Privacy Policy

1. Controller

The controller responsible for processing your personal data within the meaning of the GDPR is:
NMA Venture Capital GmbH
Am Sandtorkai 27, 20457 Hamburg, Germany
Email: info@nma.vc

2. Legal Basis for Processing

2.1 Scope of Processing

We process personal data of our users generally only to the extent necessary to provide a functional website and our SaaS platform.

2.2 Legal Bases

• Art. 6(1)(a) GDPR — Consent (e.g. connecting a source)
• Art. 6(1)(b) GDPR — Performance of a contract (delivering the SaaS platform)
• Art. 6(1)(f) GDPR — Legitimate interest (system security, logs; improving the shared classification models with derived labels, section 5.2)

3. Hosting & Log Files

3.1 Data Collected Automatically

• IP address of the user
• Date and time of access
• Browser type and version
• Operating system
• Referrer URL

3.2 Infrastructure Providers

We host our services and process user data using secure infrastructure partners under standard Data Processing Agreements (Art. 28 GDPR):

• UpCloud Ltd (Primary server node hosting, EU-based datacenter)
• Cloudflare Inc. (Content Delivery Network, WAF security, EU SCC basis)

4. Registration & Account Data

4.1 Data Collected

• Email address
• Encrypted credentials (stored as cryptographic hashes)
• First and last name
• Organization name (optional)

4.2 Legal Basis

Art. 6(1)(b) GDPR — necessary to establish and perform your user account contract.

5. AI Inference & Processing

5.1 Model calls

All LLM and reasoning queries run through Cortecs.ai (api.cortecs.ai) using strictly EU-hosted servers with a zero-retention data policy. Your inputs never train external models.

5.2 Derived labels and anonymized structural statistics

To improve the classification models that serve all Plietsch customers, we use two kinds of signal, and only these. Derived labels record how you respond to a decision the Plietsch classifier has made: your correction of a triage decision, a one-click disagreement, and passive outcome signals such as whether and how quickly a reply was sent. A derived label consists of the decision identifier, the class Plietsch proposed, the class you chose or the outcome observed, timestamps and your organisation's tenant identifier. Anonymized structural statistics are aggregate figures computed inside your organisation's tenant, such as thread length, number of participants, reply latency and the share of decisions per class, that leave the tenant only in aggregated form and cannot be traced to a message, a person or your organisation. Neither contains message text, subject lines, attachments, contact details or any other content of your messages or documents; that content never leaves your tenant for this purpose.

Purpose: training a shared classification model on pooled derived labels and calibrating it to your organisation's tenant. Legal basis: Art. 6(1)(f) GDPR — our legitimate interest in improving a product that every customer benefits from, weighed against data that is limited to decision-level signals without content, concerns you in a professional context, and that your organisation can withdraw at any time (see below). Anonymized structural statistics are not personal data. For this use NMA Venture Capital GmbH is the controller; it is governed by § 8 of the Terms of Service, not by the DPA.

Partitioning and erasure: derived labels are stored partitioned per customer organisation and kept re-derivable; pooled training sets and models are always rebuilt from that partitioned corpus. When your organisation's contract ends, when it opts out, or on an erasure request, its partition is deleted within 30 days and the pooled training set and shared models are rebuilt without it at the next scheduled re-derivation, at the latest within 90 days. Already aggregated statistics cannot be attributed and are not withdrawn. Hosting and recipients: stored and processed only on our servers in the EU, trained on EU infrastructure and only on open-weight base models; never sold, never passed to third parties, never used for advertising, never sent to an external model provider. Opt-out: your organisation can opt out at any time in text form (an email to info@nma.vc suffices); no further signals then leave its tenant, and Plietsch keeps working without restriction, including calibration on your own corrections inside your tenant as part of the service (Art. 6(1)(b) GDPR).

6. Connected Sources

Connecting an inbox, calendar or document source is optional; Plietsch works with uploaded documents alone. A source is read only after you consent at the provider, access is read-only, provider grants are brokered by Composio, and you can disconnect any source at any time in Integrations. Nothing is scanned or sent automatically.

Google API Services User Data Policy. Our use of information received from Google APIs (e.g. Gmail, Google Workspace) adheres to the Google API Services User Data Policy, including the Limited Use requirements: Google user data is used only to provide the feature you enabled, is never sold, never used for advertising, and never read by a person except with your explicit consent for support, for security purposes, or where the law requires it. No derived label and no structural statistic derived from Google-sourced data (section 5.2) is added to the pooled corpus or used to train the shared models; such signals are used only inside your organisation's tenant to calibrate the models for you.

7. Transactional & Communication Emails

We route account validations and system alerts via our transactional email provider (Resend Inc.). Legal basis: Art. 6(1)(b) GDPR.

8. Your Rights (GDPR)

• Right of access (Art. 15)
• Right to rectification (Art. 16)
• Right to erasure — "Right to be forgotten" (Art. 17)
• Right to restriction of processing (Art. 18)
• Right to data portability (Art. 20)
• Right to object (Art. 21)

You have the right to lodge a complaint with a supervisory authority. The competent authority for NMA Venture Capital GmbH is the Hamburg Commissioner for Data Protection.

To exercise your rights, contact us at: info@nma.vc