Short and honest: what goes where. This policy applies to the older pages on tomo.aivantum.com (including /betrieb/, /ebenen/, /runde/ and the English pages under /en/) and to the intro call. For the start page, the capabilities and pricing pages, the waiting list, the add-Tomo page (/installieren/), terms and withdrawal, the German legal notice (/impressum.html), and Tomo Cloud, the privacy policy of aivantum.com applies (in German).
This is a courtesy translation. The legally binding version is the German one.
As of: 28 October 2026
Jay Manuzon
AIVantum · Dein eigener Tomo
Mohnweg 75
51371 Leverkusen
Germany
jay@aivantum.com
Your files, notes and the running context of your work stay in your environment. Your Tomo works on what you give it.
Whatever the AI processes runs via Anthropic, the provider of Claude, under their terms. We are transparent about what this touches in each case.
Your Tomo only mirrors what you deliberately hand it. It does not reach into other systems on its own. You provide, it works, you approve.
If you use the contact form, we process the data you provide (name, e-mail address, the context you select, your preferred way and your message) in order to answer your enquiry and prepare an intro call. Your form data is transmitted technically via Cloudflare Workers (Cloudflare, Inc.) and the e-mail delivery service Resend (Plus Five Five, Inc., USA — Data Privacy Framework, data processing agreement); you receive a short confirmation e-mail to the address you provide. Both services only deliver — they do not analyse anything. Your enquiry arrives as an e-mail in our mailbox. If the transmission fails, the page opens your e-mail program instead, with a prepared message to us.
The legal basis is Art. 6(1)(b) GDPR (steps taken prior to entering into a contract) as well as our legitimate interest in answering your enquiry under Art. 6(1)(f) GDPR. We process this data only for as long as necessary to handle your enquiry — specifically, we delete enquiry data no later than 24 months after the last contact, unless statutory retention obligations require otherwise — and we do not pass it on to third parties without your consent.
To prevent abuse, the form endpoint briefly processes your IP address when you submit, in order to limit the number of requests per time window; a hidden field in the form catches automated submissions. The legal basis is our legitimate interest in a protected form (Art. 6(1)(f) GDPR).
If you register on one of our event pages (pages under /runde/ or /live/, the English version under /en/), we process your first name, your e-mail address, the date you chose and the page you came from, including a campaign identifier in the link if there is one. On the thank-you page you can optionally add one sentence about your task; it is stored with your registration and reflected in your reminder. So that the thank-you page can match your sentence, your browser keeps your e-mail address and a check value in session storage, and after a personal invitation also its identifier. This is not a cookie, and it is deleted as soon as you close the tab. We use this data to send you a confirmation with a calendar entry and join link, to remind you before the session (the day before and shortly before, depending on the session one hour and 15 minutes before or only 15 minutes before), and to send you the blueprint afterwards. You receive other e-mails through this registration only if you tick the box for the three questions on the thank-you page (next paragraph). The registration is stored by the form service (Cloudflare Workers with its storage Workers KV, Cloudflare, Inc.), the e-mails are sent via Resend (see above). Each of these e-mails contains a link to unsubscribe; your registration is then deleted immediately.
If Jay invites you to a session personally, he enters your first name and e-mail address in the form service. You then receive an invitation e-mail via Resend with a personal link; if Jay sends it again, it is the same link. The link contains a random identifier, not your address; when you open it, your first name and address are already filled in. You are only registered once you click “Save my place” yourself. Only people who have heard from Jay beforehand that the invitation is coming are invited. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is to invite people we know personally to a session. If you do not register, the invitation is deleted one day after the session and you receive no further e-mail about it.
If you have already told Jay you are coming, he can also register you directly: he enters your first name and e-mail address in the form service, and you immediately receive the confirmation with a calendar entry and join link, just as if you had registered yourself. The link to the one question in that e-mail contains your address and a check value; the thank-you page keeps both in your browser’s session storage and removes them from the address bar. The legal basis is Art. 6(1)(b) GDPR, your agreement to take part. If you decide not to come after all, unsubscribe via the link in any of the e-mails; your registration is then deleted immediately.
The pilot sessions come with a starter pack as a gift. The starter folder and the videos are on this website to download and watch; we store nothing about you for that. For the voucher for one month of Light, we store your first name, your e-mail address, the session and the date with the form service until the voucher is redeemed, for six months at most. We use this data only to send you access as soon as Light launches (Art. 6(1)(b) GDPR). If you unsubscribe from the session, the voucher is deleted too. If you do not want it otherwise, write to jay@aivantum.com and we will delete it.
Sessions take place via Google Meet (Google Cloud EMEA Limited, Dublin; transfer to the USA on the basis of the EU-US Data Privacy Framework and standard contractual clauses). All participants see your display name; the camera is optional. A session is only recorded if all participants agree in Meet.
The legal basis is Art. 6(1)(b) GDPR (your registration for the session); for a recording, your consent under Art. 6(1)(a) GDPR, which you can withdraw at any time. The registration is deleted automatically 30 days after the session.
If, for a live session, you also tick the optional box saying you would like to hear from us now and then, we pass your first name and e-mail address, together with the time of your consent, to MailerLite (MailerLite, Inc., USA; storage in the EU under the contract; transfer on the basis of the EU-US Data Privacy Framework and standard contractual clauses). MailerLite first sends you a confirmation e-mail, and only once you click it do you receive mail from us (double opt-in). The legal basis is your consent under Art. 6(1)(a) GDPR; you can withdraw it at any time via the unsubscribe link in each of these e-mails. The box is not needed to register for the session.
On the thank-you page you can optionally tick a box saying we may e-mail you the three questions after the session and check in once a week later to ask whether you kept building. The box is never pre-ticked and is not needed to take part. After ticking it you receive a single e-mail “Please confirm once”; your consent only applies once you click “Yes, confirm” in it. If you do not confirm, we send you nothing for this. Its purpose is exactly these two e-mails, no offers and no newsletter: the three questions are in the e-mail after the session, the check-in comes seven days after the session. As proof we store with your registration at the form service the time you ticked the box, the time you confirmed, the version of the text you agreed to and the source (thank-you page); the e-mails are sent via Resend. The legal basis is your consent under Art. 6(1)(a) GDPR. You can withdraw it at any time with one click on “No more follow-ups” in each of these e-mails or with a short note to jay@aivantum.com; after that none of these e-mails is sent, and your registration stays in place. Withdrawal does not affect the lawfulness of e-mails sent before it. The proof is deleted together with your registration, 30 days after the session.
You open the three questions about the session via a QR code during the session itself and can answer them without giving your name. Your answers reach us as an e-mail; the form service only keeps a count without personal reference. If you give your name and e-mail address because you would like to talk, we use them only for that (Art. 6(1)(b) GDPR) and delete them in line with the period for enquiries above.
This website is delivered as a static site via GitHub Pages (GitHub, Inc., USA). When you open the site, GitHub processes technically necessary server log data (such as IP address, time of access, file requested) to deliver the site securely. GitHub does this as an independent controller under its own privacy statement; there is no data processing agreement for this. The legal basis for delivering the site via GitHub Pages is our legitimate interest in a simple and secure website (Art. 6(1)(f) GDPR). GitHub also processes data in the USA and states that it is certified under the EU-US Data Privacy Framework (adequacy decision under Art. 45 GDPR).
This website and the contact form send nothing to Anthropic. Only later, when your Tomo is in operation, does Anthropic (the provider of Claude) process the content you deliberately hand to the AI. That is governed by the contract for your Tomo, not by this policy. Before the start, we disclose to you in writing which data flows your specific setup touches and on what basis they run. Your Tomo does not reach into other systems on its own.
Important: the AI does not make any decisions with legal effect concerning you — there is no automated decision-making within the meaning of Art. 22 GDPR. Your Tomo proposes, you approve.
On our page for businesses (in German) you can call our AI reception and hear how it sounds. The “Rezeption anrufen” (call reception) button is an ordinary link to the voice service ElevenLabs, not an embed. As long as you do not click it, nothing goes to ElevenLabs. If you click it, the service's page opens; that page itself is governed by ElevenLabs' privacy policy.
The call runs over the internet, not over a phone line. Your device asks once for microphone access; no phone number is transmitted. Instead of speaking, you can also type.
The reception says at the start that it is an AI. It records your request and judges nothing; it makes no decisions with legal effect concerning you (Art. 22 GDPR). It never calls anyone on its own. If you ask for a call-back or an appointment during the call, you give your name, phone number or e-mail address for it; the reception enters the request in Jay's Google Calendar (Google Ireland Limited, Dublin), and he gets back to you.
What is processed
Please do not mention health data, other sensitive information or data about other people in the demo.
Legal basis. If you request a conversation, a call-back or an appointment, it is Art. 6(1)(b) GDPR. Otherwise we rely on our legitimate interest in demonstrating the reception to you, improving it and detecting misuse (Art. 6(1)(f) GDPR).
Retention. The service does not store the audio. It deletes the transcript and the analysis automatically after 90 days. We delete calendar entries from call-back or appointment requests no later than 90 days after the call, unless they lead to an ongoing enquiry or an engagement.
Provider and transfer. ElevenLabs processes the call on our behalf; according to the service's terms, the contracting party is Eleven Labs Inc., New York (USA). The data are stored in the USA. We base the transfer on the EU-US Data Privacy Framework (adequacy decision under Art. 45 GDPR), under which ElevenLabs is certified, supplemented by standard contractual clauses in the data processing agreement. For responses and analysis, ElevenLabs uses language models, including from other providers; the list of these sub-processors is available at compliance.elevenlabs.io.
For this website and the intro call we use a few services. Most of them process data on our behalf (processors). Where a service is itself the controller, this is stated.
We do not pass data on to any third parties beyond these providers. This website sets no cookies and uses no analytics or advertising services. The fonts are embedded in the page; loading it creates no connection to Google Fonts.
Cloudflare and Resend are based in the USA, and Google may also process data from our mailbox (Google Workspace) in the USA. We base these transfers on the EU-US Data Privacy Framework (adequacy decision of the European Commission under Art. 45 GDPR), under which these providers are certified, supplemented by the European Commission's standard contractual clauses in the providers' data processing terms. GitHub, and Google for the second mailbox and the calendar, act as independent controllers; for GitHub see Hosting. For the demo call (ElevenLabs) and the AI processing (Anthropic), the sections above apply.
Under the GDPR, you have the following data subject rights:
For any of these, an informal message to jay@aivantum.com is all it takes.
The demo shown on the start page uses placeholders: all names, e-mails, appointments and amounts are invented and do not represent real personal data.