Privacy Policy

Last updated: 17 July 2026

1. Data Controller

Ali Najafzadeh
Einzelunternehmen ("Novixx")
Bockkellerstraße 6/1
1190 Vienna, Austria
Email: [email protected]
Phone: +43 681 81885458

We process personal data in accordance with the EU General Data Protection Regulation (GDPR/DSGVO) and the Austrian Data Protection Act (DSG). We collect only the minimum data necessary for the stated purpose.

3. Data We Collect

Contact Form: Name, email address, company name, industry, and your message. This data is collected when you voluntarily submit the contact form.

2-Minute AI Check: Your answers to five multiple-choice questions about your organisation — team size, where your team loses the most time, how connected your systems are, how accessible your data is, and who would own an AI project internally — together with the name and email address you enter if you choose to send the result to us. The answers are shown to you on screen first; nothing is transmitted unless you submit the form. Retained for 12 months, as for the contact form.

Server Logs: IP address, browser type, access time, and pages visited. This is collected automatically for security and performance monitoring.

Cookies: Essential cookies required for the website to function are always active. Analytics cookies (Google Analytics) are set only if you consent via the cookie banner; if you decline or ignore it, none are set. No advertising cookies are used.

Google Analytics (only with your consent): If you accept analytics in the cookie banner, Google Analytics 4 collects a randomly generated identifier, your truncated IP address, the pages you view, approximate location (country/region), device and browser type, and interaction events. It is used only in aggregate to understand how the site is used. It does not load and sets no cookie unless you consent, and you can withdraw at any time via “Cookie settings” in the footer. See section 8a.

4. Purpose of Data Processing

We process your data for the following purposes:

Responding to your inquiries (Art. 6(1)(b) GDPR)
Providing our services (Art. 6(1)(b) GDPR)
Website security and performance (Art. 6(1)(f) GDPR)
Website analytics — only with your consent (Art. 6(1)(a) GDPR)
Legal compliance (Art. 6(1)(c) GDPR)

5. Data Retention

Contact form data is retained for 12 months after your last interaction. Server logs are retained for 30 days. You may request deletion at any time.

6. Your Rights

Under GDPR, you have the right to:

Access — Request a copy of your personal data
Rectification — Request correction of inaccurate data
Erasure — Request deletion of your personal data
Restriction — Request limitation of processing
Portability — Receive your data in a structured format
Objection — Object to processing based on legitimate interest

To exercise your rights, contact us at [email protected].

7. Third-Party Services

Hosting: Our website is hosted in the EU. By default, browsing this website transfers no data outside the EEA. Three exceptions require your action first: (1) if you accept analytics cookies, Google Analytics (Google LLC, United States) — see section 8a; (2) the optional voice demo described below; and (3) the external booking link (Calendly LLC, United States) offered after the 2-Minute AI Check — following that link opens Calendly's own site, where your IP address and any details you enter are processed under Calendly's privacy policy. No data reaches any of these services unless you consent or click.

Fonts: All website fonts are self-hosted on our own server. No font data is requested from Google or any other third party, and no visitor data is transferred to an external font provider.

8a. Google Analytics (optional, consent-based, US transfer)

We use Google Analytics 4, a service of Google LLC (United States), to understand how visitors use this website so we can improve it. It is not loaded until you actively accept analytics in the cookie banner. If you decline, ignore the banner, or have JavaScript disabled, Google Analytics is never loaded and sets no cookie.

If you consent, Google Analytics sets cookies (_ga and _ga_<id>, valid up to 2 years) and processes the data listed in section 3 to produce aggregate statistics. Data is transmitted to and stored by Google on servers in the United States. Google LLC is self-certified under the EU-US Data Privacy Framework, which the European Commission recognises as providing an adequate level of protection (adequacy decision of 10 July 2023); this is the basis for the transfer.

The legal basis for this processing is your consent (Art. 6(1)(a) GDPR, and §165(3) TKG 2021). You can withdraw your consent at any time with effect for the future via “Cookie settings” in the footer, or by clearing this site's cookies and site data in your browser. Withdrawal does not affect the lawfulness of processing before it. Google's own handling of the data is described in the Google Privacy Policy.

8b. AI Voice Demo (optional, US transfer)

The AI voice demo on our demo page is not loaded until you click "Start Voice Demo". Until you do, no connection to any third party is made and no data about you leaves our EU-hosted website.

If you start the demo, an embedded application hosted on Vercel Inc. (United States) is loaded, and your browser asks for microphone permission. If you grant it and speak, the following is transmitted to that third-party service and to the voice-AI provider it uses:

your live microphone audio and any transcript derived from it,
your IP address and standard connection metadata.

This means your audio is processed on servers outside the EEA, in the United States. Starting the demo is entirely voluntary and is your explicit, informed decision to proceed with that transfer. You can use every other part of this website, and contact us normally, without ever starting it.

Because the demo is a simulated conversation, please do not speak real personal data, real patient information, or any health data into it. Speak only invented example information.

[[TODO: Rechtsgrundlage für die Drittlandübermittlung ergänzen — SCCs oder EU-US Data Privacy Framework-Zertifizierung von Vercel Inc. sowie des eingesetzten Sprach-KI-Anbieters; zusätzlich Speicherdauer und ob Audio/Transkripte zu Trainingszwecken verwendet werden. Beim Anbieter bestätigen lassen und hier konkret benennen.]]

9. Cookies

Essential cookies required for the website to function are always active and store no personal profile. A single small entry also records your own cookie choice so we do not ask again on every page.

Analytics cookies (Google Analytics _ga, _ga_<id>) are set only if you accept analytics in the cookie banner (see section 8a). If you decline, ignore the banner, or have JavaScript disabled, no analytics script is loaded and no analytics cookie is set. You can withdraw at any time via “Cookie settings” in the footer. No advertising cookies are used.

If you start the optional voice demo, the embedded third-party application may set its own cookies or browser storage under its own domain (vercel.app). That storage is outside our control and is governed by that provider. It is not set unless you actively start the demo.

10. Supervisory Authority

You have the right to file a complaint with the Austrian Data Protection Authority:

Österreichische Datenschutzbehörde
Barichgasse 40-42
1030 Vienna, Austria
www.dsb.gv.at

11. Changes to This Policy

We may update this privacy policy. Changes will be posted on this page with an updated date.