Privacy policy

This English version is provided for convenience. Only the German version is legally binding.

1. Overview

This policy explains which personal data we process when you visit this website, build your ideal customer profile in our chat, write to us, book a call or object to our research, and which data we process from public sources for our campaigns. For each case, it says why, on what legal basis and for how long.

In short, without your consent, this website sets no cookies for analytics or advertising. We count how often pages are viewed, how far they are read and how our chat is used without cookies and without passing on your IP address (section 5). More detailed analytics in your browser with PostHog, including a recording of your visit, the Meta Pixel for our ads and the embedded cal.com calendar only run if you agree. We serve our fonts from our own server. In the chat, an AI replies. We process what you enter there with providers of AI models, including outside the EU (section 7).

2. Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) is

André Gröschel
OpenProspect
Leiria RC/DT 2410-125
Portugal

You can reach us at support@openprospect.io, including with any questions about data protection.

3. When you visit the website

When you open the website, your browser sends certain information to the server that hosts it, as it technically must. The server keeps the following in log files.

• The IP address of your device
• The date and time of your visit
• The address you requested and the amount of data transferred
• The page you came from (referrer)
• Your browser and operating system

We need this information to deliver the website, keep it running reliably and securely, and detect attacks. The legal basis is our legitimate interest in a secure, working website (Art. 6(1)(f) GDPR). The website is hosted by a hosting provider that processes this information on our behalf (Art. 28 GDPR). The logs are deleted as soon as they are no longer needed for these purposes. We never combine them into a profile of you.

4. Browser storage and cookie banner

Without your consent, we only keep what the site needs to work in your browser’s storage.

• Your choice in the cookie banner and when you made it, in localStorage, for 12 months
• For the length of your visit, how the page is displayed, for example whether the bar has already appeared, in sessionStorage
• In the chat, until you close the tab, the key to your conversation so it continues after a reload, its language, your email address for the confirmation and, if you come from the field or a button on another page, your text or that button, in sessionStorage

Your browser sends whatever of this belongs to the chat to our server with your messages (section 7). Everything else never leaves your browser. The legal basis for storing it is Section 25(2) no. 2 TDDDG (German Telecommunications Digital Services Data Protection Act), and for processing it, our legitimate interest in a site that respects your choice, displays calmly and does not lose your chat conversation (Art. 6(1)(f) GDPR).

In the cookie banner, you decide whether we collect analytics with PostHog (section 5), whether we share data with Meta for our ads (marketing, also section 5) and whether we load external content, meaning the cal.com calendar (section 6). You can change or withdraw your choice at any time under “Cookies” at the bottom of the page. A withdrawal applies from then on. The banner does not appear on the chat pages. There, the choice you made on the rest of the website applies.

5. Reach, analytics and ads

Counting without cookies

We count every page view, even without your consent. For this, the page sends one short message to our own server when it loads and one when you leave. It contains the following.

• The page you opened and its language
• The domain of the page you came from and campaign details from the address (utm), if there are any, plus whether the address carried an ad platform’s click ID, without the ID itself
• Whether you are reading on a phone, tablet or computer, roughly by the width of the window
• Whether and how long the page was visible, how far you scrolled, which sections you saw and for how long, and in which one you left
• Whether you used the page with a mouse, finger or keyboard, without what exactly you did, and which of our buttons you clicked
• The country our hosting provider derives from your IP address

We do not pass on your IP address, it stays with our hosting provider as described in section 3. We store nothing in your browser for this, and the ID of a message only applies to that one page view. So we can neither connect a visit to a later one nor identify you. The legal basis is our legitimate interest in knowing which pages are read and where visitors come from, so we can improve the website (Art. 6(1)(f) GDPR). If your browser sends the Global Privacy Control or Do Not Track signal, we treat it as an objection and do not count your visit. You can also object at any time otherwise (section 14).

Analytics with your consent

If you agree to analytics in the cookie banner, we learn in more detail how the website is used. We then also collect the following.

• Which pages you open one after another and how long you stay
• Which sections you see and for how long, and how far you scroll
• Which buttons and links you click, which questions you expand and which option you pick in the comparison, when you first do something on a page, and clicks that do nothing or repeat in quick succession
• Whether you start, abandon or submit a form, with the names of its fields, and whether a call was booked in the calendar, never what you enter
• Browser, operating system, type of device, screen size, how fast the page loads and errors that occur in your browser
• A recording of your visit, meaning what was shown on the page, how you scroll, where you click and how you move the mouse. From this, we also get maps of a page that show where people click and how far they scroll.

So we can see the page views of one visit together, PostHog stores a random ID in a cookie and in your browser’s localStorage, for 12 months. PostHog does not receive your IP address, the messages go through our own server, which does not pass it on. What you type into fields stays unreadable in the recording, and so does every email address. PostHog deletes recordings after 30 days. We do not build a profile of you. The legal basis is your consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG). You can withdraw it at any time under “Cookies” at the bottom of the page. Analytics then stops immediately, and the ID is deleted from your browser.

In the chat

We also measure how the chat is used, to see where conversations get stuck, how long replies take and what the chat costs. For this, our server reports events about every conversation to PostHog, even without your consent. They show, for example, which questions you saw and answered and how long that took, whether an error occurred, whether you entered your name and email address or booked a call, where you came from and what the model calls cost. Without your consent, the chat page itself is counted like any other page, as described above, and also reports how far you got in the chat and how many messages you sent.

These reports contain no content, meaning no texts, no address of your website, no name and no email address, and neither your IP address nor a personal profile. We store nothing in your browser for this. They do carry the random ID of your conversation, which lets us link them to it for as long as we store it (section 7). The legal basis is our legitimate interest in improving the chat and knowing its costs (Art. 6(1)(f) GDPR). You can object to this at any time (section 14).

If you have agreed to analytics, the chat page also measures how long your answers are and how long you take to type them, never their text, how long you wait for replies and which controls you use. These reports also carry the ID of your conversation.

We then also record the chat and your profile page, with what is shown there, including your messages, the chat’s replies and your profile. Anything you are typing into a field, every email address, the name you give for the call and the link to your profile page stay unreadable. PostHog deletes these recordings after 30 days as well.

PostHog

All of this is analyzed with PostHog, a service of PostHog, Inc., 2261 Market St., #4008, San Francisco, CA 94114, USA. The data is stored on PostHog’s servers in the EU, in Germany, and PostHog processes it on our behalf (Art. 28 GDPR). Where PostHog accesses it from the USA, this is based on the EU-U.S. Data Privacy Framework, in which PostHog participates, and on the European Commission’s standard contractual clauses. We delete the data once we no longer need it for analysis. You can find more in PostHog’s privacy policy.

Ads with Meta

We run ads on Facebook and Instagram. To measure whether they work and to show them to people who are likely to be interested in OpenProspect, we use the Meta Pixel and the Conversions API of Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland. Both only if you agree to marketing in the cookie banner. Before that, nothing goes to Meta and no Meta cookie is set.

With your consent, a script from Meta loads on the pages with the cookie banner, not on the data opt-out and support pages and not in the chat. It tells Meta which page you view, whether you read it (for 20 seconds or scrolled a quarter of the way) and whether you booked a call in the calendar, each time with the page address, the time, your IP address and details about your browser and device. For this it stores an ID in the _fbp cookie and, if you come from an ad, its click ID in the _fbc cookie, both for 90 days. If a page has fields for an email address, phone number or name, the script can read them and send them to Meta in encrypted form, so that Meta can match the report to your account (automatic advanced matching). Meta can also read further details from the page, such as its heading and description (more detailed page and product information). Your browser sends the reports to Meta and also to a server that Meta runs for this purpose on Google Cloud and Amazon Web Services (Meta’s Conversions API Gateway).

No script from Meta loads in the chat. If you have agreed to marketing, our server tells Meta instead when you start a conversation in the chat and when you book a call. It sends the IDs from the _fbp and _fbc cookies, your IP address and the details about your browser and device, plus an ID of your conversation and, with the booking, your email address and your first and last name. These three go to Meta only in encrypted form as a hash, never in plain text. What you write in the chat, your website address and your profile are not sent to Meta. Our server keeps the IDs, your IP address and your browser details only with your conversation. It deletes them as soon as your booking has been reported or you withdraw your consent to marketing, at the latest 7 days after your last message in the chat.

The legal basis is your consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG). We and Meta are joint controllers for collecting the data with the pixel and the Conversions API and transferring it to Meta (Art. 26 GDPR). What we agreed with Meta on this is set out in Meta’s Controller Addendum. Meta alone is responsible for what it does with the data afterwards. Meta also processes the data in the USA, at Meta Platforms, Inc., based on the EU-U.S. Data Privacy Framework, in which Meta participates. You can withdraw your consent at any time under “Cookies” at the bottom of the page. The script then no longer loads, the _fbp and _fbc cookies are deleted, and our server no longer reports anything to Meta. For more, see Meta’s privacy policy.

6. Booking a call with cal.com

In the closing section of our pages and in the “Book a call” window, you can book a call with us through an embedded calendar. The calendar is provided by Cal.com, Inc., 2261 Market Street #4382, San Francisco, CA 94114, USA.

We only load the calendar once you agree, in the cookie banner or with “Load calendar.” Until then, no request goes to Cal.com. As soon as it loads, Cal.com receives your IP address and details about your browser and device, as it technically must, and Cal.com may store its own data in your browser. The legal basis is your consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG), which you can withdraw at any time under “Cookies.”

If you book a call, we process the details you enter with Cal.com, such as your name, email address, the time you chose and your message, to prepare and hold the call. The legal basis is taking steps at your request before entering into a contract (Art. 6(1)(b) GDPR). We delete these details once they are no longer needed for the call and its follow-up, unless statutory retention obligations apply.

In the chat, you book without the embedded calendar. Our server asks Cal.com for open times without any details about you, and nothing from Cal.com loads in your browser. When you pick a time, our server sends your name, your email address, your time zone and language, the time, the ID of the conversation and a note with the link to your profile page (section 7) to Cal.com. Cal.com sends you the confirmation with the calendar entry and the links to reschedule and cancel. If it does not arrive reliably, we can also send you the confirmation ourselves, through the email service provider from section 8. Here too, the legal basis is Art. 6(1)(b) GDPR.

We hold the call by video, and Cal.com creates the link with the booking, through a provider of video calls. Cal.com reports to our server every booking, rescheduling and cancellation and whether you showed up, including for calls not booked in the chat. We pass them on to our team with your name, email address, time and message, as described in section 7.

Cal.com also processes data in the USA. For transfers from the European Economic Area, Cal.com states that it relies on the European Commission’s standard contractual clauses or an adequacy decision such as the EU-U.S. Data Privacy Framework. You’ll find more in Cal.com’s privacy policy.

You can also book without the embedded calendar, directly at Cal.com with the “Open in cal.com” link, or by emailing us.

7. Your ideal customer profile in the chat

In the chat on this website, you build your ideal customer profile and can book a call with us. Many replies in the chat are written by an AI, and it can make mistakes.

What we process

In the chat, we process the following.

• Everything you write or select in the chat, including the text you bring along from the field on another page
• The address of your website and what we read there, and if you name a client as a model, the homepage and legal notice of its website
• The ideal customer profile that results, with the estimate of your market and the examples of outreach
• Your name and email address if you enter them, and the time you choose for a call, with your time zone
• Where you come from, meaning the page before and the button that brought you, the domain of the referring page and campaign details from the address (utm), plus the country our hosting provider derives from your IP address, the language and your type of device
• How the conversation goes, for example timestamps, waiting times, errors and the cost of the model calls

From your website, we read the homepage and up to 6 more pages, with an ID that names us as the sender and in line with the rules in its robots.txt. We skip pages such as team, careers, contact or privacy. We replace email addresses and phone numbers in the text before a model sees it, and from the legal notice we only take details about the company, such as its name, legal form, location and register entry, never people. If a page only shows its text in a browser, a browser at our hosting provider opens it.

Why and on what legal basis

We use this information to build your ideal customer profile with you, show you the estimate of your market and the examples, arrange a call with you and prepare for it. The legal basis is taking steps at your request before entering into a contract (Art. 6(1)(b) GDPR), otherwise our legitimate interest in handling your request (Art. 6(1)(f) GDPR).

Our team reviews conversations and analyzes where they get stuck and which pages and campaigns they come from, to check whether the chat understands and answers correctly and to improve it and our website. We do not train AI models with your information. The legal basis is our legitimate interest in a chat that works reliably and correctly (Art. 6(1)(f) GDPR).

The AI in the chat

Replies, the summary of your offer, suggestions for your profile and the examples of outreach are written by large language models. For this, your input, the texts read from your website and the conversation so far go through a routing service for AI models based in the USA to the cloud providers whose servers run the models. The random ID of the conversation goes along, your IP address does not. We only run the models with providers that commit to not keeping inputs after processing and not using them for training. Where possible, we choose data centers in the EU. The model that writes most replies, however, only runs on a global endpoint, so your information may also be processed in the USA and other countries outside the EU. These service providers process it on our behalf (Art. 28 GDPR). Section 12 has more on transfers to countries outside the EU.

Message to our team

If you enter your name and email address, the chat reports your profile to our team in a messenger for internal collaboration. The message contains your name, email address, company, website and details from its legal notice, the profile, the call, where you came from and the link to your profile page. Later changes to the profile and the call are added. This is how our team prepares for the call. The provider of this messenger may also process data in the USA. The legal basis is the same as above (Art. 6(1)(b) and (f) GDPR).

Your profile page

At the end, the chat shows your profile on a page of its own. You see the link in the chat and in the confirmation of your call, our team receives it with the message from the chat, and we can send it to you through the email service provider from section 8. Anyone who knows the link can open the page, which is why it carries a long random key. Only share it if you want others to see your profile. It is valid for 90 days from the last activity.

Protection against misuse

To keep the chat from being misused and its costs within limits, a service of our hosting provider checks in the background whether a person is using it, as soon as you open the chat or start typing in its field on our website. For this, the page loads a script from this service. The service receives your IP address and details about your browser and device, as it technically must, and our server has the result confirmed there with your IP address. We also limit the number of conversations and messages and check input for attacks. We do not count conversations per day by your IP address but by a check value we derive from it with a secret key and the date. It changes every day and is deleted after 48 hours. The legal basis is our legitimate interest in a secure chat (Art. 6(1)(f) GDPR), and for the check script in your browser, Section 25(2) no. 2 TDDDG.

Storage location and periods

We store conversations, profiles and contact details from the chat with our hosting provider in data centers in the EU. There, we delete them after fixed periods.

• The transcript, meaning what you wrote and what the chat replied, 30 days after the last activity, or after 90 days if you entered your name and email address
• The full inputs and outputs of the model calls after 30 days
• The texts read from your website after 7 days
• Your name, email address, profile, call and origin 12 months after the last contact
• Your profile page as soon as its link expires
• Technical details about how the conversation went, without content, after 90 days

After that, only figures without text, names or email addresses remain, for example how far a conversation got and how long it took. We also keep a website we read in a cache for 24 hours, so we do not load it more than once. If you ask us to, we will delete your conversation sooner (section 14).

How we measure the chat is in section 5, how booking through Cal.com works is in section 6, and what the chat keeps in your browser is in section 4.

8. Contacting us by email or form

If you email us or write to us with the form on the Support page, we process your address and what you write, and with the form also your name and, if you provide them, your company’s name and your phone number, to reply to you. Requests from the forms on this website reach us by email. To deliver them, we use an email service provider that processes the information on our behalf.

The legal basis is steps before entering into a contract or a contract (Art. 6(1)(b) GDPR), otherwise our legitimate interest in answering inquiries (Art. 6(1)(f) GDPR). We delete the information once your inquiry has been dealt with, unless statutory retention obligations apply.

9. Data opt-out

With the form on the Data opt-out page, you object to research and outreach by us. For this, we process your name, your email address, your company’s name and, if you add one, your note. The form sends them to us by email, as described in section 8. The OpenProspect team reviews every request and removes the address from all campaigns.

We need this information to carry out your objection and respect it permanently. The legal basis is our legal obligation to respect an objection (Art. 6(1)(c) GDPR in conjunction with Art. 21 GDPR). We only keep what we need so that we don’t research or contact you again, and only for as long as necessary.

10. Moving to the app

Links like “Log in” take you to our app at app.openprospect.io. Whatever you type into the field at the top of the homepage is passed to our chat (section 7) or to the app, depending on where the field leads, so your ideal customer profile starts with your words. If you reach the site through a link with campaign details (utm parameters or the click IDs gclid, fbclid and li_fat_id), we add them to the links into the app and the chat so that a sign-up or a profile can be attributed to the campaign that brought you. On this website, we only store what the chat needs for your conversation, as described in section 7. The legal basis is our legitimate interest in knowing which campaign brought someone to us (Art. 6(1)(f) GDPR).

If you register in the app, we process the details you enter there.

• First and last name
• Business email address
• Company name and company details
• Password (encrypted)
• Payment details if you order something paid in the app (handled by a payment service provider)

Creating your ideal customer profile there is free and needs no payment details. We process your details to provide the app and perform the contract (Art. 6(1)(b) GDPR) and delete them when the contract ends and no statutory retention obligations remain.

11. Research for campaigns

For our clients, we find companies that fit what they sell and the people there who decide on the topic. This information comes only from publicly available sources, such as websites and legal notices, the commercial register, job ads, business directories, map services with reviews and public profiles on professional networks.

We process the following.

• Company name, address and website
• Names, roles and departments of decision-makers
• Business email addresses and phone numbers
• Publicly available information about the company that matters for the outreach, for example from job ads or reviews

We use this information to select companies and contacts and to reach out to them on behalf of our clients for business purposes, by email, by mail or with a dedicated landing page. The legal basis is our legitimate interest and that of our clients in initiating business (Art. 6(1)(f) GDPR). We limit ourselves to business information (business-to-business). We delete the information once it is no longer needed for the campaign, at the latest when you object.

You can object to this processing at any time, with the form on the Data opt-out page or by emailing support@openprospect.io. The OpenProspect team reviews every request and removes you from all campaigns.

12. Recipients

We only share your data if you have consented (Art. 6(1)(a) GDPR), if it is necessary to perform a contract with you (Art. 6(1)(b) GDPR), if we are legally required to (Art. 6(1)(c) GDPR) or if it is necessary to establish, exercise or defend legal claims (Art. 6(1)(f) GDPR).

For hosting, analytics, sending emails, booking calls, the AI models in the chat, messages to our team and invoicing, we use service providers that process data only on our instructions. We have data processing agreements with them under Art. 28 GDPR. If a service provider processes data outside the EU or the EEA, it does so only on the basis of an adequacy decision by the European Commission or standard contractual clauses.

13. Data security

The website is only available over an encrypted connection (TLS). We protect your data against loss, destruction, tampering and unauthorized access with technical and organizational measures and keep them up to date with the state of the art.

14. Your rights

You have the right

• to request access to the data we process about you (Art. 15 GDPR);
• to request the rectification of inaccurate data or the completion of your data (Art. 16 GDPR);
• to request the erasure of your data (Art. 17 GDPR);
• to request the restriction of processing (Art. 18 GDPR);
• to receive your data in a structured, commonly used and machine-readable format (data portability, Art. 20 GDPR);
• to withdraw your consent at any time, with effect for the future (Art. 7(3) GDPR);
• to lodge a complaint with a supervisory authority, in particular in the member state where you live or work or where the suspected infringement took place (Art. 77 GDPR).

Right to object. Where we process your data on the basis of legitimate interests (Art. 6(1)(f) GDPR), you can object at any time under Art. 21 GDPR, on grounds relating to your particular situation, and to processing for direct marketing without giving any reason. An email to support@openprospect.io or the form on the Data opt-out page is all it takes.

15. Obligation to provide data and automated decisions

You are not obliged to provide us with any data. Without the technically necessary information from section 3, however, the website cannot be delivered, and without your details we cannot reply to you, build a profile with you in the chat or arrange a call with you. We do not make automated individual decisions under Art. 22 GDPR. The chat uses AI to classify your input and suggests target groups, signals and contacts. These are suggestions for your profile that you can change, not decisions about you.

16. Changes

This privacy policy is current as of October 2026. If the website, our offering or the legal requirements change, we will update it. The version published here applies.