Privacy policy (Datenschutzerklärung)

1. Controller

TCB GmbH, Europaring 4, 94315 Straubing, represented by Thomas Becheru, datenschutz@octovo.de. Competent supervisory authority: Bayerisches Landesamt für Datenschutzaufsicht (BayLDA), Ansbach.

2. The most important point first

OCTOVO is a program that runs on your device. Your emails, files, contacts, appointments and everything OCTOVO has learned about you sit encrypted in a file on your computer. We have no access to it. There is no copy with us, no backup in our cloud, no remote access.

What our server sees: the single question OCTOVO puts to the language model so that it can answer. This question is passed through and not stored — no cache, no log with content, no error message with content. What is stored is solely the time, the account, the model used, the number of characters processed, the duration and the status code. We need these numbers for billing and operations.

3. When you visit the website

Each visit creates server logs containing the IP address (stored in shortened form), the time, the page accessed, the amount of data transferred and the browser identifier. The legal basis is Art. 6 Abs. 1 lit. f DSGVO (GDPR) — our legitimate interest in secure operation. Deleted after 7 days.

We use no analytics or advertising services, load no third-party fonts, no map services and no embedded videos. That is why there is no consent banner on this website — there is nothing to consent to. Technically necessary are merely a session cookie in the account area and the state of the payment process. On the public pages themselves nothing is stored on your device: no cookie, no local storage, no identifier.

Two things these pages do nevertheless, and you should know about both. The start page and the Status page ask, when opened and roughly once a minute thereafter, our own server whether it is reachable; this creates the same server logs as described above, and nothing is transmitted about you that a normal page visit would not also transmit. And the Download page reads your browser’s identifier to move the matching package to the top — exclusively in your browser, without transmission and without storage.

4. When you create an account

The following is processed: name, email address, password (only as a non-reversible hash using Argon2id), optionally passkeys, licence and quota data, device list (name, operating system, time of last contact). Legal basis: Art. 6 Abs. 1 lit. b DSGVO (performance of contract). Deletion: with the account, except where retention periods under commercial and tax law stand in the way (invoices: 10 years).

When creating the account you expressly agree to several things: the terms and conditions, the data processing agreement, the sending of emails about your contract and the AI liability notice; you also confirm that you have read this privacy policy. Each checkbox must be ticked individually — none of them is pre-ticked, and a missing tick counts as a no.

What we store about this and why: for each of these consents, the time, the wording you agreed to, the place where you did so, your IP address and a version stamp of the legal text in force at the time. The version stamp is a checksum derived from the text itself: if we change one line of the terms, the checksum changes, and it remains provable which text you agreed to. Legal basis: Art. 6 Abs. 1 lit. c DSGVO in conjunction with Art. 7 Abs. 1 DSGVO — we must be able to prove what was agreed. These records are never overwritten; a correction is created as a new entry next to the old one. They are deleted with the account.

What of this is revocable: The consents above carry the contract and cannot be withdrawn individually — if you no longer want them to apply, you cancel. Advertising is separate from this, voluntary and revocable at any time (section 9). You can view your complete record — which consent, when, in which version — in your account; it is at the same time the information under Art. 15 DSGVO on this point.

5. When you pay

Payments are handled by Stripe Payments Europe, Ltd. Card details never reach our servers. From Stripe we receive name, billing address, payment status and invoice number. Legal basis: Art. 6 Abs. 1 lit. b DSGVO.

6. When OCTOVO thinks for you

So that OCTOVO can understand or write an email, it sends an excerpt — never your entire mailbox — via our server to the gateway nixo and from there to Anthropic PBC (USA), the provider of the language models. For this transfer, we are the processor and you are the controller; the data processing agreement is concluded together with the purchase and is available in your account as a PDF. The transfer to the USA is safeguarded by standard contractual clauses. We have requested from Anthropic that no content be stored.

If the excerpts contain other people’s data (for instance your customers’), you remain responsible for its processing. OCTOVO expressly points this out during the first getting-to-know-you run.

When Anthropic does not answer — transfer to China: If the default model (Claude Sonnet 5, Anthropic PBC) does not answer, our server repeats the same request through the same gateway with a second provider: DeepSeek (model DeepSeek V4 Pro), based in China. This happens solely in this fallback case and not in normal operation. What is transmitted is the same excerpt as always — the matter, the contact and the fitting memories, so depending on the order the text of an email, appointment details or file names; never your entire mailbox, never your memory as one piece, never an image of your screen. Nothing changes at the earlier stations: the excerpt still travels via our server in Germany and the gateway in the EU. Only the final station then lies outside the EU.

On what basis: There is no adequacy decision by the EU Commission for China under Art. 45 DSGVO. Which basis under Chapter V of the DSGVO carries this transfer has not been finally determined as of this version; it will be established by a lawyer before the sales launch and entered here as well as in the list of sub-processors. We write this down rather than name a basis we cannot evidence. For the processing on your behalf, the following remains unchanged: you are the controller, we are the processor.

7. When you switch on screen observation

This capability is switched off by default. If you switch it on, OCTOVO captures the screen content at an adjustable interval, reads it out as text entirely on your device and then discards the image. Before reading, a blocklist applies (password stores, banking and login pages, private windows and anything you add); blocked areas are never read in the first place. Card numbers, IBANs, keys and confirmation codes are removed before anything is filed. The text sits in the same encrypted file as your other data and expires automatically after the period you set (default: 7 days).

What leaves your device in the process: If you ask OCTOVO something that refers to what was seen, the necessary excerpt of this text travels, as part of a thinking request, the same route as in section 6 — via our server and the gateway nixo to Anthropic PBC. What is transmitted is text, never an image and never a video.

Inevitably, other people’s data also appears on the screen. You remain responsible for its processing; switch observation off during screen sharing and in other people’s sessions. On a work device, use without a works agreement is not permitted (§ 87 Abs. 1 Nr. 6 BetrVG); for professions bound to secrecy (§ 203 StGB), observation is blocked in confidentiality mode and must be enabled individually. Legal basis for switching it on: Art. 6 Abs. 1 lit. a DSGVO (consent), revocable at any time — “Forget the last hour” and complete deletion take effect immediately. Emotion recognition, biometric categorisation or behavioural assessment does not take place and is expressly prohibited in the terms of use.

8. Which connections OCTOVO establishes from your device

Not everything runs via our server. Some things OCTOVO fetches directly from your device — the other side then sees your IP address, just as it would with any request from your browser, and we see none of it. These connections are listed here in full:

• Your mailbox. OCTOVO talks directly to your provider’s mail server. The credentials sit in your operating system’s keychain and never reach us.
• Setting up the mailbox. So that you only have to type in your email address, OCTOVO looks up the right settings with the provider: it queries autoconfig.your-domain and .well-known, and reads your domain’s server records in the name service. What is transmitted is the part of your address after the @ sign, not the address itself.
• The weather for the “Today” board and the “wetter” tool. It is queried from Open-Meteo (Germany and Switzerland). What is transmitted is solely the place name you yourself entered in your profile, or its coordinates — no account, no key, no identifier, no personal reference. The request runs from your device, so your IP address is visible to Open-Meteo; at most four times per hour. Without a place entered, no request takes place — if you delete the place, it stops immediately. The board visibly names Open-Meteo as the source.
• Web search — if you have stored your own access key. Under Settings → “Web search” you can store access to a search interface. OCTOVO then puts your search queries to it — either to Tavily (AlphaAI Technologies Inc., New York, USA) or to Brave Search (Brave Software, Inc., San Francisco, USA) — depending on which of the two you chose. What is transmitted is your search query in plain text, together with your key; the request runs from your device, so your IP address is visible to the service. Both are based in the USA, a third country without an adequacy decision for this case; both work with standard contractual clauses, and neither is certified under the EU-US Data Privacy Framework (checked on 22 August 2026). The account and the bill for it are yours, not ours — the respective provider’s terms apply. Without stored access, none of these requests take place — if you remove it, they stop immediately.
• Searching for news — even without access. For news OCTOVO needs no key: it queries the public news feed (RSS) of Google News (controller for users in the European Economic Area: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). What is transmitted is your search query in plain text as part of the address; the request runs from your device, so your IP address is visible to Google. This is the only route that runs without any action on your part: if no search access is stored, OCTOVO falls back to it when you ask about news, and a “News” board tile you have created refreshes through it as soon as you look at it and its content is stale. If you create no such tile and do not ask about news, nothing happens here either.
• Pages OCTOVO opens for you. If you ask it to read a page — or if it opens the best hits of a search — it fetches it directly from your device. To the operator of that page this looks like a visit with your browser: they see your IP address and the address requested. We see none of it, and there is no cache of it at our end.
• Connected channels (cloud storage, Facebook pages, Instagram business accounts, LinkedIn and the other networks). Here too your device talks directly to the platform. Their own terms and privacy notices apply; you remain responsible for your accounts there.
• The reachability check with us. The program asks at intervals whether our server and the thinking service respond. No content goes out in the process.
• GitHub, when you ask about a project. If you ask OCTOVO to look at the issues, pull requests or workflow runs of a repository, it calls GitHub directly from your device. GitHub then sees the repository name, your IP address and the time — and, if you have stored your own GitHub access token under Settings, that token. Public repositories need no token, so this path runs without any setup, but only when you ask for it: nothing happens here on its own. OCTOVO only reads there; nothing is written, commented or closed. The controller is GitHub, Inc. (88 Colin P. Kelly Jr. St., San Francisco, USA) or GitHub B.V. (Prins Bernhardplein 200, 1097 JB Amsterdam). GitHub is certified under the EU-U.S. Data Privacy Framework (checked 23 August 2026) and additionally relies on the European Commission’s standard contractual clauses.

The legal basis in each case is Art. 6 Abs. 1 lit. b DSGVO. For everything you set up yourself — mailbox, connected channels, search access — the following applies: the connection arises only because and insofar as you have set up the corresponding capability, and it stops as soon as you remove it again. For the requests that are possible even without any setup — the news feed and the opening of a page — the same applies with a different trigger: they arise only from an instruction you give, or from a tile you created yourself, and they stop as soon as you stop doing that or remove the tile. A request triggered neither by a setup nor by an instruction of yours does not take place.

9. Newsletters and system emails

We distinguish two kinds of email to you, and the separation is technically enforced in the program — not merely a promise.

• Service notices about your contract (outages, maintenance, changes to the terms, security notices, invoices) go to all customers with a valid licence. They contain no advertising. Legal basis: Art. 6 Abs. 1 lit. b DSGVO.
• Advertising newsletters go exclusively to accounts with confirmed consent via the double opt-in procedure. As proof (Art. 7 Abs. 1 DSGVO) we store the wording you agreed to, the origin of the sign-up, the time and IP address of the request and the confirmation, and, where applicable, the time of the withdrawal. Legal basis: Art. 6 Abs. 1 lit. a DSGVO in conjunction with § 7 Abs. 2 UWG.

Every email carries an unsubscribe link and the legal notice (Impressum). Unsubscribing takes effect immediately upon opening the link, without logging in and without follow-up questions. What remains afterwards is solely the record that you consented and withdrew again — it is the reason no further advertising reaches you. We use no tracking pixels and measure neither whether you open an email nor what you click in it; all that is stored is whether and when an email went out. Sending is done via Mailgun (EU region), see sub-processors.

10. Diagnostic mode

Only if you expressly switch it on for your account does our server record requests, encrypted and for a limited time, so that support can find a fault. The mode always has an expiry date (at most 7 days), is visible in the program while it is running, and deletes the recordings immediately when switched off. Legal basis: Art. 6 Abs. 1 lit. a DSGVO (consent), revocable at any time.

11. Your rights

You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20) and objection (Art. 21), as well as the right to withdraw a consent at any time and to lodge a complaint with a supervisory authority (Art. 77). For the data on your device you do not need us for any of this: in the program, under “Meine Daten” (My data), you can view, change and export everything, and delete it completely with one click.

12. Recipients

The complete, continuously maintained list is available at sub-processors. We announce changes at least 30 days in advance.

13. No automated decision with legal effect

OCTOVO makes no decisions within the meaning of Art. 22 DSGVO. It prepares and carries out what you have instructed it to do; responsibility and the sender role remain with you.