Privacy Policy

The controller responsible for data processing on this platform within the meaning of the General Data Protection Regulation (GDPR), the German Federal Data Protection Act (BDSG), and other data protection legislation is:

We have not appointed a statutory Data Protection Officer, as we are not required to do so under Art. 37 GDPR. For any questions about data protection or to exercise your rights, please contact:

3.1 Categories of Data We Process

• Account data: name, email address, organization name, hashed password.
• Contact and CRM data: contact names, email addresses, company information, and job titles that you import or enter for your outreach campaigns.
• Email content: templates, email bodies, and subjects you compose in the platform.
• Mailbox connection data: OAuth tokens (encrypted at rest with AES-256-GCM) and email-provider metadata.
• Usage data: campaign analytics, open and click tracking data, and login timestamps.
• Technical data: IP address, browser type, and device information, collected automatically through server logs.

3.2 Purposes of Processing

• Providing and operating the OSENBOLT platform (Art. 6(1)(b) GDPR, contract performance).
• User authentication and account security (Art. 6(1)(b) GDPR).
• Sending emails on behalf of our users through connected mailboxes (Art. 6(1)(b) GDPR).
• Campaign analytics and performance reporting (Art. 6(1)(f) GDPR, legitimate interest).
• Preventing abuse, detecting fraud, and maintaining platform security (Art. 6(1)(f) GDPR).
• Legal compliance and responding to lawful requests (Art. 6(1)(c) GDPR).

We use the following third-party service providers (sub-processors) to operate OSENBOLT:

All sub-processors are bound by Data Processing Agreements (Auftragsverarbeitungsverträge, Art. 28 GDPR). For transfers to the USA, we rely on Standard Contractual Clauses (SCCs) approved by the European Commission, and on the EU-US Data Privacy Framework where applicable.

Some of our sub-processors are located in the United States or other countries outside the European Economic Area (EEA). We ensure an adequate level of protection through:

• EU Standard Contractual Clauses (SCCs) pursuant to Art. 46(2)(c) GDPR.
• EU-US Data Privacy Framework certification, where applicable.
• Technical measures including encryption in transit (TLS 1.3) and at rest (AES-256).

• Account data: kept for the duration of your active account, then deleted within 30 days of account closure unless legal retention periods apply.
• Campaign and email data: kept for 12 months after campaign completion. You may request earlier deletion.
• Contact and CRM data: kept until you delete it or close your account.
• Server logs (IP, access): deleted automatically after 90 days.
• OAuth tokens: deleted immediately when a mailbox is disconnected.

German commercial and tax law (HGB, AO) may require retention of certain business records for 6 to 10 years. In such cases, the data is restricted from further processing and deleted after the statutory period expires.

Under the GDPR, you have the following rights:

• Right of access (Art. 15): obtain confirmation of whether we process your personal data and request a copy.
• Right to rectification (Art. 16): request correction of inaccurate data.
• Right to erasure (Art. 17): request deletion of your data (the right to be forgotten).
• Right to restriction (Art. 18): request limitation of processing.
• Right to data portability (Art. 20): receive your data in a structured, machine-readable format.
• Right to object (Art. 21): object to processing based on legitimate interest.
• Right to withdraw consent (Art. 7(3)): withdraw consent at any time without affecting prior lawfulness.
• Right to lodge a complaint (Art. 77): file a complaint with a supervisory authority.

To exercise your rights, contact us at contact@edeborn-ai-tech.com. We respond within 30 days as required by Art. 12(3) GDPR.

You have the right to lodge a complaint with a data protection supervisory authority. The competent authority for our registered seat is:

You may also contact the supervisory authority of your own habitual residence or place of work.

10.1 Essential Cookies

We use strictly necessary cookies for authentication and session management. These cookies are required for the platform to function and cannot be disabled. Legal basis: Art. 6(1)(b) GDPR and § 25(2) TDDDG (Telekommunikation-Digitale-Dienste-Datenschutz-Gesetz).

10.2 Email Open and Click Tracking

When you send campaigns through OSENBOLT, emails may contain a tracking pixel (a 1x1 transparent image) and redirected links that measure open and click rates. This tracking applies only to the recipients of campaigns you send, not to your own use of the OSENBOLT platform.

As the sender of these campaigns, you are the data controller for your recipients' data. You are responsible for ensuring a valid legal basis, such as legitimate interest under Art. 6(1)(f) GDPR for B2B outreach, or consent where required.

• All data is transmitted over TLS 1.2 or higher.
• OAuth tokens and credentials are encrypted at rest using AES-256-GCM.
• Row-Level Security is enforced at the database level, so users can only access their own organization's data.
• Rate limiting is applied on authentication and API endpoints to prevent brute-force attacks.
• Sessions expire automatically after 5 minutes of inactivity.
• Service-role keys are isolated to server-side code and never exposed to browsers.
• We apply regular security updates and dependency audits.

When you use OSENBOLT to manage contacts and send campaigns, we act as a data processor (Auftragsverarbeiter) on your behalf under Art. 28 GDPR. You remain the data controller for the personal data of your contacts.

A Data Processing Agreement (DPA / AVV) is available on request at contact@edeborn-ai-tech.com. Our DPA covers:

• Subject matter and duration of processing.
• Nature and purpose of processing.
• Categories of data subjects and personal data.
• Obligations of the processor: confidentiality, security, and sub-processor management.
• Assistance with data subject requests.
• Audit rights.
• Return and deletion of data upon termination.

OSENBOLT is built for B2B sales outreach. As a user, you are responsible for ensuring your campaigns comply with applicable laws, including:

• GDPR (EU): legitimate interest (Art. 6(1)(f)) may serve as a legal basis for B2B contact where the outreach is relevant to the recipient's professional role.
• UWG (Germany): § 7 UWG permits commercial email to businesses where a presumed interest exists. Unsolicited email to individuals (B2C) generally requires prior consent.
• CAN-SPAM (USA): all emails must include a valid physical postal address and an unsubscribe mechanism.
• CASL (Canada): express or implied consent is required for commercial electronic messages.

OSENBOLT includes built-in compliance features:

• An automatic List-Unsubscribe header on all campaign emails.
• Bounce detection and automatic contact invalidation.
• Daily sending limits to prevent spam behavior.
• Sending-window restrictions that respect business hours.

OSENBOLT does not make decisions that produce legal or similarly significant effects about you based solely on automated processing within the meaning of Art. 22 GDPR.

The platform offers assisted features that help you draft and understand email content, such as summarizing an incoming reply or suggesting text. These features support your own judgment. They do not act on your behalf without your instruction, and the final decision and the content you send are always yours. Where these features process content through a third-party model provider, that provider is bound by a data processing agreement and does not use your content to train its models.

OSENBOLT is a business tool intended for professional use and is not directed to children. We do not knowingly collect personal data from anyone under the age of 18. If you believe a minor has provided us with personal data, contact us and we will delete it.

We maintain procedures to detect, report, and investigate personal data breaches. In the event of a breach that is likely to result in a risk to the rights and freedoms of individuals, we notify the competent supervisory authority without undue delay and within 72 hours where feasible, in line with Art. 33 GDPR. Where the breach is likely to result in a high risk, we also inform the affected individuals in line with Art. 34 GDPR.

If you use OSENBOLT as a data processor for your own contacts, we assist you in meeting your own notification obligations by informing you of relevant incidents without undue delay.

We may update this privacy policy to reflect changes in our data practices or legal requirements. Material changes are communicated by email or in-app notification. The "Last updated" date at the top indicates the most recent revision.