Privacy Policy

Ai11 Consulting GmbH / ONE / ai11one.com

Version: 9 November 2026

This English version is provided for convenience. Only the German version is legally binding; in case of doubt, the German version applies.

1. Controller

The controller for the processing described in this policy is:

Ai11 Consulting GmbH
Wastiangasse 12/1/Top 2, 8010 Graz, Austria
FN 553353 f, Regional Court for Civil Matters Graz
VAT ID: ATU76798609
Email: office@ai11.io
Phone: +43 660 6660 241

2. Data protection officer

We are not legally required to appoint a data protection officer under Art. 37 GDPR. For all questions about data protection, you can reach us at office@ai11.io.

3. Two roles, and what this policy does not cover

This policy describes how we process personal data as a controller:

• data of visitors to ai11one.com,
• data of people who contact us,
• account, administrative, and billing data of our business customers and of the users in their workspaces.

Where this policy describes the processing of customer content in ONE, it explains our activity as a processor. It does not replace the data protection information that the respective customer provides as controller. When a customer manages its own contacts, projects, time records, absences, invoices, or applicants in ONE, that customer is the controller. In that respect we act solely as a processor on its instructions. The basis for this is our data processing agreement (DPA).

If you are an employee, contact, applicant, or customer of a company that uses ONE and want to know what happens to your data or exercise your rights, please contact that company directly. It decides about this data, not we. We forward requests addressed to us to that company without delay and inform you accordingly.

4. Who ONE is for

ONE is offered exclusively to businesses (B2B). It is not offered to consumers.

Part A: Website ai11one.com

5. Visiting the website

On every visit, the web server automatically processes data transmitted by your browser:

• IP address
• date and time of access
• page or file accessed
• amount of data transferred and status code
• referrer URL
• browser type, browser version, and operating system

Purpose: delivery and stability of the website, security, error diagnosis, defence against abusive access.

Legal basis: Art. 6 (1) (f) GDPR, our legitimate interest in a secure and functioning service.

Retention: the access logs are checked daily and rotated when there are new entries. We keep the current file and up to 14 archived files. Older files are replaced at the next rotation. Without new entries, files can remain for longer. Logs for a specific security incident are kept until the investigation is complete.

6. Hosting

The website and the ONE application are operated at

Hetzner Online GmbH
Industriestr. 25, 91710 Gunzenhausen, Germany

This covers application servers, database, file storage, backups, and logs. A data processing agreement under Art. 28 GDPR is in place with Hetzner. The application, database, file, backup, and log data hosted at Hetzner are stored in data centres within the European Union.

7. Cookies and similar technologies

7.1 Public website

On ai11one.com we use technically necessary cookies and storage entries as well as optional audience measurement. For audience measurement we access information from your browser even without analytics cookies.

• Technically necessary: this includes storing your data protection choice. The legal basis is Art. 6 (1) (f) GDPR. The exception under § 165 (3) TKG 2021 applies to the necessary access to storage.
• Optional audience measurement: we activate it only after your consent. You can agree or decline in the privacy banner. The website remains usable without consent.
• Withdrawal: you can change your choice at any time via the cookie settings in the footer. Withdrawal stops further audience measurement and takes effect for the future.

Details on cookies and storage entries can be found in our cookie policy. Audience measurement is described in section 8.

7.2 In the ONE application

Within the logged-in area we use only technically necessary cookies: the session cookie and cookies for language, regional format, and dashboard period. Other interface settings are kept in the browser’s local storage.

We do not use analytics cookies within the application to track usage behaviour. We process security and error logs as described in sections 12 and 13.

8. Audience measurement

After your consent we load a script for audience measurement from one.ai11.io. It sets no analytics cookie. The script reads the page address, the referring page, campaign parameters, the screen class, and the browser language. This information is transmitted to our analytics service. Through the connection the server also receives the IP address and the browser identifier.

The analytics service creates a daily hash from the IP address, the browser identifier, and a random value that changes every day. It stores this hash, the page path, the domain of the referring page, and campaign parameters. Where applicable, country, device class, browser, and operating system are added. The analytics service does not store raw IP addresses or browser identifiers. The random values are deleted regularly; the current day and the two previous days are kept. This limits attribution to a short period. Section 5 applies to technical access logs.

Purpose: determining which pages are used.

Legal basis: your consent under Art. 6 (1) (a) GDPR and § 165 (3) TKG 2021. You can withdraw it at any time via the cookie settings. The lawfulness of the processing up to withdrawal remains unaffected.

Retention: raw events 90 days. We keep aggregated daily values without hash and without IP address for as long as we operate this website statistic.

9. Contacting us

If you contact us via a form, by email, or through a demo request, we process the data you provide and the content of your message.

Data: first and last name, email address, and your message. If you also select the newsletter sign-up in the form, section 10 applies.

Purpose: handling and answering your enquiry.

Legal basis: Art. 6 (1) (b) GDPR insofar as the enquiry concerns a possible contract; otherwise Art. 6 (1) (f) GDPR, our legitimate interest in answering enquiries addressed to us.

Retention: we delete the correspondence as soon as it is no longer needed for handling, at the latest three years after the end of the calendar year of the last message. Statutory retention obligations remain unaffected.

10. Newsletter and product information

10.1 Newsletter

You can subscribe to our newsletter via the form in the website footer or via the contact form. We use the double opt-in procedure: after signing up you receive an email with a confirmation link. Only after you confirm do we send you the newsletter.

Data: email address, and if you sign up via the contact form also first and last name, as well as the time of sign-up and confirmation.

Purpose: sending information about ONE, for example about new functions, events, and offers.

Legal basis: Art. 6 (1) (a) GDPR and § 174 (3) TKG 2021 (consent).

Withdrawal: at any time with effect for the future, via the unsubscribe link in every newsletter or by message to office@ai11.io.

Retention: until you withdraw. We then keep proof of your consent for up to three years in order to be able to demonstrate that the mailings were lawful. We also keep your email address on a suppression list so that you receive no further mailings.

Our newsletters contain no individual open-tracking pixels. We do not collect personal open statistics for these newsletters. Unsubscribe links remain assigned to your subscription so that we can implement your withdrawal.

10.2 Product information for existing customers

We send information about our own similar products or services without a separate newsletter consent only if we received your email address in connection with a sale or service to you as a customer, you have not objected to such use, and no relevant entry in the ECG list stands in the way. When collecting your email address and in every message, we offer you a clear, free, and simple way to object. You can also object at any time via the unsubscribe link in every such email or by message to office@ai11.io. The legal basis is § 174 (4) TKG 2021 in conjunction with Art. 6 (1) (f) GDPR; our legitimate interest is informing existing customers about our own similar offers.

10.3 Sending service

For sending newsletters and product information we use Microsoft 365 via the Microsoft Graph interface. The provider is Microsoft Ireland Operations Limited, Dublin, Ireland. Sender and recipient addresses, message content, any attachments, and technical delivery data are processed. Microsoft processes this data to provide the sending service on our behalf.

In the process, data may be processed outside the European Economic Area, in particular in the USA. These transfers are covered by the EU standard contractual clauses under Art. 46 (2) (c) GDPR provided for in the Microsoft data protection addendum. They oblige the recipients involved to protect the data adequately. Storage in European Microsoft data centres does not fully rule out such transfers either.

You can find the safeguards here: Microsoft data protection addendum. You can request a copy of the relevant safeguards at office@ai11.io.

Part B: The ONE application

The following sections describe data processing in the operation of ONE. Where we process personal data for our own purposes, we are the controller. Where we process customer content on the customer’s instructions, we act as a processor; the data processing agreement (DPA) applies to this.

11. Account and workspace

• User account: name, business email address, password (stored solely as a cryptographic hash), role in the workspace, language setting, time of last login.
• Workspace: company name, booked plan, number of user seats, administrator, creation date.

Origin of the data: if your company invites you to ONE or creates an account for you, we receive the necessary contact details and role information from its administrator. Information you enter yourself when setting up your account or in your account settings we receive directly from you.

Purpose: setting up and managing accounts and workspaces, authentication, access control, support.

Legal basis: for processing for our own purposes, Art. 6 (1) (b) GDPR applies insofar as you are yourself a contracting party and the processing is necessary to perform this contract. For users who are not themselves contracting parties, we base this processing on Art. 6 (1) (f) GDPR. The legitimate interests are our interest in operating a secure multi-user service and the customer’s interest in providing this service to its employees.

Retention: see section 17.

12. Login and security logs

We log security-relevant events: logins and logouts, failed login attempts, changes to roles and permissions, and administrative actions. We store the time, the user account concerned, and the type of event. For a successful or failed login we also store the IP address. For a session we store the browser identifier and a hash of the IP address.

Purpose: account security, abuse detection, investigation of incidents, fulfilment of our obligations under Art. 32 GDPR.

Legal basis: Art. 6 (1) (f) GDPR in conjunction with Art. 32 GDPR.

Retention: change and audit logs are scheduled for automatic deletion after 1,095 days, AI audit logs after 365 days. No fixed automatic deletion period is currently confirmed for session data. Statutory obligations and the investigation of specific security incidents may require longer retention.

13. Monitoring and error tracking

To detect and fix faults quickly, we record technical error messages from the application. In individual cases these may contain personal data, such as the identifier of the user account concerned, the IP address, or the page accessed.

Technical error tracking takes place in the server and application logs we operate. Sentry is currently not activated. No error data is therefore transmitted to this service.

Legal basis: Art. 6 (1) (f) GDPR, our legitimate interest in stable and secure operation.

Retention: section 5 applies to technical access logs. Application logs are stored in limited, rotating files. When a file reaches its size limit, a new file begins. Once the intended number of files is reached, the oldest file is removed. The retention period therefore depends on the volume of logs; these files are not deleted after a fixed 14 or 30 days.

14. Invoicing and contract management

We use no online payment provider. We issue invoices that are paid by bank transfer. Credit card details are neither collected nor stored.

Data: company name, billing address, VAT ID, billing contact, booked plan, number of users, invoice history, payment status.

Purpose: invoicing, accounting, contract management, collection of outstanding claims.

Legal basis: Art. 6 (1) (b) GDPR for performance of the contract; Art. 6 (1) (c) GDPR for statutory retention.

Retention: we keep invoices and accounting records for seven years in accordance with § 132 BAO and § 212 UGB, counted from the end of the calendar year in which the record was created.

This concerns our invoices to our customers. Invoices that a customer creates in ONE’s finance module are that customer’s data and are subject to the DPA.

15. Support

Our support is provided by email. If you contact us, we process your contact details, the content of your request, and the technical information needed to handle it.

For handling your request for our own purposes of customer communication, Art. 6 (1) (b) GDPR applies insofar as you are yourself a contracting party and the processing is necessary to perform the contract. For a customer’s contact persons who are not themselves contracting parties, Art. 6 (1) (f) GDPR applies; our legitimate interest is the proper handling of customer requests. The retention of support data processed for our own purposes follows section 9. Where we process customer content on the customer’s instructions in this context, the data processing agreement (DPA) applies.

Access to your workspace. We access the content of your workspace only if you expressly request or approve this to resolve a problem, or if it is strictly necessary to avert an acute threat to the security or integrity of the service. Access is limited to what is necessary and is logged.

16. AI functions

ONE contains no AI model of its own. The AI functions use the AI service set up for the respective workspace. Depending on the agreement, this is connected by the customer itself or provided by Ai11.

When a server-based AI function is used, ONE processes the inputs and context data used for this function on the ONE servers in use and transmits them to the configured AI service. For functions with a conversation history, ONE stores inputs and responses in order to provide this history.

If you connect an AI service under your own contract, the terms agreed with the provider apply to the processing by this service. Ai11’s responsibility for processing within ONE remains unaffected. Where Ai11 processes personal data on behalf of your company, the data processing agreement applies.

For this contract offer, the document extraction provided by Ai11 is deactivated and is not part of the agreed service.

If an administrator activates voice input, the browser processes the audio data and may transmit it to its manufacturer’s speech service; ONE does not receive it.

If Ai11 provides a workspace’s AI service, we name the provider, the country, and the transfer basis in the data processing agreement before this service is used.

17. Retention and deletion

• Account and profile data: for the duration of the contract
• Workspace content: for the duration of the contract, then as described below
• AI conversation histories, including stored inputs and responses: for the duration of the customer contract. After the end of the contract, the deletion periods for customer data stated below apply.
• Technical access logs: current file and up to 14 archived files; details on rotation in section 5
• Security and audit logs and session data: for deletion rules and exceptions see section 12
• Technical error and application logs: limited file rotation by data volume, as described in section 13
• Contact and support requests: up to three years after the end of the calendar year of the last message
• Invoices and accounting: 7 years (§ 132 BAO, § 212 UGB)
• Newsletter: until withdrawal; proof of consent for up to three years thereafter

We make daily local backups of databases and documents. The daily clean-up run deletes local backup files once they are at least 15 days old. The DPA applies to the deletion of customer data and backups after the end of the contract.

After the end of the contract you can, as a rule, export your data for at least 30 calendar days in a structured, commonly used, and machine-readable format. Necessary or agreed extensions remain possible. With the regular period, we delete data from active systems at the latest 60 days after the end of the contract and from backups 90 days after the end of the contract. With an extended period, deletion takes place from active systems at the latest 30 days after its end and from backups 60 days after it. Statutory retention obligations remain unaffected. The DPA applies.

18. Recipients and processors

• Hetzner Online GmbH, Germany: hosting, database, storage, backups
• Microsoft Ireland Operations Limited, Ireland: sending transactional and notification emails as well as newsletters and product information.
• Tax, audit, and legal advisers, Austria: fulfilment of statutory and contractual obligations

Contracts under Art. 28 GDPR are in place with processors. Further details on Google Forms can be found in section 24. We do not sell personal data and do not pass it on for third parties’ advertising.

19. Transfers to third countries

The application, database, file, backup, and log data hosted at Hetzner are stored in data centres within the European Union.

When emails are sent via Microsoft 365, personal data may also be processed outside the EEA, in particular in the USA. Information on the safeguards and how to obtain them can be found in section 10.3.

When AI functions are used, inputs and context data may be transmitted to the AI service configured for the respective workspace. Depending on the provider and configuration, this may involve a transfer to a country outside the European Economic Area.

For an AI service provided by Ai11, the provider, country, and basis are stated in the data processing agreement before this service is used. For a service connected by the customer, the customer’s contract with the provider applies. Further information can be found in section 16.

20. Your rights

You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection to processing based on legitimate interests (Art. 21 GDPR). You can withdraw a consent you have given at any time (Art. 7 (3) GDPR); the lawfulness of processing carried out until then remains unaffected.

To do so, contact office@ai11.io or the address given in section 1.

If your data concerns a customer’s workspace, we forward your request to that customer without delay and inform you accordingly; the decision lies with that customer.

Right to lodge a complaint. You can complain to a supervisory authority, in Austria the

Austrian Data Protection Authority (Österreichische Datenschutzbehörde)
Barichgasse 40-42, 1030 Vienna
dsb@dsb.gv.at, www.dsb.gv.at

21. Necessity of providing data

Account data is required to use ONE; without it we cannot provide the service. Billing data is required contractually and under tax law. Optional information is marked as such when collected.

22. Automated decision-making

No automated individual decision-making with legal or similarly significant effect under Art. 22 GDPR takes place.

23. Changes to this policy

We adapt this policy when ONE or the legal situation changes. The current version and its date are shown above. We inform customers of material changes affecting them in accordance with the terms.

24. Survey via Google Forms

On the page “How we could help” you can voluntarily take part in a survey. When you submit, your answers, for example on tools used, team size, and free text, are transmitted to Google Forms and stored there for us. For technical reasons, Google receives connection data from your browser, in particular your IP address. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

Purpose and legal basis: we evaluate the answers in order to develop ONE in line with actual needs. The basis is our legitimate interest under Art. 6 (1) (f) GDPR. Participation is voluntary. We delete the answers once they are no longer needed for evaluation, at the latest three years after the end of the calendar year of participation.

Transfer to third countries: a transfer to Google LLC in the USA is possible. Google LLC is certified under the EU-US Data Privacy Framework. The European Commission’s adequacy decision under Art. 45 GDPR applies to transfers to certified recipients. Further information is available at office@ai11.io.

25. The animation at the foot of the page

The animated area at the foot of the homepage is drawn with the script libraries three.js, React, and ShaderGradient. Like the fonts and all other parts of the website, we deliver these libraries from our own server (section 6). No content delivery network or other third party is contacted for them; what section 5 says about access logs applies to these requests. The libraries set no cookies or storage entries. On devices with a small screen, little memory, or data-saving mode switched on, they are not loaded; the area is then shown without animation.