Privacy policy

As of 14 October 2026

At a glance

• We use no tracking, no analytics tools and no advertising cookies.
• The website is hosted by a provider in Germany; forms and the newsletter run on our own server there.
• Our free tools calculate in your browser; your inputs are not transmitted unless you request the result by email.
• There are no transfers to third countries such as the USA.

1. Controller

NITSAN GmbH, Bischofsweg 6, 01097 Dresden, Germany · phone +49 351 48196661 · email privacy@ragsuite.de. RAGSuite is a brand of NITSAN GmbH.

2. Data protection contact

We are not required to appoint a data protection officer. For any data protection question, contact privacy@ragsuite.de or the address above.

3. Hosting and server log files

The website is hosted by ALL-INKL.COM: Neue Medien Münnich, Hauptstraße 68, 02742 Friedersdorf, Germany, under a data processing agreement (Art. 28 GDPR). When you visit, the server automatically processes your IP address, date and time, requested page, referrer URL, browser and operating system, to keep the site secure and stable (Art. 6(1)(f) GDPR; our legitimate interest is security and availability). Log files are deleted after 7 days at the latest. Connections are TLS-encrypted.

4. Cookies and browser storage

We don't use analytics or advertising cookies. In your browser we only store what is strictly necessary for the function you requested, such as your language setting (German/English): § 25(2) no. 2 TDDDG; where personal data is involved, Art. 6(1)(f) GDPR. If we ever add analytics, we will ask for your consent first (Art. 6(1)(a) GDPR, § 25(1) TDDDG).

5. Contact form, email and phone

When you contact us via the contact form, by email or by phone, we process your details (such as name, work email, company, topic and message) to answer your request. The form is processed on our own server in Germany; no external form service is used. Legal basis: Art. 6(1)(b) GDPR where your request relates to a contract, otherwise Art. 6(1)(f) GDPR (answering enquiries). We delete the data once the request is settled and no retention duty applies.

6. Partner application and questions to our team

The partner application and the "Didn't find your question?" forms work as in section 5: we use your details only to reply, on our own server in Germany (Art. 6(1)(b) or (f) GDPR).

7. Meeting and demo requests

We take meeting requests via the contact form or by email; no external booking service is used. Section 5 applies.

8. Newsletter "The Sovereign AI Brief"

If you subscribe, we process your email address based on your consent (Art. 6(1)(a) GDPR) using double opt-in. We log sign-up and confirmation with a timestamp to prove consent (Art. 6(1)(f) GDPR). The newsletter is sent from our own server in Germany. You can unsubscribe at any time via the link in every issue or by email; we then delete your address unless we need it to prove your earlier consent.

9. Free tools (e.g. GDPR check, DPIA template, AI policy, AI cost calculator)

The tools run entirely in your browser. Your answers and inputs are not sent to us or stored; reloading the page deletes them. Only if you request the result by email do you send us your email address and the result. We process them to send you the result (Art. 6(1)(b) GDPR) and, with your consent, to contact you about it (Art. 6(1)(a) GDPR). You can withdraw consent at any time.

10. Links to other websites

We link to GitHub, npm, LinkedIn, X and other sites. These are plain links, not embedded content: data is only transferred once you click a link, after which the other provider's privacy policy applies.

11. Fonts and embedded content

Fonts and all content load from our own server. We don't embed third-party content such as videos, maps or externally hosted fonts.

12. The RAGSuite software

If you run RAGSuite yourself, you process the data in your own environment and are responsible for it. The software sends no telemetry or usage data to us. If support gives us access to personal data, we sign a data processing agreement with you (see DPA).

12a. RAGSuite Engine

Account and trial. When you create an account for the RAGSuite Engine, we process your name, email address, company, password (as a hash only) and chosen settings to provide the service (Art. 6(1)(b) GDPR). We need no payment method for the free trial.

Billing. For paid plans we process billing and payment data to perform the contract and because of statutory retention duties (Art. 6(1)(b) and (c) GDPR). Payment provider: [provider to follow].

Service usage data. To operate and secure the service and for billing and to ensure fair use, we record technical logs and usage per account: [scope to follow] (Art. 6(1)(b) and (f) GDPR).

Your content. Documents, questions, answers and histories you process in the RAGSuite Engine are processed by us as a processor on your behalf under the data processing agreement (see DPA). You are the controller for them. The sub-processors, including the providers of the chosen language models, are listed in the annex to the DPA.

Retention. We keep account data for the term of the contract and billing data for the statutory periods. Data from a trial that is not continued is deleted after [period to follow].

13. Recipients and third countries

When you visit this website, the recipient of your data is our hosting provider as a processor. No data is transferred to third countries outside the EU/EEA. For the RAGSuite Engine, section 12a and the list of sub-processors apply.

14. Retention

We keep personal data only as long as the purpose requires or statutory retention periods demand, for example under commercial and tax law (up to ten years for accounting records).

15. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20) and to withdraw consent with effect for the future (Art. 7(3)). Write to privacy@ragsuite.de.
Right to object (Art. 21 GDPR): where we process data under Art. 6(1)(f) GDPR, you may object at any time on grounds relating to your particular situation.

16. Right to complain

You may complain to a data protection supervisory authority, in particular where you live or work. Our competent authority is the Sächsische Datenschutz- und Transparenzbeauftragte (Saxon Data Protection and Transparency Commissioner), Maternistraße 17, 01067 Dresden, Germany.

17. Obligation to provide data; automated decisions

You are not obliged to provide data, but without your contact details we can't answer your request. We do not use automated decision-making, including profiling (Art. 22 GDPR).

18. Changes

We update this policy when our website or the law changes. The current version on this page applies.