Privacy notice

1. Data controller

The controller as defined by the EU General Data Protection Regulation (GDPR, Regulation (EU) 2016/679) is:

Maxlina GmbH (company in formation; registration number:FN — to be added after registration in the companies register, Commercial Court of Vienna)
Felsgasse 9 Tuer 20-21, 1110 Vienna, Austria
Contact for privacy enquiries:
Email: datenschutz@regolio.com

Note on the tenant architecture: This privacy notice describes the processing of personal data by the platform operator REGOLIO. If you are a user of a tenant instance (for example a project contributor submitting inputs for a project), your respective tenant (the company or person using REGOLIO) is the independent controller of your data. In that case, REGOLIO acts as a processor within the meaning of Art. 28 GDPR (see section 3).

Data Protection Officer

Privacy requests are handled centrally before public go-live.
Email: datenschutz@regolio.com

No Data Protection Officer has been appointed because there is no appointment duty under Art. 37 GDPR (no large-scale regular and systematic monitoring of data subjects and no large-scale processing of special categories as a core activity; the duty is re-assessed annually). Data-protection requests are handled directly by the controller at datenschutz@regolio.com.

2. Privacy by design & by default

• EU hosting for all platform data: All servers, databases and object storage run exclusively on Hetzner Cloud in Germany (Nuremberg/Falkenstein). No US cloud provider for project data. No CDN mirror outside the EU. The only documented exception is email delivery via the provider Resend (USA, see section 10): it receives transactional and invoicing content only (e.g. recipient address, subject, invoice PDF) — never project data, contributions or reports.
• Schema-per-tenant + Row-Level Security: Each tenant receives its own PostgreSQL schema. Within that schema, customer data is additionally isolated by row-level security policies. Cross-tenant access is technically impossible. See section 4.
• Presidio pseudonymisation before every cloud LLM call: All personal data is replaced by Microsoft Presidio with pseudonym tokens such as [PERSON_1] or [ORG_2] before leaving EU infrastructure. Cloud LLMs never see plaintext names, addresses or phone numbers. Re-identification happens locally inside your tenant schema. If Presidio fails, processing aborts with an error — there is no fallback to unencrypted submission.
• Complete erasure (Art. 17 GDPR): Deleting a tenant removes the entire database schema and all associated file objects in one pass; backup copies expire with the encrypted backup rotation (within 30 days at the latest). There is no silent partial success: failures are loudly logged and retried. Invoice records subject to statutory retention are exempt (section 12).

3. Processor agreement under Art. 28 GDPR

For project data processed inside a tenant instance (customer records, project plans, team members, contributions, reports, IPMA documents), REGOLIO acts as a processor. The tenant is the controller under the GDPR and decides on the purposes and means of processing.

REGOLIO concludes a data processing agreement (DPA) under Art. 28 GDPR with every paying tenant. The DPA governs in particular:

• Purpose, duration, nature and scope of the processing
• REGOLIO’s obligation to follow the tenant’s documented instructions
• Technical and organisational measures (TOMs) under Art. 32 GDPR (see section 11)
• Sub-processor relationships (Hetzner, Mollie, Resend as email provider, optional cloud LLM providers — see section 10)
• Assistance with data subject rights (Art. 15–21 GDPR)
• Notification of personal data breaches within 24 hours
• Atomic erasure or return of all data at the end of the contract

The DPA is available in German and English as a PDF at contract signing and is signed electronically. Existing tenants can request the DPA by email to datenschutz@regolio.com.

4. Tenant isolation (multi-tenancy architecture)

REGOLIO uses a two-layer isolation architecture:

This architecture follows the recommendations of the German Federal Office for Information Security (BSI) for tenant isolation in cloud applications (“double isolation”). It is provisioned automatically during tenant onboarding and verified on every commit by an automated compliance audit.

File objects in MinIO are additionally scoped under {tenant_slug}/{project_id}/{uuid}/{filename}. Every upload is bound to a tenant and a project; a link to a foreign file cannot be guessed.

5. Categories of personal data processed

a) Account and authentication data (via Zitadel)

• Data type: Name, email address, tenant role, login timestamps, short-lived JWT tokens
• Purpose: Authentication, authorisation, tenant assignment
• Legal basis: Art. 6 (1) (b) GDPR (performance of a contract)
• Storage location: Self-hosted Zitadel instance on Hetzner Cloud in Germany. No US transfer.

b) Project data inside the tenant schema

• Data type: Customer records, projects, milestones, risks, stakeholders, RACI entries, contributions (text, audio incl. meeting transcripts, PDF), generated reports, audit logs, all 14 IPMA documents
• Purpose: Providing the platform functions (project management, automated report generation)
• Legal basis: Art. 6 (1) (b) GDPR (performance of a contract with the tenant); REGOLIO acts as a processor under Art. 28
• Controller: The respective tenant

c) Data sent to cloud LLMs (only if enabled)

• Data type: Pseudonymised text excerpts from contributions. Microsoft Presidio detects twelve entity types — persons (PERSON), organisations (ORGANIZATION), locations (LOCATION), email addresses (EMAIL_ADDRESS), phone numbers (PHONE_NUMBER), IBAN (IBAN_CODE), credit-card numbers (CREDIT_CARD) and dates (DATE_TIME) — and replaces them with pseudonym tokens (e.g. [PERSON_1], [ORG_2]) before the call is made. In addition, German national identifiers of heightened sensitivity (Art. 9-adjacent) are detected and pseudonymised: tax identification number (DE_STEUER_ID), social-security number (DE_SV_NUMMER), national ID-card number (DE_PERSONALAUSWEIS) and health-insurance number (DE_KV_NUMMER). The pseudonymisation is reversible within the meaning of Art. 4 (5) GDPR: a Fernet-encrypted mapping table is retained locally inside the tenant schema; this is pseudonymisation, not anonymisation.
• Purpose: Structuring and synthesis of project reports plus assistant and agent functions of the platform assistant MAXI (answering questions, preparing actions). On the default trust level every writing action is executed only after explicit human approval; the tenant may raise the trust level, in which case reversible data changes run automatically (each with an audit trail). Payments, plan changes, GDPR erasure requests, approvals, member invitations and external communication require approval at every level. MAXI takes no automated decisions with legal effect concerning natural persons within the meaning of Art. 22 GDPR (see section 9). The default is local Gemma/Ollama processing without cloud transfer; external LLMs are available only with explicit AIRequestPolicy approval, provider allowlist and jurisdiction profile.
• Recipient: Only the provider explicitly approved by the tenant from the REGOLIO provider matrix (Gemini, Claude, OpenAI, Mistral, DeepSeek, Groq, xAI, Cohere or Custom/BYOK), and only after pseudonymisation.
• Legal basis: Art. 6 (1) (a) GDPR (tenant consent) plus sub-processor chain
• Re-identification: Tokens are mapped back to cleartext locally inside the tenant schema. Cloud LLMs never receive the mapping.

d) Magic-link tokens for external contributors

• Data type: SHA-256 hash of a signed token, expiry timestamp, binding to email + project + role
• Purpose: Passwordless one-time access for external contributors without a tenant account
• Legal basis: Art. 6 (1) (b) GDPR (performance of a contract with the tenant)
• Retention: Default 24 hours, one-time use, invalidated afterwards (SEC-007)

e) Billing data (via Mollie)

• Data type: Billing address, payment method, transaction history — managed by Mollie (Netherlands)
• Purpose: Invoicing the Pro or Team subscription
• Legal basis: Art. 6 (1) (b) GDPR plus statutory retention under Austrian tax law (§ 132 BAO)
• Storage location: Mollie B. V., Amsterdam, Netherlands (EU)

f) IP addresses and technical logs

• Data type: IP, user agent, HTTP path, timestamp, response code
• Purpose: Security (application-side rate limiting, TLS termination via Traefik), operational monitoring, abuse detection
• Legal basis: Art. 6 (1) (f) GDPR (legitimate interest in a secure and stable service)
• Retention: Rate-limit counters 1 minute; access logs max. 14 days

g) Dictation bridge (phone as dictation mic)

• Data type: Text dictated on the phone (no audio is transferred), held briefly in an encrypted relay; access is possible only via an unguessable short-lived code stored server-side as a SHA-256 hash only
• Purpose: Transferring dictated input from the phone into the assistant's input field on the desktop (optionally as direct send, configurable by the tenant)
• Legal basis: Art. 6 (1) (b) GDPR (performance of a contract with the tenant)
• Retention: The text is deleted immediately on pickup at the desktop. Unclaimed entries are locked server-side after expiry (rolling approx. 10 minutes, access absolute max. 30 minutes) and are permanently removed when the next dictation session starts. The transfer event itself (without text content and without the code) remains in the tenant's audit log

6. What REGOLIO does NOT collect

REGOLIO neither actively nor passively collects any of the following:

• Location data or GPS coordinates
• Biometric data
• Browser fingerprints or device identifiers
• Behavioural profiles or analytics
• Social media data
• Content of other tenants (technically impossible, see section 4)
• Raw, non-pseudonymised cleartext in cloud LLM calls (technically blocked, see section 2)

7. Cookies, tracking and analytics

The public marketing website (this page) uses no cookies, no tracking pixels, no Google Analytics, no Mixpanel, no Sentry, no Hotjar and no browser fingerprinting. There is no behavioural analysis and no profiling.

The dashboard application (after logging into a tenant instance) uses only strictly necessary cookies for authentication via Zitadel (session cookies with SameSite=Strict, HttpOnly, Secure). These cookies are permissible under Art. 6 (1) (b) GDPR because they are indispensable for performing the contract, and they do not require consent under § 165 (3) of the Austrian Telecommunications Act (TKG 2021).

8. Transfers to third countries

REGOLIO operations are EU-first. In the EU/local default path (Ollama/Gemma) no third-country transfer occurs; the default policy EU_STRICT has cloud LLM and BYOK disabled and an empty provider allowlist. A third-country transfer is triggered only by per-tenant opt-in (the tenant actively enabling a cloud/BYOK provider via AIRequestPolicy). Where a provider is enabled, the transfer basis depends on the provider: the EU-US Data Privacy Framework (DPF) if the specific entity is actively DPF-listed (e.g. Google), otherwise the EU Standard Contractual Clauses (SCC) Module 2 (Implementing Decision (EU) 2021/914) together with a Transfer Impact Assessment (TIA) and supplementary measures (Presidio pseudonymisation as a supplementary measure within the meaning of EDPB Opinion 28/2024). The table below lists every possible destination:

9. Your rights as a data subject

As a data subject you have the following rights against the controller. Most are implemented automatically in REGOLIO or via a short workflow:

No automated individual decision-making (Art. 22 GDPR): LLM-generated reports and the assistant/agent functions (MAXI) of REGOLIO produce decision proposals and prepared actions; results with legal or commercial significance are reviewed and released by a human user. There is no automated decision with legal or similarly significant effect on data subjects within the meaning of Art. 22 GDPR.

10. Recipients and sub-processors

The following external services may receive data during platform use. Their precise role as processor or independent controller depends on the contractual arrangement and data flow. Contractual and transfer evidence must be completed before go-live and documented as a go-live gate. Self-hosted open-source components (Coolify, Traefik, Zitadel, Microsoft Presidio) that run exclusively on our own Hetzner infrastructure are not external recipients within the meaning of Art. 28 GDPR. Zitadel and Presidio are shown in the table only to make their self-hosted classification transparent; the corresponding technical and organisational measures are described in section 2. Tenants are notified at least 30 days in advance of any planned change of sub-processors and have a right to object under Art. 28 (2) GDPR.

Self-hosted components with no external recipient: Coolify and Traefik (self-hosted deployment/proxy software), Zitadel (OIDC), Microsoft Presidio (pseudonymisation), MinIO (object storage), the local self-hosted AI models (Ollama running Gemma 4 26B for report synthesis and bge-m3 for embedding the project memory; faster-whisper for speech transcription), PostgreSQL and the native workflow worker run exclusively on REGOLIO-controlled Hetzner infrastructure. The worker orchestrates report workflows; workflow state is tenant-scoped in PostgreSQL and report artifacts are stored in MinIO. The technical review found that this internal component replacement engages no hosted workflow provider, telemetry recipient or support recipient and therefore introduces no new external recipient. The corresponding technical and organisational measures are described in section 11.

Third-party systems connected by the tenant: If the tenant connects its own integrations (e.g. Jira, Microsoft Teams, Confluence or generic webhooks), data is transferred to those systems on the tenant's instruction and responsibility; such recipients are not sub-processors of REGOLIO. Incoming calls are processed with signature verification.

11. Technical and organisational measures (Art. 32 GDPR)

REGOLIO implements the following technical and organisational measures:

• Encryption in transit: All external connections exclusively over HTTPS/TLS (Traefik with Let’s Encrypt certificates)
• Encryption at rest: Encrypted backups (Restic); access and API keys exclusively in the protected deployment environment, never in source code
• Fernet field encryption (MultiFernet, rotatable keyring): Personal-data fields in the database are additionally encrypted at the field level — including BYOK keys, the canonical values and aliases of the PII registry, and the owner_email in the registration intent
• Two-layer tenant isolation: Schema-per-tenant in PostgreSQL + row-level security per customer (see section 4)
• Presidio pseudonymisation before every cloud LLM call with loud failure on Presidio outage (fail-closed marker, no silent fallback)
• Project-scoped pseudonym mapping: Re-identification only within the same project; no cross-project leakage
• Network segmentation: Five isolated Docker bridge networks (edge, db-regolio, db-zitadel, storage, ai); only the backend is on all of them
• Rate limiting: Application-side fixed-window limits on security-critical endpoints (including auth, webhook and registration paths)
• Content Security Policy: Strict CSP headers on every web surface
• Input validation: Pydantic models on the backend, strict TypeScript on the dashboard, magic-byte MIME checks on uploads
• Anti-virus scanning: ClamAV scans every upload before storing in MinIO
• Defense in depth at the DB layer: Every ORM query additionally filters on customer_id, even though RLS is already active
• Audit log: All security-relevant actions (login, approval, invitation, deletion) are recorded per tenant
• Data-minimising audit logs (SHA-256 hashes instead of plaintext): Audit entries store SHA-256 hashes instead of the plaintext of AI inputs and email addresses (e.g. created_by_email_hash), keeping actions traceable without retaining raw PII
• Automated compliance audit: Before every release, parallel review agents check 12 mandatory rules (including multi-tenancy defense in depth, GDPR pipeline, secret hygiene)
• Alembic migrations with advisory lock: No concurrent DDL on container startup, no silent schema corruption

12. Retention periods and erasure

13. Data Protection Impact Assessment (DPIA, Art. 35 GDPR)

A Data Protection Impact Assessment under Art. 35 GDPR has been carried out for REGOLIO’s core processing activity (automated generation of project reports from contributions by multiple individuals). The DPIA evaluates in particular:

• The risk of re-identification despite Presidio pseudonymisation
• The risk of cross-tenant data leakage due to coding errors
• The risk of silent pipeline regressions (e.g. cloud LLM without pseudonymisation)
• The risk of unauthorised access by operator personnel

The identified risks are addressed by the technical measures described in section 11 and by the pre-commit audit. The Art. 35 review dated 20 July 2026 found that the internal replacement with the native workflow worker changes neither data categories, recipients, retention, the role of automated decisions nor the risk profile; on that basis alone, it does not automatically trigger a new DPIA. The DPIA will be reassessed if any of those factors or the level of risk changes. External legal and privacy review remains a mandatory go-live gate. The DPIA can be inspected on request.

14. Protection of minors

REGOLIO is a B2B platform targeted exclusively at professional users. The platform knowingly does not collect data from persons under 16. Tenants are contractually required not to create projects with minors as team members unless parental consent under Art. 8 GDPR is in place.

15. Changes to this privacy notice

This privacy notice is updated when processing activities change substantially (new recipients, new purposes, new legal bases). Existing tenants are informed about material changes by email and in the dashboard. The current version is always available at regolio.com/en/privacy.

16. Contact for privacy requests

For access requests, erasure requests, objections or any other privacy-related matter, contact:

REGOLIO Privacy
Email: datenschutz@regolio.com

We confirm receipt of your request within 72 hours and process it within the statutory one-month period under Art. 12 (3) GDPR.

17. Legal primacy of the German version

This privacy notice is a courtesy translation of the legally binding German-language “Datenschutzerklärung” required under the GDPR and Austrian law (in particular the DSG). The German-language version remains legally authoritative. See the German version for the binding text.