Privacy policy

For the website arvemo.ai, the beta at beta.arvemo.ai and the apps for iPhone, iPad and Mac. The German version is authoritative. Last updated: 13 November 2026

1. Controller

We have not appointed a data protection officer, as we are not required to. Please send questions about data protection to the email address above.

2. What this is about

ARVEMO is a workspace for advisory engagements: advisors and their clients work together in workspaces, AI agents propose content, and a person approves it. The beta is free of charge, by invitation only, and meant for businesses and self-employed professionals. We process all data in the European Union; the exceptions are, in the apps, Apple's services for push notifications and speech recognition (section 5).

We use no tracking, no analytics or advertising services and no third-party cookies, and we do not sell data. Your content is not used to train AI models.

3. What data we process and why

3.1 Visiting the website

When you open arvemo.ai, our host processes technically necessary data (IP address, time, page requested, browser) to deliver the page and protect it against abuse. The website sets no cookies. Legal basis: legitimate interest in secure operation (Art. 6(1)(f) GDPR).

3.2 Invitation, sign-up and account

For an account we process your name, business email address, company, language, the invitation code and – if you upload one – a profile photo. We do not accept private or disposable addresses, because ARVEMO is meant for businesses. Without these details we cannot create an account. Legal basis: the contract for using the beta (Art. 6(1)(b) GDPR).

3.3 Signing in and sessions

You sign in with personal links sent by email; there are no passwords. With each session we store the IP address and the browser or device, to detect abuse and to show you the devices you are signed in on. In the apps, each device has its own access key, kept in the device's keychain. Legal bases: Art. 6(1)(b) and (f) GDPR (security).

3.4 Content in workspaces

What you and your team create, write or upload in ARVEMO – messages, comments, documents, files, photos, session recordings, tasks, decisions – we process to provide the service: to store, display, search it and work on it with the agents. Only people invited to the workspace have access, according to their role. Legal basis: Art. 6(1)(b) GDPR.

If you upload personal data of third parties (for example about people at your client), you or your organisation are responsible for it, and we process it on your behalf (Art. 28 GDPR). We provide organisations with a data processing agreement on request to hello@sebastian-kuepers.com.

3.5 AI agents

The agents work with language models from Mistral AI (Paris). For this, the content a task needs goes to Mistral: the request and excerpts from the workspace, files also for text recognition (OCR), recordings for transcription. Short yes/no and choice decisions (for example: who answers, is a text ready for the client, does a file contain instructions aimed at an AI) are made by the Strom service from Uprelic; it receives excerpts of the state concerned and writes no text itself. When an agent researches the web, only search terms leave (companies, markets, topics), never the workspace's content. For traceability and the test credit, we store the purpose, model, size and cost of each model call in the workspace. Legal basis: Art. 6(1)(b) GDPR.

Whatever an agent creates or changes is a proposal that only takes effect once a person approves it. There is no solely automated decision within the meaning of Art. 22 GDPR.

3.6 Research at sign-up

So that your start fits you, ARVEMO can do some research in advance – only after you have confirmed your email address and only if you agree (a checkbox at sign-up):

• Your company: public information on the website of your email address's domain and public search results via Mistral (business, focus, industries, location).
• You as a person (separate consent in your profile): public information about your professional role – website, talks, publications – plus your CV or LinkedIn profile as a PDF if you upload it (used only for the research, shown to nobody). ARVEMO does not search for private information.

You see the result as a proposal ("Did we get you right?") and adopt, change or discard it. Legal basis: your consent (Art. 6(1)(a) GDPR). You can withdraw it at any time with effect for the future, in your profile or by email. Without your consent ARVEMO does no research; you then fill in the details yourself.

3.7 Sample workspace

New advisors find a sample workspace with fictitious data and a guided tour. What you enter there yourself is treated like other content. If the sample is not used for seven days, we set it aside; 90 days after its last use it is deleted entirely. You can remove it yourself at any time.

3.8 Emails

We send emails that are part of the service: sign-in and invitation links, confirmations, notes about approvals and mentions and – depending on your setting – a daily summary, which you can turn off in the settings. We send no newsletters or advertising. Legal basis: Art. 6(1)(b) GDPR.

3.9 Apps for iPhone, iPad and Mac

• Push notifications: if you allow notifications, we store your device's push token. Only a delivery id, an id without content for grouping, a generic notice text and the number of what is waiting for you pass through Apple – never your text, titles or workspaces. The app then fetches the content from us itself.
• Dictation and voice notes: depending on the feature, either Apple's speech recognition or Mistral (section 3.5) turns speech into text. For dictation, Apple's speech recognition runs on the device where the device supports it; otherwise – and for voice notes in the chat – the audio goes to Apple's speech recognition service.
• Camera, microphone, photos: only when you trigger and allow it; images and recordings go only into your workspace.
• On the device the app stores settings (appearance, column widths, what was last open) and the access key in the keychain. The apps contain no analytics or advertising SDKs.
• TestFlight: Apple distributes the beta apps through TestFlight. Apple processes data there as a separate controller under its own privacy policy; we receive from Apple your email address (if you were invited by email), crash reports and the feedback you send through TestFlight.

3.10 Operation and errors

The server logs requests and errors (time, path, request id, error message, where applicable the person's id) to detect and fix faults. Legal basis: Art. 6(1)(f) GDPR.

3.11 Reports to the ARVEMO team (ideas and bugs)

In the apps you can send us an idea or report a bug. For this we process your text, for a bug also what you expected, and what you send along – each part can be left out: the page, device and app version, for a bug the most recent errors with their request id. Only you and the platform administrators read your text. A language model by Mistral AI (Paris, section 3.5) talks with you: from your report it writes a technical version without your name, your company, clients, colleagues, figures or quotes, and later, from our development's assessment, the answer to you. Before the technical version goes on, Strom (Uprelic, Berlin) checks it against your text and the names in your account; if it still carries anything about you, it goes no further and a person of the ARVEMO team looks at it. The Arvemo Developer Agent, with which we develop ARVEMO, receives only this technical version – never your text, your name or your answers –, reads our source code and writes us an assessment; a person of the ARVEMO team decides on the report. For planning we create an entry at GitHub (USA) – in our words, without your text, your name, clients or figures. If your report becomes a public feature, we describe it in our words and name you and your company only if you did not choose "anonymous". You receive answers in the app and by email. You can also report on the Arvemo Community (readable by anyone); if you write there before signing in, we keep your report with your account for up to 24 hours until you look at it and send it through the link in our email – otherwise we delete it unsent. If there is no account for the address, we store nothing. Legal basis: Art. 6(1)(b) GDPR (the function is part of the service).

4. Processors

We use the following service providers, each under a data processing agreement pursuant to Art. 28 GDPR:

The beta uses no payment services.

5. Transfers to third countries

In the apps, data goes to Apple in the USA: for push notifications the push token, the delivery id and the grouping id; for speech recognition that does not run on the device, the audio of the dictation or voice note. Apple is certified under the EU-US Data Privacy Framework (adequacy decision of the European Commission, Art. 45 GDPR). No other content from ARVEMO reaches Apple. For TestFlight see section 3.9.

Reports to the ARVEMO team (section 3.11) do not leave the EU with your data: Mistral and Strom process them in the EU; the Arvemo Developer Agent and GitHub receive only the technical version or our words, without personal data.

6. Retention

Statutory retention duties (for example for invoices) remain unaffected; the free beta issues no invoices.

7. Cookies and browser storage

The beta sets a single cookie, __Secure-better-auth.session_token, which keeps you signed in. It is strictly necessary (§ 25(2) no. 2 TDDDG) and needs no consent. In your browser's storage (localStorage) the interface keeps settings such as language, appearance, column widths and the chat last open; they do not leave your device. The website arvemo.ai sets no cookies. There are no tracking, analytics or advertising cookies.

8. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21). You can withdraw consent at any time (Art. 7(3)); processing up to the withdrawal remains lawful.

• Deleting your account: at any time yourself in the settings (web, Mac, iPhone and iPad). After a short period in which you can undo it, we delete you as a person, your sessions and devices, your sample workspace and – if you are the only owner of your organisation – the organisation with its workspaces; its other members are told by email beforehand and lose their access afterwards. If you are a member of someone else's organisation, only your membership ends; what you contributed there stays with the organisation. Data disappears from backups once their retention ends (30 days).
• Export: you receive your data in a common, machine-readable format as a download in the app.
• Access and anything else: informally by email to hello@sebastian-kuepers.com.

You may also lodge a complaint with a data protection supervisory authority, for example the one responsible for us: the Berlin Commissioner for Data Protection and Freedom of Information (Berliner Beauftragte für Datenschutz und Informationsfreiheit).

9. Security

All connections are encrypted with TLS. The database is reachable only over a private network, the workspaces' data is kept apart in the database, and every person sees only what their role allows.

10. Changes

If the way we process data changes, we update this policy and inform signed-in people of material changes by email.