Privacy policy
This is a translation for convenience. The German version (Datenschutzerklärung) is the legally binding one.
1. Controller
dispatcha.ai UG (haftungsbeschränkt)
Blutenbergstr. 75 d, 80634 München, Germany
Represented by the managing director Alexander Weihe
Email: [email protected]
This policy covers the website dispatcha.ai and, in section 5, data from Google accounts that users connect to our software Dispatcha. For the software otherwise, we publish a separate privacy notice.
2. Providing the website
When you open this website, your browser transmits technically necessary data: IP address, date and time, the address requested, the page visited before (referrer), and details of your browser and operating system. We process them to deliver the pages and to protect the website against attacks and abuse. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is providing the website securely and reliably. The connection is TLS-encrypted.
The website is delivered through Cloudflare Pages. The provider is Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA, which processes this data on our behalf as a processor (Art. 28 GDPR). Data may be transferred to the USA in the process. Cloudflare is certified under the EU-US Data Privacy Framework; the transfer relies on the European Commission's adequacy decision (Art. 45 GDPR).
We keep no access logs ourselves. Cloudflare stores the data only as long as needed to deliver and secure the website.
3. Cookies, consent and web analytics
The fonts (Archivo, JetBrains Mono) are delivered with the website; your browser makes no connection to third parties such as Google for them. We embed no third-party content.
Strictly necessary. We store your choice in the cookie banner in a
cookie (cc_cookie, lifetime six months). If you pick a language with the
language switcher or the language notice, or dismiss that notice, your browser
remembers the choice in local storage (localStorage); it is not sent to us. Neither needs consent, because both are strictly necessary for the
service you asked for (§ 25(2) no. 2 TDDDG, the German Telecommunications Digital
Services Data Protection Act). The legal basis is Art. 6(1)(f) GDPR; our legitimate
interest is respecting your choice and not asking again.
If Cloudflare detects suspicious traffic, it may set a technically necessary security cookie. That too needs no consent (§ 25(2) no. 2 TDDDG); the processing involved rests on Art. 6(1)(f) GDPR, protecting the website against automated attacks.
Web analytics with Google Analytics. Only if you consent in the cookie
banner do we use Google Analytics 4, a web analytics service of Google Ireland Limited,
Gordon House, Barrow Street, Dublin 4, Ireland. Before that, your browser makes no
connection to Google. Google Analytics sets cookies (_ga and
_ga_VMRWWLSSR5, each with a lifetime of two years) and processes information
about your use of the website: pages viewed, time spent, approximate location (country,
region), and device and browser details. Google Analytics 4 does not log or store IP
addresses. Google processes the data as a processor (Art. 28 GDPR); data may be
transferred to Google LLC in the USA, which is certified under the EU-US Data Privacy
Framework (Art. 45 GDPR).
We have limited data retention to two months and switched off Google Signals and ad personalisation. The legal basis is your consent (§ 25(1) TDDDG, Art. 6(1)(a) GDPR). You can withdraw it at any time with effect for the future — or use “Cookie settings” at the foot of every page. Withdrawal does not affect the lawfulness of processing before it.
4. Contacting us by email
When you write to us, we process your email address, your name if you give it, and the content of your message in order to answer your enquiry. If the enquiry aims at a contract, such as taking part in our pilot programme, the legal basis is Art. 6(1)(b) GDPR, otherwise Art. 6(1)(f) GDPR (our legitimate interest in answering enquiries). The information is voluntary; without it we cannot reply.
Our mailbox is run by Google Workspace. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, as a processor (Art. 28 GDPR). Data may be transferred to Google LLC in the USA; Google is certified under the EU-US Data Privacy Framework (Art. 45 GDPR).
We delete your message once your enquiry is dealt with, unless statutory retention obligations apply — for example six years for business letters (§ 257 HGB, the German Commercial Code).
5. Our software: data from your Google account
In Dispatcha, users can choose to connect their Google account (My account → Connections). We request only the permissions a feature needs, and only when you turn that feature on:
Gmail, send only (gmail.send): if your organisation chooses
this setting, Dispatcha sends e-mails about the work packages you are responsible for
through your Gmail account, in your name — for example a follow-up question to a
subcontractor. Dispatcha writes these e-mails; replies are addressed to a Dispatcha
address. We do not and cannot read your mailbox: the permission only allows sending. We do
not store what Google returns about a sent message.
Google Drive, only files you pick (drive.file): you can link
files you select yourself in Google's file picker to a project. We store the file's ID,
name, type and the address of its icon, so your project team can open it in Google Drive.
We do not retrieve or store the contents of your files; you pick them in your browser.
Your Google address (openid, email): to show you
which account is connected.
Sign in with Google (openid, email,
profile): if you sign in with your Google account instead of a password,
Google sends us the account's name, e-mail address and profile picture. Our sign-in
service (Supabase Auth, servers in Frankfurt am Main) stores them with your login;
Dispatcha itself uses only the e-mail address, to recognise you as the person your
organisation invited. A Google account nobody invited cannot sign in, and no login is
created for it. The data is deleted together with your login. You can sign in with a
password instead at any time.
Storage. We store the access tokens Google issues to us encrypted (AES-256-GCM), together with your Google address and the permissions granted, in our database in Frankfurt am Main. When you disconnect, or when your user account is deleted, we revoke the permission at Google and delete the tokens. Linked files stay in their project until someone removes them or the project is deleted. You can also revoke the permission at any time in your Google account (myaccount.google.com/connections).
No other use. We use data from your Google account only for the features described above. We do not sell it, do not use it for advertising and do not share it with third parties — except the providers that run our servers and database (Google Cloud and Supabase, servers in Frankfurt am Main), as processors under Art. 28 GDPR, and where the law requires it. We do not pass it to any AI model, and we do not use it to develop, improve or train AI or machine-learning models. Our staff look at it only if you ask us to, if it is necessary to investigate security incidents or abuse, or if the law requires it.
Dispatcha's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
The legal basis is your consent (Art. 6(1)(a) GDPR), which you give by connecting and can withdraw at any time by disconnecting. Withdrawal does not affect the lawfulness of processing before it.
6. Your rights
You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). To exercise them, write to [email protected].
You may also lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is the Bavarian State Office for Data Protection Supervision (Bayerisches Landesamt für Datenschutzaufsicht), Promenade 18, 91522 Ansbach, Germany.
No automated decision-making, including profiling (Art. 22 GDPR), takes place.
7. Right to object
Where we process data on the basis of Art. 6(1)(f) GDPR, you may object to this processing at any time on grounds relating to your particular situation (Art. 21 GDPR). We will then no longer process the data unless we demonstrate compelling legitimate grounds that override your interests, or the processing serves the establishment, exercise or defence of legal claims.
Last updated: October 2026