Privacy notice

1. Controller

2. Page requests and hosting

The website is provided on our server at STRATO in Germany. The hosting provider is STRATO GmbH, Otto-Ostrowski-Straße 7, 10249 Berlin. When you request a page, technical information including your IP address, the time, requested address and browser information is transmitted. This is necessary to deliver the page and protect operation against faults and abuse. These are our legitimate interests; the legal basis is Article 6(1)(f) GDPR.

The public website’s separate access log contains only the time, request method, response status, response size and processing duration. It does not store IP addresses, requested addresses, browser information, cookies or message content. Error logs may, however, include the request and IP address. Both logs are cleaned daily: at most six archives are kept alongside the current file; archives older than seven days are removed at the next run. Under normal operation this corresponds to approximately one week. A server outage can delay cleanup. These logs are not part of content backups.

3. AI support chat

What data we use and why

The AI support chat starts only when you send a message yourself. Opening it or typing alone does not start a conversation. Before that, no chat messages are transmitted and no chat visitor identifier is created. A customer account is not required. We store your messages, answers and timestamps under a random identifier on our server in Germany. We use them to answer questions about Thosia; authorised AE24 GbR team members can follow up and handle open support requests. This public chat does not offer order lookups or file uploads.

AI service provider IONOS

To produce an AI answer, our server sends your message, relevant previous messages, suitable Thosia knowledge and assistant instructions to IONOS AI Model Hub. The chatbox does not connect your browser directly to IONOS. The call is made by the Thosia server; your browser IP is not sent to the AI as a separate field. Personal information you write in a message may nevertheless form part of the transmitted content. Please do not send passwords, API keys, health data or other particularly sensitive information.

According to the IONOS data handling documentation , AI Model Hub processes inputs and answers in Germany, does not keep its own conversation history and does not retain this content persistently or for model training. Technical metadata such as call time, model and token count is recorded for operation and billing; IONOS does not specify a fixed general retention period in days. Our own storage is described below.

Retention and deletion

Chat messages and conversation histories are removed after 30 days without a new message, at the next successful hourly deletion run, including associated conversation audit records and visitor identifiers no longer needed. In-progress AI calls, technical faults or a cleanup backlog may delay deletion.

Separately created support tasks remain available for processing; completed tasks are deleted from 90 days after completion at the next successful maintenance run. This does not extend chat retention. Usage details for cost control and error checking, such as model and token count without message text, are cleaned from 90 days after recording. Direct references to deleted AI conversation turns are removed. Daily allowance counters remain separate; deleting a chat does not reset consumed allowances.

As evidence of the support request, we store the identifier, timestamp and displayed privacy notice, not your IP address or browser characteristics. After explicitly requested and completed chat deletion, this evidence remains without message content for a further 30 days until the next maintenance run. Otherwise it is removed with the visitor identifier when that is no longer needed. Clearly attributable AI audit records already separated from the chat are cleaned from 30 days after the event.

Encrypted backups may contain older content. Daily backups retain seven successfully completed generations, not a blanket seven calendar days. Additional backups on the server and our local backup computer are outside this rotation; replacing them requires a verified replacement. They are not used for ongoing support handling. After a restore, expired data and outstanding deletion requests must be addressed before renewed use.

“End chat” closes this session and stops further chat transmissions. Our team can see in the conversation that you ended it. The stored history remains subject to the retention period above. If the end of the chat is unconfirmed because of a connection problem, input remains blocked here. Content already sent to IONOS cannot be recalled retrospectively. Explicitly requested deletion is retried later if calls are still running or storage errors occur. For earlier deletion or access requests, contact us at info@thosia.com.

Legal basis and your choice

The basis is Article 6(1)(f) GDPR. Our legitimate interest is to answer questions about Thosia clearly and promptly and to follow up on open support cases. The chat is optional; you can use the FAQ or contact the team instead. Sending is not recorded as consent. You may object to processing on grounds relating to your particular situation at info@thosia.com. AI answers can be wrong; the chatbox makes no legally binding decisions about you.

4. Cookies, fonts and analytics

The chat does not set cookies or store a persistent identifier in browser storage. The identifier stays only in the memory of the open page; reloading starts a new session. This does not delete content already stored on our server. The public website uses no analytics or advertising trackers and no externally loaded fonts. Page files and the logo come from our own web server.

The Light, Dark or System appearance is stored on this device for up to one year in a functional cookie for thosia.com and its portal addresses. You can change the choice at any time or delete the cookie in your browser. Appearance changes neither conversation content nor your own chatbox settings.

5. Contact form and email

The email link opens your own email application. Only when you send a message does AE24 GbR receive your sender address, its content and the information you provide. For contractual and pre-contractual requests, the basis is Article 6(1)(b) GDPR; otherwise Article 6(1)(f) GDPR applies, with the interest of answering requests. Providing information is voluntary, but we cannot reply without a reachable contact address. Please do not send passwords or API keys.

The contact form asks for your name, email address and message. These details are sent to info@thosia.com; no copy is created as a contact record in the Thosia database. Email content stays in the mailbox.

Spam protection uses short-lived identifiers derived from the IP address and email address. The IP-related identifier expires after ten minutes and the email-related one after 30 minutes; a shared sending counter expires after one hour. Name and message are not stored there. The purpose is to limit abusive requests and email sending; the basis is Article 6(1)(f) GDPR.

We use STRATO for sending over an encrypted connection. STRATO processes messages as our email service provider.

Ordinary contact requests are manually reviewed after handling is complete and deleted from the mailbox within 90 days. Thosia does not automatically delete mailbox contents. Business documents subject to statutory retention duties are retained in accordance with those duties. Where information is needed to protect or enforce legal claims, it is retained only for that purpose and for the necessary period.

6. Links to the portal and other websites

The customer portal opens only when you select its link. Different data flows apply there, particularly for sign-in, account management and uploads. Those are not covered by this public website notice. External information links are also not embedded in advance or loaded automatically.

7. Your rights

Subject to the legal conditions, you may request access, correction, deletion, restriction and data portability. You may object to processing based on legitimate interests on grounds relating to your particular situation. Any consent may be withdrawn for the future. Contact us about these matters at info@thosia.com.

You may complain to a data protection supervisory authority, for example the Baden-Württemberg Commissioner for Data Protection and Freedom of Information. The public website does not carry out automated decision-making with legal or similarly significant effects or profiling.