naylo
de

Privacy policy

Last updated: November 2026

1. Controller

The controller responsible for data processing on this website is:

Dreiländereck Events GmbH
Lingertstraße 3
79541 Hauingen, Germany
Managing director: Patric Götz

Email: hallo@naylo.ai
Data protection: datenschutz@naylo.ai

Further provider details are in the imprint.

2. General information on data processing

We only process personal data where this is necessary and you have consented or another legal basis applies. Our database and our email sending are located in the EU (Ireland). Where service providers are based in the USA, this is stated in section 10.

Data is transmitted over encrypted connections (TLS/HTTPS) and stored only as long as the respective purpose requires. No automated decision-making, including profiling, takes place.

3. Hosting and log files (Vercel)

This website is hosted by Vercel Inc. When you visit it, the host processes technical log data: IP address, browser, requested URL and timestamp. This may involve a transfer to the USA (see section 10).

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in stable and secure operation). Retention: We do not store this log data ourselves. How long the host keeps it depends on its settings.

4. Contact form and AI check

If you write to us through the contact form, or enter your email address in the AI check to receive the detailed evaluation, we store:

  • name, email address, optionally company and phone number
  • your message, and for the AI check your answers (for example industry, time-wasters, tools, biggest problem)
  • the page you came from and any campaign parameters (UTM)
  • browser identifier (user agent) and referrer
  • the time of your consent

We use your IP address briefly to prevent abuse (limiting requests per address). Only a hash combined with a secret value is stored, not the IP address itself. For every new enquiry our mail provider sends us an internal notification.

Legal basis: your consent (Art. 6(1)(a) GDPR), given by ticking the box in the form, and, where you are interested in our services, Art. 6(1)(b) GDPR (pre-contractual measures). Retention: 24 months from receipt, after which our database deletes the entry automatically. You can withdraw your consent at any time and ask for earlier deletion: datenschutz@naylo.ai.

5. Setup wizard (/setup)

If you use our setup wizard, we process the data you enter voluntarily in order to create a personal Claude setup package:

  • Name, role, city, email address
  • Company name, website, size, main offering, industry
  • Tools used, data storage, editor, operating system
  • Pain points, 3-month goal, selected workflows
  • Optional: uploaded files (logo, brand guide, writing-style sample)
  • Technical metadata: user agent, referrer
  • Consent (time, marketing consent)

Uploaded files are not stored on our servers. They go straight into the ZIP you download. Only a metadata entry (name, size, type) remains as proof of processing. We send you the package and a confirmation by email and receive an internal notification ourselves (sent via Resend).

Legal basis: Art. 6(1)(b) GDPR (pre-contractual measure, creating the package at your request) and, where you have given the marketing consent, Art. 6(1)(a) GDPR. Retention: 24 months from creation, after which our database deletes the entry automatically. You can withdraw your consent at any time and ask for earlier deletion: datenschutz@naylo.ai.

6. Appointment booking (Naylo Dates)

For discovery calls we use our own booking system “Naylo Dates” (dates.naylo.ai). It is embedded in our contact page as a frame. As soon as the frame loads, the booking page receives your IP address and technical connection data. It is delivered via Netlify Inc. (see section 10).

When you book, we process your name, email address, optionally your message and the chosen time slot, and store them in our database (Supabase, Ireland region). We send the confirmation by email via Resend (Ireland region). To prevent abuse we briefly store the IP address; it is deleted after 7 days. The booking page sets no third-party tracking cookies.

Legal basis: Art. 6(1)(b) GDPR (initiating a contract) and, for the briefly stored IP address, Art. 6(1)(f) GDPR (protection against abuse). Retention: We delete the booking once it is no longer needed for its purpose and no statutory retention duty applies.

7. Email communication

If you email us directly, we process your address and the content of your message in order to reply. Our mailbox is hosted by Migadu (Switzerland). The European Commission has found an adequate level of data protection for Switzerland.

Legal basis: Art. 6(1)(b) GDPR where our services are concerned, otherwise Art. 6(1)(f) GDPR (legitimate interest in answering enquiries). Retention: until the enquiry is resolved, and afterwards only where retention duties apply (for example for business letters).

8. Web analytics (PostHog and Matomo) and consent storage

This website uses PostHog for reach and usage analysis. Processing takes place in the EU cloud in Frankfurt am Main. We only use PostHog after you have consented in the cookie banner. Without your consent no script is loaded, no cookies are set and no data is collected.

Among other things we process pages viewed, clicks, time on page, origin (referrer/campaign), approximate region, device type and browser. The EU cloud does not store the IP address by default. We also record anonymised session replays to spot usability problems. Form inputs are masked and not recorded. A “Do Not Track” signal from your browser is respected.

The legal basis is your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG). You can withdraw it at any time with effect for the future by choosing “Essential only” in the cookie banner or by deleting this website’s data in your browser. A data processing agreement under Art. 28 GDPR is in place with the provider.

We also use the open-source software Matomo to count page views. Matomo runs on our own server in Germany (data centre of Hetzner Online GmbH, Falkenstein), and the data does not go to third parties. Matomo is configured so that no cookies are set and no information is stored on or read from your device. The IP address is truncated immediately. We process pages viewed, time on page, referrer, time, approximate origin (country) as well as browser and operating system. A returning visit is only recognised through a daily-changing, irreversible key.

The legal basis is our legitimate interest in anonymous reach measurement (Art. 6(1)(f) GDPR). Raw data is deleted after 180 days at the latest. You can object by enabling “Do Not Track” in your browser or by writing to us.

Your cookie choice is stored in your browser’s local storage (entry “naylo_consent”). This is technically necessary so that we respect your choice on your next visit (§ 25(2) no. 2 TDDDG). The entry does not leave your device.

9. Fonts

We serve this website’s fonts ourselves. Your request does not go to Google or other font providers for this.

10. Processors and transfers to third countries

Where service providers process data on our behalf, agreements under Art. 28 GDPR are in place:

  • Vercel Inc. (USA): hosting of this website
  • Supabase Inc. (database in the Ireland region): storage of enquiries, setup data and bookings
  • Netlify, Inc. (USA): delivery of the “Naylo Dates” booking page (dates.naylo.ai)
  • Resend, Inc. (sending from the Ireland region): confirmation and notification emails
  • PostHog Inc. (processing in the EU cloud, Frankfurt): web analytics, only with your consent
  • Hetzner Online GmbH (Germany): server on which our Matomo runs
  • Migadu (Switzerland): email mailbox

Where data reaches providers based in the USA or is accessible from there, we base the transfer on an adequacy decision of the European Commission (EU-US Data Privacy Framework) or on EU standard contractual clauses (Art. 44 et seq. GDPR). We will give you details on request.

11. Your rights

You have the right at any time to:

  • Access (Art. 15 GDPR): which data we hold about you
  • Rectification (Art. 16 GDPR): correct inaccurate data
  • Erasure (Art. 17 GDPR): the “right to be forgotten”
  • Restriction of processing (Art. 18 GDPR)
  • Data portability (Art. 20 GDPR): your data as a machine-readable file
  • Objection (Art. 21 GDPR): to processing based on legitimate interests
  • Withdrawal of consent (Art. 7(3) GDPR): at any time, without giving reasons

A simple email to datenschutz@naylo.ai is enough. We reply within 30 days.

12. Right to lodge a complaint

You have the right to lodge a complaint with a data protection supervisory authority. The competent authority is:

Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg
Lautenschlagerstraße 20, 70173 Stuttgart, Germany
baden-wuerttemberg.datenschutz.de

13. Changes to this policy

We update this privacy policy when legal requirements or our processing activities change. The current version is always available on this page.