Privacy policy
As at: 6 October 2026
Controller
The controller for the processing of personal data within the meaning of the GDPR is:
Splendid Minds GmbH
Spitzwiesenstraße 33
90765 Fürth
support@splendidminds.de
What this policy covers
ETSpilot consists of three parts that handle data differently:
- This website (www.etspilot.de) – purely an information site with no sign-in.
- The account portal (account.etspilot.de) – management of account, subscription, AI access and projects.
- The ETS6 add-in and the mobile app – they work on your computer and communicate with our server.
Who is responsible for which data
We are the controller within the meaning of the GDPR for your account, the usage data and this website. Content from your ETS projects – such as room and device names, comments or details of your client – is processed by us solely to answer your requests. In this respect we act as your processor (Art. 28 GDPR); you are responsible for this data towards your clients and the users of the building.
You assure us that you are entitled to process this data and to transfer it to the AI provider you have chosen. A data processing agreement is available on request from support@splendidminds.de.
Legal bases for processing
We process personal data only on one of the following bases:
- Consent (Art. 6(1)(a) GDPR) – for example when you provide us with documents for evaluation. You may withdraw it at any time with effect for the future.
- Performance of a contract (Art. 6(1)(b) GDPR) – provision of the account, the add-in and the processing of your requests.
- Legal obligation (Art. 6(1)(c) GDPR) – in particular retention obligations under commercial and tax law.
- Legitimate interest (Art. 6(1)(f) GDPR) – secure operation, detection of misuse, improvement of the service.
We do not process special categories of personal data under Art. 9 GDPR. If you enter such data into a request, this happens at your instigation; we ask you to refrain from doing so.
This website
The website uses no advertising or analytics services. No tracking takes place, no cookies are set for analytics purposes, and no consent is required.
Server logs
When the page is requested, our web server processes the IP address, date and time, the address requested, the referring link and details of the browser and operating system. This is technically necessary in order to deliver the page and to detect attacks. The legal basis is our legitimate interest in secure operation (Art. 6(1)(f) GDPR). The logs are deleted after 14 days.
Fonts
The fonts used are delivered from our own server. No request is made to Google Fonts or any other third party; your IP address is therefore not passed on to anyone.
Local storage
If you switch between light and dark appearance, your browser remembers that choice locally. This information does not leave your device.
Account portal and add-in
An account is required in order to use ETSpilot. The following data is processed in that context:
| Data | Purpose | Retention period |
|---|---|---|
| E-mail address | Sign-in via one-time code, account management, system messages | until the account is deleted |
| API key of your AI provider | Forwarding your requests to the provider you have chosen | until deleted by you; stored encrypted |
| Project-related content from the ETS | Answering your requests by the AI model | in the chat history; deleted automatically three months after the conversation was last used, earlier on request |
| Planning documents in the project folder | Searchability by the assistant | until deleted by you; stored encrypted |
| Usage data (time, model, token count) | Billing, detection of misuse, capacity planning | 400 days |
| Ratings of answers | Improving the quality of answers | until the account is deleted |
| Acceptance of the terms of use and privacy policy (time, version, registration channel) | Proof of acceptance | until the account is deleted |
| Technical server logs (time, request ID, error messages – no content) | Secure operation and troubleshooting | 30 days |
| Diagnostic log containing the full request and response | Troubleshooting; only switched on by an administrator in individual cases | 14 days |
Transfer to the AI provider
Your requests do not go directly to the AI provider but first to our server in Germany. There they are supplemented with KNX expertise and then forwarded to the provider via the account you have stored. Depending on your choice, that is:
- Anthropic PBC (Claude) – transfer to the USA
- OpenAI, L.L.C. – transfer to the USA
- Microsoft (Azure AI Foundry) – region depends on your endpoint
For transfers to the USA we rely on the European Commission's standard contractual clauses (Art. 46(2)(c) GDPR) or – where the provider is certified under it – on the adequacy decision for the EU-US Data Privacy Framework (Art. 45 GDPR). For their business accounts, the providers undertake not to use transmitted content to train their models. If you wish to avoid transfers to third countries, choose an Azure endpoint within the EU.
What you can exclude from transmission
For every project you can define in the portal which data categories must never leave your computer – security keys, device parameters or the building structure, for example. Blocked categories are neither transmitted nor made available to the assistant.
Voice input
The add-in's dictation function uses the online speech recognition of Windows. Your voice recording is processed by Microsoft in the process. The function can only be used if you have enabled it beforehand in the Windows privacy settings; ETSpilot itself does not transmit any audio data.
Hosting and processors
We operate our servers and database with STACKIT, a service of Schwarz Digits Cloud GmbH & Co. KG, Bad Friedrichshall, in data centres in Germany. E-mails (for example sign-in codes) are sent via STRATO GmbH, Berlin. We process enquiries to our support mailbox with Microsoft 365 (Microsoft Ireland Operations Limited, Dublin); this may involve a transfer to Microsoft Corporation in the USA, based on the adequacy decision for the EU-US Data Privacy Framework and on EU standard contractual clauses. We have concluded data processing agreements pursuant to Art. 28 GDPR with all three providers. You use the AI providers named in the preceding section via your own account; their terms additionally apply in that respect.
Security measures
In accordance with Art. 32 GDPR we take technical and organisational measures appropriate to the risk: end-to-end transport encryption (TLS), encrypted storage of access keys and uploaded documents, access only for those people who need it to perform their duties, separate environments for development and operation, and regular updates of the systems in use. Sign-in is by one-time code; we do not store passwords.
Deletion of data
We delete personal data as soon as the purpose of processing ceases to apply and no statutory retention obligation stands in the way. We retain commercial and tax records for six and ten years respectively; such data is restricted in processing rather than deleted until the period expires. If you delete your account, we remove chat histories, stored access keys and uploaded documents immediately. Deleted data remains in our backups until the backup retention period expires and is overwritten afterwards.
Your rights
Under the GDPR you have the following rights:
- Access to the data stored about you (Art. 15)
- Rectification of inaccurate data (Art. 16)
- Erasure (Art. 17)
- Restriction of processing (Art. 18)
- Data portability (Art. 20) and objection (Art. 21)
You can carry out access, export and deletion yourself in the portal under “Account” – without a request to us.
Withdrawal and objection
You may withdraw consent you have given at any time with effect for the future. You may object at any time to processing we base on a legitimate interest; we will then cease it unless we can demonstrate compelling legitimate grounds. An informal message to support@splendidminds.de is sufficient.
Complaint to the supervisory authority
Irrespective of this, you have the right to lodge a complaint with a data protection supervisory authority. The authority responsible for us is the Bavarian State Office for Data Protection Supervision, Promenade 18, 91522 Ansbach, Germany.
Changes
We adapt this policy when the processing changes. The version currently in force can be found on this page.