Privacy policy

The controller for the data processing within the meaning of the General Data Protection Regulation (GDPR) is:

No data protection officer has been appointed: we do not reach the thresholds of § 38 BDSG. The management answers data protection questions at the address given in section 11.

We process personal data solely in accordance with the GDPR and the German Federal Data Protection Act (BDSG). We process data only where this is necessary to provide our services, where there is a legal basis, or where you have given your consent.

ComLayer is aimed exclusively at entrepreneurs within the meaning of § 14 BGB; the details of the contractual relationship are set out in our General Terms and Conditions.

When you visit our website, your browser automatically transmits technical information (including IP address, date and time of access, page requested, browser used). This data arises at our hosting provider and serves secure and stable operation. The legal basis is our legitimate interest under Art. 6(1)(f) GDPR.

We do not use visitor counting of our own, audience measurement or advertising tracking on this website. We also do not embed any third-party services for that purpose.

Using the ComLayer platform requires an account. We process the data you provide (for example name, email address, company details and credentials) as well as the content and support data that arises while you use the service. The processing serves the performance of the usage contract under Art. 6(1)(b) GDPR.

If you use ComLayer to offer support to your own end customers, we process the data that arises on your behalf as a processor under Art. 28 GDPR. We agree the corresponding rules with you in the data processing agreement; it also sets out the categories of data subjects, the types of data processed and the technical measures.

ComLayer produces draft answers with language models, based on the knowledge you provide. To deliver this function, the content of the request and the matching extracts from your knowledge base are transmitted to the service providers named in section 6. We do not process this content for our own purposes; in particular, we do not analyse it to train models of our own.

The same applies to the model and embedding providers used: Both providers have contractually committed to the same exclusion: the model provider through the data processing terms of Google Cloud, the embedding provider through the terms of use of Voyage AI.

If semantic search is configured, your knowledge content is additionally converted into embeddings and stored in that form in our database. If it is not configured, the search works purely on text.

We use the following service providers to deliver ComLayer. It is the same list that the DPA names as sub-processors — it is maintained in one place and shown on both pages. We have contracts under Art. 28 GDPR with all of them.

If the client embeds an appointment booking of its own via Cal.com, Cal.com is its service provider and not a sub-processor of the processor; the processor merely receives the notification of booked appointments.

The following overview names every entry that ComLayer stores in your browser or has stored there — complete and derived from the source code. We do not set a cookie of our own; the cookies listed all come from our sign-in service. Everything else is not cookie technology but local storage in the browser: individual values in localStorage, plus two databases in IndexedDB that the live update creates.

Unlike a cookie, local storage is not sent along with every request by itself. Two entries still reach the server, and that belongs here: the support widget sends its visitor identifier with every request — without it a returning visitor would not find their history again —, and the sign-in database of the live update holds the short-lived token that your browser uses to sign in to the Realtime Database. All other entries stay in the browser.

Clerk appends an identifier to the cookie name depending on the instance; the browser may therefore show “__session_a1b2c3” where “__session” is given here.

For the sign-in cookies and the local storage in the application we rely on § 25 Abs. 2 Nr. 2 TDDDG: without them the service you have asked for cannot be delivered. These entries can therefore not be switched off. We take one entry out of this, instead of claiming it along with the rest: the daily counter “firebase-heartbeat-database” serves the version statistics of the library and not the service. It cannot be switched off — the library always creates it. We therefore base it on our legitimate interest in operating the real-time function under Art. 6(1)(f) GDPR and name it here, instead of passing it off as necessary. It contains no attribute of your account, only the date and the version of the library. You can change your decision about everything else at any time — here or through the entry of the same name in the footer of every page: Cookie settings

The content stays in the EU. Conversations, knowledge base and accounts are held in the database region europe-west3 (Frankfurt), file attachments and logos in the file storage of the same region, the live update of open conversations runs in europe-west1, and the AI agent answers from the Vertex multi-region eu; the auxiliary models for subject lines and document analysis run in europe-west1. The region of the file storage was measured on 7 August 2026 against the buckets in use; all the others are stated in the configuration of the deployment.

Four services process outside the EU, namely in the USA: Clerk for sign-in, accounts and sessions, Stripe for payment processing, Resend for sending the team notifications — these contain verbatim excerpts from conversations — and Voyage AI for the embeddings of the semantic search, which receives the knowledge content for that purpose. These transfers are based on the standard contractual clauses of the EU Commission; which version and which impact assessment applies to each provider is recorded in the data processing agreement. The operation of the application itself lies with Vercel, a US corporation; the serving region of this deployment has not been measured and is marked there as an open slot as well.

We base the transfers to the USA on the standard contractual clauses of the EU Commission under Art. 46(2)(c) GDPR, in the version of Implementing Decision (EU) 2021/914 of 4 June 2021, module 2 (transfer from a controller to a processor). The providers used each supply their own transfer impact assessments, which we rely on; we do not carry out an additional assessment of our own in the individual case. The processing region of each individual service provider is given in section 6; where it is not documented, it is marked there as an open point.

We store personal data only for as long as it is needed for the purposes named or as long as statutory retention obligations exist. After that the data is deleted or anonymised. For the entries in the browser the overview in section 7 applies; for the data of a workspace the deletion under section 10 applies.

Under the GDPR you have the following rights:

• Access to the data processed (Art. 15 GDPR)
• Rectification of inaccurate data (Art. 16 GDPR)
• Erasure (Art. 17 GDPR)
• Restriction of the processing (Art. 18 GDPR)
• Data portability (Art. 20 GDPR)
• Objection to the processing (Art. 21 GDPR)

Customers with a ComLayer account can exercise the right to data portability themselves: under Einstellungen → Allgemein → “Daten exportieren” administrators can produce a complete, machine-readable export of their workspace in JSON format at any time. The file is created on click and downloaded directly; it covers conversations, messages, visitors, knowledge content, Help Centre, feedback, team and settings of that one workspace. Machine-generated intermediate results without informational value are not included (embedding vectors, search indexes); file attachments are listed with their address, the file itself remains in the attachment storage and is delivered through the application.

The same applies to the right to erasure: under Einstellungen → Allgemein → “Workspace löschen” administrators can request the deletion of their workspace themselves. It is queued with a grace period of 30 days and can be revoked until the last day; after that, conversations, visitor data, knowledge sources, Help Centre, status page and all uploaded files are deleted permanently and a running subscription ends. Billing data is subject to retention obligations under commercial and tax law (§ 147 AO, § 257 HGB); under Art. 17(3)(b) GDPR it is not deleted but restricted in processing for the duration of the retention period (Art. 18(1)(b) GDPR) and removed from day-to-day operation.

Both routes are open regardless of the plan booked — they are a legal right and not a product feature. End customers whose data is processed through the support widget of one of our customers turn to that customer as the controller; we support that customer in line with the DPA.

You also have the right to lodge a complaint with a data protection supervisory authority.

For questions about data protection or about exercising your rights you can reach us at info@comlayer.app.