Only technically necessary cookies, no marketing or analytics cookies (section 3).
The platform runs in Hetzner data centres in Germany (section 6.1).
Without explicit activation by your organisation, nothing is sent to AI providers (section 6.2).
Server log files are deleted automatically after 7 days at the latest (section 2).
This summary does not replace the full text. The wording of the respective section is authoritative.
1Controller
The controller within the meaning of the General Data Protection Regulation (GDPR) and other data protection provisions is:
2Provision of the website & server log files
Each time our website is accessed, our system automatically collects data and information from the computer system of the accessing device. The following data is stored in the server log files:
- IP address
- Date and time of access
- Browser type and version
- Operating system
- Referrer URL (previously visited page)
- Requested URL and amount of data transferred
3Cookies
Lalabase uses only technically necessary cookies that are strictly required to operate the application: in particular to maintain your login session and to switch between organisations.
We use no tracking, marketing or analytics cookies. Separate consent is therefore not required. In the technically necessary session we remember which page brought you to us; this is only stored permanently if you register. Details in section 4.2.
4Registration & user account
A user account is required to use Lalabase. When it is created, we collect the following data:
- First name and last name
- Email address
- Password (stored exclusively as a bcrypt hash, never in plain text)
- Time of registration and of the last login
4.1 Application for the new-business discount (voluntary)
When registering, you can apply for a discount for newly founded businesses. This information is voluntary and is only collected if you explicitly request the application. If you do not apply, the fields are not displayed; registration is fully possible without them. If you apply for the discount, we additionally collect:
- Company name and registered office
- Date of incorporation
- Approximate annual turnover, as a range rather than an exact amount
- Phone number for the call back
4.2 Where your registration came from
When you visit our website, we remember in your session which page and which referral brought you to us. If you then register, we store this information once with your account:
- the first page you opened
- campaign identifiers from the link, if any (such as
reforutm_source) - the web address of the referring page, only its host name and never the full path
- the time of the first visit
5Use of the platform functions
Content that you create or upload in Lalabase within your organisation, such as tickets, documents, comments, time entries and attachments, is stored in order to provide the functions.
Data of different organisations is strictly separated (multi-tenancy). Members of other organisations have no access whatsoever to your content.
6Recipients of data & processors
6.1 Hosting with Hetzner Online GmbH
The Lalabase platform is hosted in data centres of Hetzner Online GmbH, Industriestraße 25, 91710 Gunzenhausen, Germany. All data remains on servers within Germany.
A data processing agreement pursuant to Art. 28 GDPR is in place with Hetzner.
6.2 AI functions: activation and choice of provider
AI-supported functions (e.g. AI assistant, automatic summaries, intelligent search, semantic links) are deactivated by default. They are only used after an administrator of your organisation has explicitly activated the AI features in the settings. After activation, the related content (e.g. tickets, notes, comments, documents, meetings including transcripts and meeting notes, content of connected repositories) is transmitted to one or more of the AI providers named in sections 6.3 to 6.7. Chat answers and semantic search use separately configured access and may be handled by different providers. Which providers these are is determined by the AI package chosen by your organisation or by its own provider configuration; administrators can see the current assignment, including its legal classification, at any time in the AI settings, and the chat interface permanently shows the active providers.
| Provider | Registered office | Processing | Third-country basis |
|---|---|---|---|
| OpenAI, L.L.C. | San Francisco, USA | USA | EU-US Data Privacy Framework + SCC (Art. 46(2)(c) GDPR) |
| Anthropic, PBC | San Francisco, USA | USA | DPA with SCC (Art. 46(2)(c) GDPR) |
| Google Vertex AI | Google Cloud EMEA, Dublin, Ireland | EU region (e.g. Frankfurt) | Group access possible: DPF + SCC |
| Mistral AI SAS / IONOS SE / OVH SAS | Paris · Montabaur · Roubaix | EU only | No third-country transfer, DPA pursuant to Art. 28 GDPR |
| Own key or own endpoint | determined by you | determined by you | Choosing and vetting the recipient is up to your organisation |
6.3 OpenAI (AI functions)
If your organisation's AI configuration provides for OpenAI as the provider, the related content is transmitted to OpenAI, L.L.C., 3180 18th Street, San Francisco, CA 94110, USA, and processed there. The activation requirement from section 6.2 applies.
6.4 Anthropic (AI functions)
If your organisation's AI configuration provides for Anthropic as the provider, the related content is instead transmitted to Anthropic, PBC, 548 Market Street, San Francisco, CA 94104, USA, and processed there. The same activation requirement as in 6.2 applies: without explicit activation by an administrator of your organisation, no transfer takes place.
6.5 Google Vertex AI (AI functions, EU region)
If your organisation's AI configuration provides for Google Vertex AI, the related content is transmitted to Google Cloud EMEA Limited, 70 Sir John Rogerson's Quay, Dublin 2, Ireland, and processed in an EU region (e.g. europe-west3, Frankfurt am Main). The activation requirement from section 6.2 applies.
6.6 European AI providers: Mistral AI, IONOS, OVHcloud
If your organisation's AI configuration provides for one of the following European providers, the related content is transmitted to that provider and processed exclusively within the EU:
- Mistral AI SAS, 15 rue des Halles, 75001 Paris, France
- IONOS SE, Elgendorfer Straße 57, 56410 Montabaur, Germany
- OVH SAS (OVHcloud AI Endpoints), 2 rue Kellermann, 59100 Roubaix, France
6.7 Own credentials and own endpoints
Instead of the providers named above, your organisation can store its own credentials or connect its own OpenAI-compatible endpoint (e.g. a self-hosted language model). In this case your organisation determines the recipient of the content itself; choosing this recipient and assessing it under data protection law is the responsibility of your organisation.
6.8 Fonts
All web fonts used (Archivo, JetBrains Mono, Inter) are hosted on our own servers at Hetzner in Germany. There is no transfer to third parties (in particular no transfer to Google).
6.9 Booking an appointment
On our pages you can book a call via a scheduling calendar. This is a link, not an embed: the calendar is not loaded on our pages. As long as you do not click the link, no data is transferred to the provider.
With the click you leave our pages and go to Calendly LLC, USA. If you book an appointment there, Calendly processes the data you provide (usually name, email address, chosen time slot and any message) on our behalf so that we can keep the appointment. The legal basis is Art. 6(1)(b) GDPR (steps taken at your request prior to entering into a contract). Processing takes place in the USA; the transfer is based on a data processing agreement together with standard contractual clauses (Art. 46(2)(c) GDPR).
7Email communication
Lalabase sends transactional emails (e.g. notifications, password resets, invitations). For this, your email address and the respective message content are processed.
Emails are sent via the mail infrastructure of Hetzner Online GmbH, Industriestraße 25, 91710 Gunzenhausen, Germany. There is no transfer to a US email service provider. A data processing agreement pursuant to Art. 28 GDPR is in place with Hetzner.
8Your rights
You have the following rights towards us with regard to the personal data concerning you:
You can request information about the data stored about you.
We have inaccurate data corrected and incomplete data completed.
You can request the erasure of your data unless a statutory retention obligation prevents it.
Instead of erasure, you can request that processing be restricted.
You receive your data in a structured, commonly used format for transfer to another controller.
You can object to the processing of your data where it is based on legitimate interest.
You can withdraw consent you have given at any time with effect for the future.
Competent authority: Die Landesbeauftragte für den Datenschutz Niedersachsen (the State Commissioner for Data Protection of Lower Saxony), Prinzenstraße 5, 30159 Hannover.
An informal message to info@lalabase.com is sufficient to exercise these rights.
9Data security
We take technical and organisational measures to protect your data against accidental or intentional manipulation, loss, destruction or unauthorised access:
- Encrypted transmission (TLS/HTTPS) on all pages
- Passwords are hashed with modern methods (bcrypt), never stored in plain text
- Strict tenant separation across the entire data layer
- Regular backups, stored encrypted
- Access to production systems for authorised personnel only
10Changes to this policy
We reserve the right to adapt this privacy policy when legal requirements or functions of our platform change. The current version is always available on this page.
September 2026. This privacy policy is continuously adapted to the actual data processing.