Privacy Policy
We are pleased about your interest in our company. The protection of your personal data is important to us.
1. Responsible person
BrightSide Technologies GmbH, Trausnitzstr. 8, 81671 Munich, Germany, email: info@thebrights.ai, telephone: +49 89 62825500. Represented by managing directors Eike Kohlmeyer and Abhishreshth Deswal. (A data protection officer has not currently been appointed as the legal requirements for this do not exist.)
2. General information on data processing
We only process personal data to the extent necessary to provide a functional website and our content and services. Processing usually only takes place with your consent or based on legal permission.
3. Provision of the website and server log files (hosting by Vercel)
When you visit our website, our hosting provider Vercel Inc. (USA) automatically collects information that your browser transmits to our server (server log files).
This includes: IP address, date and time of the request, time zone difference, content of the request, access status/HTTP status code, amount of data transferred, website from which the request comes, browser, operating system and its interface as well as language and version of the browser software.
The legal basis is Article 6 Paragraph 1 Letter f GDPR (legitimate interest in the secure and stable provision of the website).
The data is usually automatically deleted after 30 days.
Vercel Inc. is based in the USA.
The transfer is based on the EU Commission’s standard contractual clauses (SCCs).
Further information: https://vercel.com/legal/privacy-policy
4. Contact form and email communication (Resend)
If you send us inquiries using the contact form, the data entered in the input mask (first name, last name, email address, company, message, if applicable topic/size/industry) will be stored by us.
The legal basis is Article 6 Paragraph 1 Letter b GDPR (fulfillment of the contract / pre-contractual measures) and Article 6 Paragraph 1 Letter f GDPR (legitimate interest in processing your request).
The data is sent as an email via the Resend, Inc. (USA) service.
Resend is a processor.
There are order processing contracts and standard contractual clauses.
The data will only be stored by us and the service provider for as long as is necessary to process the request (usually a maximum of 12 months).
5. Bot and spam protection (Cloudflare Turnstile and security services)
To protect our contact forms (contact page and lead form on the homepage) from automated and abusive input — including AI-powered spam attacks — we use Cloudflare Turnstile.
The provider is Cloudflare, Inc. (USA).
Cloudflare may process technical data (including IP address, browser/device information, referrer URL, interaction and verification data).
The processing serves exclusively for security and protection against spam, not for advertising or profiling.
The legal basis is Article 6 Paragraph 1 Letter f GDPR.
If our domain is provided via Cloudflare, Cloudflare also processes access data to protect against attacks (WAF, bot management, rate limiting).
The transfer to the USA takes place on the basis of standard contractual clauses (SCCs).
Further information: https://www.cloudflare.com/privacypolicy/ and https://developers.cloudflare.com/turnstile/
6. Eve Voice Demo (SpaceXAI / Grok Voice)
On the /voice page we optionally offer a speech demo (“Eve”).
If you start the demo and grant microphone access, audio streams are sent in real time to the SpaceXAI Voice API (Grok Voice / Realtime) for speech recognition, dialogue, and speech output.
Processed data include audio (microphone), technical connection data (e.g.
IP address, browser/device info), and transcripts or generated replies from the dialogue.
Processing is based on your consent (Art.
6(1)(a) GDPR) and our legitimate interest in a working product demo (Art.
6(1)(f) GDPR) where applicable.
Without consent and microphone permission the demo does not start.
The model/voice infrastructure provider is SpaceXAI (USA).
Transfers to the USA use Standard Contractual Clauses (SCCs).
Ephemeral session tokens are issued server-side; the API key stays on our server.
Audio is processed only for the demo session and not for marketing profiles.
More information: https://x.ai/legal/privacy-policy We may also offer an optional phone demo (number on /voice).
If you call, SpaceXAI and any telephony provider (e.g.
SIP/PSTN via the Voice Agent Builder) process call audio, caller metadata, and technical connection data for real-time speech processing.
Processing is based on your choice to dial the number (consent by using the service) and, where applicable, Art.
6(1)(f) GDPR for operating the demo.
Do not call if you do not agree.
Call content is used only for the demo (e.g. booking intent) and not for marketing profiles.
5. Language preference with next-intl
We use the next-intl framework to provide multilingual content. A cookie (name: NEXT_LOCALE, duration: 1 year) is set to save your language preference. The legal basis is Article 6 (1) (f) GDPR (legitimate interest in a user-friendly, multilingual website).
6. No other tracking or analysis services
No other tracking, analysis or marketing services (e.g. Google Analytics, Meta Pixel) are currently used on this website. If additional services are added in the future, we will update this privacy policy accordingly and inform you in advance.
Cookie settings and consent
On your first visit a cookie banner appears with equal options “Accept all”, “Necessary only” and “Settings”.
We store your choice locally (localStorage key brights.cookie-consent.v1 and cookie brights_consent, 180 days) so we do not ask again.
Strictly necessary cookies do not require consent (TTDSG/TDDDG): language preference, Cloudflare security cookies (__cf_bm, cf_clearance, _cfuvid when the domain is served through Cloudflare) and Turnstile for form protection.
Statistics and marketing cookies load only after consent — none of those services are active today.
You can change your choice anytime via “Cookie settings” in the footer.
7. Rights of those affected
You have the following rights towards us with regard to your personal data: right to information (Art. 15 GDPR), correction (Art. 16 GDPR), deletion (Art. 17 GDPR), restriction of processing (Art. 18 GDPR), data portability (Art. 20 GDPR), objection (Art. 21 GDPR) and revocation of consent given (Art. 7 Para. 3 GDPR). Please send your request by email to info@thebrights.ai or by post to the address above.
8. Right to lodge a complaint with a supervisory authority
You have the right to complain to a data protection supervisory authority. The responsible authority for us is: Bavarian State Office for Data Protection Supervision (BayLDA), Promenade 18, 91522 Ansbach, telephone: +49 (0) 981 180093-0, email: poststelle@lda.bayern.de, web: https://www.lda.bayern.de
9. Storage period
Personal data is only stored for as long as it is necessary for the respective purposes or as long as there are legal retention obligations (e.g. 6-10 years for tax or commercial law obligations). Contact requests are usually deleted after 12 months.
10. Changes to this Privacy Policy
We reserve the right to adapt this data protection declaration if necessary in order to adapt it to changes in the legal situation or changed functions of the website. You can always find the current version at this URL.