Privacy Policy

1 Who is responsible

deepblick GbR
Partners: Jan Gutberlet and David Ochs
Fleischergasse 15, 60487 Frankfurt am Main, Germany
Email: info@deepblick.com

If you use deepblick for work, follow your organisation’s rules for the information you provide, including information about other people.

2 Website visits and contact

Our hosting services process technical request data, including IP address, request time, requested address, browser and operating system, to deliver and secure the service. The basis is our legitimate interest in reliable, secure operation under Article 6(1)(f) GDPR.

For enquiries and demos, we process your name, email, optional company/message, Excel use case, preferred times and time zone, plus the submission reference, policy acknowledgement, receipt and delivery status. Campaign parameters may appear in the notification email, but not the request database. We rely on Article 6(1)(b) GDPR for pre-contractual requests and Article 6(1)(f) for our legitimate interest in answering other enquiries.

The form uses Cloudflare Turnstile for abuse prevention, Neon for storage and Resend for email delivery. Turnstile processes IP information and technical browser signals. Delivered email is separate from the database record.

Product videos are hosted on YouTube. Preview images load from YouTube’s image service when they come into view. Choosing Play loads an embedded player from youtube-nocookie.com; YouTube then receives technical request and playback information, including your IP address. Choosing a video with the position dots or adjacent previews removes the current player. See Google’s Privacy Policy for its processing information.

3 Microsoft sign in and your account

Microsoft handles sign-in. We associate verified Microsoft identifiers with your deepblick user, account and membership, and process the supplied display name, session credentials, expiry and revocation information. This supports account recognition, access and usage records under Article 6(1)(b) GDPR.

Necessary website cookies protect the sign-in transaction and authenticated session. The transaction cookie is removed after the callback; the session cookie follows server-session expiry. The app uses a local authentication cache. Signing out or session expiry does not delete your account or history.

4 Excel tasks and AI processing

deepblick processes your instructions and task context, which may include worksheet values and formulas, workbook structure, VBA code, file contents and paths, tool inputs/results, conversation history and images. These can contain personal or confidential information.

Our backend sends task content to the AI provider. Earlier versions used the official DeepSeek API, operated by Hangzhou DeepSeek Artificial Intelligence Co., Ltd. OpenAI-based versions use OpenAI’s API, with OpenRouter as an explicitly configured fallback to OpenAI. The available route depends on the app version and server configuration; older apps may need an update.

Requests include pseudonymous user, request or chat identifiers, depending on the route. Task content is not anonymous. Provider credentials stay on our server. We process requested tasks under Article 6(1)(b) GDPR. Only provide information you are authorised to process and disclose.

5 Session history and service records

The app keeps local session history. Separately, deepblick collects server-side history to investigate service faults and support requests: messages, responses, tool inputs/results, workbook-related content and paths, linked to your account, installation, app version and session. Collection occurs during use without submitting feedback. Credential filtering does not remove all personal or confidential content. Authorised operators can access this history for those purposes.

This history processing relies on our legitimate interest in resolving service problems under Article 6(1)(f) GDPR. Account-linked access and usage records support entitlement checks, actual usage accounting, remaining Credits and prevention of duplicate grants under Article 6(1)(b). Security and abuse prevention rely on Article 6(1)(f).

6 Downloads updates and payments

Downloading and installing does not require website sign-in or payment. Download requests and update checks disclose technical request data, including the requested file or version, for delivery and security under Article 6(1)(b) and (f) GDPR. They do not automatically upload a workbook.

When you choose to pay or manage billing, we use Stripe-hosted pages. Our backend sends Stripe customer and purchase references, the selected offer and return links. Stripe collects the payment and billing details you enter, including a billing address for tax calculation. For monthly payments, Stripe can save a payment method for agreed future charges.

We link Stripe customer, purchase, payment and invoice references, amounts, status and billing periods to your deepblick account. Our backend receives signed payment notifications and retrieves records from Stripe to confirm payments, provide purchased Credits, manage renewals and cancellations, and resolve payment problems.

7 Service providers and international processing

We use Vercel for website/account functions, Hetzner for the app backend and server records, Microsoft for identity, DeepSeek, OpenAI and the configured OpenRouter intermediary for AI processing as described in section 4, Stripe for payments and billing management, and Cloudflare, Neon and Resend for the contact form and delivery.

The apphost is in Helsinki, Finland. Website account functions are configured for Vercel’s Washington, D.C., US East region. Other provider, CDN, log and backup locations can differ. Microsoft, OpenAI, OpenRouter and other providers operate internationally; DeepSeek is based in China. Data can therefore be processed outside the European Economic Area. Contact info@deepblick.com about the applicable transfer arrangements.

8 Cookies and website analytics

When enabled, Vercel Web Analytics measures aggregate public-page visits, referring origins and broad device categories. Queries, fragments, private pages, form content and account identifiers are excluded. It uses no analytics cookies or cross-site identifiers; its temporary visitor session expires after 24 hours. We respect Do Not Track and Global Privacy Control. Required consent must precede analytics.

Vercel Speed Insights also measures loading speed, responsiveness and visual stability on public pages to help us improve website performance. Measurements include the public page path, performance values, affected element selectors, network speed, browser, device, operating system, country, SDK version and receipt time. Queries, fragments, private pages, form values and account identifiers are excluded. Speed Insights does not use analytics cookies or identify visitors across pages. The same Do Not Track, Global Privacy Control and browser analytics opt-outs apply.

?analytics=off disables browser analytics for that tab session using session storage. A non-identifying session cookie also suppresses analytics when other cookies or website sign-in are present. Separate fixed server events exclude personal/request identifiers, IPs, cookies, form content and queries in their defined fields. These events and infrastructure logs continue independently of browser analytics.

9 How long data are kept

• Contact database records receive a 12-month expiry; daily cleanup is scheduled. Correspondence and business records depend on the enquiry, resulting relationship and legal obligations. Database cleanup does not delete email.
• Server session content has a configured 30-day window from receipt, with cleanup in stages. Identifiers, usage records, local files, exports and backups are separate.
• Account/access records support ongoing access. Usage and grant records also serve unresolved accounting, entitlement disputes, claims and legal retention obligations. Session expiry is not a deletion period.
• Vercel Pro runtime logs have a one-day service retention period. Other logs can rotate by size. Security incidents, legal obligations and recovery needs determine the continued need for separate records and backups; there is no single service-wide deletion period.
• Local history and authentication data remain on your computer independently of server cleanup.

Erasure requests are assessed against these purposes and legal requirements. Ending access does not erase every record or copy.

10 Your choices and rights

Browsing and downloading require no account. Identification and task context support authenticated AI use; contact details let us answer enquiries. Unrelated personal information is not required.

Subject to applicable conditions, you can request access, correction, erasure, restriction and portability, and object to processing based on legitimate interests. Consent can be withdrawn for future processing. Write to info@deepblick.com; we may need to verify your request. You may complain to a supervisory authority, including the Hessian Commissioner for Data Protection and Freedom of Information.