How we handle what you tell us

Processing by purpose

The Article 6 GDPR legal basis and the Chapter V condition for a third-country transfer are separate questions. Consent to the conversation therefore does not itself prove a valid transfer mechanism. Where configuration permits US or global processing, the records available to us do not establish the specific Chapter V mechanism; it must be documented before operation.

You are talking to an AI

This conversation is led by an AI system. Replies are generated by a machine and can contain mistakes. When you ask for it, a person takes over: the result reaches our team as an enquiry.

Typed and spoken conversations run in real time through a service. Your text and, when you use voice, your voice are processed there to hold the conversation. Typing is not an alternative to that processing: both paths run through the same session at the same provider. Who does the processing is listed below, and you agree to it explicitly at the start.

The gear in the top right is where you choose the conversation route. In the default “Quality” setting, conversation providers in the United States process it. The “Privacy” tier uses Mistral AI for speech recognition, the language model and voice, with fewer conversation providers involved. The currently configured global Mistral endpoint does not guarantee a particular processing location; the documented regional EU endpoint is not configured and availability of the selected models there is not evidenced. Support access, subprocessors, onward transfers and any required mechanism under Chapter V GDPR also remain unresolved. You can switch at any time, including mid-conversation. To continue the conversation, its existing history may also be sent to the newly selected provider. The consent sentence on the start card names the provider for your current choice.

Only when the optional image feature is enabled on the server can OpenRouter, Inc. and its global upstream OpenAI, L.L.C. use GPT Image 2 through the global Images API to generate visual interface concepts within the available credit allowance from your conversation in the “Quality” tier. Our server requests the images; an API key never reaches your browser. Default abuse-monitoring logs may include the request and output and may be retained for up to 30 days; this service neither assumes nor promises zero data retention. This optional feature is disabled in the “Privacy” tier. That technically separates image processing from the Mistral conversation route, but is not a promise about its processing location or possible onward transfers.

Who is responsible

Augmentoring GmbH, Gamsgebirgstraße 23, 8510 Gamsgebirg, Austria.

Companies register FN 682911g, Landesgericht für Zivilrechtssachen Graz. Managing director: Ing. David Scheutz.

Member of the Styrian Economic Chamber, Professional group for management consultancy, accounting and information technology (UBIT). Supervisory authority: Bezirkshauptmannschaft Deutschlandsberg.

Access and data protection requests: office@augmentoring.com.

What is collected

The following is processed:

• Your email address.
• The text you write or paste.
• Text extracted from files you upload.
• The conversation history of this session.
• When the image feature is enabled, interface concepts generated from the conversation within the available credit allowance and your like or hide choice for them.
• If you use voice, your voice, in order to hold the conversation in real time.
• Your IP address for abuse prevention. It is not stored in your session or written to disk; the daily ceiling uses a salted, irreversible key.

What is not kept

Text is extracted from uploaded documents; the original file is then discarded. With your consent, image attachments may be stored as private reference files for concepts until the conversation expires.

Our own server stores no audio, only the text of the conversation and the fact that a turn was spoken. Whether the speech service retains recordings is shown in the provider list.

No analytics, tracking or advertising cookies. No fonts or scripts from third-party servers, so visiting this page discloses no IP address to anyone else.

Cookies

Three strictly necessary cookies: session, this browser's conversation list, chosen language. None is used for measurement.

Temporary interface notices and a history of at most 50 messages with their time are kept for this visit in sessionStorage and disappear when the tab closes.

Retention

A session, meaning email address, transcript, extracted text and generated interface concepts, is deleted automatically shortly after 24 hours have elapsed. Short-window IP keys remain in memory for about ten minutes, the salted daily-ceiling key for at most two UTC days.

Daily totals per provider and capability serve cost control and are kept for 90 days. They carry no personal data and are linked to neither a person nor a conversation.

To bound conversation budgets and confirmation emails we keep two separate counters. They hold no addresses, only a value computed from your confirmed address or your browser with a server-side key. Without that key nobody can derive who you are from it; we ourselves can link the counter to your confirmed address for as long as it exists. The budget counter is deleted with your session after 24 hours, the confirmation counter after at most two UTC days. Before confirmation only your browser counts, so entering somebody else's address can never reveal their usage.

If you request a next step at the end, we receive your contact details, the summary, the transcript and extracted file text by email. Our ordinary retention for business correspondence applies to that message.

If delivery fails temporarily, the message is queued with access protection and retried. Undelivered queue records are deleted after no more than seven days.

The confirmation link

The link shows that the address you gave belongs to you. It works once and expires. You do not need it to start: a conversation begins without confirmation.

Without confirmation, however, a considerably smaller spending limit applies to the language model and the voice. A longer conversation or a further call can reach it. A notice then appears in the conversation. After confirming, you can continue with the higher budget. What you told us so far is kept.

The message is queued with access protection before sending. A failure is retried until the link expires, for no more than 30 minutes, and the record is then deleted.

When delivery is enabled, the configured email provider processes your address and the message. It is shown in the provider list.

Your rights

You have the right to access, rectification, erasure, restriction and portability. Where we rely on legitimate interests under Article 6(1)(f) GDPR, you may object for reasons arising from your particular situation. A message to office@augmentoring.com is enough.

You may withdraw consent at any time for the future by unticking consent in the conversation settings or by email. Withdrawal does not affect the lawfulness of processing before withdrawal.

You may complain to the Austrian Data Protection Authority (Österreichische Datenschutzbehörde), Barichgasse 40-42, 1030 Vienna.