Privacy Policy

Last updated: 31 October 2026. This notice covers the MISGORA website, enquiries, local and AI-assisted guidance and related private project, account and support functions.

Controller: Goran Macasev, Marshall Heights Ring 3L, 97318 Kitzingen, Germany. Email: contact@misgora.com. You can also submit privacy requests through the contact form.

When you visit, we process technical information needed to display and protect the website, including IP address, request time, browser information, session identifiers and security or error information. Technical sessions protect forms and access and preserve functions you request. The purposes are reliable operation and abuse prevention. The legal basis is our legitimate interest in these purposes under Article 6(1)(f) GDPR; processing necessary for requested contractual services also uses Article 6(1)(b).

The initial contact form asks for your name, email address and message; an existing website address is optional. The selected language, package or example and whether the enquiry came from the contact page, campaign or assistant can accompany the request. We use your details to answer, clarify requirements and prepare an individual proposal. Please do not send passwords, card details or confidential records about your customers.

Requested steps before a contract use Article 6(1)(b) GDPR. Other business correspondence uses our legitimate interest in answering and documenting communications under Article 6(1)(f). Providing details is voluntary, but without the contact information and message needed for your request we cannot respond. An enquiry does not create a paid order or sign you up for marketing.

The assistant supports two types of help. Its local guide works without an external AI model. If AI mode is enabled and you send a question, MISGORA can send the question, up to six recent conversation messages, selected language, a limited summary of project choices and necessary instructions to the OpenAI API to generate a text reply. No visitor IP address is deliberately included in the AI request; no photos, attachments or external tools are sent by this assistant. A reply is generated only after you interact with the conversation; merely visiting the page does not transmit a chat question. When AI mode is unavailable or the guest quota is exhausted, the local guide answers instead.

A browser may obtain up to ten successful external AI answers in a rolling 30-day period. Errors and local-guide answers do not use this allowance. The guest allowance is associated with a first-party browser cookie, not verified identity or an account. Clearing it can restart the allowance, while independent server limits continue to apply.

The assistant processes the chosen language, conversation identifier, messages and project information needed to continue the conversation. Messages and conversation state are encrypted in MISGORA application storage. Ordinary use does not require an email address. To submit an enquiry from a conversation, you review the proposed summary and selected recent messages and actively submit a separate enquiry; an email verification step may be required. Using the assistant does not sign you up for marketing. After you open or use the assistant, browser session storage remembers the conversation reference and interface choices, but not the message text.

Requested project and pre-contract assistance relies on Article 6(1)(b) GDPR; general guidance, continuity and secure abuse prevention rely on our legitimate interests under Article 6(1)(f) GDPR. No binding contract or automated decision with legal or similarly significant effects is made by this assistant.

When appropriate for your request, we may create a private project and invite you or notify your existing account. We process the necessary contact and account details, invitation and access records, project content, replies, status history and files you provide. Access to private project and support material is limited to authorized users and staff. A private demonstration is not approval for public website publication. These functions support your requested project, support and access security under Article 6(1)(b) GDPR or our legitimate interests under Article 6(1)(f).

Ratings and private product feedback are voluntary. A private opinion is not a public testimonial. Publishing a quote or display name requires the relevant separate permission and moderation; a rating or private message alone is not permission. You can withdraw publication consent by contacting us. Withdrawal does not affect earlier lawful processing. Feedback for service improvement stays private unless a separately permitted publication is approved.

Hetzner Online GmbH, Germany, provides our hosting and infrastructure. Our application server is in Germany; the existing managed offsite backup destination is a Hetzner Storage Box in Helsinki, Finland. Restricted recovery copies support restoration after failures. They are separate from the active application and remain subject to the retention and access limits described below.

Brevo GmbH, Berlin, Germany, provides transactional email delivery. It receives the recipient address, message content and the technical information needed to send and reconcile the message. Brevo states that its core hosting uses OVH in France and Germany and Google Cloud in Belgium. European core storage does not by itself exclude international support or subprocessor access.

We use the existing Titan Email service, obtained through NameSilo, for incoming business email and correspondence at contact@misgora.com. This includes messages, attachments and the associated email metadata.

Authorized staff and providers receive the information needed for their role. Email also passes through the recipient’s chosen mail service. We do not sell enquiry or assistant data.

If external AI help is enabled, OpenAI provides text generation as a service provider. It receives only the conversation material and limited project context described above; its API is called with response storage disabled. OpenAI states that API input and output are not used for model training by default, unless the customer opts in. Refer to https://developers.openai.com/api/docs/guides/your-data and https://openai.com/policies/data-processing-addendum/ .

Depending on the service and support arrangement, providers or their subprocessors may process data outside the European Economic Area. Brevo’s published data-processing terms provide for service-related access or processing by group companies and subprocessors, including in the United States and India. The applicable safeguards depend on the particular recipient and include EU standard contractual clauses with supplementary measures or, for covered recipients, a European Commission adequacy decision. Titan’s published data-processing addendum also addresses standard data-protection clauses for covered transfers.

Information about Brevo’s arrangements is available at https://www.brevo.com/de/legal/termsofuse/ and about Titan’s addendum at https://support.titan.email/hc/en-us/articles/5526041683225-Data-Processing-Addendum. You can request information and a copy of the applicable safeguards from contact@misgora.com, subject to protection of confidential information and other people’s rights.

OpenAI and its subprocessors may process API data outside the European Economic Area. The actual account terms and appropriate transfer mechanism, including any applicable adequacy decision or EU standard contractual clauses, must be verified before we enable the external AI function. OpenAI's current subprocessor information is at https://openai.com/policies/sub-processor-list/ .

We send service messages about enquiries, invitations, private projects and support. Recipient and message information, message identifiers and delivery or error status are used to provide the requested communication and prevent abuse. Depending on the request, this processing is based on Article 6(1)(b) GDPR or our legitimate interests in reliable, secure communication under Article 6(1)(f). A service message is not consent to marketing.

Our current Brevo configuration uses anonymized measurement of email opens and link clicks. HTML messages can contain a small remote image and links routed through Brevo. Loading an image or following such a link can send technical request information to the provider, including an IP address, time, browser information and a message or link identifier. According to Brevo, the resulting open and click statistics are anonymized so that we cannot associate them with a particular contact. Anonymization is separate from switching measurement off.

We do not use these statistics to build individual engagement profiles. Our application receives a delivery confirmation for the relevant message; it does not receive open or click events through that delivery connection. The necessary delivery record is separate from optional measurement of opens and clicks.

Private demos follow a 30-day period and a further seven-day recoverable archive, unless an extension or hold is documented. Automatic demo archiving and permanent cleanup are currently disabled. The demo period is separate from retention of your account, enquiry and correspondence.

MISGORA enquiries, including archived enquiries and linked replies and attachments, are temporarily protected from automatic enquiry cleanup while a specific retention policy is reviewed. This protection does not expire automatically. It prevents unattended deletion; it does not prevent authorized individual deletion or a properly assessed privacy request. Continued retention is assessed against the open request, active business relationship, necessary evidence and applicable obligations. The protection will be lifted only after the actual records have been reviewed and a replacement policy has been expressly adopted.

Local conversations expire 24 hours after creation. The hourly cleanup then deletes expired conversations and their turns. An enquiry you separately submitted is retained under the enquiry policy and does not disappear with the chat. Application security and error logs currently rotate after 14 days; other infrastructure and provider records are considered separately according to necessity and applicable obligations. A demo ending does not automatically delete your account. Financial records and necessary business evidence have separate requirements.

Backups may still contain data deleted from the active application. Access to recovery copies is restricted. Deleting an active record does not mean it has immediately disappeared from every backup.

For external AI requests, OpenAI's published default abuse-monitoring retention is up to 30 days, subject to stated exceptions or legal requirements. MISGORA sends requests with the Responses API `store=false`; this is not the same as zero retention of provider security records. The 30-day browser quota cookie contains only recent successful-answer timestamps, not questions or responses.

This marketing website uses technical sessions for security and functions you request. When you choose the assistant, session storage supports restoring your conversation and interface choices as described above. We do not run optional visitor analytics or an advertising-tracking service on this marketing website. It is excluded from the statistics feature for customer-operated websites. Cloudflare Turnstile is currently disabled. Introducing an optional technology would require the applicable privacy information and controls before it is used.

To enforce the free guest AI allowance, the assistant sets a first-party HttpOnly, encrypted and authenticated cookie (`misgora_guest_ai_30d`) after each successful AI response. It stores up to ten response timestamps, expires after 30 days, and is used for the requested limited service and abuse prevention. It is not an advertising cookie. The cookie's existence does not prove a distinct person's identity.

You can request access, correction, erasure, restriction and, where applicable, portability. You can object to legitimate-interest processing for reasons relating to your situation and withdraw an applicable consent. Statutory conditions and necessary protection of other people apply. Contact contact@misgora.com or use the contact form; we may reasonably verify identity. Protection from automatic cleanup does not remove your rights.

You can complain to a supervisory authority, including the Bayerisches Landesamt für Datenschutzaufsicht (BayLDA), Promenade 18, 91522 Ansbach, Germany. Current complaint and contact options: https://www.lda.bayern.de/de/kontakt.html. We will update this information when actual processing changes.