Privacy Policy

1. Controller and data protection contact

The controller is Seibert Group GmbH, Luisenstraße 37–39, 65185 Wiesbaden, Germany, represented by the managing directors Joachim Seibert, Martin Seibert and Sebastian Martini. Phone: +49 611 20570 0, email: gpt@seibert.group. For questions about data protection, you can reach us at datenschutz@seibert.group.

You can reach our data protection officer by email at dsb@seibert.group or by post at the address above, marked “Data Protection Officer”.

2. Sign-in via the Seibert Customer Login

You sign in to SeibertGPT via the Seibert Customer Login (customer.seibert.group) of Seibert Group GmbH. How your data is processed there is described in the terms of use and privacy notice of the customer portal (opens in a new tab).

After you sign in, we receive from the Customer Login your name, your email address and whether it has been verified, the address of your profile picture and a unique identifier of your account. We use this to create your user account and keep it up to date each time you sign in. We also store the sign-in data (tokens) that the Customer Login issues in the process.

Signing in is only possible with a verified email address. Without this information, you cannot use SeibertGPT. The legal basis is Art. 6(1)(b) GDPR.

3. Cookies and local storage

For sign-in, SeibertGPT sets technically necessary cookies: a session cookie that keeps you signed in, and cookies that secure the sign-in process and remember which page you return to afterwards. The session is stored in our database and ends when you sign out, at the latest 30 days after your last use. The cookies of the sign-in process are valid until you close the browser, two of them for no more than 15 minutes. During sign-in, the cookie for the return page also contains the origin information from section 4; we remove it afterwards.

If you explicitly select a language, for example in the menu, SeibertGPT stores this choice for one year in the cookie “NEXT_LOCALE” so that you continue to see the pages in this language. SeibertGPT sets this cookie itself (first-party cookie); it contains only the selected language.

These cookies are strictly necessary to provide the service you have requested; consent is therefore not required under Section 25(2) No. 2 TDDDG. The legal basis for the associated processing is Art. 6(1)(b) GDPR.

After you sign in, SeibertGPT also sets the cookie “seibert-id” of the Seibert customer identity (section 4). If you open a referral link without being signed in, the cookie “sgpt_ref” stores the referral code for 30 days so that we can associate an account created afterwards with the person who invited you. If you come to the home page via a link with campaign information, for example from an ad, the cookie “sgpt_lv” stores for 30 days which version of the home page you see. It contains only this information and no identifier. If PostHog counts your page views (section 4), it receives the version with every event on SeibertGPT, on all pages and also after you sign in, and we use it to count sign-ins per version.

If you come to SeibertGPT via a link with campaign information or from another website, your browser stores this origin information (campaign information, domain of the website, landing page and time) locally for 30 days so that we can associate it with an account created later (section 4). It only reaches us when you sign in; SeibertGPT then deletes it from your browser.

If you explicitly choose a light or dark theme, your browser stores this choice locally. Your browser keeps entries in the contract form (section 7) as a draft until you close the tab. Neither reaches us; we only receive the form entries when you submit the form.

The portal does not embed content from third-party servers, including fonts.

4. Customer identity and usage analytics

SeibertGPT uses the Seibert customer identity (cookie “seibert-id”) and the web analytics service PostHog in the same way as the other Seibert Group websites and the Seibert customer portal. The legal basis, recipients, storage period and your choices are described in the general Seibert Group privacy notice (opens in a new tab) and the terms of use and privacy notice of the customer portal (opens in a new tab). You can withdraw personalization at any time in the settings of your Seibert customer account at customer.seibert.group/settings.

For SeibertGPT, the following applies in detail:

• The cookie “seibert-id” is issued by the Seibert Customer Login; after you sign in, SeibertGPT sets it for seibert.ai and all subdomains. Among other things, it contains your identifier in the Customer Login, your name and your email address, and it expires after one year at the latest. We delete it when you sign out of SeibertGPT or when the Customer Login reports it as invalid.
• PostHog (EU instance, connected via ph.seibert.group) records on SeibertGPT only page views including time on page and scroll depth, the start of a sign-in and, on the inquiry forms, the click on an inquiry button and the start of typing (without your entries), clicks on links to Weldall and Taskmate, and nothing on the administration pages. Of the transmitted URLs, only the page and campaign parameters (utm_*) are kept; in addition, on all pages, the version of the home page from the cookie “sgpt_lv”, if set (section 3).
• If SeibertGPT does not recognize you by the cookie “seibert-id”, PostHog counts your page views anonymously, without cookies and without a persistent identifier; in the browser, PostHog only notes whether measurement is switched on or off. If SeibertGPT recognizes you by the cookie, even after your session has expired, PostHog associates the page views with your identifier in the Customer Login, your name and your email address. If you have switched off personalization in your customer account, SeibertGPT does not load PostHog.

If personalization is switched on in your Seibert customer account, the SeibertGPT server reports the following events to PostHog with your identifier in the Customer Login and your email address:

• your first sign-in, with its origin: website (domain only), campaign information from the link and landing page
• changes to your plan, with the new plan, status and reason
• using up the day's free messages in the web chat
• the creation of an API key
• your answer to the question of how you heard about SeibertGPT, with the campaign information of your registration, without any text you entered yourself

Regardless of whether personalization is switched on, we count every first sign-in and every start of a sign-in together with the advertising campaign, the website you came from (domain only), your landing page and the version of the home page, in order to measure the success of our advertising. In doing so, we transmit neither your identifier nor your email address.

Likewise, we count every inquiry sent via the forms on /unternehmen, /teams, /unternehmen/privacy-filter and /loesungen (section 8) with this origin information, the page on which you made the inquiry, the selected offers or topics and the number of users. We do not transmit company, name, email address or message to PostHog in the process.

For the same purpose, we store this origin information in your account when you register, together with the time you first came to SeibertGPT. After your first sign-in, we ask you once how you heard about SeibertGPT; answering is voluntary, and we also store the answer in your account.

When you start a purchase, we store the same information (source, campaign, referring page, landing page and time of arrival) once more in your account in order to measure the success of our advertising up to the purchase.

We do not transmit the content of your chats and API requests to PostHog.

5. Server logs

Each time you access SeibertGPT, your IP address is processed for technical reasons so that the request can be answered. For operation and security, we log operational events and errors in server logs. For each request, the API gateway logs only metadata such as user account, API key, plan, model, status, tokens and duration, and no content of inputs or responses.

The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is secure and stable operation. We store server logs for as long as is necessary for operation and security.

If the booked plan provides for IP binding, we store for each API key the most recently bound IP address (for IPv6 only the /64 network) and the time of the last request from this address. The purpose is to prevent the sharing of access and the misuse of published keys. The entry is overwritten with the next binding and deleted when the binding is released or the key is revoked; we do not keep a history of previous addresses. The legal bases are Art. 6(1)(b) GDPR (performance of the contract, whose terms provide for IP binding) and Art. 6(1)(f) GDPR (legitimate interest in preventing misuse).

6. API usage and billing data

For your API keys, we store the name you assign, a short prefix for recognition and the times of creation, last use and, where applicable, revocation. We display the full key only once, when you create it; only a hash value is stored.

For every request to the API, including from the web chat, we store the time, duration, model, number of tokens, status, the key used and the booked plan, and for your plans the term, limits and quota used. We use this data for billing, limits and your usage overview. The SeibertGPT gateway and the portal do not store any content of API requests, i.e. neither prompts nor responses. The legal basis is Art. 6(1)(b) GDPR.

To limit large requests to a conversation that has been inactive for a long time or is unknown (fair use, see also the Terms and Conditions), we additionally store, per user account, a SHA-256 hash of the beginning of the respective conversation (system prompt and first user message) and the time of the last request in that conversation. The purpose is to keep SeibertGPT available for all customers; the legal basis is Art. 6(1)(f) GDPR. This entry is automatically deleted after 24 hours at the latest or, if a longer inactivity limit is configured, after twice that period, if that is longer.

If you book a plan online, we process the payment via Stripe (Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland). You enter your card details directly with Stripe; they do not reach our servers. We transmit your email address, your name and an internal customer number to Stripe and receive from Stripe your billing address, where applicable your company name and VAT ID, the payment status and the invoices. The legal basis is Art. 6(1)(b) GDPR; invoices are retained under Art. 6(1)(c) GDPR on the basis of obligations under commercial and tax law.

7. Contracts (NDA and DPA)

In your account, you can request a non-disclosure agreement (NDA) and a Data Processing Agreement (DPA) with the Seibert Group. For this, we process the information you provide in the form: company and address, name, title or position and email address of the person signing the contract, and for the DPA additionally the person authorized to give instructions and your information on the processing governed by the DPA. We prefill some fields from your user account and your Seibert customer account.

We store the request, create the contract with the Seibert Group contract application (templates.seibert.group) and send it via the signature service sign.seibert.group for electronic signature to the email address provided. If this fails, the SeibertGPT team receives an internal email with your user ID, email address and your company.

If the box “Save … in my Seibert customer account” is checked when you submit (default setting), we also store the address and company in your Seibert customer account and, if you sign yourself, your title or position and a changed name. We do not write information about another signing person to your customer account.

The legal basis is Art. 6(1)(b) GDPR (conclusion of the requested contracts and management of your customer account at your request).

8. Contact form

When signed in, you can write to us using the contact form in your account. We store your inquiry with your user account and send it with your name, if available, and your email address by email to the SeibertGPT team, which will reply to you. For technical inquiries, we attach information about your plans, your API keys and your most recent failed requests, but no chat content and no keys; the form shows you this information before you submit it.

You can also write to us without signing in via the inquiry forms on /unternehmen, /teams, /unternehmen/privacy-filter and /loesungen. We send your information (company, name, email address, selected offers or topics, number of users and message) by email to the SeibertGPT team, which will reply to you; we do not store this information in the portal. For evaluation purposes, we store one row per submission without company, name, email address and message: form, number of users, selected offers or topics, origin information (source, campaign, ad, referring domain), time, whether a confirmation email was sent and when it was confirmed. The legal basis is Art. 6(1)(b) GDPR (pre-contractual measures at your request). To measure our advertising, we count the inquiry without company, name, email address and message (section 4).

After you submit the form, we send you a confirmation email. Only once you confirm do we create a Seibert account for you on customer.seibert.group with your name and email address and inform you by email about offers from the Seibert Group; the notices linked in section 4 apply to this.

To protect against automated requests, your browser solves a small computational puzzle before submission, which SeibertGPT itself generates and verifies, without an external service and without a cookie. The legal basis is Art. 6(1)(b) GDPR.

9. Web chat and chat history

In the web chat, we store your chats (title, your messages and the model's responses) so that you can access your history again. The history remains stored until you delete a chat or all chats. We process the content on behalf of your company (section 10).

10. Content of chat and API (processing on behalf of customers)

We process the content that you or employees of your company send to SeibertGPT, i.e. inputs to the web chat and API, the model's responses and the stored chat histories, on behalf of your company. Insofar as it contains personal data, we are a processor within the meaning of Art. 28 GDPR; to that extent, your company is the controller. We conclude a Data Processing Agreement with business customers for this purpose (see Data Processing Agreement).

Inputs are transmitted to the language model in order to answer them. SeibertGPT does not use inputs or responses to train AI models.

11. Recipients and subprocessors

• Verda Cloud Oy (formerly DataCrunch Oy), Helsinki, Finland: GPU infrastructure for operating the language model. The content of the AI requests as well as connection and usage data are processed. Place of processing: Helsinki, Finland (EU). The basis is a data processing agreement pursuant to Art. 28 GDPR. According to Verda's terms, customer data is not used for training.
• SeibertGPT reaches the language model via an interface (proxy) operated by the Seibert Group in front of the model servers.
• The application itself (portal, API gateway and database) is operated on the hosting platform managed by the Seibert Group. The servers for it are provided by Hetzner Online GmbH, Gunzenhausen, Germany. The data mentioned in this policy passes through these servers, including requests on their way to the language model. Place of processing: Nuremberg and Falkenstein, Germany (EU). The basis is a data processing agreement pursuant to Art. 28 GDPR.
• Sign-in takes place via the Seibert Customer Login of Seibert Group GmbH (section 2).
• We create contracts (section 7) with the Seibert Group contract application (templates.seibert.group) and send them for signature via sign.seibert.group.
• PostHog Inc. (USA): usage analytics (section 4), EU instance, connected via ph.seibert.group. The place of processing and safeguards are listed in the service provider overview linked below.
• Stripe Payments Europe, Ltd. (Ireland): payment processing for online bookings. Stripe processes the payment data on our behalf on the basis of a data processing agreement pursuant to Art. 28 GDPR. For its own purposes, such as fraud prevention, risk management and legal obligations such as anti-money laundering checks, Stripe processes data as an independent controller; details are provided in the Stripe Privacy Policy (opens in a new tab).

According to its contractual terms, Verda stores and processes personal data primarily in the European Economic Area; transfers outside the European Economic Area take place there only by way of exception and on the basis of standard contractual clauses or an adequacy decision of the European Commission.

An overview of the Seibert Group's service providers with their function and place of processing can be found in the service provider overview (opens in a new tab).

12. Legal bases

• Art. 6(1)(b) GDPR (contract): user account and sign-in, provision of web chat and API, API keys, limits and billing, IP binding if the plan provides for it, contracts (NDA and DPA), contact form, inquiry forms on /unternehmen, /teams, /unternehmen/privacy-filter and /loesungen.
• Art. 6(1)(f) GDPR (legitimate interest): server logs for operation and security; IP binding to prevent misuse (section 5); limiting large requests (fair use, section 6); counting first sign-ins and purchases per advertising campaign and origin in the account, including your answer on how you heard about SeibertGPT, as well as counting started sign-ins and business inquiries per advertising campaign, to measure advertising success.
• Art. 6(1)(c) GDPR (legal obligation): statutory retention obligations.

For customer identity and usage analytics, the Seibert Group notices linked in section 4 apply in all other respects. We process the content of chats and API requests on behalf of our customers (section 10).

13. Storage period

• We store account data, information on API keys and plans, contract and contact requests as well as usage data for as long as your SeibertGPT account exists, and beyond that only insofar as statutory retention obligations exist.
• We store chats until you delete them.
• The session ends when you sign out, at the latest 30 days after your last use.
• We store server logs for as long as is necessary for operation and security.

14. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16 GDPR), erasure (Art. 17 GDPR), restriction of processing (Art. 18 GDPR) and data portability (Art. 20 GDPR). You can object to processing based on Art. 6(1)(f) GDPR on grounds relating to your particular situation (Art. 21 GDPR). To do so, please contact dsb@seibert.group.

If your request concerns data that we process on behalf of a customer (section 10), please contact that customer as the controller; we will support them in this.

15. Right to lodge a complaint with a supervisory authority

You can lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is the Hessian Commissioner for Data Protection and Freedom of Information (HBDI), Postfach 3163, 65021 Wiesbaden, Germany, datenschutz.hessen.de (opens in a new tab).

16. No automated decision-making

We do not make any decisions based solely on automated processing, including profiling, within the meaning of Art. 22 GDPR.

17. Changes to this Privacy Policy

We update this Privacy Policy when SeibertGPT or the legal requirements change. The version published on this page at any given time applies.