Legal
This notice informs you, in accordance with the General Data Protection Regulation (GDPR) and the Austrian Data Protection Act (DSG), about the processing of personal data when using this website and the Agentic-Firmenbuch.at service.
Privacy. The content of your queries is not stored: no prompts, company names or search terms. Per account we keep call counters (which tool, how often) for rate limits and billing; for fault detection we also record technical measurements per call (including duration, result count and the names of the filters you set, never their contents). Details.
The controller responsible for the data processing within the meaning of Art. 4 No. 7 GDPR is:
When you sign up for access, we process the following data:
Purpose: provision of the service, verification of the e-mail address and prevention of misuse.
Legal basis: performance of a contract or pre-contractual measures (Art. 6 (1) (b) GDPR) as well as consent within the framework of the double opt-in (Art. 6 (1) (a) GDPR). Consent can be withdrawn at any time with effect for the future.
Usage data per API key: To provide the service, to enforce fair-use limits (rate limit) and to prevent misuse, we log per API key which tools are queried how often and when (aggregated counters per day). The key is stored only as a hash value; the usage log contains neither the content of the queries nor the e-mail address. Legal basis: performance of a contract (Art. 6 (1) (b) GDPR) and our legitimate interest in stable, misuse-free operation (Art. 6 (1) (f) GDPR). Retention period: a maximum of 12 months, then automatic deletion.
Technical measurements per call: To detect faults and gaps in the service, such as queries that return no result, we record technical measurements for each tool call: the tool called, the processing time, the database load caused, the number of results (or whether there were none), the page number, the plan (e.g. Free or Pro) and the names of the filters set (such as "bundesland" or "branche"). The contents of the filters are not recorded: no search terms, no company names, no prompts. A technical session identifier is added that groups the calls of one connection; no link to an account, API key or e-mail address is stored. Processing takes place in Azure Application Insights (Germany West Central region, EU). Legal basis: our legitimate interest in a functioning, low-fault service (Art. 6 (1) (f) GDPR). Retention period: 90 days, then automatic deletion.
On an individual query, the service delivers data from the Austrian Firmenbuch (High Value Dataset of the BMJ/JustizOnline, CC BY 4.0). This also includes personal data of officers (e.g. managing directors, board members, authorised signatories): name, function and type of representation as well as the year of birth or the age calculated from it.
Data minimisation: Of birth dates, exclusively the year is processed and delivered, never the day or month.
Purpose: provision of business information on Austrian companies (e.g. for creditworthiness, succession or business-partner checks) by way of individual query. Legal basis: legitimate interest in providing publicly accessible register information (Art. 6 (1) (f) GDPR). The data is in any case accessible in the public Firmenbuch on a statutory basis (Firmenbuch Act).
No mass processing: Systematic mass extraction, profiling as well as the disclosure or resale of the personal data are technically limited and prohibited under the Terms of use.
Your rights: Affected persons can assert their rights towards the controller (see the section Your Rights). The service reflects the official register status; changes to an entry are to be initiated primarily at the Firmenbuch court.
List matching (web app): When you upload a CSV or Excel list, the file is read in memory and not stored. The extracted rows (company names, register numbers, the row's column values) are stored in your account for 30 days and then deleted automatically, or immediately on request. Purpose: matching against the register at your request (Art. 6(1)(b) GDPR). If the list contains personal data of third parties, you are responsible for it; we process it only on your instructions.
Bug reports (feedback form): Your description, optional screenshots, the page address and browser details are stored as a ticket in our development system (GitHub, not public); screenshots additionally in our storage for the duration of the handling. An e-mail address you provide voluntarily is stored separately from the ticket and used only to get back to you (deleted after 180 days). Legal basis: your request (Art. 6(1)(b)) and our legitimate interest in a working service (Art. 6(1)(f)).
To protect the sign-up form against automated requests (spam/bots), we use Cloudflare Turnstile, a service of Cloudflare, Inc. Turnstile checks whether the input comes from a human without classic captcha puzzles; in doing so, technical information (e.g. IP address, browser characteristics) is processed. Cloudflare states that it does not set any tracking cookies for advertising purposes for this.
Legal basis: legitimate interest in secure, misuse-free operation (Art. 6 (1) (f) GDPR). Insofar as data is transferred to third countries, this is based on Standard Contractual Clauses (SCC) or the EU-US Data Privacy Framework. Details: Cloudflare Privacy Policy.
The website is hosted with Microsoft Azure (Static Web Apps / Functions, Germany West Central region, EU). When the site is accessed, technically necessary data is automatically processed in server log files: IP address (shortened where possible), date and time, requested resource, referrer, browser and operating-system identifier.
Purpose: delivery of the website, stability and security. Legal basis: legitimate interest (Art. 6 (1) (f) GDPR). A data-processing agreement in accordance with Art. 28 GDPR is in place with the host.
This website loads fonts via the Google Fonts CDN (Google Ireland Ltd.). In doing so, the visitor's IP address is transmitted to Google. Legal basis: legitimate interest in a consistent, performant presentation (Art. 6 (1) (f) GDPR).
Data is only disclosed to service providers who support us in providing the service, to the extent necessary and on the basis of data-processing agreements:
Payment processing via Stripe: For the paid Pro subscription, we use the payment service provider Stripe (Stripe Payments Europe, Ltd., Ireland). When a subscription is concluded or managed, the data required for this, in particular e-mail address, payment-method and invoicing data as well as a customer identifier (Stripe customer ID), is processed by Stripe. Full payment data (e.g. card numbers) is processed exclusively by Stripe and is not stored with us; we essentially receive from Stripe the payment or subscription status and the customer identifier in order to assign the plan to the account. Legal basis: performance of a contract (Art. 6 (1) (b) GDPR) as well as compliance with legal, in particular tax-related, obligations (Art. 6 (1) (c) GDPR). Insofar as a transfer to third countries takes place, this is based on Standard Contractual Clauses (SCC). Details: Stripe Privacy Policy.
The Firmenbuch data retrieved via the MCP server is not transferred to third parties for advertising purposes.
We store personal data only for as long as is necessary for the stated purposes or for as long as statutory retention obligations exist. Sign-up and API-key data is deleted as soon as the account or the key is revoked or requested for deletion, at the latest after 12 months of inactivity. Technical measurements per call (see section 02) are deleted automatically after 90 days.
Under the GDPR, you have the following rights:
To exercise them, a message to support@agentic-firmenbuch.at is sufficient. In addition, you have the right to lodge a complaint with the supervisory authority, in Austria the Austrian Data Protection Authority (www.dsb.gv.at).
We adapt this Privacy Policy if the service or the legal situation changes. The version published on this page applies in each case.