Privacy policy

This English version is provided for convenience only. The German version (Datenschutzerklärung) is the legally binding one.

This policy describes how we process personal data on our website ordyse.com and in the Ordyse portal, in accordance with the EU General Data Protection Regulation (GDPR).

1. Controller

CoreGnition UG (haftungsbeschränkt)
Leopoldstraße 31, 80802 Munich, Germany
Managing director: Maxim Mikhalchenko
Email: info@coregnition.ai

We are currently not legally required to appoint a data protection officer. For any questions about data protection, contact us at info@coregnition.ai.

2. Website

2.1 Hosting

Our website runs on our own server with Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany, in a data center in Germany. When you visit, the server processes your IP address, the date and time, and the page requested in order to deliver the page to your browser. We do not store access logs containing IP addresses. Server error logs contain no IP addresses and are deleted after 7 days.

The legal basis is Art. 6(1)(f) GDPR, based on our legitimate interest in operating the site securely. We have a data processing agreement with Hetzner under Art. 28 GDPR.

2.2 Cookies, analytics and advertising

Our website uses no analytics tools and no advertising pixels. On your device we store only what is strictly necessary for a service you have expressly requested: the sign-in cookie for the help center and the admin area, and the assistant's conversation history in session storage (see 2.8 and 2.9). If you use the language switcher, your browser also stores your language choice (German or English) in local storage. Under Section 25(2) no. 2 of the German Telecommunications Digital Services Data Protection Act (TDDDG), this is permitted without consent. That is why we do not show a cookie banner.

2.3 Fonts

We serve the IBM Plex Sans typeface from our own server. Your browser does not connect to Google or any other third party for this.

2.4 Process assessment requests

Our request form asks for your ERP system, your monthly order volume and the areas you would like to start with, along with your name, business email address, company and, optionally, your phone number. We use this information to respond to your request and prepare for the call. Through the contact form in the legal notice we receive your name, email address, your message and, optionally, your company and phone number; we use them only to answer your message. The same retention periods apply to both forms.

The legal basis is Art. 6(1)(b) GDPR (pre-contractual steps taken at your request). The request is stored on our server with Hetzner. If no contract is concluded, we delete it after 12 months at the latest. An invisible check field keeps out automated spam; no data is evaluated for this purpose.

2.5 Appointment booking

To let you pick a time, we use Microsoft Bookings, a service of Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland. In the “Time” step, our server retrieves the available times from Microsoft; your browser does not connect to Microsoft for this. When you choose a time, our server transmits your name, email address, company, phone number (if provided) and your answers from the form to Microsoft Bookings. Microsoft stores this information with the appointment in our Microsoft 365 account and sends you a confirmation with a Microsoft Teams link. If this connection fails, Microsoft's booking page opens in a new tab instead, where you enter the details yourself. We have a data processing agreement with Microsoft under Art. 28 GDPR. Microsoft's privacy statement at privacy.microsoft.com also applies to the booking page and the call.

The legal basis is Art. 6(1)(b) GDPR. If no contract is concluded, we delete appointment data no later than 24 months after the appointment. We transfer booked appointments to our internal admin system to prepare for the calls.

2.6 Contact by email

When you write to us, we process your details (name, company, contact details, content of your message) to respond. The legal basis is Art. 6(1)(b) GDPR if your inquiry relates to a contract, otherwise Art. 6(1)(f) GDPR. We delete the data once your inquiry has been dealt with and no retention obligations apply. We retain business correspondence for six years under Section 257 of the German Commercial Code (HGB).

2.7 Sending emails

We send confirmations, appointment emails and replies to inquiries via Brevo GmbH, Köpenicker Str. 126, 10179 Berlin, Germany. Brevo processes your email address and the content of the message on our behalf under a data processing agreement pursuant to Art. 28 GDPR.

2.8 Help center and Ordyse assistant

On ordyse.com and in the help center at ordyse.com/hilfe, an assistant answers questions using a language model. Without signing in, it answers only from public content on the website and in the help center. It is clearly labeled as AI. To answer, your question and the conversation so far are sent, together with relevant sections of the help center, to Mistral AI SAS, Paris, France, and processed on servers in the EU under a data processing agreement pursuant to Art. 28 GDPR. Mistral does not use this data for training.

Customers open the full help center, and the assistant's answers based on it, via a sign-in link that we send to their business email address. For this we store the email address, the link for 30 minutes and the session for 30 days in a technically necessary cookie. We do not store the conversations. Your browser keeps the history only while the tab is open. On our server we only count how many conversations took place each day, without content and without any personal reference. The IP address is held briefly in memory solely to limit misuse. Please do not enter passwords, credentials or third parties' personal data in the chat.

The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is answering questions about our product quickly and around the clock. For existing customers, the assistant also serves the performance of the contract (Art. 6(1)(b) GDPR).

2.9 Support requests

If you submit a support request through the help center, we store your name, email address, company, topic, urgency, your description and, if you tick the box, your conversation with the assistant. The request and our replies are stored on our server with Hetzner; related emails are sent via Brevo (see 2.7). We use this information only to handle your request. The legal basis is Art. 6(1)(b) GDPR, or Art. 6(1)(f) GDPR for prospective customers. We delete resolved requests after 24 months unless they are linked to a customer contract or retention obligations apply. Apart from the sign-in cookie, we store nothing on your device. The conversation history is kept only in your browser's session storage and is deleted when you close the tab. If you ask a question before signing in, your browser keeps it until you sign in, for a maximum of one hour, so that we can answer it afterward.

3. Ordyse portal

3.1 Your process data: we process on your behalf

In the portal we process the data your company connects from its ERP, inbox and other systems: sales orders, invoices, deliveries, business emails and the contact persons named in them. Your company is the controller for this data. We act as a processor on the basis of the data processing agreement (DPA) under Art. 28 GDPR that we conclude with every customer. You can obtain information about this processing from your employer or business partner.

Built in by design:

• Employees appear only under a pseudonym. Analyses are available by order and team, never by individual person.
• Personal names in emails are masked. Email bodies are deleted after 90 days.
• Every action with external effect requires approval by a person.

3.2 Sign-in and account

You sign in at app.ordyse.com with your business email address. Based on your company's settings, we check which account the address belongs to and send you a link and a code via Brevo (see 2.7). Both are valid once and for 15 minutes; we store only hashes of them. If your company uses its own identity provider, such as Microsoft Entra ID, we redirect you there and receive your name, a technical identifier and your roles. In analyses, approvals and logs we store a pseudonym instead of your name. If your company provisions user accounts automatically from its identity provider (SCIM), the data transmitted, such as user name, display name and groups, is kept in user management, which only administrators can see. The legal basis is Art. 6(1)(b) GDPR in conjunction with your company's contract, and Art. 6(1)(f) GDPR.

3.3 Strictly necessary cookies

The portal sets two cookies that are strictly necessary for signing in:

Under Section 25(2) no. 2 TDDDG, these cookies are permitted without consent. The portal also stores your language choice in your browser and in a cookie, so that pages and downloads appear in your language.

3.4 Logs

We log approvals, imports and exports with a pseudonym and timestamp, so it remains traceable who approved what. The legal basis is Art. 6(1)(f) GDPR. The logs are kept for the term of the contract and deleted together with the customer account.

3.5 Language model

To answer questions in natural language, read business emails and suggest wording, Ordyse uses the language model of Mistral AI SAS, Paris, France, with processing in the European Union. Only the content needed for the specific task is transmitted; personal names in emails are masked. Mistral does not use this data to train models. At your company's request, Ordyse can work rule-based without a language model or with a model hosted in your own network. Mistral is listed as a subprocessor in the DPA.

3.6 Portal hosting

The portal runs on our own server with Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany, in a data center in Germany, with a separate database for each customer. Portal emails, such as notifications, are sent via Brevo (see 2.7). If you prefer, you can run Ordyse in your own environment.

4. Recipients and third countries

We share personal data only with the service providers named above, who work on our behalf. Data is transferred to countries outside the EU only if your company chooses such a provider, and then on the basis of an adequacy decision or the EU Standard Contractual Clauses. For appointment booking via Microsoft Bookings (section 2.5), Microsoft may also process data in the United States. This is based on the European Commission's adequacy decision for the EU-U.S. Data Privacy Framework, under which Microsoft is certified.

5. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21). To exercise these rights, email us at info@coregnition.ai. If your request concerns your company's process data, we will forward it to your company.

You have the right to lodge a complaint with a data protection supervisory authority. The authority responsible for us is the Bavarian State Office for Data Protection Supervision (Bayerisches Landesamt für Datenschutzaufsicht, BayLDA), Promenade 18, 91522 Ansbach, Germany.

6. Automated decision-making

Ordyse suggests steps. Decisions with external effect are always made by a person. No automated decision-making within the meaning of Art. 22 GDPR takes place.

7. Changes

We update this policy when our services or the legal situation change. The version published here applies.

Last updated: October 2026