individually or completely, and export them as a file. Company entries are visible to all users of your company; personal entries only to you. Legal basis: Art. 6(1)(b) GDPR (provision of the agreed function) and point (f) GDPR (efficient, cost-saving processing). Storage period: until deleted by you, at the latest upon termination of the contract.
With the ChatiTec add-ins for Outlook, Word, Excel and OneNote and the ChatiTec extension for Chrome, Edge and Firefox, you can have an open e-mail, a document, a spreadsheet range, a notebook page, a web page or selected text summarised, improved, translated or analysed, or have texts, formulas, replies or reminders created from it. Content is only transmitted when you expressly click on an action, and only the selection or the currently open e-mail, the open document, the selected spreadsheet range, the current notebook page or the active browser tab (for web pages additionally the page title and domain, not the full address). Processing takes place as described in § 3 and § 4.3 (anonymisation before external processing; law firm accounts exclusively locally). Results are not stored in the chat history and are not automatically transferred to Memory (§ 4.7). Draft replies and appointments are only sent or saved once you confirm this in Outlook yourself; documents, spreadsheets and notes are only written to after you click “Insert”. The extension does not read browser history, form inputs or pages in the background; login credentials (access tokens) are stored only locally in the memory of the add-in or extension and are deleted when you log out. Legal basis: Art. 6(1)(b) GDPR. If e-mails or web pages contain personal data of third parties, responsibility for the lawfulness of the disclosure to ChatiTec lies with the user or the user’s company; we process such data as a processor in accordance with the data processing agreement.
In the Performer plan, AgentiTec can execute commands via SSH on your servers on your instruction. Each command is shown to you for confirmation beforehand, unless you have expressly approved a target permanently; commands that delete data, stop services or change access rights are always confirmed individually. Without the Connector, ChatiTec connects only to publicly accessible servers; for this purpose, ChatiTec generates a separate SSH key for each user. Optionally stored passwords and the private key are stored in encrypted form and are never transmitted to AI models. With the ChatiTec Connector (a program on your PC), the approved commands run via your PC, its network and VPN; access credentials remain on your PC. The following are processed: target (server, user, port), command, output and exit code; the output is transmitted to the AI model in order to process your task. Queries and jobs are deleted after 30 days, log entries after 90 days. Legal basis: Art. 6(1)(b) GDPR; if the servers contain data of third parties, we process such data as a processor. AgentiTec is not available for law firm accounts.
Insofar as you use functions that rely on external AI providers, exclusively anonymised content (see § 3) is transmitted to the following processors or sub-processors:
| Recipient | Purpose | Location | Transfer mechanism |
|---|---|---|---|
| OpenAI | AI/LLM inference | USA | SCC (Art. 46 GDPR) and/or EU-US Data Privacy Framework |
| Anthropic | AI/LLM inference | USA | SCC (Art. 46 GDPR) and/or EU-US Data Privacy Framework |
| Google (Gemini) | AI/LLM inference | USA | SCC (Art. 46 GDPR) and/or EU-US Data Privacy Framework |
Owing to third-country concerns (China), the provider “DeepSeek” is deactivated by default and is not used without express, separate activation.
Further categories of recipients may include: IT service providers for hosting and maintenance (in Germany/the EU), payment service providers (only for paid plans), as well as tax advisors and authorities within the scope of statutory obligations.
A complete and up-to-date list of the sub-processors engaged can be found in “Annex 2 – List of Sub-processors” to the Data Processing Agreement.
When external AI providers are used, anonymised content is transferred to the USA (a third country within the meaning of the GDPR). Appropriate safeguards pursuant to Chapter V GDPR are in place for these transfers:
The upstream anonymisation (§ 3) ensures that no identifying personal data in plain text reach the third country. When purely local models are used, no transfer to a third country takes place.
A copy of the relevant safeguards may be requested using the contact details given in § 2.
We store personal data only for as long as is necessary for the respective purposes or as required by statutory retention periods:
The Platform is accessible exclusively via a TLS-encrypted connection (certificates via Let's Encrypt). You can recognise an active encryption by the address bar of your browser (https://).
We use technically necessary cookies or comparable technologies (e.g. session/authentication tokens, JWT) that are required for operation and secure login. The legal basis for this is § 25(2) no. 2 TDDDG (technically necessary storage) and Art. 6(1)(b)/(f) GDPR. We do not use non-essential cookies or analytics, tracking or marketing tools; a cookie banner is therefore not required.
When the Platform is accessed, technical information is automatically collected and stored in server log files, in particular: - truncated/processed IP address, - date and time of access, - resource accessed/status code, - amount of data transferred, - user agent (browser type/version, operating system).
Processing takes place on the basis of Art. 6(1)(f) GDPR in order to ensure trouble-free and secure operation. The storage period is 14 days, unless a security incident requires longer storage.
A decision based solely on automated processing which produces legal effects concerning you or similarly significantly affects you (Art. 22 GDPR) does not take place within the Platform. The AI serves as a support tool; the professional assessment and decision always remain with the professional using it.
The language models (LLMs) used generate outputs on a statistical basis. Results may be incomplete, outdated or incorrect (“hallucinations”). Outputs must be checked on your own responsibility and do not replace professional, legal or medical advice.
Subject to the statutory requirements, you have the following rights:
Note: Where data are processed on behalf of a customer acting as controller (law firm/practice), please address data subject requests to that controller; we assist the controller in fulfilling these rights.
To exercise your rights, please contact the contacts named in § 1 or § 2.
Without prejudice to any other remedy, you have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), in particular in the Member State of your habitual residence, place of work or place of the alleged infringement.
The supervisory authority competent for the controller is:
Bayerisches Landesamt für Datenschutzaufsicht (BayLDA), Promenade 18, 91522 Ansbach
The provision of certain data is necessary for the conclusion of the contract and the use of the Platform (e.g. e-mail address for setting up the account). Without these data, the Service cannot be provided, or can be provided only to a limited extent. A statutory obligation to provide data exists only where required by law (e.g. tax-law obligations).
We reserve the right to amend this Privacy Policy in order to adapt it to changes in the legal situation or changes to the Service. The version available at the time of use applies in each case.
Last updated: 24.10.2026