Privacy policy

1. Data protection at a glance

General information

The following information provides a simple overview of what happens to your personal data when you visit this website and use our platform inomerce. Personal data is any data by which you can be personally identified. Detailed information on the subject of data protection can be found in our privacy policy set out below this text.

This privacy policy applies to www.inomerce.com and to our services The Vision (ai.inomerce.com), The Brain (brain.inomerce.com), Author (author.inomerce.com), the Dashboard and Conciva on the web and as an iOS app. The Office (Das Büro) at main.inomerce.com and the associated iPhone app are covered by a separate privacy policy at main.inomerce.com/datenschutz.

Data collection on this website

Who is responsible for the data collection on this website?
Data processing on this website is carried out by the website operator. You can find the operator’s contact details in the section “Information on the data controller” in this privacy policy.

How do we collect your data?
On the one hand, your data is collected when you provide it to us. This may, for example, be data that you enter when registering or in our services. Other data is collected automatically by our IT systems when you visit the website. This is mainly technical data (e.g. internet browser, operating system or time of the page request).

What do we use your data for?
Part of the data is collected to ensure that the website is provided without errors. We use other data to provide our services (account management, AI functions, billing). Your user behaviour is not analysed: we do not use any analytics, tracking, advertising or error-reporting tools and do not embed any third-party content.

What rights do you have regarding your data?
You have the right at any time to receive information, free of charge, about the origin, recipients and purpose of your stored personal data. You also have the right to request the rectification or erasure of this data. If you have given consent to data processing, you can withdraw this consent at any time with effect for the future. You also have the right, under certain circumstances, to request the restriction of the processing of your personal data. Furthermore, you have the right to lodge a complaint with the competent supervisory authority. You can contact us at any time about this and any other questions on the subject of data protection.

2. Hosting

We operate our website and our web applications (The Vision, The Brain, Author, Dashboard and Conciva on the web) with Vercel Inc., USA (hereinafter “Vercel”). The applications run in the London server region (United Kingdom). With each request, Vercel processes the data required for it, in particular the IP address, the address requested, the time and the browser identifier, and records it in server logs (section 4). The data you store in our services is held in our database at Supabase (section 5).

Vercel is a company based in the USA; a transfer of personal data to the USA can therefore not be ruled out. The basis for this is the EU-US Data Privacy Framework (Art. 45 GDPR) or, where applicable, the standard contractual clauses of the European Commission (Art. 46(2)(c) GDPR). For the United Kingdom, an adequacy decision of the European Commission is in place (section 5).

The hosting provider is used for the purpose of performing the contract with our potential and existing customers (Art. 6(1)(b) GDPR) and in the interest of a secure, fast and efficient provision of our online services by a professional provider (Art. 6(1)(f) GDPR).

Where necessary, we have concluded data processing agreements (DPAs) pursuant to Art. 28 GDPR with the hosting providers and infrastructure service providers.

3. General information and mandatory information

Data protection

The operators of these pages take the protection of your personal data very seriously. We treat your personal data confidentially and in accordance with the statutory data protection regulations and this privacy policy. Please note that data transmission over the internet (e.g. when communicating by email) may have security gaps. Complete protection of data against access by third parties is not possible.

Information on the data controller

The data controller responsible for data processing on this website is:

The data controller is the natural or legal person who, alone or jointly with others, decides on the purposes and means of the processing of personal data (e.g. names, email addresses or similar).

Storage period

Unless a more specific storage period has been stated within this privacy policy, your personal data will remain with us until the purpose for the data processing no longer applies. If you assert a justified request for erasure or withdraw consent to data processing, your data will be erased unless we have other legally permissible reasons for storing your personal data (e.g. retention periods under tax or commercial law); in the latter case, erasure will take place once these reasons cease to apply.

General information on the legal bases for data processing on this website

If you have consented to data processing, we process your personal data on the basis of Art. 6(1)(a) GDPR or Art. 9(2)(a) GDPR if special categories of data under Art. 9(1) GDPR are processed. In the case of explicit consent to the transfer of personal data to third countries, the data processing is also based on Art. 49(1)(a) GDPR. If your data is required for the performance of a contract or for the implementation of pre-contractual measures, we process your data on the basis of Art. 6(1)(b) GDPR. Furthermore, we process your data if it is required to fulfil a legal obligation on the basis of Art. 6(1)(c) GDPR. Data processing may also be carried out on the basis of our legitimate interest (Art. 6(1)(f) GDPR).

Recipients of personal data

In the course of our business activities, we work with various external parties. In some cases, this also requires the transfer of personal data to these external parties. We only pass on personal data to external parties if this is necessary for the performance of a contract, if we are legally obliged to do so, if we have a legitimate interest in the disclosure or if another legal basis permits the disclosure of the data. When using processors, we only pass on our customers’ personal data on the basis of a valid data processing agreement.

Withdrawal of your consent to data processing

Many data processing operations are only possible with your express consent. You can withdraw consent you have already given at any time. The lawfulness of the data processing carried out until the withdrawal remains unaffected by the withdrawal.

Right to object to data collection in special cases and to direct marketing (Art. 21 GDPR)

IF THE DATA PROCESSING IS BASED ON ART. 6(1)(E) OR (F) GDPR, YOU HAVE THE RIGHT AT ANY TIME TO OBJECT TO THE PROCESSING OF YOUR PERSONAL DATA ON GROUNDS RELATING TO YOUR PARTICULAR SITUATION; THIS ALSO APPLIES TO PROFILING BASED ON THESE PROVISIONS. THE RESPECTIVE LEGAL BASIS ON WHICH PROCESSING IS BASED CAN BE FOUND IN THIS PRIVACY POLICY. IF YOU OBJECT, WE WILL NO LONGER PROCESS YOUR PERSONAL DATA CONCERNED, UNLESS WE CAN DEMONSTRATE COMPELLING LEGITIMATE GROUNDS FOR THE PROCESSING WHICH OVERRIDE YOUR INTERESTS, RIGHTS AND FREEDOMS, OR THE PROCESSING SERVES THE ESTABLISHMENT, EXERCISE OR DEFENCE OF LEGAL CLAIMS (OBJECTION PURSUANT TO ART. 21(1) GDPR).

Right to lodge a complaint with the competent supervisory authority

In the event of infringements of the GDPR, data subjects have the right to lodge a complaint with a supervisory authority, in particular in the Member State of their habitual residence, their place of work or the place of the alleged infringement. The right to lodge a complaint is without prejudice to any other administrative or judicial remedies.

The authority competent for us is the Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia, LDI NRW), Kavalleriestraße 2–4, 40213 Düsseldorf.

Right to data portability

You have the right to have data that we process automatically on the basis of your consent or in performance of a contract handed over to you or to a third party in a common, machine-readable format. If you request the direct transfer of the data to another controller, this will only be done to the extent that it is technically feasible.

Access, rectification and erasure

Within the scope of the applicable statutory provisions, you have the right at any time to obtain information free of charge about your stored personal data, its origin and recipients and the purpose of the data processing and, where applicable, a right to rectification or erasure of this data. You can contact us at any time about this and any other questions on the subject of personal data.

Right to restriction of processing

You have the right to request the restriction of the processing of your personal data. You can contact us about this at any time. The right to restriction of processing applies in the cases set out in Art. 18 GDPR.

SSL or TLS encryption

For security reasons and to protect the transmission of confidential content, such as orders or enquiries that you send to us as the site operator, this site uses SSL or TLS encryption. You can recognise an encrypted connection by the fact that the address bar of the browser changes from “http://” to “https://” and by the padlock symbol in your browser bar. If SSL or TLS encryption is activated, the data you transmit to us cannot be read by third parties.

4. Data collection on this website

Cookies and Local Storage

Our websites use cookies and the local storage of your browser (Local Storage). We only use cookies and storage operations that are strictly necessary for the functions you have requested. There are no cookies or storage operations for analytics, tracking or advertising purposes; for this reason, we do not ask for consent to them either. In detail:

• Sign-in: The sign-in cookies of Supabase apply to the domain inomerce.com and its subdomains; this way, signing in once is sufficient for all inomerce services. In addition, there are the cookies “inomerce-session-hint” (indicates to the pages that you are signed in) and “inomerce-password-recovery” (records, when you reset your password, that you came via the link from the email).
• Language: On www.inomerce.com, the cookie “inomerce-locale” stores the language you have selected.
• Local Storage in The Vision: Settings and chat histories, including the images generated in them, so that you can continue your work in the same browser.
• Local Storage on www.inomerce.com: Your email address for signing in, but only if you select “Remember”.

The legal basis for storing and reading this information on your terminal device is § 25(2) No. 2 TDDDG (German Telecommunications and Digital Services Data Protection Act); the subsequent processing is carried out to perform the user agreement (Art. 6(1)(b) GDPR) and on the basis of our legitimate interest in secure operation (Art. 6(1)(f) GDPR).

You can set your browser so that you are informed about the setting of cookies and only allow cookies in individual cases, exclude the acceptance of cookies for certain cases or in general, and activate the automatic deletion of cookies when closing the browser. You can delete the Local Storage in your browser. Signing in is not possible without the sign-in cookies.

Server log files

Our hosting provider Vercel (section 2) automatically collects and stores information in so-called server log files, which your browser transmits automatically. These are:

• Browser type and browser version
• Operating system used
• Referrer URL
• Host name of the accessing computer
• Time of the server request
• IP address

This data is not combined with other data sources. This data is collected on the basis of Art. 6(1)(f) GDPR. The website operator has a legitimate interest in the technically error-free and secure provision of its website – for this purpose, the server log files must be collected. The server log files are deleted in accordance with Vercel’s retention periods.

Contact by email

If you contact us by email, your enquiry, including all personal data resulting from it (name, enquiry), will be stored and processed by us for the purpose of handling your request. We do not pass on this data without your consent. This data is processed on the basis of Art. 6(1)(b) GDPR if your enquiry is related to the performance of a contract or is necessary for the implementation of pre-contractual measures. In all other cases, the processing is based on our legitimate interest in the effective handling of the enquiries addressed to us (Art. 6(1)(f) GDPR) or on your consent (Art. 6(1)(a) GDPR) if this has been requested.

5. Registration, user account and teams

You can register on our platform in order to use additional functions. We use the data entered for this purpose only for the purpose of using the respective offer or service for which you have registered. During registration, we process in particular:

• Email address and password (or sign-in with Google or with Apple)
• Display name
• Account type (private or business) and, where applicable, company name and team size
• Team or organisation membership and invitation codes

The mandatory information requested during registration must be provided in full. Otherwise, we will reject the registration. The data entered during registration is processed for the purpose of carrying out the user relationship established by the registration and, where applicable, for initiating further contracts (Art. 6(1)(b) GDPR). The data collected during registration will be stored by us for as long as you are registered on our platform and will be deleted thereafter. Statutory retention periods remain unaffected.

Authentication and data storage (Supabase)

For registration, sign-in and the storage of user and application data, we use the backend platform Supabase (Supabase, Inc.). Supabase provides authentication (Supabase Auth), the database (PostgreSQL) and object storage (Supabase Storage) for our platform. In this context, your login credentials, account information, chat/planning data, settings and uploaded and generated images are processed and stored. Supabase is used to provide and securely operate our platform (Art. 6(1)(b) and (f) GDPR).

The database and storage infrastructure that we use for Supabase is operated in the AWS region “eu-west-2” (London, United Kingdom) — the data is therefore not located on servers within the European Union. In terms of data protection law, the United Kingdom is a third country, but one for which an adequacy decision of the European Commission is in place (most recently extended on 19 December 2025, valid until 27 December 2031). In that decision, the European Commission finds that a level of data protection comparable to EU law is ensured in the United Kingdom; personal data can therefore be transferred to the United Kingdom on this basis without the need for additional safeguards such as standard contractual clauses. Any processing by Supabase beyond this (e.g. support or infrastructure sub-service providers) may also take place outside the United Kingdom, including in the USA; where personal data is affected by this, we or Supabase, as applicable, rely on appropriate safeguards pursuant to Art. 44 et seq. GDPR (in particular EU standard contractual clauses). We have concluded a data processing agreement (Data Processing Addendum) with Supabase.

The emails confirming registration, for signing in and for resetting the password are sent by Supabase on our behalf to the address you have provided.

Sign-in with Google and with Apple

In all services except the Dashboard, you can sign in with your Google account instead of with an email address and password. For this purpose, you are redirected to Google (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland) and sign in there; we receive from Google the information required for signing in, in particular your email address and your name. In the Conciva iOS app, you can also sign in with Apple (section 7). The legal basis is the performance of the user agreement (Art. 6(1)(b) GDPR); whether you choose this option is your own decision.

Storage of images

Images that you upload to or generate in The Vision, Author, The Brain or The Office are stored by us in a storage area at Supabase that can be read without signing in. An image can only be retrieved via its link, which contains an identifier that cannot be guessed. Anyone who knows this link can open the image without signing in; therefore, only share links to images if the image may be seen. Attachments in Conciva, by contrast, are kept in non-public storage (section 7).

Dashboard and change log

In the Dashboard, the administrators of a company manage the team and usage across all inomerce services. We record actions in the Dashboard and in Conciva, such as role changes, approvals or credit transactions, in a change log, together with the person acting, the IP address and the browser identifier. The purpose is to be able to trace who changed what and to investigate misuse (Art. 6(1)(f) GDPR). We retain the entries without a fixed time limit; they are also retained if the company is deleted. If you delete your account, we remove the IP address and browser identifier from the entries relating to your actions and replace your name with a pseudonym.

6. Use of the platform functions (AI processing)

Image upload and AI image generation

To provide our core service, we process the product images you upload and the descriptions/prompts you enter in order to generate new image content (scenes, variants) from them using artificial intelligence. For image processing and generation, we use Google’s Gemini interface (see below). The images and prompts you provide are transmitted to Google for this purpose and processed there. The legal basis is the performance of the user agreement in place with you (Art. 6(1)(b) GDPR). Please do not upload any images for which you do not hold the necessary rights or which contain personal data of third parties where there is no legal basis for doing so.

AI-supported text and planning functions (Google Gemini)

For planning shots, generating and revising texts, analysing uploaded product images, converting voice recordings into text and other language-based functions, we use Google’s Gemini interface in The Vision, The Brain, Author and Conciva (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, and Google LLC, USA). The texts, information, images and recordings you enter are transmitted to Google for this purpose and processed there. So that stored knowledge in The Brain can be searched, we also have Google calculate numerical representations of the texts (embeddings). We do not use any other AI providers.

The legal basis is the performance of the user agreement (Art. 6(1)(b) GDPR). Google does not use the content transmitted via the paid interface to train its models.

Note on processing outside the EU: Processing may also take place outside the European Union. The basis for this is the standard contractual clauses of the European Commission (Art. 46(2)(c) GDPR) and the certification of Google LLC under the EU-US Data Privacy Framework. Nevertheless, please do not enter any special categories of personal data or any personal data of third parties in the input fields unless this is necessary for the task.

Voice input in The Vision

In The Vision, you can dictate a request instead of typing it. For this, your browser asks for access to the microphone. The recording (maximum 60 seconds) is transferred to our server and from there transmitted to Google (Gemini API), which converts it into text and phrases it as a request. You receive the text back in the input field and can change it before sending. We do not store the recording itself. The legal basis is the performance of the user agreement (Art. 6(1)(b) GDPR).

Condensing conversations into company knowledge (The Brain)

Content that you enter in the chat and request functions is automatically transferred to our knowledge function “The Brain” after a conversation has ended and is condensed there into permanently stored company knowledge of your organisation. The purpose is that later requests can build on earlier information instead of asking for it again.

What has been learned remains assigned to the organisation to which you belong and is not used across organisations. It passes through a review stage before it is approved. The legal basis is the performance of the user agreement (Art. 6(1)(b) GDPR) and our legitimate interest in a platform that remembers the state of your work (Art. 6(1)(f) GDPR).

This processing is something different from training AI models: no change is made to a language model; instead, a searchable body of knowledge is created in your own workspace. You can view stored knowledge and request its deletion; to do so, please contact the address given above.

Product import / linking from online shops

If you insert a product link from an online shop, we retrieve the product information publicly available via this link (e.g. images, variants and attributes) in order to make it available in the platform. The processing is carried out for the performance of the contract (Art. 6(1)(b) GDPR) at your instigation.

Author

With Author, you create texts for marketplaces and shops from product information, such as titles, descriptions, bullet points and search terms. For this purpose, we transmit your input and uploaded product images to Google (Gemini API, see above). Author reads your organisation’s existing brand and product knowledge from The Brain and stores new insights from the conversation there (see above on The Brain). We store conversations, results and their versions in your account until you delete them or your account. The legal basis is the performance of the user agreement (Art. 6(1)(b) GDPR).

7. Conciva and the iOS app

Conciva (until October 2026 “Ino Reply”) is our tool for the customer service of businesses on marketplaces, available as the app “Conciva” for iPhone and iPad and on the web at concierge.inomerce.com. The same user account applies as for the other inomerce services (section 5).

Data of a business’s customers

Via Conciva, businesses handle the enquiries of their own customers: names, messages, photos and attachments as well as order and delivery data. The data comes from the sources that the business connects itself: marketplaces (such as Mirakl, OTTO or Amazon via its forwarding address), its own mailboxes (IMAP and SMTP) and the merchandise management system Odoo. We store the order data relating to a conversation together with the conversation.

The respective business is the controller for this data. We process it exclusively on its behalf and in accordance with its instructions on the basis of a data processing agreement (Art. 28 GDPR). The business accepts this agreement in Conciva before it connects a marketplace, a mailbox or Odoo.

We use the following sub-processors for this: Supabase (database, sign-in and file storage; storage location London, United Kingdom), Vercel Inc. (operation of the application; server region London; as a US company, a transfer to the USA is possible, based on the EU-US Data Privacy Framework or, where applicable, standard contractual clauses), Google (Gemini API) for formulating replies, searching company knowledge and analysing and generating images, and Apple (Apple Push Notification Service) for notifications that state at most the marketplace and order number. Google does not use the data transmitted via the paid interface to train its models. Please direct any enquiries regarding this data to the business from which you made your purchase.

We retain conversations, messages, attachments and order data without a fixed time limit; there is no automatic deletion after a period of time. If the business deletes a channel, its conversations are deleted; if the company is dissolved, all of its data including the attachments is deleted. The exception is the change log in which we record actions in Conciva (section 5). Attachments are kept in non-public storage and can only be retrieved via time-limited links.

AI functions

Formulating, improving, translating, looking up company knowledge, spare-part notes and images transmit the content of the respective conversation (messages, order data without the delivery address and photos from the most recent customer message) to our services The Brain and The Vision and, via these, to Google. Images created in this process are stored by The Vision in the image storage described in section 5, which can be accessed via unguessable links without signing in. Before first use, the iOS app expressly asks for your consent; you can withdraw it at any time in the app under “Konto” (Account). Without consent, these functions remain locked in the app; all other functions can still be used.

Company knowledge

Under “Wissen” (Knowledge), the administrators of a business store rules for the tone of the replies and entries such as return or shipping conditions, including by importing PDF, text and RTF files. During import, the app extracts the text on the device; only this text is transferred, not the file. We store the entries in The Brain with the respective business and have Google calculate a numerical representation of the text for search purposes. The AI draws on them when formulating. The business can change or delete entries at any time.

Learning from sent replies

A business can switch on, under “Wissen” (Knowledge), the option for Conciva to learn from sent replies; by default, this is switched off. If it is switched on, we transmit the history of the conversation (at most the last 40 messages) to The Brain after a reply has been sent. There, an AI (Google) suggests what from it is suitable as general knowledge of the business. A suggestion is only used once an administrator of the business approves it; rejected suggestions are archived and not used. This processing is also carried out on behalf of the business.

Notifications (push)

If you allow notifications in the app, we store the device token issued by Apple together with your user account, the company selected on the device and your sign-in session. Using this, we deliver notices via the Apple Push Notification Service (Apple Inc.), for example about new customer messages or about drafts awaiting your approval. A notification never states the name or the text of a customer, but at most the marketplace and order number. You set which notifications you receive in the app; when you sign out, the device is unlinked from your account. The legal basis is the performance of the user agreement (Art. 6(1)(b) GDPR).

Sign in with Apple

If you sign in with Apple, we receive from Apple a user identifier and, depending on your choice, your name and your email address or a forwarding address provided by Apple. If you delete your account, we also revoke the sign-in with Apple.

Face ID and data on the device

The optional app lock uses Face ID, Touch ID or your device passcode. The check is carried out exclusively on the device by the operating system; we do not receive any biometric data. The app stores its sign-in in the device’s keychain and an interim copy of the conversations of the selected company, so that you can read them even without a connection. When you sign out and when you switch company, this data is deleted from the device. The app contains no advertising and no third-party analytics or tracking tools.

Subscriptions via the App Store

You take out plans for Conciva in the app as a subscription via Apple’s in-app purchase. Payment and billing are handled by Apple as a controller in its own right; we do not receive your payment data. For each purchase, we receive from Apple the transaction data (product, transaction numbers, purchase and expiry date, status and refunds) and an identifier that the app passes on with the purchase and that corresponds to your user account. We use this to assign the subscription to your company and to allocate the included credit to the owner of the company; if Apple refunds a purchase, we deduct the credit allocated for it again. The legal basis is the performance of the user agreement (Art. 6(1)(b) GDPR). We delete the assignment of the subscription to your account together with your account; we retain the notifications that Apple sends us about purchases, renewals and refunds for evidentiary purposes (Art. 6(1)(c) and (f) GDPR). You can cancel a subscription in the settings of your Apple ID; deleting your account does not end it.

Deleting your account

You can delete your account in the app under “Konto” (Account) → “Konto löschen” (Delete account) or request deletion via the address given below. The account applies to all inomerce services and is also deleted there. A company of your own without any other active members is deleted together with all its data; if it has other members, you first transfer it to an administrator or dissolve it. Personal credit is forfeited. Entries in the change log of your companies are retained but pseudonymised in such a way that they can no longer be attributed to any person. Records of concluded data processing agreements are retained for as long as the company exists (Art. 17(3)(e) GDPR). Our payment service provider retains invoices and payment receipts for the statutory periods.

8. Payments and billing

Purchases in the Conciva iOS app are processed via Apple (section 7).

Stripe

For processing payments (subscriptions and credit purchases), we use the payment service provider Stripe. The provider for customers within the EEA is Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland (hereinafter “Stripe”). As part of the payment process, the data required for processing the payment (e.g. name, email address, payment data, billing data, transaction and contract data) is transmitted to Stripe and processed there. You enter your payment data directly with Stripe; we ourselves do not store any complete payment instrument data (e.g. credit card numbers).

The data is processed on the basis of Art. 6(1)(b) GDPR (execution of the contract) and on the basis of our legitimate interest in reliable and secure payment transactions (Art. 6(1)(f) GDPR). A transfer of data to Stripe in the USA cannot be ruled out; the transfer is based, among other things, on the standard contractual clauses of the European Commission. Details on data processing by Stripe can be found in Stripe’s privacy policy at https://stripe.com/de/privacy.

9. Transfers to third countries

To provide our services, we in some cases use service providers that process, or may process, personal data outside the European Union or the European Economic Area. A level of data protection comparable to that in the EU may, under certain circumstances, not be guaranteed in these third countries. Where data is transferred to third countries, this only takes place if there is an adequacy decision of the European Commission, if appropriate safeguards within the meaning of Art. 44 et seq. GDPR (in particular EU standard contractual clauses) exist or if another permissible legal basis (e.g. your explicit consent pursuant to Art. 49 GDPR) applies.

This concerns Vercel (section 2), Supabase with its storage location in the United Kingdom (section 5), Google (sections 5 and 6), Stripe (section 8) and Apple (section 7). For transfers to the USA, we rely on the EU-US Data Privacy Framework where the recipient is certified under it, and otherwise on the standard contractual clauses of the European Commission.

10. Changes to this privacy policy

We reserve the right to amend this privacy policy so that it always complies with current legal requirements or in order to reflect changes to our services in the privacy policy, e.g. when introducing new functions. The new privacy policy will then apply to your next visit.

If you have any questions about data protection, you can reach us at support@inomerce.com.