Privacy Policy

This translation is for information only. The German version is legally binding.

As of: 6. November 2026

1. Controller

moewe communication group GmbH, Pfeuferstr. 49, 81373 München, Deutschland — email: app@moewe-studio.de, telephone: +49 (0)89 21 54 62 75 - 0.

2. What data we process and for what purpose

  • Account: Name, email address, password (stored as hash only), two-factor authentication settings, account type and activations, time of registration and last login. Legal basis: contract (Art. 6(1)(b) GDPR).
  • Content: Your chat histories, uploaded files, generated images and documents, projects, libraries, custom assistants and the optional memory are stored so that you can retrieve and continue working with them — except in incognito mode, where nothing is stored. The memory consists of your self-written profile and, only with your express consent, short memory notes that an AI model derives from the conversation history after your chats (e.g. role, projects, language and style preferences; no special categories within the meaning of Art. 9 GDPR). Both are sent along with each request to the selected AI model, can be viewed and deleted at any time under Settings → Memory; you may withdraw your consent there at any time. Legal basis: contract; for the memory notes, your consent (Art. 6(1)(a) GDPR).
  • Safeguard: Optionally, the Studio checks your message before sending for sensitive information (e.g. IBAN, card numbers, email addresses, telephone numbers, names, passwords) and replaces them with placeholders before the message is sent to the AI model. The check, including name recognition, runs exclusively on our servers in Germany; the original values do not leave our system and are reinserted in the response. Legal basis: contract.
  • Team: If you invite sub-users, we process their name and email address; the main user sees the usage and settings of their sub-users, but not their chat content (except in jointly used projects).
  • Billing: Usage data per request (model, costs, time, token numbers), credit balances, subscription status, top-ups and invoice data (billing address, VAT ID if applicable). We do not see or store card data — payment is processed by Stripe. Legal basis: contract and statutory retention obligations (Art. 6(1)(c) GDPR).
  • Age verification (voluntary, only for "18+" models): Stripe Identity verifies identity document and selfie; document and images are transmitted directly to Stripe and processed there. We receive and store only the result (of legal age yes/no), the time and the verification reference. Legal basis: protection of minors (Art. 6(1)(c) GDPR) in conjunction with your request.
  • Automations: Scheduled tasks run on your behalf; results are delivered in the chat and/or by email to you and stored like other content.
  • Connections to third-party services: If you connect services such as Canva, Figma, Notion, Linear or Zapier, we store the access tokens in encrypted form and transmit the necessary content to the respective service when used. This only happens at your instigation; you confirm modifying actions beforehand. The data protection provisions of the service apply to processing there.
  • Web research and scraping: If you use this function, search queries and results (including personal data from public sources) are collected via the Apify service and stored with us as a table. You as the user are responsible for the lawfulness of the collection and use (see Terms and Conditions); business customers conclude a data processing agreement for this purpose.
  • Agent: If you use this function (only after activation for your account), we transmit your task description and your messages in the course of the task to the Manus service (Butterfly Effect Pte. Ltd., Singapore). The agent carries out the task there autonomously in an isolated working environment — it researches on the web, visits websites and creates files — and uses its own AI providers and service providers for this, including in the USA. Tasks run under the Studio's account: we do not transmit your name, e-mail address or account data; Manus only receives what you write into the task. We store the course of the task and the result files with us like other content. At Manus, we arrange for the task to be deleted immediately when you delete it, otherwise seven days after it was last completed. The transfer to Singapore and the USA is based on EU Standard Contractual Clauses. Under its own terms, Manus may also use content from tasks to improve its services and models; an opt-out is currently not set up for our account. The function is not available in accounts with "EU models only" and in child profiles. Only give the agent data that is necessary for the task (see Terms and Conditions).
  • Weather: For weather information in voice conversations and automations, our server transmits only the place name to the geocoding service Nominatim (OpenStreetMap Foundation) and the resulting coordinates to the weather service of the Norwegian Meteorological Institute (MET Norway). We do not transmit any details about you or your account. Weather data: MET Norway, licence CC BY 4.0; place data: © OpenStreetMap contributors.
  • Feedback: Messages sent via the feedback button are stored with your account, the page accessed and browser information so that we can trace errors.
  • Security and operations: Technical logs (errors, runtimes, IP address on login and payment transactions, top-up limits) to prevent misuse and payment fraud. Legal basis: legitimate interest (Art. 6(1)(f) GDPR).
  • Statistical analysis: To improve the service, we analyse usage in aggregated form (e.g. which functions and topics are frequently used) — without reference to individual persons. Legal basis: legitimate interest.
  • Child profiles: If parents or legal guardians (as main users) or we at their request set up a child profile, we additionally process the age group. The child's messages, responses and image requests are automatically checked for inappropriate content before display (content moderation by OpenAI; for accounts with "EU models only" by Mistral AI in the EU). Blocked content is stored as a security notification with category and time; for children up to 12 years of age with a short excerpt; security notifications are deleted after 12 months. Parents or legal guardians can read all chats for children up to 12 years of age, from 13 years of age only the security notifications. If a message indicates self-harm, we inform the parents or legal guardians immediately by email (without the message text); the child is notified of this. Legal basis: contract with the parents or legal guardians (Art. 6(1)(b) GDPR), their consent for the child (Art. 8 GDPR) and — in the case of notification — the protection of vital interests (Art. 6(1)(d) GDPR).
  • Notifications: System emails regarding registration, payments, credit, automations and security events (e.g. change of email address). No advertising emails without consent.

3. AI providers and other recipients (processors)

Before your first request the studio asks for your explicit consent to this transmission; you can see and revoke it under Settings → Account → "AI providers". The model picker shows which provider is behind each model.

To answer your requests, their content (text, files if applicable, images, voice recordings) is transmitted to the selected AI provider. Which providers receive data is controlled by you via the model selection; models with the 🇪🇺 label are processed in EU data centres, and the "EU models only" option allows an account to be completely restricted to these. Our providers do not use your content to train their models in accordance with the contract; this does not apply to the "Agent" function (see above). For providers outside the EU, transmission is based on EU standard contractual clauses or the EU-US Data Privacy Framework.

  • Hetzner Online GmbH — Hosting, Datenbank, Backups (Storage Box); processing: Deutschland.
  • Stripe Payments Europe Ltd. / Stripe Inc. — Zahlungen, Rechnungen, Altersprüfung (Identity), Steuerberechnung; processing: Irland / USA; basis: EU-Standardvertragsklauseln, EU-US Data Privacy Framework.
  • OpenRouter Inc. — Vermittlung von KI-Modellen (Chat, Bilder) verschiedener Anbieter; processing: USA; basis: EU-Standardvertragsklauseln.
  • OpenAI (OpenAI Ireland Ltd. / OpenAI LLC) — KI-Modelle, Sprachfunktionen (Diktat, Vorlesen, Live-Gespräch), Bilder, Inhaltsprüfung bei Kinderprofilen; processing: Irland / USA; basis: EU-Standardvertragsklauseln, Data Privacy Framework.
  • Anthropic Ireland Ltd. / Anthropic PBC — KI-Modelle (Claude); processing: Irland / USA; basis: EU-Standardvertragsklauseln, Data Privacy Framework.
  • Google Cloud EMEA Ltd. (Vertex AI) — EU-gehostete KI-Modelle (Gemini), Bilder; processing: EU (Frankfurt, Niederlande).
  • Amazon Web Services EMEA SARL (Bedrock) — EU-gehostete KI-Modelle (Claude); processing: EU (Frankfurt).
  • Microsoft Ireland Operations Ltd. (Azure OpenAI) — EU-gehostete KI-Modelle (GPT); processing: EU (Germany West Central).
  • Mistral AI SAS — EU-gehostete KI-Modelle, Inhaltsprüfung bei Kinderprofilen im Nur-EU-Modus; processing: Frankreich.
  • Venice.ai (Venice Labs) — unzensierte KI-Modelle (Text, Bilder) — nur nach Altersprüfung; processing: USA; basis: EU-Standardvertragsklauseln.
  • fal.ai (Features and Labels Inc.) — Bildgenerierung; processing: USA; basis: EU-Standardvertragsklauseln.
  • Apify Technologies s.r.o. — Web-Recherche und Scraping (nur bei Nutzung der Funktion); processing: Tschechien (EU).
  • Butterfly Effect Pte. Ltd. (Manus) — Agent — selbstständige, mehrstufige Aufgaben (nur nach Freischaltung und bei Nutzung der Funktion; nicht im Nur-EU-Modus, nicht in Kinderprofilen); processing: Singapur / USA; basis: EU-Standardvertragsklauseln (Data Processing Addendum des Anbieters).
  • Verbundene Drittdienste (z.B. Canva, Figma, Notion, Linear, Zapier) — nur, wenn der Nutzer eine Verbindung herstellt; Datenübermittlung im Auftrag des Nutzers; processing: je nach Dienst, überwiegend USA; basis: gemäß den Bedingungen des jeweiligen Dienstes.

4. Hosting and security

moewe AI studio and all stored data are located on servers of Hetzner Online GmbH in Germany (data processing agreement in place). Transmission is encrypted (TLS), access credentials and keys are stored encrypted, access to the servers is restricted to key-based login. Daily backups are retained for 14 days; the copy outside the server is encrypted.

5. Emails

We send system emails via our own mailbox with the host Hetzner. Replies to these emails reach us at app@moewe-studio.de.

6. Cookies and audience measurement

We use only technically necessary cookies for login (session) and settings. For audience measurement we use Umami — a self-hosted, cookieless statistics tool without tracking across other websites; IP addresses are not stored, visitors are not re-identified. There are no advertising cookies and no Google Analytics — therefore also no cookie banner.

7. Retention period

Account data and content remain stored as long as your account exists; thereafter we delete them unless statutory retention obligations exist (billing data: 10 years). Technical logs are automatically overwritten after 30 days, backups after 14 days. Invitation and confirmation links expire after 7 days at the latest.

8. Your rights

You have the right to access, rectification, erasure, restriction of processing, data portability and objection to processing based on legitimate interests, as well as the right to lodge a complaint with a data protection supervisory authority (competent for us: Bayerisches Landesamt für Datenschutzaufsicht). Simply contact app@moewe-studio.de for this purpose. You can delete chats, files and memory entries yourself at any time, and save content via the export functions.

9. Changes

When new functions or providers are added, we update this policy and the list of processors; the date above shows the current version.

Impressum · Datenschutz · AGB · Revoke · AVV