Privacy policy

1. Controller and scope

The controller is Selqo GmbH, An der schönen Aussicht 1, 33098 Paderborn, Germany, represented by its managing directors Mirco Gemmeke, Thomas Bussek and Hendrik Wittrock. You can reach us at support@selqo.ai. Further details are in our legal notice.

This policy covers the platform at app.selqo.ai, registration, the booking pages at getselqo.ai and the letters, emails, calls and links with which Selqo itself contacts businesses. Data that our customers process about third parties on the platform is processed on their behalf (section 5).

2. Registration and trial account

When you create a trial account, we process company, website, first and last name, business email address and phone number, your statement that you act for your business, a discount code from the link you came through, and information on how you found us (campaign details in the link, page visited, referring page). We also store your IP address, browser identifier, the time and proof that this privacy policy was linked during registration. We need the phone number to reach you with questions and advice during the trial. Without the required details we cannot create a trial account.

The purpose is to set up and run the trial, including pre-contractual conversations (Art. 6(1)(b) GDPR). We send the confirmation link by email via Google Workspace.

To prevent abuse, we check whether the email address can receive mail (Bouncer, Poland), whether the domain belongs to a business that has or had an account, and we limit registrations per IP address. Each business gets one trial. The form is protected against automated sign-ups by Cloudflare Turnstile; Cloudflare, Inc. receives your IP address and technical characteristics of your browser. This is strictly necessary for the registration you requested (Section 25(2) no. 2 TDDDG). The legal basis is our legitimate interest in a fair trial without abuse (Art. 6(1)(f) GDPR).

During setup we read your website to suggest your offer, target industry and arguments, and we store the name, role, logo and signature that appear on your letters. To complete the setup we send a sample letter to your business address. We retrieve the website via Firecrawl (USA) and analyse it with artificial intelligence via Google Cloud (Vertex AI, processing worldwide, including the USA); Skrift (Germany) prints and mails the sample letter.

Our team receives a notification of your registration with your details by email and in our ticket system. Registration data whose link is not confirmed is deleted after 7 days, confirmed data after 30 days; by then the details are in your account. A trial account created through registration without a booked plan is deleted 90 days after the trial ends. We keep the domain and company name of a business that has already had a trial (for addresses of general email providers, the email address) for as long as necessary to prevent repeated trials by the same business.

3. Using the platform

For your account we process name, email address, role, password (only as an irreversible hash) and settings, as well as the details about your business that you enter during onboarding and in the settings. Each time you log in we store a session with IP address, browser identifier and the time of your last activity; expired sessions are deleted daily. The legal basis is the contract (Art. 6(1)(b) GDPR) and, for login security, our legitimate interest (Art. 6(1)(f)).

We analyse how the platform is used, for example which features are used when and for how long and which suggestions are accepted or changed. This helps us improve the platform, detect operating errors and support you (Art. 6(1)(f) GDPR). From time to time we ask you for a rating; answering is voluntary. We keep this data as long as your account exists; after that we only keep, for our key figures, whether the account was used on a given day.

If an error occurs in your browser or on our server, we receive an error report via Sentry (data centre in Frankfurt). It contains technical details such as page, browser and error message and, for errors on our server, the internal identifier of your account; your IP address is not stored (Art. 6(1)(f) GDPR).

If you send a request via the support button, we process your message, an image of the current view (you can remove it before sending) and technical details such as page, window size, browser and language. If you tick the box, we also send a recording of the last two to three minutes in the platform; it shows content, entries and clicks, password fields are masked, and it is stored at Sentry. The legal basis is handling your request (Art. 6(1)(b) GDPR) and, for the recording, your consent given with the box (Art. 6(1)(a)).

In the search area a map shows where we search. Your browser loads the map images from the OpenStreetMap Foundation (United Kingdom), which receives your IP address. The EU Commission has issued an adequacy decision for the United Kingdom. The legal basis is our legitimate interest in a clear display of the search area (Art. 6(1)(f) GDPR).

Cookies and browser storage

The platform only sets cookies that are strictly necessary for its operation: a cookie for your login (up to 30 days), a cookie for the read-only view after a trial ends (2 hours) and short-lived check cookies when you connect a mailbox or calendar (a few minutes). We also keep display settings, drafts, the history of your questions about a lead and a session identifier for the recording with help requests in your browser storage. We do not use cookies or similar storage techniques for analytics or advertising; we serve fonts ourselves. The legal basis is Section 25(2) no. 2 TDDDG together with Art. 6(1)(b) and (f) GDPR.

Recipients and service providers

We use service providers in the following categories:

• hosting of the platform and database (data centres in the EU),
• artificial intelligence services,
• logging of artificial intelligence requests for troubleshooting (data centre in the EU),
• email delivery and calendar,
• checking whether email addresses can receive mail,
• finding business email addresses and mobile numbers of contact persons,
• error monitoring,
• protection against automated sign-ups,
• retrieving public websites,
• printing and mailing letters (Germany),
• recording online meetings,
• payment processing (section 4).

Some of them are based outside the EU or also process data there:

• Railway Corporation (USA): hosting in data centres in the Netherlands, operational logs partly in the USA; safeguard: EU standard contractual clauses.
• Google Cloud EMEA Ltd. (Ireland) for Google Workspace: storage in the EU, processing also outside; safeguard: EU standard contractual clauses and EU-US Data Privacy Framework.
• Google Cloud EMEA Ltd. (Ireland) for artificial intelligence (Vertex AI): processing worldwide, including the USA; safeguard: EU standard contractual clauses and EU-US Data Privacy Framework.
• Functional Software, Inc. (Sentry, USA): data centre in Frankfurt, some operational data in the USA; safeguard: EU-US Data Privacy Framework and EU standard contractual clauses.
• Cloudflare, Inc. (USA): protecting registration and Selqo's booking pages; safeguard: EU-US Data Privacy Framework.
• FullEnrich Corp. (USA): finding business email addresses and mobile numbers of contact persons when we find none ourselves; safeguard: EU standard contractual clauses.
• SideGuide Technologies, Inc. (Firecrawl, USA): retrieving public websites; safeguard: EU standard contractual clauses (being concluded).
• Hyperdoc Inc. (Recall.ai, USA): recording online meetings in a data centre in Frankfurt; safeguard: EU standard contractual clauses.
• OpenStreetMap Foundation (United Kingdom): map images; safeguard: adequacy decision.

4. Contract and payment

When you book a plan, we process plan, term and price, your declarations at booking with their time, billing address and billing email, invoices, payments, credit bookings and reminders. The legal basis is the contract (Art. 6(1)(b) GDPR) and, for retention, our legal obligation (Art. 6(1)(c)).

Payments by direct debit or card are handled by Stripe Payments Europe, Ltd. (Ireland). You enter your payment details directly with Stripe. Stripe receives from us your company name, billing email address, an identifier of your account and the amounts; we receive identifiers of the customer and the payment method, a short description of the payment method (such as card brand and last four digits), the mandate reference for direct debit, and the status of payments. Stripe also processes data as an independent controller, for example to prevent fraud, and transfers data to the USA (safeguard: EU-US Data Privacy Framework).

We keep invoices and other accounting records for 8 years, business letters for 6 years and books for 10 years (Section 147 AO, Section 257 HGB). We keep your other account data until your account is deleted; you can request deletion at any time unless a retention obligation applies. Even after that we keep daily figures on contract and revenue for our key figures and a log of our administrators' actions in your account.

5. Data our customers process on the platform

Our customers use Selqo to find and contact businesses and their contact persons. The platform processes contact details, letters, emails from connected mailboxes, calls, appointments, recordings and summaries of conversations, voice input, notes and reactions to letters and emails. The respective customer is the controller for this data; Selqo processes it on the customer's behalf (Art. 28 GDPR). We tell our customers which sub-processors we use for this.

If you were contacted by one of our customers, please address your concerns to that business. We forward requests that reach us to the business concerned.

6. Selqo's own purposes

We process some data from the platform for our own purposes, for which we are the controller. The legal basis is our legitimate interest (Art. 6(1)(f) GDPR).

• Block for all customers: if a recipient has sent Selqo or a customer a cease-and-desist letter or sued over contact via the platform, or if we have undertaken to refrain from contacting them, we store the business's domain and the reason. For as long as necessary, no account then sends emails to addresses of its domain, and leads of that business that the platform proposes or contacts automatically receive an advertising stop.
• Coordination between customers: so that the same business is not contacted by several Selqo customers in quick succession, we store identifiers of the business, such as website, address and details from its legal notice, and the times at which it was suggested to or contacted by a customer. A suggested business is usually held back from other customers for 30 days, a contacted one for 60 days. No customer learns which businesses other customers contact. We also compare the website addresses of businesses across all accounts to recognise shared websites such as platforms and branch networks.
• Improving the platform: we analyse how the platform rates businesses and how customers accept or change suggestions and drafts, to improve research and drafts.
• Key figures: from the use by all customers we compile aggregated figures, such as reply and reaction rates, that identify neither a customer nor a person, and may also publish them.

7. Selqo's booking pages

Selqo's booking pages, for example from one of our letters or a link on our website, let you book an appointment with us. We process name, company, email address, phone number and the chosen time, add the appointment to our calendar and send you an invitation and, shortly before the appointment, a reminder. Without these details we cannot create the appointment. Using the domain of your email address we match your details with businesses we already know; if we do not know your business yet, we add it and analyse its website (Firecrawl, Google Cloud). To prevent abuse we count requests per IP address and detect automated entries with an invisible field and with Cloudflare Turnstile; Cloudflare, Inc. receives your IP address and technical characteristics of your browser, which is strictly necessary for the booking you requested (Section 25(2) no. 2 TDDDG). The page reports suspicious requests with the IP address to our ticket system. We receive error reports as described in section 3. The legal basis is arranging the appointment (Art. 6(1)(b) GDPR) and our legitimate interest in matching and protecting the page (Art. 6(1)(f)).

If the meeting takes place online, a note taker (Recall.ai, data centre in Frankfurt) takes part and records, transcribes and summarises the conversation. It joins shortly before the start and points this out in the meeting chat; we announce it at the start of the conversation. If you do not want a recording, we switch it off; we then have the recording deleted, and no summary is created. The legal basis is our legitimate interest in reliably documenting conversations (Art. 6(1)(f) GDPR); you can object at any time. Once the transcript has been retrieved, we have the recording deleted at the provider.

8. Our customers' booking pages

Many booking pages at getselqo.ai do not belong to Selqo but to one of our customers. The business concerned is named at the bottom of the booking page. That business is the controller for the details you enter there (name, email address, phone number, company where applicable and the chosen time); Selqo provides the page as a service provider and processes the data on its behalf (Art. 28 GDPR). To protect the page we count requests per IP address and receive error reports (section 3).

The named business provides information on the processing and your rights; its privacy policy applies. We forward requests that reach us to that business.

9. When Selqo contacts you itself

Selqo wins its own customers with its own platform. To do so, we contact businesses whose activities match our offer by letter, email and phone.

Which data and where from

We process company name, address, industry, website and details from the legal notice, names and positions of the management, business phone numbers and email addresses, our assessment of how well your business fits our offer, and the history of our contact (letters, emails, calls, appointments, notes and your reactions to them). The data comes from publicly available sources: map and business directories, your business's website including its legal notice, contact and team pages, public registers and directories, and providers of business contact data for the email address and mobile number of contact persons. We partly form business email addresses of individuals according to your business's usual pattern and have Bouncer (Poland) check whether they can receive mail. We derive the form of address (Mr or Ms) from the name, also with artificial intelligence. We will tell you the specific source of your data on request.

Purpose and legal basis

We process the data to promote our offer to businesses (direct marketing, Art. 6(1)(f) GDPR, Recital 47). The fit assessment is made with artificial intelligence and only serves to select whom we contact; there is no automated decision within the meaning of Art. 22 GDPR. Recipients are Firecrawl (USA) for retrieving websites, FullEnrich (USA) for finding business email addresses and mobile numbers, Google Cloud (Vertex AI, processing worldwide, including the USA) for analysis with artificial intelligence, Bouncer (Poland) for checking email addresses, Skrift (Germany) for printing and mailing letters, and our other service providers (section 3).

QR codes and links

Our letters carry a QR code, our emails contain links. If you open one of them, we store the time, the link opened, the browser identifier and technical details of the network the request comes from (network operator, country and a hash value of the IP address, not the IP address itself) to tell real visits from automated checks and to take your interest into account in our further contact (Art. 6(1)(f) GDPR). To prevent abuse, the IP address may briefly appear in technical logs.

Objection and retention

You can object to the use of your data for advertising at any time: by replying to our letter, by email to support@selqo.ai, via the opt-out QR code in the letter or the opt-out link in our emails. We then no longer use your data for advertising and keep it so that your objection is respected permanently. Without an objection we keep the data as long as we intend to contact your business about our offer or are in touch with you. We keep businesses we do not contact so that we do not suggest them again; we keep records of letters sent as proof.

10. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). You can withdraw consent at any time with effect for the future (Art. 7(3)). You can lodge a complaint with a data protection supervisory authority (Art. 77).

For all data protection matters, contact us at support@selqo.ai. We do not make automated decisions within the meaning of Art. 22 GDPR. We update this policy when our processing changes; the version with the date shown above applies.