This is a convenience translation. The German version is binding. In case of any discrepancy, the German version prevails. German version
Version 2026-10-ea1 · valid from 12 October 2026 · Early Access
This notice explains, in accordance with Art. 13 GDPR, how Verged processes personal data when you request and use Mundaka Early Access. The privacy policy at https://verged.ai/privacy applies to the website verged.ai.
1. Controller
Verged CX GmbH, Rheinpromenade 4a, 40789 Monheim am Rhein, Germany, represented by its managing director Christian Schacht. Email for data protection requests: hello@verged.ai.
2. What data we process, for what purpose and for how long
| Data | Purpose | Legal basis | Retention |
|---|---|---|---|
| Request via the form: name, email, company, other form details | Reviewing the request, invitation | Art. 6(1)(b) GDPR (pre-contractual measures) | approved requests until 30 days after the account is deleted, unless a further business relationship exists; rejected requests 6 months |
| Email address on the Early Access list and invitation link | Access control | Art. 6(1)(b) GDPR | until the account is deleted or Early Access ends. The invitation link is valid for 7 days. If you do not create an account, your email address remains on the list until Early Access ends, unless you request earlier deletion via hello@verged.ai. |
| Account: email, first name, last name, company, password as a hash (never in plain text), organisation derived from the email domain | Providing the account | Art. 6(1)(b) GDPR | until the account is deleted |
| Sessions, session cookie and OAuth tokens of connected clients | Sign-in and connection of clients | Art. 6(1)(b) GDPR; the cookie is technically necessary (Section 25(2) no. 2 of the Telecommunications Digital Services Data Protection Act (TDDDG)) | until expiry, revocation or deletion of the account |
| Accepted version of the terms of use and time of acceptance | Proof of acceptance | Art. 6(1)(b) and (f) GDPR | until the account is deleted |
| Per-person counters for usage limits | Protection against overload, fair distribution | Art. 6(1)(f) GDPR | 48 hours from the start of the time window |
| Number of calls per organisation, bundle, operation and day | Operation, capacity planning, further development | Art. 6(1)(f) GDPR | no fixed period, as there is no personal reference; see note below |
| Inputs in calls, for example search terms and company names | Executing the operation | Art. 6(1)(b) GDPR | only for the duration of execution; not stored in logs |
| Server and application logs: IP address, time, request, client identifier | Security, error analysis | Art. 6(1)(f) GDPR | 7 days at most |
The number of calls per organisation contains no name. If an organisation has only one person, for example with an address from a general email provider, the figures can be attributed to that person. When we delete the account of the last person in an organisation, we also delete the organisation. We then keep its figures under a neutral collective key, with no reference to any person.
We need the account data to provide you with an account. Without them, use is not possible. Our legitimate interest under Art. 6(1)(f) GDPR is the secure and fair operation of Mundaka.
3. Recipients
- IONOS SE, Montabaur: hosting of Mundaka in a data centre in Germany and sending of our emails. IONOS processes the data on our behalf (Art. 28 GDPR).
- HubSpot: provider HubSpot Ireland Limited, Dublin; management of access requests. HubSpot processes the data on our behalf. The data are stored in a data centre in the EU. EU standard contractual clauses apply to access from the USA, for example by support staff.
- Target systems: the inputs of a call go to the target system the operation needs, for example the joint register portal of the German federal states (Registerportal der Länder) or the platform of a trade fair. Your account data do not go to target systems. The queries are sent from our server.
- Your client: the results go to the client you have connected, for example Claude. What happens to the data there is governed by your contract with the client's provider.
- Anthropic Ireland, Limited, Dublin: Mundaka uses language models from Anthropic (Claude) to plan and execute queries. In doing so, the inputs of a call go to Anthropic; your account data do not. Anthropic processes the data on our behalf (Art. 28 GDPR). EU standard contractual clauses apply to transfers to the USA. We use other models only for inputs without personal reference.
We do not sell data and do not use them for advertising. No automated decision within the meaning of Art. 22 GDPR takes place.
4. Deleting your account
You can delete your account at any time in the account settings. We then delete account data, password hash, sessions, tokens, the accepted version and your entry on the Early Access list. The number of calls per organisation is retained without personal reference. If you are the last person in your organisation, we also delete the organisation and keep its figures under a neutral collective key.
We delete your request in HubSpot within 30 days of the account being deleted, unless a further business relationship exists. You can request earlier deletion via hello@verged.ai.
5. Your rights
You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). You can object to processing based on Art. 6(1)(f) GDPR on grounds relating to your particular situation (Art. 21). To do so, write to hello@verged.ai.
You can lodge a complaint with a data protection supervisory authority. The authority responsible for us is the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia (Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen, ldi.nrw.de).
6. Changes
We update this notice when Mundaka or the legal situation changes. The current version, with its version identifier, is shown in the Mundaka web interface.