Privacy Policy

Data protection notice for the ivy application (meet-ivy.eu) and the services provided through it.

Introduction and organisational information

We, at inQ.Politics GmbH (“inQ”, “we”, “us”), operate the ivy application and are dedicated to serving our customers and contacts to the best of our abilities. Part of that commitment is the responsible management of personal information collected through meet-ivy.eu, the ivy application and any related interactions. Our primary goals in processing this information are:

• Providing the ivy service to our customers: monitoring, analysing and reporting on regulatory and political developments.
• Enhancing the user experience by understanding customer needs and preferences.
• Providing timely support and responding to inquiries or service requests.
• Improving our products and services to meet the evolving demands of our users.
• Conducting necessary business operations, such as billing and account management.

It is our policy to process personal information with the utmost respect for privacy and security. We adhere to the EU General Data Protection Regulation (GDPR), the German Federal Data Protection Act (BDSG) and all other relevant regulations to ensure that the data we handle is protected against unauthorised access, disclosure, alteration and destruction.

We do not have a designated Data Protection Officer (DPO) but remain fully committed to addressing your privacy concerns. Should you have any questions or require further information about how we manage personal information, please contact us at the addresses above.

Scope and application

This policy protects the personal information of all our stakeholders: visitors of meet-ivy.eu, registered users of the ivy application, customers and their staff, people who register for events we or our customers organise, newsletter subscribers, and individuals whose professional information appears in the ivy stakeholder directory. It outlines our practices and your rights related to personal information.

What data we process

Users of the ivy application

• Account data: name, business e-mail address, organisation, role, language preference, login timestamps.
• Usage data: the questions you ask the AI search, documents you upload, analyses, projects and notes you create, feature settings. This content is stored for your account and shared only with members of your organisation’s account.
• Technical data: IP address, browser and device information, security logs.

Event registrations and invitations

• Name and e-mail address you provide when registering for an event, the event you registered for, the time of registration, your acknowledgement of the privacy notice and — only if you opt in — your newsletter consent.
• Invitation recipients: name, organisation, position and professional e-mail address of people our customers invite from their contact lists, plus the delivery status of the invitation and any unsubscribe request.

Stakeholder directory

ivy contains a directory of public office holders and professional stakeholders (e.g. members of parliament, officials of EU institutions, association representatives) with their professional role, institution, committee memberships, public positions and, where published, professional contact details and photographs. This information is compiled from official and publicly available sources and processed on the basis of our customers’ legitimate interest in political monitoring and public affairs work. We do not profile private individuals.

Newsletter

If you consent, we process your e-mail address and name to send you information by e-mail. Each newsletter contains an unsubscribe link.

Purposes and legal bases

• Performance of a contract (Art. 6(1)(b) GDPR): providing the ivy service to our customers and their users, managing event registrations.
• Legitimate interests (Art. 6(1)(f) GDPR): operating and securing the application, political monitoring and public-affairs analysis for our customers, inviting professional stakeholders to events, improving our services, defending legal claims.
• Consent (Art. 6(1)(a) GDPR): newsletter, optional photographs at events, any non-essential cookies. You can withdraw consent at any time with effect for the future.
• Legal obligations (Art. 6(1)(c) GDPR): retention duties under commercial and tax law.

Artificial intelligence

ivy uses large language models to search, summarise and analyse documents and to draft texts. Content you submit for analysis (questions, documents, notes) is transmitted to our AI providers (Anthropic PBC, and — where enabled by your account — Google and OpenAI) for processing under contractual terms that prohibit the use of your data for training their models. ivy favours extractive, source-traceable outputs; AI-generated content is marked as such and must be verified by the user before being relied on. Our principles are set out in the inQ AI philosophy, available inside the application under Settings.

Data storage and protection

Data storage

• Personal information is stored in secure, access-controlled cloud databases operated by Supabase Inc. (PostgreSQL, hosted on Amazon Web Services) and the application is served by Vercel Inc. Some infrastructure is located in the United States; such transfers are protected by the EU Standard Contractual Clauses and the EU–US Data Privacy Framework where applicable.
• Transactional e-mails (invitations, password resets, reports) are sent through Microsoft 365 (Microsoft Ireland Operations Ltd.) from inQ mailboxes.
• Data hosting partners are selected for their adherence to stringent data-protection and security standards (ISO 27001 / SOC 2).

Data protection measures

• Encryption: data is encrypted in transit (TLS) and at rest.
• Access control: access to personal information is strictly limited to authorised personnel with a legitimate business need; customer accounts are isolated from each other at database level, and we regularly review permissions.
• Security monitoring: we monitor our systems for unusual activity and review access logs; vulnerabilities are remediated promptly.

Data sharing and disclosure

Sharing personal information

• Third-party service providers (processors): hosting, database, e-mail and AI providers named above act on our behalf under data-processing agreements, may access personal information only on a need-to-know basis and are contractually bound to confidentiality and to using the data solely for our instructions.
• Within a customer account: content you create in ivy is visible to the other members of your organisation’s account. Event organisers see the registrations for their events.
• Legal requirements: we may disclose information where required by law, court order or to protect our rights, property or safety.
• We do not sell personal information and do not share it with third parties for their own marketing.

Retention

• Account and usage data: for the duration of the customer relationship and up to 12 months thereafter, unless longer retention is required by law.
• Event registrations: until 6 months after the event, unless you ask us to delete them earlier.
• Newsletter data: until you withdraw your consent.
• Directory information on public office holders: as long as the person holds the public role or the information remains publicly relevant; corrected or removed on request.
• Accounting records: 10 years (statutory).

Your rights

Under the GDPR you have the right to access the personal information we hold about you, to have it rectified or erased, to restrict or object to its processing, to data portability, and to withdraw any consent at any time with effect for the future. To exercise these rights, write to privacy@inq.technology. You also have the right to lodge a complaint with a supervisory authority — for inQ this is the Berliner Beauftragte für Datenschutz und Informationsfreiheit, Alt-Moabit 59-61, 10555 Berlin.

Cookies

meet-ivy.eu uses only strictly necessary cookies: the session cookie that keeps you logged in and a preference cookie for your language and account selection. We do not use advertising or tracking cookies and do not embed third-party analytics on the application pages.

Children

ivy is a professional service and not directed at children under 16. We do not knowingly collect personal information from children.

Changes to this policy

We may update this policy to reflect changes in our services or legal requirements. The effective date at the top indicates the latest revision; material changes will be announced inside the application.

Contact