Data security and GDPR
Neurask AI runs on servers in Frankfurt am Main. Here you can read which data we process, where it is stored and how we protect it.
Last updated:
At a glance
- Hosting in Germany: Website and app run in a data center in Frankfurt am Main.
- Data in the EU: Account and measurement data is stored in the EU (Frankfurt, Ireland). For measurements and payments we also use providers based in the US, see list.
- Data minimization: AI providers only receive what is necessary for a question. Never your email address, never account data.
- No training on your data: We use the APIs of OpenAI and Anthropic. Under their terms, API data is not used to train their models.
- Cookies only with consent: Analytics on this website only run once you agree. Before that, nothing is loaded from Google.
Sub-processors
We have a data processing agreement (DPA) with every provider. Where a transfer to the US is possible, the EU-US Data Privacy Framework (DPF) and the EU standard contractual clauses apply.
| Provider | Purpose | Location |
|---|---|---|
| DigitalOcean, LLC | Hosting of website and app | Frankfurt am Main, Germany |
| Supabase, Inc. | Database, login, background tasks | EU (Ireland) |
| OpenAI, L.L.C. | Asking questions to ChatGPT, analyzing answers | USA |
| Anthropic, PBC | Asking questions to Claude, analyzing answers, suggesting questions, researching brands | USA |
| Mixpanel, Inc. | Usage analytics in the app, only with your consent | EU (EU data residency) |
| Stripe Payments Europe, Ltd. | Payment and invoices | EU (Ireland), USA |
| Resend, Inc. | Sending reports and notifications | EU (Ireland) |
Technical and organizational measures
- Encrypted transmission (TLS) for all connections, HSTS on this website.
- Encrypted storage of the database and backups.
- Strict tenant separation: each brand sees only its own data, enforced at database level.
- Two-factor login for all administrative access, access only on a need-to-know basis.
- Logging of security-relevant events, without email addresses or answer texts in the log.
- Automatic deletion periods instead of unlimited storage.
- Data export for your account and your brand with one click.
EU AI Act
Neurask AI uses AI models for measurement and analysis. Results that are generated automatically, such as summaries or recommendations, are visibly marked as AI-generated in the product (EU AI Act Art. 50). Neurask AI makes no decisions about people and is not a high-risk system within the meaning of the AI Act.
Found a security vulnerability?
Please report it to [email protected]. We confirm receipt within two business days and keep you updated. Please don't access other people's data while doing so, and don't publish anything before we have been able to close the vulnerability. Our contact details are also in the security.txt.
Learn more
All details on the processing of personal data are in the privacy policy (German).