Privacy Policy

Last updated: October 2026

1. Controller

The controller responsible for data processing on this website within the meaning of the General Data Protection Regulation (GDPR) is:

Represented by its Managing Director, Moritz Luck. Further details are in the Imprint.

2. Summary

• Optional services only run if you allow them in the privacy settings shown on your first visit: Microsoft Clarity and Google Analytics for usage analysis (section 4) and Google reCAPTCHA for spam protection on the contact page (section 7). Both set cookies. Without your consent, this website sets no cookies and uses no analytics, tracking or marketing services.
• You can change or withdraw your choice at any time via "Privacy settings" at the bottom of every page.
• Apart from that, nothing is stored on or read from your device beyond what is strictly necessary for the website or a function you actively use (§ 25 (2) TDDDG, see section 10).
• Fonts, images, videos and scripts are served from our own server. No third-party content (e.g. Google Fonts, YouTube, social media plugins) is embedded.
• If you use the contact form, your details are sent to us by email and, for business enquiries, stored in our CRM (section 5). If you subscribe to product updates, your email address is stored with our newsletter provider beehiiv and in our CRM (section 6).

3. Hosting and server log files

This website is hosted by Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA ("Vercel") and delivered via its content delivery network. When you visit the website, Vercel processes technically necessary data that your browser transmits automatically:

• IP address of the requesting device
• Date and time of access
• Page or file requested and amount of data transferred
• Referrer URL (previously visited page)
• Browser type and operating system (user agent)
• HTTP status code

Purpose: delivering the website, ensuring its stability and security (e.g. defending against attacks) and error analysis.

Legal basis: Art. 6 (1) (f) GDPR. Our legitimate interest is the secure and reliable provision of our website.

Retention: log data is kept only as long as necessary for these purposes and then deleted. It is not combined with other data sources.

Data processing agreement and international transfers: we have concluded a data processing agreement with Vercel pursuant to Art. 28 GDPR. Personal data may be transferred to the USA. Vercel is certified under the EU-US Data Privacy Framework; transfers are based on the European Commission's adequacy decision (Art. 45 GDPR) and additionally on Standard Contractual Clauses (Art. 46 (2) (c) GDPR). More information: vercel.com/legal/privacy-policy.

4. Usage analysis (only with your consent)

If you allow "Analytics" in the privacy settings, we use two services to understand how our website is used and to improve it. Until you consent, neither is loaded and no connection to Microsoft or Google is made.

Microsoft Clarity

Microsoft Clarity is a service of Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland ("Microsoft").

Clarity records how you use our pages: clicks, scrolling, mouse movements, the pages you visit and how long you stay, as well as information about your device and browser (e.g. screen size, operating system, approximate location derived from your IP address). From this, Clarity creates heatmaps and recordings of individual visits (session replays) that help us find and fix problems with the website. Text you type into forms is masked and not recorded; on the contact page the whole content is masked.

Clarity sets cookies on your device (e.g. "_clck", which keeps a Clarity user ID for up to one year, and "_clsk", which connects page views of one visit for up to one day) and may use Microsoft cookies such as "MUID". Data may be transferred to Microsoft Corporation in the USA; Microsoft is certified under the EU-US Data Privacy Framework (Art. 45 GDPR). According to Microsoft, recordings are deleted after 30 days and the other data after 13 months at the latest.

More information: privacy.microsoft.com/privacystatement and Clarity's cookie list.

Google Analytics 4

Google Analytics 4 is a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland ("Google"). It records which pages are visited, how visitors arrive (e.g. from a search engine or a link), how long they stay and how they interact with the pages, together with device and browser information and an approximate location (country, region, city) derived from the IP address. Google Analytics 4 does not store full IP addresses. We have switched off Google Signals and ad personalisation, so the data is not linked to Google accounts or used for advertising.

Google Analytics sets the cookies "_ga" and "_ga_R24D667JPQ" (to tell visits apart, for up to two years). Data may be transferred to Google LLC in the USA; Google LLC is certified under the EU-US Data Privacy Framework (Art. 45 GDPR). We have a data processing agreement with Google (Art. 28 GDPR). Event data is deleted after 2 months. More information: policies.google.com/privacy.

Legal basis for both services: your consent (Art. 6 (1) (a) GDPR and § 25 (1) TDDDG). You can withdraw it at any time via "Privacy settings" at the bottom of every page; both services are then stopped and the page reloads without them.

5. Contact form

If you send us a message via the form on /contact, we process the details you enter: full name, company or organisation, work email address, the topic you choose and, if you provide them, your phone number and message. To filter out automated spam we also check a hidden field and how long the form took to fill in; this information is not stored.

Purpose: answering your request, sending you a confirmation email (for demo requests with a link to book an appointment) and, for business enquiries, keeping a record of the contact in our customer relationship management (CRM) system so that we can follow up.

Legal basis: your consent, which you give by ticking the box in the form (Art. 6 (1) (a) GDPR), and, where your request concerns a contract with us, Art. 6 (1) (b) GDPR. You can withdraw your consent at any time with effect for the future by writing to hi@pliera.ai.

Recipients and processors:

• Vercel Inc. (see section 3) runs the server function that receives the form.
• Resend, Inc. (USA) delivers the notification email to our team and the confirmation email to you. Personal data is transferred to the USA on the basis of a data processing agreement (Art. 28 GDPR) and the EU Standard Contractual Clauses (Art. 46 (2) (c) GDPR). resend.com/legal/privacy-policy
• Zoho hosts our CRM (Zoho CRM) in its EU data centre; processing takes place within the EU under a data processing agreement (Art. 28 GDPR). Messages sent with the topic "Join the team" are not stored in the CRM. zoho.com/privacy.html

Retention: emails and CRM records are kept as long as needed to deal with your request and any business relationship that follows from it, and deleted when you withdraw your consent or ask us to, unless statutory retention obligations apply (e.g. under commercial or tax law, up to 6 or 10 years).

6. Newsletter (product updates)

Below the contact form you can subscribe to Pliera product updates. We use the double opt-in procedure: after you sign up you receive an email with a confirmation link, and we only send updates once you have clicked it. To be able to prove your consent, the time of your signup and confirmation and the IP address used are recorded.

Data: your email address and the signup and confirmation records described above. The newsletter emails contain technology that registers when an email is opened and which links are clicked, so that we can see which topics interest our readers.

Legal basis: your consent (Art. 6 (1) (a) GDPR; § 7 (2) no. 2 UWG), which also covers the open and click statistics. You can withdraw it at any time with the unsubscribe link in every email or by writing to hi@pliera.ai.

Recipients and processors:

• beehiiv Inc. (USA) stores the subscriber list and sends the emails. Personal data is transferred to the USA on the basis of a data processing agreement (Art. 28 GDPR) and the EU Standard Contractual Clauses (Art. 46 (2) (c) GDPR). beehiiv.com/privacy
• Your email address is also recorded in our CRM (Zoho, EU data centre, see section 5) as a newsletter contact.

Retention: until you unsubscribe. If you never confirm your subscription, you will not receive any updates. After you unsubscribe we may keep your email address on a block list so that we do not write to you again, and the record of your consent for as long as we need to be able to prove it.

7. Google reCAPTCHA (contact page, only with your consent)

To protect the contact and newsletter forms from spam we use Google reCAPTCHA v3, a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland ("Google"). It is only loaded if you allow "Spam protection" in the privacy settings; until then no connection to Google is made. You can use the forms without it.

Once loaded, reCAPTCHA analyses how you interact with the page (for example your IP address, browser and device information, the time spent on the page and mouse movements), sets cookies and sends this information to Google, which returns a score indicating whether the form is likely being filled in by a person. A message or signup whose score indicates a bot is not processed; in that case you can still reach us by email. Data may be transferred to Google LLC in the USA; Google LLC is certified under the EU-US Data Privacy Framework (Art. 45 GDPR).

Legal basis: your consent (Art. 6 (1) (a) GDPR and § 25 (1) TDDDG). You can withdraw it at any time via "Privacy settings" at the bottom of every page; the contact page then reloads without Google's script. More information: policies.google.com/privacy.

8. Applications (Careers)

If you choose "Join the team" in the contact form or write to us about a job, we use your details and any documents you send only to handle your application. Legal basis: § 26 (1) BDSG and Art. 6 (1) (b) GDPR. Applications are not stored in our CRM. If we do not hire you, we delete your data six months after the end of the application process, unless you have agreed that we may keep it longer.

9. Contact by email or phone

If you contact us by email or phone, we process the information you provide (e.g. name, email address, phone number, content of your enquiry) to handle your enquiry.

Legal basis: Art. 6 (1) (b) GDPR where your enquiry relates to a contract or pre-contractual steps; otherwise Art. 6 (1) (f) GDPR (legitimate interest in responding to enquiries).

Retention: we delete your enquiry once it has been fully dealt with, unless statutory retention obligations apply (e.g. under commercial or tax law, up to 6 or 10 years).

10. Settings stored in your browser

Two settings can be saved in your browser's local storage. Neither is a cookie, neither is sent to us or to third parties, and neither identifies you:

• Language (Gen page): only when you use the English/German switch on /gen, your choice ("en" or "de", key "pliera:lang") is saved so the page opens in your language next time.
• Your privacy settings: which optional services you allowed and when (key "pliera:consent"), so that we respect your choice and do not ask again on every visit.

Legal basis: § 25 (2) no. 2 TDDDG, as storing these settings is strictly necessary for the functions you use. You can delete them at any time via your browser settings (site data).

11. Links to other websites

Our pages and emails contain links to other services, for example to the Gen application (gen.os.build) and to the scheduling service Calendly (calendly.com) for booking a demo. These services are only contacted when you click such a link; they then open in a new tab and their own privacy policies apply. No data is transferred to them when you merely visit our pages.

12. SSL/TLS encryption

For security reasons this website uses SSL/TLS encryption. You can recognise an encrypted connection by "https://" in your browser's address bar.

13. Your rights

You have the following rights regarding your personal data:

• Right of access (Art. 15 GDPR)
• Right to rectification (Art. 16 GDPR)
• Right to erasure (Art. 17 GDPR)
• Right to restriction of processing (Art. 18 GDPR)
• Right to data portability (Art. 20 GDPR)
• Right to withdraw consent at any time with effect for the future (Art. 7 (3) GDPR)

To exercise your rights, simply write to hi@pliera.ai.

Right to object (Art. 21 GDPR)

Where we process your data on the basis of Art. 6 (1) (f) GDPR, you have the right to object to this processing at any time on grounds relating to your particular situation. We will then no longer process your data unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims.

Right to lodge a complaint

You have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is:

14. No automated decision-making

No automated decision-making, including profiling, within the meaning of Art. 22 GDPR takes place. The spam check of the forms on the contact page (section 7) only decides whether a message is delivered and has no legal or similarly significant effect on you.

15. Obligation to provide data

You are not legally or contractually required to provide personal data. However, the website cannot be delivered without processing the connection data listed in section 3, and we cannot answer a contact form request without the fields marked as required.

16. Changes

We update this privacy policy when the website or the legal situation changes. The version published here applies.