Privacy notice

1. Scope

This notice covers the Implisense Platform at app.implisense.com — the website, the signed-in area and the API reachable through it — and our MCP server at mcp.implisense.com, through which AI assistants connect to the platform. Our marketing site implisense.com has its own privacy notice.

2. Controller

Implisense GmbH, Spiekermannstraße 31a, 13189 Berlin, Germany
Phone: +49 30 44719759
E-mail: info@implisense.com

Represented by the Managing Directors Dr. Andreas Schäfer and Dr. André Bergholz. Further details in our legal notice.

3. Processing at a glance

4. Account, organisation and billing

Sign-in

User accounts are managed by Clerk. Registration collects your e-mail address, first and last name and the sign-in method you chose; if you accept our terms and this notice during registration, the time of that acceptance is stored as well. Our own database keeps a copy of name, e-mail address and the time of the last sign-in. Passwords never reach our systems.

Payment

Payments — the Plus licence and credit top-ups — are handled by Stripe. Payment data, card details in particular, are collected and processed by Stripe and never reach our servers. We store the billing address, the VAT identification number, the Stripe customer number and the status of the licence.

Abandoned payments

If someone starts a purchase and does not complete it, we record that a purchase was started and not completed, with the time and the organisation. We use this solely to find obstacles in the checkout and delete these records automatically after 90 days. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is a working checkout.

5. Product analytics in the signed-in area

To understand which features of the platform are used and where they fail, we record a limited, conclusively defined list of events in the signed-in area: running a search, opening a company profile, meeting a paywall, running out of credits, and creating or editing lists, notes and uploads. For each event we store the time, the user account, the organisation, the name of the event and a few technical details.

We do not store search terms. All that is derived from the search text is a classification into one of a few categories — such as “hit”, “no hit”, “person”, “foreign” or “too short”. The text you entered is not stored.

The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest is designing and debugging our own product. There is no advertising profiling, no cross-site tracking and no disclosure to third parties.

Retention 90 days. After that the individual events are deleted automatically; only aggregated figures without any personal reference remain. You may object to this processing at any time under Art. 21(1) GDPR — an informal e-mail is enough.

6. History of companies you viewed

We store the company profiles you opened most recently against your account so that you can find them again. The history is visible only to you. Under Settings → Profile you can pause it and delete it entirely at any time.

7. Research in company data

When you use the platform we retrieve data on German companies from our own database. That data comes from public sources — the commercial and company registers, the Bundesanzeiger and company websites among them — and contains personal data of directors and shareholders. We process it on the basis of Art. 6(1)(f) GDPR; the legitimate interest is economic information about companies and who represents them, which is the very purpose the legislator pursues with register publicity. Separate information of the data subjects under Art. 14 GDPR is dispensable under Art. 14(5)(b) GDPR where it would involve disproportionate effort; data subjects receive information through our privacy portal at privacy.implisense.pro (the form is in German) and may object to the processing.

Uploaded lists

When you upload a table for matching, the file is processed in memory only and never stored. Columns that map to no search field are discarded immediately. Only the companies you then add to a list are stored permanently.

Shareholder lists

When you order a shareholder list, we instruct a retrieval service we operate ourselves to fetch it from the register portal. Only the details of the company sought are transmitted, no data about you.

Access through the API and AI assistants (MCP)

The company data can also be reached through our API and our MCP server. The MCP server lets you connect an AI assistant such as Claude or ChatGPT to your account. To do so you enter your API key on a page of ours; we hand it to the assistant through a one-time code that we delete when it is used, after five minutes at the latest. The assistant’s provider then stores the key in order to make requests to us on your behalf. You can deactivate any key on the platform at any time, which also disconnects the assistant.

With each request we receive only what the assistant passes to the tool in question — a company name, search filters or a company ID, for example. We do not receive your conversation with the assistant. For billed requests we store the time, the organisation, the name of the tool or endpoint called and the credits charged, but not the content passed; technical logs are covered by section 12. A contact search started through an assistant is the same one described in section 8. The legal basis is Art. 6(1)(b) GDPR.

What the assistant’s provider does with your conversation and with our answers is governed by that provider’s own privacy terms. It is not our processor; you decide which assistant you connect.

8. AI-assisted features

Three features of the platform put a language model by OpenAI to work; contact research additionally retrieves profile data through Apify. Your identity is never transmitted — no name, no e-mail address, no account or organisation identifier. What is transmitted differs by feature:

Contact research is therefore processing of third parties’ personal data. The result may contain business phone numbers, e-mail addresses and profiles on professional networks. The legal basis is Art. 6(1)(f) GDPR; our customers’ legitimate interest is getting in touch with a business. Only business contact details are sought, never private ones.

Two properties of this feature matter enough to state here. First, the source is carried and shown for every entry; an entry without proof is not delivered. The enrichment service could supply e-mail addresses with no stated origin — we deliberately do not use that, because Art. 14 GDPR cannot be met without the source. Second, the result is not stored: it is produced on request, delivered, and then discarded.

Data subjects may object at info@implisense.com. An objection is followed by suppression: the name is recorded and the person drops out of future results — at delivery, not merely at collection. All we store for that is the name and, where the objection concerns one company, its identifier. That record serves only to honour the objection. The data is not used to train models.

9. Customer outreach

At regular intervals we evaluate how intensively an organisation uses the platform — as a figure over the past 28 days, without individual events. On that basis we choose which customers to approach, for instance with a pointer to a feature or with the question what is getting in the way. We record who was approached, through which channel, and whether the message arrived; part of the selected organisations is deliberately not approached, so that we can tell whether an approach achieves anything at all.

The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is supporting existing customers and improving the product. You may object at any time under Art. 21(2) GDPR; you will then receive no further messages of this kind. An informal e-mail is enough.

10. Audience measurement

We count page views with Umami, which we run on our own infrastructure at umami.implisense.com. It sets no cookies, stores no IP addresses and builds no cross-device identifiers; the data never leaves our infrastructure. The legal basis is Art. 6(1)(f) GDPR.

Alongside page views we count anonymous interaction events there: that a button was pressed, a filter opened, a dialogue abandoned or a step of a wizard reached. Only the name of the event and a few fixed details about it are transmitted — which button it was, which step, and whether the access is a free or a paid one. No personal reference and no free text: neither your account nor your email address, nor any search terms or company names you typed, are sent with it. No cookies are set for this either.

11. Cookies and local storage

The platform sets two cookies, both technically necessary:

• a session cookie from Clerk that carries your sign-in for the duration of the session — without it there could be no signed-in area;
• a language cookie that remembers whether you use the platform in German or English.

In addition, some features keep intermediate results in the memory of your browser tab so that an analysis already computed need not be fetched again when you navigate back. That storage is cleared when the tab is closed.

All three fall under § 25(2) no. 2 TDDDG: they are strictly necessary for the service you expressly requested. We therefore ask for no consent and show no cookie banner. We set no advertising or tracking cookies, neither our own nor those of others.

12. Server logs

When the platform is accessed, our ingress server processes the IP address, the time, the address requested, the status code and the browser identification in order to keep the service running and to detect abuse. The legal basis is Art. 6(1)(f) GDPR. The logs are used for that purpose only, are not combined with other data and are deleted automatically.

13. Recipients and transfers to third countries

Data processing agreements under Art. 28 GDPR are in place with all of the providers named. With these providers they form part of the respective terms of service and take effect when those are accepted.

Clerk, Inc. is certified under the EU-U.S. Data Privacy Framework. The transfer to the USA therefore rests on the European Commission’s adequacy decision under Art. 45(3) GDPR. In addition, Clerk’s data processing agreement incorporates the European Commission’s standard contractual clauses under Art. 46(2)(c) GDPR, which apply should the framework cease to be available.

Umami, our shareholder-list retrieval service and our company database run on our own infrastructure; no transfer to third parties takes place there. The platform’s fonts are served from our own servers — there is no connection to a third-party font service.

14. Retention periods

15. Your rights

You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection to processing based on legitimate interests (Art. 21). The right to object covers the product analytics in section 5, the customer outreach in section 9 and the audience measurement in section 10 in particular.

You can delete the history of companies you viewed yourself (section 6). To delete your account and all remaining data stored about you, an informal message to info@implisense.com is enough; we act on it without undue delay.

Requests about company and person data

Where your rights concern data we publish in our company database — your name as a managing director, for instance — please use our privacy portal at privacy.implisense.pro (the form is in German). There you request erasure, objection to the processing, blocking of the entire company profile, rectification, access or de-indexing directly. You confirm the request via a link sent to your e-mail and can check its status at any time afterwards.

You may also lodge a complaint with a supervisory authority. The authority responsible for us is the Berliner Beauftragte für Datenschutz und Informationsfreiheit, Friedrichstraße 219, 10969 Berlin, Germany.

16. What we do not do

We do not sell usage data, we build no advertising profiles, we set no third-party advertising or tracking cookies, and we do not follow you across other websites.