Privacy policy

Last updated: 11 October 2026

1. Controller

The controller responsible for processing personal data on getteddy.ai within the meaning of the EU General Data Protection Regulation (GDPR) is:

We have not appointed a data protection officer, as we are not currently required to do so under Art. 37 GDPR and § 38 BDSG. For all data protection matters, please contact privacy@getteddy.ai.

2. Overview

This policy explains which personal data we process when you visit getteddy.ai, fill in one of our forms, book a demo, subscribe to product updates, apply as a partner, panel member or employee, or use the GetTeddy platform as a customer. Personal data is any information relating to an identified or identifiable person, such as your name, email address or IP address.

We process personal data on the following legal bases: your consent (Art. 6(1)(a) GDPR), the performance of a contract or steps before entering into one (Art. 6(1)(b) GDPR), legal obligations (Art. 6(1)(c) GDPR) and our legitimate interests (Art. 6(1)(f) GDPR). For each processing activity below, we name the legal basis.

3. Visiting the website

Hosting and server logs

Our website is hosted by Webflow, Inc., 398 11th Street, San Francisco, CA 94103, USA. When you visit the website, the hosting provider automatically processes technical data that your browser sends: IP address, date and time of the request, the page requested, referrer URL, browser type and operating system. This is necessary to deliver the website, keep it secure and detect misuse.

Legal basis: our legitimate interest in a secure and functioning website (Art. 6(1)(f) GDPR). We have concluded a data processing agreement with Webflow. Server logs are deleted after a short period unless they are needed to investigate a security incident.

Content delivery and fonts

Images, fonts and scripts on this website are delivered through the content delivery network of our hosting provider, so that pages load quickly. The same technical data as above is processed for this purpose. All fonts are hosted on our own website infrastructure. We do not load fonts from Google Fonts or other third-party font services.

4. Cookies and consent

We use the consent management platform of Usercentrics GmbH, Sendlinger Str. 7, 80331 Munich, Germany, to obtain and store your consent for cookies and similar technologies. Usercentrics processes your consent decision, a consent ID, the date and time of the decision, your browser information and an anonymised IP address.

Strictly necessary cookies and technologies are used without consent because the website cannot work properly without them (§ 25(2) TDDDG, Art. 6(1)(f) GDPR). All other cookies and technologies are only used if you agree (§ 25(1) TDDDG, Art. 6(1)(a) GDPR). You can change or withdraw your consent at any time through the privacy settings on this website. Withdrawing consent does not affect the lawfulness of processing before the withdrawal.

The Google tag is only loaded after you have consented to Google Analytics or Google Ads. Your consent decision is then passed on to Google through Google Consent Mode, so that Google services behave according to your choice. Details are in section 9.

The services that are currently active, their purposes and storage periods are listed in the privacy settings of the consent banner.

5. Forms and demo bookings

How our forms work

The forms on this website are provided by HubSpot, a customer relationship management system of HubSpot Ireland Ltd., One Sir John Rogerson's Quay, Dublin 2, Ireland, part of HubSpot, Inc., USA. When you open a page with a form, the form is loaded from HubSpot's servers in the EU, which means your IP address and browser information are transmitted to HubSpot. When you submit a form, your entries are stored in our HubSpot account together with the page you sent it from and the time of submission. HubSpot processes the data on our behalf under a data processing agreement. See section 14 for international transfers.

We only accept business email addresses, so the form may reject addresses from free email providers.

Contact requests

When you use our contact form, we process your first and last name, work email address, phone number if given, and your message. We use this data to answer your request.

Demo bookings

You can book a demo directly in our scheduling tool, which is also provided by HubSpot (HubSpot Meetings). When you open the booking page, the scheduling tool is loaded from HubSpot's servers, so your IP address and browser information are transmitted to HubSpot. When you book, we process your first and last name, work email address, the time you select and any information you add. The appointment is created in our calendar, and you receive an invitation with a video link (Google Meet, part of Google Workspace, see section 11). We use this data to prepare, hold and follow up on the demo.

Antler portfolio offer

When you request the Antler portfolio offer, we process your first and last name, work email address and your message, for example the name of your startup and your Antler cohort. We use this data to check your eligibility and to send you the offer.

CISO Panel applications

When you apply to join the GetTeddy CISO Panel, we process your first and last name, work email address and any further details you provide. We use this data to review your application, to arrange an introductory call and, if you join, to invite you to panel sessions and webinars.

Partner applications

When you apply to our partner program, we process the details you submit, such as your first and last name, work email address, website, partner type, number of clients, the frameworks you work with and your message. We use them to assess your application and to contact you about a possible partnership.

Legal basis for all forms and demo bookings: steps prior to entering into a contract (Art. 6(1)(b) GDPR) where your request relates to our services, a partnership or panel membership, otherwise our legitimate interest in answering enquiries (Art. 6(1)(f) GDPR).

6. Spam protection (Google reCAPTCHA)

To protect our forms against spam and automated abuse, we use reCAPTCHA, a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. reCAPTCHA checks whether a form is filled in by a human or by an automated program. For this purpose, it analyses information such as your IP address, browser and device information, the time spent on the page and your interaction with it, and may set cookies. This data is transmitted to Google and may be processed by Google LLC in the USA.

Legal basis: Storing and reading information on your device for reCAPTCHA is strictly necessary to provide the forms you use in a secure way (§ 25(2) no. 2 TDDDG). The further processing is based on our legitimate interest in protecting our website and forms against abuse and spam (Art. 6(1)(f) GDPR).

Storage period: We do not store the data analysed by reCAPTCHA ourselves. Google stores it according to its own retention periods. The cookies reCAPTCHA may set and their storage periods are listed in the cookie table in section 4. For more information, see Google's privacy policy and terms of service.

7. Product update emails

If you tick the box “Send me occasional product updates” in one of our forms, we send you occasional emails about new features, guides and events from GetTeddy. We only process your name and email address for this purpose and store your consent with the date, time and the text you agreed to.

We send these emails with HubSpot. To improve our emails, we measure whether an email was opened and which links were clicked. You can unsubscribe at any time using the link in every email or by writing to privacy@getteddy.ai.

Legal basis: your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time with effect for the future.

8. Website optimisation and analytics (Webflow Optimize and Webflow Analyze)

Webflow Optimize

With your consent, we use Webflow Optimize (formerly Intellimize), a service of Webflow, Inc., to test different versions of our pages and to improve their content. For this purpose, a pseudonymous identifier is stored in your browser and information about the pages you view and your interactions with them is processed. We do not use this information to identify you personally.

Webflow Analyze

With your consent, we also use Webflow Analyze, the analytics feature of our hosting provider Webflow, Inc., 398 11th Street, San Francisco, CA 94103, USA. It shows us how our website is used, for example which pages are visited, how long visitors stay, which elements they click and how they found the website. For this purpose, a pseudonymous identifier is stored in your browser and information about your visit is processed, such as the pages viewed, your interactions with them, the referring website, device and browser type and your approximate location. We use these reports to improve our website and do not use them to identify you personally.

Webflow processes the data for both services on our behalf under a data processing agreement. Data may be transferred to Webflow, Inc. in the USA, see section 14.

Legal basis for both services: your consent (§ 25(1) TDDDG, Art. 6(1)(a) GDPR), which you can withdraw at any time through the privacy settings on this website. Without your consent, neither service is activated.

Storage period: The data is stored in pseudonymous form and deleted as soon as it is no longer needed for testing and analysis. The identifiers stored in your browser and their storage periods are listed in the cookie table in section 4.

9. Web analytics and ad measurement

We use Google Analytics 4 and Google Ads conversion tracking, services of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, together with Google Consent Mode. The Google tag is only loaded after you consent to Google Analytics or Google Ads in the consent banner. How it then works depends on your choice, as described below.

Web analytics (Google Analytics 4)

With your consent, we use Google Analytics 4 to understand how visitors use our website, for example which pages are viewed and how visitors find us. Google Analytics then stores a pseudonymous identifier in your browser and processes information about your visit, such as the pages viewed, the time spent on them, the referring website, device and browser type and your approximate location. Google Analytics 4 does not log or store full IP addresses. We do not use Google Analytics to identify you personally, and we do not combine this data with other data about you. Google processes the data on our behalf under a data processing agreement. Data may be transferred to Google LLC in the USA, see section 14. Analytics data is deleted after 14 months.

Ad measurement (Google Ads conversion tracking)

If you consent to marketing cookies, we use Google Ads conversion tracking. If you reach our website by clicking on one of our Google ads, Google stores a cookie in your browser. If you then book a demo, Google can recognise that the booking followed a click on our ad. This tells us how well our ads work. We only receive aggregated statistics, such as the number of bookings that followed an ad click, and cannot identify you from them.

Enhanced conversions: If you have consented to Google Ads and then submit one of our forms or book a demo, we also use Google's enhanced conversions feature. The email address you entered is converted in your browser into a one-way hash value (SHA-256) and only this hashed value is transmitted to Google. Google compares it with its own hashed account data to attribute your request to an earlier click on one of our ads. Google acts as an independent controller for this processing under the Google Ads Controller-Controller Data Protection Terms. We do not receive any additional data about you from Google; our reports remain aggregated. Legal basis: your consent (§ 25(1) TDDDG, Art. 6(1)(a) GDPR), which you can withdraw at any time through the privacy settings on this website.

For Google Ads, Google acts as an independent controller under the Google Ads Controller-Controller Data Protection Terms. If you are signed in to a Google account, Google may link this information to your account under its own responsibility, see Google's privacy policy. Data may be transferred to Google LLC in the USA, see section 14.

Legal basis for analytics and ad measurement with cookies: your consent (§ 25(1) TDDDG, Art. 6(1)(a) GDPR), which you can withdraw at any time through the privacy settings on this website.

Google Consent Mode: what happens without your consent

If you do not consent, or have not yet decided, the Google tag is not loaded. No cookies are set or read for Google Analytics or Google Ads, and no data is sent to Google for these purposes.

If you consent to only one of the two services, the Google tag is loaded and the service you have not consented to runs in a restricted mode. In this mode, no cookies are stored in your browser, no existing cookies are read, and advertising identifiers are removed. Google only receives limited signals that your browser transmits with the request: your consent status, the time, the page viewed and the referring page, browser and device type and, if you came from one of our ads, the ad click identifier contained in the page address. Your IP address is transmitted for technical reasons but is not stored by Google Analytics.

Google uses these signals only in aggregated form, for example to estimate how many visits and demo bookings resulted from our ads overall (conversion and behavioural modelling). We cannot identify you from them, and they are not used to build a profile of you.

Legal basis for this restricted mode: our legitimate interest in measuring the effectiveness of our website and advertising in aggregated, non-identifying form (Art. 6(1)(f) GDPR). You can object to this processing at any time (Art. 21 GDPR) by writing to privacy@getteddy.ai. If you give your consent, the services work as described above under “Web analytics” and “Ad measurement”. More information about Consent Mode is available in Google's privacy information for businesses.

10. Job applications

If you apply for a position by email to jobs@getteddy.ai, we process the data contained in your application, such as your CV, cover letter, certificates and contact details, to run the application process.

Legal basis: steps prior to entering into an employment contract (Art. 6(1)(b) GDPR). If we do not hire you, we delete your application six months after the end of the process, unless you have agreed that we keep it longer for future positions (Art. 6(1)(a) GDPR).

11. Email communication and video calls

If you write to us by email, we process your email address, the content of your message and any attachments to answer you. Legal basis: Art. 6(1)(b) or (f) GDPR, depending on the subject of your message.

Our email, calendar, video calls and office communication run on Google Workspace (including Gmail, Google Calendar and Google Meet), provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google processes the data on our behalf under a data processing agreement. See section 14 for international transfers.

12. Customers and the GetTeddy platform

When your company uses the GetTeddy platform, we process the data your company provides or connects to the platform on your company's behalf, as a processor under Art. 28 GDPR. The details, including subprocessors and technical and organisational measures, are set out in our data processing agreement, which we provide on request.

For the customer relationship itself, such as contract management, billing and support, we act as controller. Legal basis: performance of the contract (Art. 6(1)(b) GDPR) and legal retention obligations (Art. 6(1)(c) GDPR).

GetTeddy does not use customer data to train AI models.

13. Recipients and processors

We share personal data only where this is necessary for the purposes described above. For this website and our communication, we use the following service providers:

Webflow, Usercentrics, HubSpot, Google Analytics and Google Workspace process data on our behalf under data processing agreements. Subprocessors of the GetTeddy platform are listed in our data processing agreement, available on request. We may also disclose data to public authorities where we are legally required to do so. We never sell personal data.

14. International transfers

Some of our service providers are located in, or may access data from, the United States. Where this is the case, we transfer data on the basis of the European Commission's adequacy decision for the EU-U.S. Data Privacy Framework (Art. 45 GDPR), if the provider is certified, and otherwise on the basis of the European Commission's standard contractual clauses (Art. 46(2)(c) GDPR). You can request a copy of the safeguards from us.

15. Retention

We keep personal data only as long as it is needed for the purpose it was collected for. Enquiries, demo bookings and applications are deleted when they have been fully dealt with and there is no ongoing business relationship, usually after two years at the latest. Web analytics data is deleted after 14 months. For Google Ads conversion tracking, Google stores the conversion data as an independent controller according to its own retention periods; the cookies used and their storage periods are listed in the cookie table in section 4, and we ourselves only receive aggregated statistics. Emails and calendar entries are deleted as soon as they are no longer needed; business correspondence is kept for six years as required by the German Commercial Code (§ 257 HGB). If you have subscribed to product updates, we keep your name and email address until you unsubscribe, and keep a record of your consent and withdrawal as long as we need to prove it. Where statutory retention periods apply, for example under the German Commercial Code (HGB) or Fiscal Code (AO), we keep the relevant data for six or ten years and restrict its processing in the meantime.

16. Your rights

You have the following rights regarding your personal data:

• Access to your data (Art. 15 GDPR)
• Rectification of inaccurate data (Art. 16 GDPR)
• Erasure (Art. 17 GDPR)
• Restriction of processing (Art. 18 GDPR)
• Data portability (Art. 20 GDPR)
• Withdrawal of consent at any time, with effect for the future (Art. 7(3) GDPR)

To exercise your rights, write to privacy@getteddy.ai or to our postal address above. You also have the right to lodge a complaint with a supervisory authority. The authority responsible for us is the Berlin Commissioner for Data Protection and Freedom of Information (Berliner Beauftragte für Datenschutz und Informationsfreiheit), Alt-Moabit 59–61, 10555 Berlin, Germany.

We do not use automated decision-making, including profiling, that produces legal effects concerning you or similarly significantly affects you (Art. 22 GDPR).

17. Security

This website is served exclusively over encrypted connections (TLS). We use technical and organisational measures to protect personal data against loss, misuse and unauthorised access, and review them regularly. More information is available on our security page.

18. Changes to this policy

We update this policy when our services or the law change. The current version is always available on this page, with the date of the last update at the top.