Valurec is a brand and product of Donnerstag.ai Technologies GmbH. This privacy policy therefore also applies to the Valurec website and the Valurec platform.
Thank you for your interest in donnerstag.ai. The protection of your personal data is important to us. The following information sets out comprehensively how we process personal data collected when you visit our website and when you use the donnerstag.ai platform. The processing of your data is carried out exclusively in accordance with applicable data protection laws, in particular the General Data Protection Regulation (GDPR) and the German Federal Data Protection Act (BDSG).
Controller within the meaning of the GDPR
Donnerstag.ai Technologies GmbH
Am Steinernen Stock 1
60320 Frankfurt am Main
Germany
Phone: +49 (0) 69 348 78 27 20
Email: privacy@donnerstag.ai
Data Protection Officer
PROLIANCE GmbH
Leopoldstr. 21
80802 München
Our privacy policy is intended to be straightforward and comprehensible for everyone. Where appropriate, we use the official terms of the General Data Protection Regulation (GDPR). The official definitions can be found in Article 4 GDPR.
We engage several technical service providers to operate our website and the donnerstag.ai platform, on the basis of processor agreements pursuant to Article 28 GDPR. Where personal data is transferred to third countries in this context, this is carried out exclusively under appropriate safeguards (see Section 16).
4.1 Website hosting (Framer)
The donnerstag.ai website is hosted by Framer B.V., Krijn Taconiskade 426, 1087 HW Amsterdam, Netherlands. During website operation, personal data (in particular IP addresses, user agent, request logs and page view events) is processed on Framer’s servers within the European Union. The hosting service itself relies on Article 6(1)(f) GDPR (legitimate interest in the technically correct provision of the website and IT security). The additional analytics functions (page views, session telemetry for performance evaluation) are activated only on the basis of your consent obtained via our consent banner (Article 6(1)(a) GDPR in conjunction with Section 25(1) TTDSG). A Data Processing Agreement (DPA) pursuant to Article 28 GDPR has been concluded with Framer.
Framer Privacy Policy: https://www.framer.com/legal/privacy
4.2 Frontend hosting (Vercel)
Parts of our platform’s frontend application (Next.js) are additionally provided by Vercel Inc., 340 S Lemon Ave #4133, Walnut, CA 91789, USA. The data processed includes IP addresses and request and performance logs. Since this may involve the transfer of personal data to the United States, we have entered into Standard Contractual Clauses pursuant to Article 46(2)(c) GDPR with Vercel. The legal basis is Article 6(1)(f) GDPR.
Vercel Privacy Policy: https://vercel.com/legal/privacy-policy
4.3 Backend infrastructure (Microsoft Azure)
The backend of the donnerstag.ai platform runs on Microsoft Azure cloud infrastructure. The provider is Microsoft Ireland Operations Ltd., One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland. All processing takes place exclusively in data centres within the European Union. Any intra-group transfers to Microsoft Corporation (USA) are safeguarded by Standard Contractual Clauses pursuant to Article 46(2)(c) GDPR and by Microsoft’s approved Binding Corporate Rules.
Microsoft Privacy Statement: https://privacy.microsoft.com/en-us/privacystatement
4.4 Database and backend services (Supabase)
The primary application database and authentication and storage services are provided by Supabase Inc., 970 Toa Payoh North, #07-04, Singapore 318992. Data processing takes place on servers within the European Union (eu-central-1 · Frankfurt region). Any support-related access from third countries is safeguarded by Standard Contractual Clauses pursuant to Article 46(2)(c) GDPR.
Supabase Privacy Policy: https://supabase.com/privacy
4.5 Supplementary cloud infrastructure (Google Cloud Platform)
We additionally use Google Cloud Platform, provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, for specific compute and storage workloads. Processing takes place exclusively in data centres within the European Union. Any intra-group transfers to Google LLC (USA) are safeguarded by the EU-U.S. Data Privacy Framework (Google LLC is DPF-certified) and supplementary Standard Contractual Clauses pursuant to Article 46(2)(c) GDPR.
Google Cloud Privacy Notice: https://cloud.google.com/terms/cloud-privacy-notice
When you visit our website, technically necessary data is transmitted by your internet browser to our web server. During an active connection, the following data is recorded to enable communication between your browser and our web server:
Operating system and browser type/version;
Hostname and public IP address of the requesting device;
Date and time of the request;
URL of the referring website (referrer URL);
Volume of data transferred.
The legal basis for the temporary storage of log files is Article 6(1)(f) GDPR. Our legitimate interest lies in ensuring system security and stability and in protecting against attacks. The data is anonymised after 7 days at the latest by truncating the IP address at the domain level. The data is not stored together with other personal data, nor is it shared with any third party.
6.1 Cookies in general
Our website uses what are known as cookies: small text files that are stored either temporarily for the duration of a session (session cookies) or permanently (persistent cookies) on your device. Cookies serve various functions: some are technically necessary, others are used to analyse website usage or support marketing activities.
Technically necessary cookies are stored on the basis of Article 6(1)(f) GDPR and Section 25(2) of the German Telecommunications Telemedia Data Protection Act (TTDSG). All other cookies (in particular for analytics and marketing purposes) are used exclusively with your consent under Article 6(1)(a) GDPR and Section 25(1) TTDSG. You may withdraw your consent at any time with effect for the future.
6.2 Consent management with Cookiebot
To obtain, manage and audit-proof document your consents, we use the consent management service Cookiebot provided by Cybot A/S (Havnegade 39, 1058 Copenhagen, Denmark; part of the Usercentrics group). When you visit our website, Cookiebot sets a technically necessary cookie and pseudonymously documents your consent decision. The processing serves to fulfil our documentation obligation under Article 7(1) GDPR (legal basis: Article 6(1)(c) GDPR). A Data Processing Agreement has been concluded with Cookiebot; all processing takes place within the EU.
Cookiebot Privacy Policy: https://www.cookiebot.com/en/privacy-policy/
6.3 Managing your cookie preferences
You may withdraw or modify your cookie preferences at any time via the cookie banner (link in the footer of our website). You can also configure your browser to be notified about cookies being set or to refuse cookies entirely. If you disable cookies entirely, some functionality of our website may be impaired.
The tools described in this section are activated exclusively after you have given your explicit consent via our consent banner. The legal basis is Article 6(1)(a) GDPR and Section 25(1) TTDSG.
7.1 Google Tag Manager
We use Google Tag Manager, provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, to centrally manage the tags used on our website. The Tag Manager itself does not set cookies and does not collect personal data; however, it enables the integration of other tools that do collect data. IP addresses may be transmitted to Google in the United States in this context; such transfers are safeguarded by Standard Contractual Clauses pursuant to Article 46(2)(c) GDPR and the EU-U.S. Data Privacy Framework.
7.2 Google Analytics
We use Google Analytics 4 (Google Ireland Limited) to analyse the usage behaviour of our visitors. Google Analytics sets cookies that allow your browser to be recognised. We use Google Analytics exclusively with IP anonymisation activated, your IP address is truncated before being stored. Transfers to the United States are possible and are safeguarded by SCCs and the EU-U.S. Data Privacy Framework. Data is deleted at the user and event level at the latest 14 months after collection.
7.3 Google Ads with conversion tracking
We use Google Ads (Google Ireland Limited) to run advertising campaigns and to measure their effectiveness via conversion tracking. If you reach our website by clicking a Google ad, a cookie is stored on your device (typically valid for 30 days). This cookie allows Google and us to recognise whether the ad led to a conversion (e.g. a demo request). No personal identification of you takes place; we only receive statistical reports.
7.4 Microsoft Advertising (formerly Bing Ads)
We use the conversion tracking of Microsoft Corporation, One Microsoft Way, Redmond, WA 98052-6399, USA. If you reach our website via a Microsoft Advertising ad, a conversion cookie is stored on your device (valid for 30 days). The cookie serves conversion measurement and does not identify you personally. Since transfers to the United States may occur, we have entered into Standard Contractual Clauses pursuant to Article 46(2)(c) GDPR with Microsoft.
7.5 LinkedIn Insight Tag
We use the conversion tracking and retargeting technology of LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland. For this purpose, a cookie (the LinkedIn Insight Tag) with a validity of 120 days is set in your browser, allowing LinkedIn to create anonymised reports on the performance of our advertising and information about website interaction. Data may be transferred to the United States; such transfers are safeguarded by Standard Contractual Clauses pursuant to Article 46(2)(c) GDPR. You may deactivate the LinkedIn Insight Tag and personalised advertising at any time:
LinkedIn opt-out: https://www.linkedin.com/psettings/guest-controls/retargeting-opt-out
7.6 Leadfeeder (B2B visitor identification)
We use Leadfeeder, a service provided by Liidio Oy, Mikonkatu 17 C, 00100 Helsinki, Finland. Based on the IP address of website visitors, Leadfeeder identifies the associated company in order to qualify B2B sales leads. No personal identification of individual visitors takes place, we receive information about the organisation, not about the natural person. The data processed includes IP address, browser information, referrer, pages visited and time on site. This service is activated exclusively on the basis of your consent obtained via our consent banner (Article 6(1)(a) GDPR; as an alternative ground we rely on Article 6(1)(f) GDPR, legitimate interest in B2B sales initiation). Data processing takes place exclusively within the EU; the retention period is a maximum of 24 months.
Leadfeeder Privacy Policy: https://www.leadfeeder.com/privacy/
For contact forms, meeting scheduling and our Customer Relationship Management (CRM), we use HubSpot Germany GmbH, Am Postbahnhof 17, 10243 Berlin, Germany. HubSpot is a subsidiary of HubSpot, Inc. (USA); data processing takes place in data centres within the European Union. A Data Processing Agreement pursuant to Article 28 GDPR has been concluded with HubSpot. Any intra-group transfers to the United States are safeguarded by Standard Contractual Clauses pursuant to Article 46(2)(c) GDPR and supplementary HubSpot approved Binding Corporate Rules.
8.1 Contact form
If you contact us via the contact form on our website or by email, the information you provide (at minimum your name and email address; voluntarily: phone number and the content of your enquiry) is stored for the purpose of processing the enquiry and for any follow-up questions. The legal basis is Article 6(1)(f) GDPR and, where applicable, Article 6(1)(b) GDPR insofar as your enquiry is aimed at entering into a contract.
8.2 Meeting scheduling
You may schedule a meeting with us via the HubSpot meeting tool embedded on our website. The data you provide (name, email address, selected time, optional further details) is transmitted to the relevant contact person in our company and stored in our CRM. You will receive a confirmation of the meeting by email. The legal basis is Article 6(1)(f) GDPR (efficient meeting scheduling) and Article 6(1)(b) GDPR in the context of contract initiation.
8.3 Newsletter and marketing automation
If you have subscribed to our newsletter or otherwise consented to marketing communications, we process your data via HubSpot’s marketing automation on the basis of your consent (Article 6(1)(a) GDPR). You may withdraw this consent at any time with effect for the future, e.g. by clicking the unsubscribe link in any marketing email.
HubSpot Privacy Policy: https://legal.hubspot.com/privacy-policy
As part of our B2B sales activities we proactively approach potential business partners and decision-makers. In this context we process business contact data of employees at other companies on the basis of our legitimate interest in initiating business relationships (Article 6(1)(f) GDPR; Recital 47 GDPR).
9.1 Information for recipients of our outbound communications
If you received a business email or other approach from us without previously having provided your data to us, this privacy policy fulfils our information duty pursuant to Article 14 GDPR.
Categories of personal data: name, business role, company name, business email address, and where applicable publicly available LinkedIn profile URL and company metadata.
Source of the data: publicly accessible sources (in particular company websites, business databases, professional networks such as LinkedIn) and specialised B2B data providers.
Purpose of processing: initiating business relationships and informing you about our services.
Legal basis: Article 6(1)(f) GDPR (legitimate interest in business initiation).
Storage period: until your objection, but no longer than 24 months after the last contact attempt.
Your right to object: you may object to the processing at any time without giving reasons, e.g. by email to privacy@donnerstag.ai or via the unsubscribe link in any of our outreach emails.
9.2 Service providers used
To carry out outbound communications, we engage the following processors:
Lemlist (lempire SAS)
lempire SAS, 55 rue de Bretagne, 75003 Paris, France, operates the platform for executing outbound sales campaigns, including sequence automation and reply tracking. Data processing takes place exclusively within the EU. A Data Processing Agreement has been concluded with lempire.
Lemlist Privacy Policy: https://www.lemlist.com/privacy
Clay (Clay Labs, Inc.)
Clay Labs, Inc., 228 Park Avenue South, PMB 87826, New York, NY 10003, USA, operates the platform for enriching and aggregating B2B business data from publicly accessible sources and specialised providers. Since transfers to the United States may occur, we have entered into Standard Contractual Clauses pursuant to Article 46(2)(c) GDPR with Clay.
Clay Privacy Policy: https://www.clay.com/privacy
10.1 Data processing within the platform
When you use the donnerstag.ai platform we may carry out the following processing activities:
Upload, processing and parsing of invoices, credit notes and accounting documents;
Creation and management of service records;
Automated invoice reconciliation with AI support;
Use of AI-powered text processing and assistive features;
Processing of user interactions to improve the user experience.
In particular, the following personal data may be processed: information from uploaded documents (e.g. names, addresses and contact details on invoices and receipts), manually entered service data, IP address and timestamps, as well as content within chat and assistive features.
The legal basis is Article 6(1)(b) GDPR (performance of a contract) and Article 6(1)(f) GDPR (legitimate interest in improving and securing our platform). All platform data is stored on Microsoft Azure and Supabase servers within the European Union.
10.2 OpenAI (GPT models)
For AI-powered content processing we use the GPT models of OpenAI, L.L.C., 3180 18th Street, San Francisco, CA 94110, USA. Processing takes place via the OpenAI Enterprise API; the use of your inputs for model training is contractually excluded (zero data retention). We have entered into Standard Contractual Clauses pursuant to Article 46(2)(c) GDPR with OpenAI.
OpenAI Privacy Policy: https://openai.com/policies/privacy-policy
10.3 Anthropic Claude
We additionally use the Claude models of Anthropic, PBC, 548 Market Street, PMB 90375, San Francisco, CA 94104, USA, via the Anthropic Commercial API. The use of your inputs for model training is contractually excluded (zero data retention; maximum 30-day retention for abuse monitoring). We have entered into Standard Contractual Clauses pursuant to Article 46(2)(c) GDPR with Anthropic.
Anthropic Privacy Policy: https://www.anthropic.com/legal/privacy
10.4 LandingAI (computer vision)
To extract structured data from scanned or photographed invoices and documents, we use the computer vision platform of LandingAI, Inc., 530 Lytton Avenue, Palo Alto, CA 94301, USA. The data processed includes images of uploaded documents and the personal data they contain. The use of this data for model training is contractually excluded. We have entered into Standard Contractual Clauses pursuant to Article 46(2)(c) GDPR with LandingAI.
LandingAI Privacy Policy: https://landing.ai/privacy
10.5 LlamaIndex (RAG framework)
For semantic search and contextual retrieval on your documents within our platform, we use the LlamaCloud service of LlamaIndex, Inc., 575 Market Street, San Francisco, CA 94105, USA. Vector embeddings are generated and stored from your uploaded documents. The use of this data for model training is contractually excluded. We have entered into Standard Contractual Clauses pursuant to Article 46(2)(c) GDPR with LlamaIndex.
LlamaIndex Privacy Policy: https://www.llamaindex.ai/privacy
10.6 The role of donnerstag.ai in data processing
The controller within the meaning of the GDPR for the operation of the website and the donnerstag.ai platform is Donnerstag.ai Technologies GmbH as identified in Section 2. To deliver the platform we engage technical service providers as processors pursuant to Article 28 GDPR and, where required, as independent controllers (e.g. for certain tracking or advertising services).
For payment processing, subscription management and invoicing, we use Stripe Payments Europe, Ltd., The One Building, 1 Grand Canal Street Lower, Dublin 2, Ireland. Depending on the chosen payment method, payment data (encrypted by Stripe), billing address and transaction history are processed. The legal basis is Article 6(1)(b) GDPR (performance of a contract). A Data Processing Agreement pursuant to Article 28 GDPR has been concluded with Stripe.
Stripe Privacy Policy: https://stripe.com/privacy
12.1 Transactional emails (Resend)
For the delivery of transactional emails (e.g. meeting confirmations, login and security notifications, system messages) we use Resend Inc., 2261 Market Street #5039, San Francisco, CA 94114, USA. The data processed includes your email address, your name and the content of the transactional message. The legal basis is Article 6(1)(b) GDPR (performance of a contract). We have entered into Standard Contractual Clauses pursuant to Article 46(2)(c) GDPR with Resend.
Resend Privacy Policy: https://resend.com/legal/privacy-policy
12.2 Cloud telephony (sipgate)
For handling inbound and outbound business calls, we use the cloud telephony platform of sipgate GmbH, Gladbacher Str. 74, 40219 Düsseldorf, Germany. Data processed includes phone numbers, call times and durations and connection metadata. Call content is not stored. Processing takes place exclusively in Germany. The legal basis is Article 6(1)(b) GDPR (performance of a contract) and Article 6(1)(f) GDPR (legitimate interest in efficient business communication).
sipgate Privacy Policy: https://www.sipgate.de/en/privacy
For the electronic signing of contracts we use the platform of DocuSign, Inc., 221 Main Street, Suite 1550, San Francisco, CA 94105, USA. The data processed includes your signer information (name, email, where applicable role), the contract document, the signing audit trail and the IP address at the time of signature. The legal basis is Article 6(1)(b) GDPR (performance of a contract). DocuSign is certified under the EU-U.S. Data Privacy Framework; in addition we have entered into Standard Contractual Clauses pursuant to Article 46(2)(c) GDPR.
DocuSign Privacy Policy: https://www.docusign.com/company/privacy-policy
Our website contains links to external websites (e.g. to our social media profiles). When you click such a link you are redirected to the page of the respective provider; only following this redirection is user information transmitted to the provider. Information on how your personal data is processed when you use these websites can be found in the privacy notices of the respective providers.
donnerstag.ai follows an EU-first principle: wherever possible, your data is processed within the European Union. Where transfers to third countries outside the EEA are nevertheless necessary, they take place exclusively under appropriate safeguards pursuant to Chapter V of the GDPR. The following table summarises the current third-country transfers:
Recipient
Country · Purpose
Safeguard
Vercel Inc.
USA · Frontend hosting
SCC
OpenAI, L.L.C.
USA · AI content analysis (GPT)
SCC + Zero Data Retention
Anthropic, PBC
USA · AI content analysis (Claude)
SCC + Zero Data Retention
LandingAI, Inc.
USA · Computer vision (OCR)
SCC
LlamaIndex, Inc.
USA · RAG / embeddings
SCC
Clay Labs, Inc.
USA · B2B data enrichment
SCC
Resend Inc.
USA · Transactional email
SCC
DocuSign, Inc.
USA · Electronic signatures
SCC + DPF
Microsoft Corporation
USA · Intra-group transfer
SCC + BCR
Google LLC (via Google Ireland)
USA · Analytics, Ads, Cloud
SCC + DPF
LinkedIn Corporation (via Ireland)
USA · Insight Tag, Social Media
SCC
Microsoft Corporation (Ads)
USA · Bing Ads conversion
SCC
Overview of safeguards in place:
Standard Contractual Clauses (SCCs) pursuant to Article 46(2)(c) GDPR in conjunction with Commission Implementing Decision (EU) 2021/914 for all transfers to the United States.
EU-U.S. Data Privacy Framework (DPF) pursuant to Article 45 GDPR as an additional safeguard where the relevant US recipient is DPF-certified.
Binding Corporate Rules (BCR) as a supplementary safeguard for intra-group transfers (in particular Microsoft and HubSpot).
Supplementary technical and organisational measures including encryption in transit and at rest, pseudonymisation and strict access controls.
We process your personal data on the following legal bases, depending on the specific processing context:
Article 6(1)(a) GDPR (consent): e.g. for analytics, marketing and tracking cookies, newsletter subscriptions.
Article 6(1)(b) GDPR (contract / pre-contractual measures): e.g. for contact enquiries, demo bookings, contract conclusion and platform use.
Article 6(1)(c) GDPR (legal obligation): e.g. for the documentation of consents and statutory retention obligations under tax and commercial law.
Article 6(1)(f) GDPR (legitimate interest): e.g. for IT security, stability, abuse prevention, the technical provision of the website and B2B sales outreach.
Pursuant to Article 32 GDPR, taking into account the state of the art, the costs of implementation, and the nature, scope, circumstances and purposes of the processing, we implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk. These include in particular:
SSL/TLS encryption of all data transmissions between your device and our systems;
Encryption of stored personal data (at rest);
Strict access controls following the need-to-know principle;
Regular security audits and penetration tests;
Regular data protection and information security training for all staff.
All platform data is stored exclusively on servers within the European Union (Microsoft Azure and Supabase, in Frankfurt and Dublin respectively).
The duration for which personal data is stored is determined by the applicable statutory retention obligations (in particular those under commercial and tax law, typically 6 or 10 years). After the relevant period expires, the corresponding data is routinely deleted. Where data is required for the performance or initiation of a contract or where we have a legitimate interest in continued storage, the data will be deleted once it is no longer required for those purposes or once you have exercised your right to withdrawal or objection.
As a data subject under the GDPR you have comprehensive rights. In particular:
Right of access (Article 15 GDPR): information about the personal data we process about you, including processing purposes, data categories, recipients and storage periods.
Right to rectification (Article 16 GDPR): immediate rectification of inaccurate, or completion of incomplete, personal data.
Right to erasure (Article 17 GDPR): deletion of your personal data stored by us, provided no statutory retention obligations apply.
Right to restriction of processing (Article 18 GDPR): under the conditions set out there.
Right to data portability (Article 20 GDPR): receipt of your personal data in a structured, commonly used and machine-readable format.
Right to object (Article 21 GDPR): see separate notice in Section 21.
Right to withdraw consent (Article 7(3) GDPR): withdrawal of consents previously given, with effect for the future.
Right to lodge a complaint (Article 77 GDPR): complaint to a data protection supervisory authority, typically the authority of the federal state of your usual residence, workplace, or our registered office (the Hessian Data Protection Commissioner).
To exercise any of your rights, an informal email to privacy@donnerstag.ai or a written letter to the address in Section 2 is sufficient. We will respond to your request without undue delay, and at the latest within one month of its receipt.
Where your personal data is processed on the basis of Article 6(1)(f) GDPR (legitimate interest), you have the right to object to the processing at any time on grounds relating to your particular situation.
Where the objection concerns the processing of your personal data for direct marketing purposes (including our B2B outbound communications), you have a general right to object, no specific reason is required.
To exercise your right to withdrawal or objection, an email to privacy@donnerstag.ai is sufficient.
No decision based solely on automated processing (including profiling) which produces legal effects concerning you or similarly significantly affects you pursuant to Article 22 GDPR takes place. The AI-powered features of our platform (e.g. automated invoice reconciliation) serve solely as decision support; any final decisions with legal effect are made by authorised employees or users.
We reserve the right to update or amend this privacy policy where necessary in line with applicable data protection laws, for example, due to changes in our services or legal framework. The current version of this privacy policy applies to your visit and use of our platform. We notify existing customers of material changes, in particular the engagement of new sub-processors, via the contact details on file.
14. Social media presences
14. Social media presences
14. Social media presences
We maintain online presences on social media platforms, currently in particular on LinkedIn (LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland). When you visit our profiles or interact with us via the platform, personal data is collected and processed by the respective provider, in particular for market research and advertising purposes. This processing regularly takes place under joint controllership pursuant to Article 26 GDPR. Transfers of data to the United States are possible and are safeguarded by Standard Contractual Clauses pursuant to Article 46(2)(c) GDPR and/or the EU-U.S. Data Privacy Framework.
If you contact us via social media, we process your data to handle the enquiry and, where applicable, to initiate a contractual relationship (Article 6(1)(f) and (b) GDPR).
LinkedIn Privacy Policy: https://www.linkedin.com/legal/privacy-policy