Informational translation. The German version remains authoritative. German original

Privacy

Last updated: September 17, 2026

1. Controller and contact

Hamza Yagci
Kaiserebersdorfer Straße 222, 1110 Wien, Österreich
Email: info@panthorys.com

This notice covers the Panthorys website, contact inquiries, checkout, onboarding and the public AI demo. Responsibilities and processing arrangements for production customer solutions are agreed separately.

2. Contact and lead form

We process your name, company, industry, email address, process description, acknowledgement of the privacy notice and any optional website or phone details. We use this information to handle your inquiry, respond to you and prepare an offer. Required fields are necessary for this purpose; the form cannot be submitted without them. The website validates entries and uses a technical field to detect simple spam submissions.

The legal basis is Article 6(1)(b) GDPR for pre-contractual inquiries where a natural person is the prospective contracting party. For a company's contact persons, Article 6(1)(f) GDPR applies: our legitimate interest in handling business inquiries and communicating with the company. The checkbox acknowledges this notice; it is not consent to advertising. You are not automatically subscribed to a newsletter.

3. Onboarding and email

During onboarding, we process company, contact person, email address, industry and requested processes, together with optional phone, website, customer channel, service, qualification question, availability, booking link and special instruction details. The purpose is to configure and support the agreed automation. The legal bases are Article 6(1)(b) GDPR or, for company contact persons, Article 6(1)(f).

Contact and onboarding information is sent to our business email inbox via SMTP; you receive an acknowledgement by email. This website does not maintain a separate permanent database of form submissions. Emails do, however, remain in the mailbox. Email provider: IONOS SE, Deutschland. Please do not enter passwords, API keys or unnecessary personal information about other people in free-text fields.

4. Stripe payment processing

After confirming your business status and accepting the terms, you are redirected to external Stripe Checkout. We send product and pricing information and record the accepted terms version and B2B declaration as checkout metadata. Stripe directly collects payment, billing, contact and, where applicable, tax information, initially saving the payment method without a charge. For onboarding and later live activation, we process the Checkout and Customer identifiers, setup status, payment-method reference, company country, pricing market, tenant identifier, approved website domain and pilot status. Subscription and trial data are added only at live activation. Our form does not collect full card details.

Payments are processed through Stripe Payments Europe, Limited, Ireland, and participating Stripe companies. Depending on the service, Stripe processes data on our behalf or as a controller for its own legal, security and payment purposes. Our contract processing is based on Article 6(1)(b) GDPR, statutory retention on Article 6(1)(c), and abuse prevention on Article 6(1)(f). Further information: Stripe privacy notice.

5. Public AI demo and OpenAI

The demo is identified as an AI application. Inputs, conversation history, a random conversation identifier and derived qualification information are processed on our server. To identify requests and generate responses, conversation content and the necessary agent configuration are sent to OpenAI via its API. For EEA customers, the contracting entity is generally OpenAI Ireland Limited, Ireland; other cloud providers and subprocessors may be involved. Use fictional example data only, never real contact, health or payment information.

The purpose is the requested demonstration, based on Article 6(1)(f) GDPR (our interest in an interactive product demonstration and its secure operation). The assistant classifies inputs by request and lead qualification, for example; it makes no solely automated decisions with legal or similarly significant effects under Article 22 GDPR. No real booking or order is created. A transfer to the human team is shown as successful only if the configured delivery channel actually accepted the message; otherwise the assistant provides an honest contact route.

The server holds conversation data only temporarily in the memory of the relevant process. Demo sessions are automatically removed from that memory no later than one hour after the last successful activity; they may disappear earlier if the server process ends. Restarting the demo in the browser creates a new conversation identifier, but does not itself delete the earlier conversation on the server. IP addresses and conversation identifiers are also processed to limit requests. The related rate-limit and message-limit entries are automatically removed after the ten-minute counting window expires.

OpenAI requests disable storage of Responses as application state. This does not exclude the provider's security logs. OpenAI specifies a standard retention period of up to 30 days for these logs, subject to legal exceptions; special zero-retention arrangements are not promised. According to OpenAI, API content is not used for model training by default unless voluntary data sharing is enabled. Details: OpenAI data processing and OpenAI privacy notice.

6. Website assistant

The Panthorys assistant available on this website processes messages, a random conversation identifier and the structured information needed for the relevant inquiry. It answers approved product information and takes business inquiries. The legal basis is Art. 6(1)(f) GDPR (our interest in secure, interactive product information and handling business inquiries) or Art. 6(1)(b) GDPR where the communication is part of pre-contractual steps. Please do not enter passwords, payment details or unnecessary sensitive information. Sensitive, unclear or explicitly human matters are passed on for personal clarification.

The conversation is processed on the server only temporarily in working memory; the browser can keep the limited conversation context in Session Storage for up to one hour so a conversation can continue after a new server process. Session Storage is deleted when the browser tab is closed. When a qualified inquiry is successfully delivered, the structured summary is sent to the configured business email inbox. Use of the widget for customer businesses is agreed separately.

7. Hosting, technical logs and cookies

The intended hosting service, Vercel Inc., USA, processes information including IP addresses, timestamps, requested URLs, browser and device information, HTTP status and technical error data. These are used for delivery, stability, troubleshooting and attack detection. The legal basis is Article 6(1)(f) GDPR. Server errors may include additional technical details from the providers involved. Technical hosting log retention: according to the active Vercel project and plan retention periods, and only as long as necessary for operation, security and troubleshooting. Details: Vercel privacy notice.

Following confirmed checkout, the website sets the necessary cookie panthorys_onboarding for seven days. It contains a signed access token with a checkout identifier and expiry time, protects onboarding access and cannot be read by browser scripts (HttpOnly; Secure in production; SameSite=Lax). The legal basis for personal-data processing is Article 6(1)(b) or (f) GDPR; storage serves the expressly requested service under section 165(3) of the Austrian Telecommunications Act 2021. Protected access is not possible without this cookie.

This website does not embed analytics or advertising trackers. The public demo does not store its content in Local Storage or Session Storage; the website assistant uses the session-limited Session Storage context described above. The separate Stripe page may use its own necessary cookies and additional features, about which Stripe provides information. Additional hosting integrations must be reviewed separately before activation.

8. Recipients and international transfers

Access is available to authorized Panthorys personnel and the service providers needed for email, hosting, payments and AI. Processing on our behalf requires an agreement under Article 28 GDPR. Payment providers, tax advisers and competent authorities may also receive data for their own statutory purposes.

Vercel, Stripe and OpenAI may process data in the USA and other third countries. Transfers require an applicable adequacy decision under Article 45 GDPR — for the EU–US Data Privacy Framework, only for certified recipients and covered data — or appropriate safeguards under Article 46 GDPR, particularly EU Standard Contractual Clauses with any necessary supplementary measures. The specific provider agreements, regions and transfer grounds must be documented before live operation; processing exclusively in Europe is not promised. Information and copies of the relevant safeguards can be requested at the email address above.

9. Retention periods

Inquiries and emails are needed only for as long as required to handle them, carry out a resulting contractual relationship or address a specific need to establish or defend legal claims. Data that is no longer required must be deleted. Contract and onboarding information remains necessary for setup, support and contract administration; after that, only applicable retention duties or justified further purposes apply. Accounting and tax-relevant records generally must be retained for seven years, or longer where required in legal proceedings. Mailbox and backup deletion must be implemented operationally. The separate periods described above apply to demo memory, OpenAI logs, hosting logs and cookies.

10. Your rights

Subject to the GDPR, you have rights of access, rectification, erasure, restriction and data portability. You may object to processing based on legitimate interests for reasons relating to your particular situation. Where separate consent has been given, it may be withdrawn at any time for the future, without affecting the lawfulness of earlier processing. Please contact the email address above.

You may lodge a complaint with a data protection supervisory authority, particularly the Austrian Data Protection Authority, Barichgasse 40–42, 1030 Vienna, Austria; email: dsb@dsb.gv.at.

When you manually select a language, we store the language code in the panthorys_locale cookie for 180 days. Before checkout, the company or billing country is processed to determine the pricing market and permitted currency on the server. Technical country information, such as a hosting-provided signal, may be used only as a non-binding initial hint; the information confirmed before checkout is authoritative.