rinqorinqo
Translation for convenience, the German version is legally binding.

Privacy Policy

As of: 30 September 2026 · Version 2026.10

This privacy policy informs you, in accordance with Art. 13 and 14 GDPR, about the personal data we process as controller when you visit app.rinqo.de, try out rinqo in the preview, request access, create an account and use the platform. Visits to the website rinqo.de are governed by that website’s own privacy policy (rinqo.de/en/privacy). If you talk to an AI agent that a company operates via rinqo, section 6 applies.

1. Controller

Sven Pflüger, trading as “rinqo”
Schusterstraße 40
79098 Freiburg im Breisgau
Germany
Data protection email: privacy@rinqo.de
General contact: hello@rinqo.de

2. Contact for data protection enquiries

Send questions about data protection and requests under section 16 to privacy@rinqo.de.

3. At a glance: what we process

  • Preview and access request: your input while trying rinqo out and the details from the request form (section 5.1).
  • Account: name, email address, company name, password as an irreversible hash, organisation and team memberships, subscription and usage.
  • Use of the platform: technical server logs, load time measurements and counted steps of the sign-up process (sections 5.4, 5.6 and 11).
  • Billing: invoice details, payment and customer identifiers, payment status and, for SEPA Direct Debit, the mandate reference and the evidence of the mandate and the pre-notification.
  • Connections: calendar, mailbox and phone numbers, if you set them up (sections 5.9 to 5.11).
  • Partner programme: applications, referral codes, commission bases and businesses submitted by partners (sections 5.7, 5.8 and 5.13).
  • Assistant: your questions and the data the assistant reads from your account to answer them (section 5.15).

4. Legal bases

  • Art. 6(1)(b) GDPR (contract and pre-contractual steps), where you yourself are our contracting party or are initiating a contract with us, for example as a sole trader: preview, access request, account, subscription, connections, phone numbers, partner contract.
  • Art. 6(1)(c) GDPR (legal obligation): invoicing, verification of the VAT identification number and retention under commercial and tax law (§ 147 AO, § 257 HGB, § 14b UStG).
  • Art. 6(1)(f) GDPR (legitimate interests): providing the account, connections and the assistant to employees and invited team members of our customers (our interest, and that of your company, in performing the contract concluded with us); IT security, rate limiting and protection against abuse; analysing the channels through which requests reach us and the steps at which sign-up is abandoned; performance measurement; traceable partner and commission accounting; invitations; businesses submitted by partners; naming genuine customer references.
  • Art. 6(1)(a) GDPR (consent): product news and tips by email, if you subscribe to them.
  • § 25 Abs. 2 Nr. 2 TDDDG: storing information on your device and reading it from there, to the extent that this is strictly necessary for the function you are using (section 11).

5. In detail: account and platform

5.1 Before registration: preview and access request

In the preview, you can try out an agent before you have an account. If you enter a website, rinqo retrieves its home page and up to five further pages of the same domain and has a language model (section 8) summarise information about your business from them. We store your input and the test agent’s replies for the duration of the session, for no more than one hour, and the summarised information for no more than two hours. In doing so, we process a hash of your IP address to protect against abuse. For a test call, you enter your phone number; we send you a code by SMS via our telephony provider and call you for no more than 60 seconds.

If you submit an access request, we store the details you enter in the form (name, company, email address, phone number, industry, intended use and how you heard about us), the settings of the agents you keep from the preview, including the information about your business summarised there, a referral code if you came via a partner’s link, the page you came from, campaign information from the link, a hash of your IP address and a truncated user agent. We review the request, call you and, if we approve it, send you a link to register; if we decline it, we record the reason. We cannot process the request without a phone number. The legal bases are Art. 6(1)(b) GDPR and, for protection against abuse and for analysing the channels through which requests reach us, Art. 6(1)(f) GDPR.

5.2 Registration

We collect your name, business email address, company name, a password you choose yourself and your declaration that you are acting as a business. We store the password only as an irreversible hash. We record, as evidence, which version of the Terms and Conditions and of the Data Processing Agreement you accepted and when. We need this information for the contract; without it, we cannot create an account. For a paid subscription, we also need your invoice and payment details.

5.3 Signing in

After you sign in, we set a technically necessary session cookie. This is based on § 25 Abs. 2 Nr. 2 TDDDG.

5.4 Log data

On every access, we process the IP address, timestamp, requested resource, user agent and status code in order to deliver the request, fend off attacks and fix errors. In the application’s server logs, we remove email addresses and phone numbers and truncate IP addresses before storing them. The logs are overwritten on a rolling basis as soon as they reach 30 MB per service; how far back they go depends on how much is logged.

5.5 Security

We protect the platform with technical and organisational measures in accordance with Art. 32 GDPR. Customers can find them in the Data Processing Agreement in their account (the “Contracts and data” area).

5.6 Performance measurement

To detect loading errors and delays, the app measures in your browser how quickly a page loads and sends only the measured values, the type of page without specific identifiers and a browser class to our server. We do not record user identifiers in the process, and we record the organisation identifier only as a salted hash; we do not attribute the values to any person. The values are written to the server logs (section 5.4). The legal bases are § 25 Abs. 2 Nr. 2 TDDDG and Art. 6(1)(f) GDPR, our interest in a functioning service.

5.7 Application for the partner programme

You need an account to apply. Companies and private individuals aged 18 or over can apply. We process your account and contact details, the information in your application, internal review notes, the decision and, where applicable, the reason for rejection. This serves pre-contractual steps and the conclusion of the partner contract under Art. 6(1)(b) GDPR, and checks for abuse and conflicts of interest under Art. 6(1)(f) GDPR. We delete application notes and reasons for rejection 365 days after the decision has been finalised. We process identity, contract and accounting records of an accepted partner separately for the performance of the contract, accounting and statutory documentation obligations.

5.8 Referral and partner attribution

We do not set a referral cookie. A referral code from a link is entered in a visible, optional field of the registration form. You can change or remove it. Only when you submit the form do we adopt the code entered at that point for partner attribution. We store the code, the attributed partner identifier, the timestamps of the attribution and changes to it with the reasons given, and the details on customer and contract status, commission bases and commission amounts needed for the commission. We do not use conversation content for this. The legal bases are Art. 6(1)(b) GDPR for the customer and partner contracts and Art. 6(1)(f) GDPR for traceable accounting that is secure against abuse.

If you are attributed to a partner, the partner sees in their partner area your company name, the date of registration, your package, whether your subscription is paid and their commission from it. When you register, the partner receives an email containing your company name.

5.9 Connecting a calendar (Google Calendar, Microsoft 365, CalDAV)

You can connect a Google calendar, a Microsoft 365 calendar or a CalDAV calendar (such as iCloud) to rinqo. This lets rinqo know your busy times, avoid double bookings and recognise events it created itself. During synchronisation, Google and Microsoft transmit the complete events; for CalDAV, the calendar server does so. Of these, rinqo keeps only the start, end and status of each event and whether it is marked as free or busy; in rinqo, these events appear only as “Busy”. We do not store titles, descriptions, locations or attendees. Of the title, we store only a check value generated with a secret key; it does not contain the title and serves solely to let rinqo recognise its own events. We also receive the email address and the name of the connected account in order to display the connection. rinqo creates booked appointments in your calendar and changes or deletes them when the booking is changed or cancelled in rinqo. For this purpose, rinqo accesses only those Google calendars that you own.

The data is held on servers in Germany, with backup copies in the EU. For an appointment booking, rinqo calculates free time slots from the busy times and passes only these time slots to the language model that formulates the agent’s reply; it does not pass on the event data itself. If you ask the assistant about your calendar connections, it passes the email address and the name of the connected account to the language model (section 5.15). We do not use the data for advertising, do not sell it and do not use it to develop, improve or train AI models. The connection to the providers is encrypted, and we store the access credentials in encrypted form. We store events within the period from 30 days in the past to 180 days ahead; we delete older entries.

If you disconnect the calendar in rinqo, we delete the access credentials and all event data retrieved; for Google, we additionally revoke access at Google. You can also revoke access at any time with the provider: for Google at myaccount.google.com/permissions, for Microsoft at myapps.microsoft.com or account.live.com/consent/Manage, and for CalDAV calendars by deleting the app password with the provider.

rinqo’s use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

5.10 Connecting a mailbox

If you connect a mailbox, the email agent reads and sends emails through it on behalf of your company (section 6). We store the password and access credentials in encrypted form. If you disconnect a Microsoft mailbox, we delete its access credentials; you can also revoke access at myapps.microsoft.com or account.live.com/consent/Manage.

5.11 Ordering a phone number

If you order a phone number with a local area code, we transmit the details of your company (company name, address, register number and VAT identification number) and the name and contact details of the contact person to our telephony provider, which assigns the number in accordance with the rules of the Federal Network Agency (Bundesnetzagentur). Your browser encrypts the proof of your registered office for the provider; we cannot read it. No number can be assigned without this information. If you want to use a phone number of your own as the sender, we verify it with a code that our telephony provider sends to that number, and store the confirmed number. The legal basis is Art. 6(1)(b) GDPR.

5.12 Invitations

If someone from your company invites you, we receive your email address, your name where applicable and the intended role from the person inviting you. We use this information for the invitation; invitations that are not accepted expire after seven days. The legal basis is Art. 6(1)(f) GDPR, your company’s interest in giving you access.

5.13 Businesses submitted by partners

Partners can submit a business to us or ask us for an introduction. We then receive from the partner the name and location of the business, where applicable the name, email address and phone number of the contact person, and a note on the relationship; later, we record the status of the discussions. We use this to approach the business at its request and to attribute the submission to the partner in a traceable manner. The legal basis is Art. 6(1)(f) GDPR: the initiation of a contract and traceable attribution of commission.

5.14 Customer references

As a reference, we state only the company name and, where applicable, a verified logo of a paying customer whose accepted Terms and Conditions govern naming as a reference. We do not publish content, conversation data or statements about use. The legal basis is Art. 6(1)(f) GDPR; our interest is in showing prospective customers truthfully which companies use rinqo. For particularly sensitive industries, we publish only after express approval. Naming as a reference ends when your paid subscription ends or when you object; a message in text form to hello@rinqo.de is sufficient.

5.15 Assistant in your account

Owners and administrators can put questions to the assistant in the account and have it propose changes. Your question and the previous messages of the conversation are sent to a language model (section 8). To answer, the assistant reads data from your account as needed, such as agents, contacts, conversations, appointments, team members and invoices, and passes the necessary extracts to the language model. Only your open browser window holds the conversation history. On our servers, we store for each message the usage and a log entry with the time, your user identifier and the functions called (section 14). We store changes you confirm like any other change in your account.

6. Conversations with a company’s AI agents

If you reach a rinqo agent on a company’s website, under its phone number or in its mailbox, that company is the controller of your data (Art. 4(7) GDPR). rinqo processes the data on its behalf (Art. 28 GDPR). Information on this is provided by that company, for example in its privacy policy, and you exercise your rights with that company.

For our own purposes, we use two things from these conversations: call minutes and the number of messages per company, in order to bill the company, and a counter per phone number or sender address recording how often someone makes contact within one hour. If a phone number or address exceeds the limit, the agent accepts nothing further from it for the rest of that hour. The counter contains the phone number or address and deletes itself after one hour. The legal basis is Art. 6(1)(f) GDPR; our interest is correct billing and protection against abuse that would use up the company’s balance.

7. Hosting

The platform, including its database and voice service, runs on servers of a hosting provider in Germany; encrypted backup copies are held by the same provider in the EU.

8. Recipients

This section sets out who receives data from our own processing. For our operations, we use processors under Art. 28 GDPR; we name them by category, with their activity and country:

  • Hosting: the platform’s servers (Germany) and encrypted backup copies (EU).
  • Language model: replies of the assistant and of the test agent, summary of your website in the preview (France).
  • Speech services in the test call: speech recognition (France) and speech output (Germany).
  • Telephony: phone numbers, SMS codes and the details provided when ordering a phone number (Ireland).
  • Email delivery: notices about account and contract, invoices, setup guidance and product news (France).
  • Status page: display of availability at status.rinqo.de; anyone who visits it transmits their IP address to the provider in doing so (Czechia).

The following also receive data: Mollie B.V. (Netherlands) as an independent controller for payments (section 12), which, according to its own privacy policy, may also use service providers outside the European Economic Area; the partner to whom you are attributed via a referral code (section 5.8); the tax authorities, for example when the VAT identification number is verified through the European Commission’s VAT Information Exchange System; and, where applicable, our tax advisers. We operate audience measurement and server logs ourselves in Germany.

The service providers we use for the agents on behalf of the companies are set out in the list of sub-processors, which customers can find in their account (the “Contracts and data” area); prospective customers receive it on request to privacy@rinqo.de.

9. Training of AI models

We ourselves do not use content from accounts, conversations or knowledge bases to train AI models.

10. Data Act: jurisdiction and protection of non-personal data

In accordance with Art. 28 of Regulation (EU) 2023/2854 (Data Act), we state the following: the application, database and voice service run in data centres in Germany, and encrypted backup copies are held in Finland. This infrastructure is subject to the law of these states and of the EU. Individual functions are provided by service providers in France, Ireland, Czechia and Germany, whose infrastructure is subject to the law of the respective country. We protect non-personal data held in the EU against governmental access from third countries that would conflict with Union law or the law of a Member State: technically (encryption, access controls), organisationally (access only where necessary; case-by-case review of every request from an authority) and contractually, in that we engage service providers only under a contract pursuant to Art. 28 GDPR. We do not thereby rule out such access in every case. The rules on switching providers and data export are set out in section 7 of our Terms and Conditions.

11. Cookies and storage on your device

The platform stores information on your device or reads it from there to the extent that this is strictly necessary for the function you are currently using (§ 25 Abs. 2 Nr. 2 TDDDG). These are cookies for the session, for protection against forged requests (including when connecting a calendar or mailbox), for the selected organisation, for the language and for whether the sidebar is expanded or collapsed. The app stores in your device’s browser storage the settings you choose yourself, such as the appearance, dismissed notices or drafts not yet sent, and, in the preview, your input until the end of the session. The app also measures in your browser how quickly a page loads (section 5.6). For referrals, only the visible field under section 5.8 applies.

On the preview pages and the sign-in and sign-up pages, we count page views and individual steps of the sign-up process. This happens on our server, without a cookie and without a script in the browser: the server reports the page requested, the page visited before it, the IP address and the user agent to our own measurement system in Germany. From these, the system derives a value that changes daily, with which visits on the same day can be counted together, and it stores neither the IP address nor the user agent. The legal basis is Art. 6(1)(f) GDPR; our interest is in identifying the steps of the sign-up process at which prospective customers drop out.

12. Payments and billing

Payments are processed by Mollie B.V. Mollie and rinqo are independent controllers for their respective processing; how Mollie processes data is set out in Mollie’s privacy policy. We store customer and payment identifiers, payment status, invoice details and, for SEPA Direct Debit, the mandate reference, the evidence of the mandate and the pre-notification and the bank details that Mollie transmits to us for this purpose. The legal bases are Art. 6(1)(b) and (c) GDPR.

13. Communication by email

We send messages about your account and contract (such as password resets, invoices and security notices) via our email service provider (section 8). The legal basis is Art. 6(1)(b) GDPR. In the first seven days after registration, we send you up to three emails with setup guidance; each of these emails contains an unsubscribe link.

We send you product news and tips only if you have subscribed to them (Art. 6(1)(a) GDPR). We record, as evidence, when and with which wording you subscribed. You can withdraw your consent at any time: in your account under “Notifications”, via the unsubscribe link in each of these emails or with a message to privacy@rinqo.de.

14. Storage period

  • Account: until termination; deletion within 30 days thereafter, unless a statutory retention obligation applies. The data disappears from our encrypted backup copies no later than 30 days after that.
  • Preview: session no more than one hour, summarised information about your website no more than two hours.
  • Access requests: 365 days after the decision on the request.
  • Server logs and performance measurement values: until they are overwritten (section 5.4).
  • Calendar data: as long as it lies within the synchronisation window (section 5.9); on disconnection, immediately from the live system and from backup copies after 30 days at the latest.
  • Invitations: invitations not accepted expire after seven days.
  • Referral code and partner attribution: for the term of the customer contract; commission statements in the same way as accounting vouchers.
  • Customer reference: until you object or your paid subscription ends.
  • Commercial and business letters, such as emails on the conclusion and termination of contracts: 6 years (§ 147 Abs. 3 AO, § 257 Abs. 4 HGB).
  • Invoices and accounting vouchers: 8 years, calculated from the end of the calendar year in which they were issued (§ 147 Abs. 3 and 4 AO, § 257 Abs. 4 and 5 HGB, § 14b UStG).
  • Books, annual financial statements, inventories: 10 years (§ 147 Abs. 3 AO).
  • Log of actions relevant to data protection, including the assistant’s log entries: 365 days.
  • Earlier versions of agent settings (for “Undo”): 30 days.
  • Businesses submitted by partners and reservations: 365 days after completion or expiry.
  • Application notes and reasons for rejection: 365 days after the decision has been finalised. We retain identity, contract and accounting records of accepted partners in the same way as invoices and accounting vouchers.
  • Consent to product news: until withdrawn and thereafter for as long as we must be able to prove it.
  • Open security and deletion tasks: until their documented completion, even if the regular period ends earlier.

How long conversations with AI agents are stored is determined by the company that operates the agent (section 6).

15. Your right to object

Where we process data on the basis of Art. 6(1)(f) GDPR, you can object at any time on grounds relating to your particular situation (Art. 21(1) GDPR). You can object at any time, without giving reasons, to processing for direct marketing (Art. 21(2) GDPR); we will then no longer use your data for that purpose. A message to privacy@rinqo.de or the unsubscribe link is sufficient.

16. Your other rights

Under the GDPR, you have the right to

  • access (Art. 15),
  • rectification (Art. 16),
  • erasure (Art. 17),
  • restriction of processing (Art. 18),
  • data portability (Art. 20),
  • withdraw consent you have given (Art. 7(3)), with effect for the future.

Exercising these rights is, as a rule, free of charge for you (Art. 12(5) GDPR). To do so, contact privacy@rinqo.de. You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), for example with the State Commissioner for Data Protection and Freedom of Information Baden-Württemberg as the authority competent for us, or with the supervisory authority of your place of residence.

17. Automated decisions

If a payment is not received, the consequences agreed in our Terms and Conditions (section 6) take effect automatically after fixed periods: after three days, the subscription’s allowance is blocked; after seven days, the agents no longer make outgoing calls or send outgoing messages; after 14 days, the subscription ends. The sole criterion is whether the payment has been received. You can request that a human review the case, set out your point of view and contest the decision; a message to privacy@rinqo.de is sufficient. We do not take any other decisions based solely on automated processing which produce legal effects concerning you or similarly significantly affect you (Art. 22 GDPR).

18. Target group

The platform is aimed at companies and their employees aged 18 or over. Private individuals aged 18 or over can take part in the partner programme as referrers. We do not knowingly process data of minors.

19. Changes to this policy

We amend this privacy policy when our processing operations change or the legal situation changes. The version stated above is authoritative.

Last updated: 30 September 2026.