Privacy Policy

Last updated: 09 July 2026

This privacy policy is available in German and English. In case of discrepancies, the German version prevails.

1. Controller

Iceflower GmbH
Tieckstr. 35, 10115 Berlin, Germany
Managing Directors: Benedikt Ernst, Simon Kröger
Email: info@iceflower.ai
Commercial register: Amtsgericht Charlottenburg, HRB 260660 B
VAT ID: DE366054787

This policy explains how we process personal data when you visit our website, create an account, use the Iceflower application, book a call with us, or otherwise contact us.

2. What we process, why, and on which legal basis

2.1 Visiting the website. When you access our pages, our servers process connection data automatically: IP address, date and time, requested page, referrer URL, browser type and operating system. We use this data to deliver the site, ensure stability and security, and detect misuse. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in a secure, functioning website). Server logs are deleted after 30 days unless needed to investigate an incident.

2.2 Trial signup and account. When you request a trial or create an account, we process the data you provide: name, business email address, company, intended data category, and password (stored hashed). Trial accounts are reviewed by us before activation; during review we process the signup data to assess the request. After activation we process login and usage data (features used, last activity per named user) to operate the service, provide support, and understand product usage. Legal basis: Art. 6(1)(b) GDPR (steps prior to entering into a contract; performance of the contract). If a trial does not convert, account data is deleted 12 months after trial end unless you ask us to keep it or we are required to retain it.

2.3 Subscriptions and billing. For paid plans we additionally process contract, billing and payment data. Legal basis: Art. 6(1)(b) GDPR and Art. 6(1)(c) GDPR (statutory retention obligations under commercial and tax law, currently up to 10 years, § 147 AO / § 257 HGB).

2.4 Booking a call. Our “Talk to us” and scoping call links lead to Google Calendar appointment scheduling, provided by Google Ireland Ltd. If you book, Google processes the data you enter (name, email, chosen time) and shares it with us. Legal basis: Art. 6(1)(b) GDPR (pre-contractual steps at your request). Google’s privacy policy applies in addition: https://policies.google.com/privacy.

2.5 Contact by email. If you contact us, we process your message and contact details to handle the request. Legal basis: Art. 6(1)(b) or (f) GDPR depending on the nature of the inquiry. Correspondence is retained as long as needed for the matter and any statutory retention periods.

2.6 Customer relationship management. We manage business contacts and correspondence in HubSpot (HubSpot Inc., processing for us under an Art. 28 GDPR data processing agreement with EU standard contractual clauses). This may include your name, company, role, contact details and our communication history. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in managing customer and prospect relationships in a structured way). You may object at any time (see section 7).

2.7 Marketing communication. We send product updates or commercial emails only to existing business contacts in accordance with § 7 UWG or with your consent (Art. 6(1)(a) GDPR). Every such email contains an unsubscribe link.

3. Processors and recipients

We use the following categories of service providers, each bound by a data processing agreement under Art. 28 GDPR:

We disclose personal data to third parties beyond this only where legally required (e.g. to authorities upon a lawful request), to enforce or defend legal claims, or in the context of a corporate transaction (e.g. merger or acquisition), in which case data remains protected under this policy or a successor policy.

4. International transfers

Where providers process data outside the EU/EEA (in particular in the United States), we rely on an adequacy decision (EU-U.S. Data Privacy Framework, where the provider is certified) or EU standard contractual clauses with supplementary measures. Details are available on request.

5. Retention

We keep personal data only as long as needed for the purposes above: server logs 30 days; non-converted trial data 12 months after trial end; contract and billing data for the statutory retention periods; CRM contact data until you object or the business relationship plus a reasonable follow-up period ends. We review stored contacts periodically and delete those no longer needed.

6. Security

We protect data with appropriate technical and organisational measures. All connections to our services are encrypted in transit (HTTPS, TLS 1.2 minimum). Data is encrypted at rest (AES-256). Passwords are stored hashed, access is per named user with role-based permissions, our internal systems require multi-factor authentication, and access to production systems is restricted and logged. No internet service can guarantee absolute security; we review and improve our measures continuously.

In the event of a personal data breach, we will notify the competent supervisory authority within 72 hours and affected users without undue delay, as required by Art. 33 and 34 GDPR.

7. Your rights

Under the GDPR you have the right to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20), and to object to processing based on legitimate interests (Art. 21). Where processing is based on consent, you may withdraw it at any time with effect for the future. To exercise your rights, contact info@iceflower.ai.

You also have the right to lodge a complaint with a supervisory authority, in particular the Berliner Beauftragte für Datenschutz und Informationsfreiheit, Alt-Moabit 59-61, 10555 Berlin, https://www.datenschutz-berlin.de.

8. Cookies and similar technologies

8.1 Essential cookies. We use only technically necessary cookies: session cookies for login and security tokens (CSRF protection). These are required to provide the service and are used on the basis of § 25(2) TDDDG and Art. 6(1)(f) GDPR. They are deleted at the end of the session or after a short period.

8.2 Web analytics (Plausible). On our public pages we use Plausible Analytics, a privacy-friendly web analytics service provided by Plausible Insights OÜ (Västriku tn 2, 50403 Tartu, Estonia), with all data hosted in the EU. Plausible does not use cookies or any other identifiers stored on your device, so § 25 TDDDG does not apply and no consent banner is required. Your IP address and user agent are processed only transiently to derive a short-lived, irreversible hash for counting unique visits and are not stored; we only receive aggregated statistics (pages visited, referrer, country, device type). Legal basis: Art. 6(1)(f) GDPR (legitimate interest in understanding aggregate usage of our website). Details: plausible.io/data-policy.

We do not use advertising cookies and we do not sell personal data.

9. Minors

Our services are directed at businesses and are not intended for persons under 18. We do not knowingly collect data from minors.

10. Changes to this policy

We may update this policy from time to time; the current version is always published on this page with its date. For material changes affecting active users, we will provide notice within the service or by email.

11. Contact

Iceflower GmbH, Tieckstr. 35, 10115 Berlin, Germany · info@iceflower.ai