Privacy Policy

Controller within the meaning of Art. 4 No. 7 GDPR:

Ing. Dipl.-Ing. (FH) Karl J. Pilz
Sole proprietorship
Sagmüllerweg 8, 5081 Anif-Niederalm, Salzburg, Austria
VAT-ID: ATU 66845907
Email: datenschutz@hoviguard.eu
Phone: +43 660 1495489

Data Protection Officer (Sec. 13(1) DSG in conjunction with Art. 37 GDPR): Karl J. Pilz, contact as above.

HOVIGuard is a B2B SaaS gateway for the secure use of AI models in enterprises. We process personal data exclusively within the EU (server location: Hetzner GEX44, Falkenstein/Germany). Third-country transfers only occur via EU-approved safeguards (DPF or SCCs).

• Account data (name, email, password hash)
• Usage data (chats, generated images/videos, uploaded files)
• Billing data (tenant, seat count, token consumption)
• Technical logs (IP address pseudonymised after 7 days, user-agent, audit trails)

• Art. 6(1)(b) GDPR — contract performance (account, billing, service delivery)
• Art. 6(1)(c) GDPR — legal obligations (accounting, tax, audit)
• Art. 6(1)(f) GDPR — legitimate interest (security logs, fraud prevention)

We use carefully selected sub-processors, all bound by data processing agreements (DPAs) and, where applicable, Standard Contractual Clauses (SCCs):

• Hetzner Online GmbH (Germany) — hosting ¹
• Requesty Ltd. (London, UK — EU adequacy decision; processing in AWS Frankfurt) — primary AI model gateway for GPT-5.x, Claude 4.x, Gemini, Mistral via the EU-only endpoint router.eu.requesty.ai (Requesty DPA v2.2 + SCCs, Logging disabled = zero data retention)
• OpenAI Ireland Ltd. (Dublin) — direct API access to GPT-5.x / o3 / o4 (fallback) via the EU endpoint eu.api.openai.com (OpenAI DPA + SCCs Module 2/3, zero data retention)
• Google Cloud EMEA Ltd. (Dublin) — Vertex AI EU multi-region for Gemini 3.x + Claude 4.x (Anthropic-on-Vertex); customer data never used for training (Google Cloud DPA + SCCs Module 2/3)
• SpaceXAI LLC (formerly xAI, Inc.; EU region eu-west-1 for processing; HQ USA) — direct call to Grok models (xAI enterprise DPA + EU SCCs, zero retention)
• Amazon Web Services EMEA SARL (Luxembourg; Bedrock Frankfurt eu-central-1) — AWS Bedrock for Anthropic Claude 4.x; no storage at rest, no training (AWS DPA + SCCs Module 2/3)
• Eden AI SAS (Villeurbanne, France; processing in Paris eu-west-3) — active AI gateway for part of the chat models plus image and video models, exclusively via the EU endpoint api.eu.edenai.run (DPA per Art. 28)
• Stripe Payments Europe Ltd. (Dublin) — payment processing (SCCs Module 1+2 + EU-US DPF for Stripe LLC USA)
• All-Inkl.com (Germany) — SMTP email delivery

Aggregator note: Requesty is a primary gateway sub-processor with its own (nested) sub-processor chain. Under our EU-only configuration (endpoint router.eu.requesty.ai, logging disabled, EU-only models) your data stays exclusively within the EU. The current list of inference providers used by Requesty is public at requesty.ai/privacy/subprocessors. If your company admin enables non-EU models, US/third-country sub-processors are added and that responsibility lies with the enabling customer.

Where HOVIGuard processes personal data on behalf of the Customer, our Data Processing Agreement (DPA) per Art. 28 GDPR applies and is part of the contract. Enterprise customers may request a separately signable PDF version via datenschutz@hoviguard.eu.

You have the following rights under the GDPR:

• Right of access (Art. 15)
• Right to rectification (Art. 16)
• Right to erasure (Art. 17)
• Right to restriction of processing (Art. 18)
• Right to data portability (Art. 20)
• Right to object (Art. 21)
• Right to lodge a complaint with the Austrian Data Protection Authority (DSB), Barichgasse 40–42, 1030 Vienna

Requests to: datenschutz@hoviguard.eu.

• Account data: duration of business relationship + 30 days
• Usage and token records: 365 days
• IP addresses: pseudonymised after 7 days
• Invoices: 7 years (Sec. 212 BAO, Austrian accounting law)
• Application and configuration audit: 365 days; AI request audit (including full prompt and response text where enabled): 180 days; safety decision audit: 180 days; email delivery logs: 90 days; sessions: 30 days after expiry
• Website analytics (Umami): 13 months

HOVIGuard records every AI request in a tamper-evident request audit. Because content can be stored in clear text in the process, we disclose what that means:

What is stored. For every request via chat, image generation, video generation, comparison mode, Veritas and Advisor, a record is created containing the timestamp, user and company assignment, the model used, the provider route and processing region, token consumption, the safety layer’s decision including its category, as well as latency and error code. In addition, prompt and response text are stored in clear text. The records form part of a continuous integrity hash chain and cannot be altered retrospectively.

Switchable per company. Storage of the full prompt and response text can be disabled per tenant. Where it is disabled, only the metadata listed above is recorded — the content of the request is then not stored.

How long. 180 days. After that the records are deleted in full by an automatic process that runs daily. No extension takes place.

Purpose. Traceability of AI usage for companies with their own compliance or supervisory duties; detection of misuse, data exfiltration and prompt injection; evidence of the effectiveness of our protective measures (Art. 32 GDPR); investigation of security incidents.

Who can view it. On the customer side, an administrator only sees records belonging to their own company. Contents are masked by default and are visible only with the explicitly granted “prompt access” permission; that permission is granted by the platform administrator.

We only use technically necessary cookies (session, CSRF, language preference). No tracking cookies, no third-party advertising.

Website analytics with Umami. On our public pages and the registration page we measure visits with the open-source software Umami, which we run ourselves on our server in Germany (analytics.hoviguard.eu); no data is passed to third parties. Umami sets no cookies and stores nothing on your device. Processed: the page visited including campaign parameters in the address (e.g. “utm_source”), referring page, browser, operating system, device type, screen size, language, and the country, region and city derived from the IP address. The IP address itself is not stored; together with the browser identifier it feeds into a hashed visit identifier that changes monthly. We also count individual events (e.g. a button click, a completed registration, a submitted enquiry); these are not linked to your HOVIGuard account. Purpose: improving the website and evaluating which pages and campaigns lead to registrations. Legal basis: Art. 6(1)(f) GDPR (legitimate interest). Retention: 13 months. You can object at any time (Art. 21 GDPR), for example by blocking scripts from analytics.hoviguard.eu in your browser or by email to datenschutz@hoviguard.eu.

HOVIGuard records every AI request in a tamper-evident request audit. Because this can store content in plain text, we disclose what that means:

What is stored. For every request via chat, image generation, video generation, compare mode, Veritas and Advisor, a record is created with timestamp, user and company assignment, model used, provider route and processing region, token usage, the security layer's decision including category, plus latency and error code. In addition, the prompt and response text are stored in plain text. The records form a continuous integrity hash chain and cannot be altered afterwards.

Can be switched off per company. Storage of the full prompt and response text can be disabled per tenant. When disabled, only the metadata listed above is recorded — the content of the request is then not stored.

How long. 180 days. After that the records are deleted completely by a daily automated process. There is no extension.

Why. Traceability of AI usage for companies with their own compliance or supervisory obligations; detection of abuse, data exfiltration and prompt injection; evidence of the effectiveness of our safeguards (Art. 32 GDPR); investigation of security incidents.

Who can view it. On the customer side an administrator only sees records of their own company. Content is masked by default and only visible with the explicitly granted permission "prompt access"; that permission is granted by the platform administrator.

• Transport encryption on all public endpoints (TLS 1.3 preferred, TLS 1.2 minimum, older protocols disabled)
• scrypt password hashing (RFC 7914, N=16384/r=16/p=1, per-password salt), rate limiting, IP blocklists
• Fully encrypted daily backups (BorgBackup, repokey-blake2; rotation 30 daily, 4 weekly, 6 monthly; key remains on our server)
• Operational secrets AES-256-GCM encrypted in the database; database payload and object storage reside on mirrored NVMe drives in an ISO 27001 certified data centre without additional disk-level encryption
• RBAC with strict Company-Admin / Superadmin separation
• Safety layer (Qwen3Guard) for prompt injection and jailbreak detection
• Audit logs for security-relevant events

In case of a data breach with risk to the rights and freedoms of natural persons, we will notify the Austrian Data Protection Authority within 72 hours (Art. 33 GDPR) and inform affected customers immediately if a high risk exists (Art. 34 GDPR).

All photographic marketing content on hoviguard.eu (hero images, illustrations, person portraits in hero sections) is entirely AI-generated. These are not photographs of real persons, employees, or customers. Any depicted person is a synthetic character; any resemblance to existing individuals would be coincidental.

Authentic application screenshots (chat UI, audit log, model catalog, etc.) are real captures of the HOVIGuard platform and are not AI-generated.

This notice fulfils the transparency obligation under Art. 50 of EU Regulation 2024/1689 (EU AI Act) effective 02 Aug 2026 as well as obligations to avoid misleading advertising under § 2 UWG (AT) / § 5 UWG (DE). An additional "AI-generated" notice is shown in the website footer.

This privacy policy will be updated as processing changes. The current version is available at hoviguard.eu/privacy. Material changes will be announced at least 30 days in advance via email.