Privacy Policy

1. Controller & contact

The controller under the General Data Protection Regulation (GDPR) for www.vividomo.ai is:

Privacy contact:
For privacy questions, email us at info@vividomo.com.

2. Scope

This privacy policy applies to the marketing website www.vividomo.ai. The Vividomo application at app.vividomo.ai is covered by the Vividomo® application Privacy Policyavailable there. Marketing consent is stored consistently across both subdomains.

3. Server logs / hosting (Vercel)

This website is delivered using infrastructure from Vercel Inc. (USA). Page requests involve technically necessary server log data, typically including:

• The requesting device's IP address
• Date and time of access
• Requested URL/page
• Volume of data transferred
• HTTP status code
• Browser and operating system (user agent)

This data delivers the website, detects errors and ensures security. It is not used to identify or track individual visitors.

Legal basis: Article 6(1)(f) GDPR: legitimate interest in providing a secure, stable website.

Third-country connection (USA): Vercel Inc. is based in the USA. We have a data processing agreement under Article 28 GDPR (concluded on 9 July 2026). Transfers to the USA are protected by EU Standard Contractual Clauses (Article 46(2)(c) GDPR) and certification under the EU-US Data Privacy Framework . Details are available in the Vercel Privacy Policy and the Data Processing Addendum.

4. Contact form

On /en/contact you can send an enquiry using the contact form. We process:

• Name (required)
• Email address (required)
• Phone number (optional)
• Subject (optional)
• Message (required)

We only use these details to handle your enquiry and reply. Without consent, they are not used for other purposes or shared with third parties unless necessary to handle the enquiry, for example with responsible staff.

Technical email delivery: Contact form notifications are delivered through Resend (Plus Five Five, Inc., 2261 Market Street #5039, San Francisco, CA 94114, USA), acting as a processor. The sending region is EU (Ireland) ; however, account data, email metadata and logs, particularly recipient address, sending time and delivery status, are stored in the USA.

Legal basis: Article 6(1)(b) GDPR: pre-contractual steps at your request; or Article 6(1)(f): legitimate interest in answering enquiries.

Third-country connection (USA): Plus Five Five, Inc. is based in the USA. We have a data processing agreement under Article 28 GDPR; transfers are protected by EU Standard Contractual Clauses and self-certification under the EU-US Data Privacy Framework . Further information is in the Resend Privacy Policy and the Data Processing Agreement.

4b. Appointment booking (Cal.com)

For demo appointments, the /en/demo page embeds the calendar service from Cal.com (Cal.com, Inc., USA). The calendar only loads after you click “Load calendar”; no connection is made beforehand.

Once loaded, Cal.com processes booking data such as name, email and preferred appointment. See the Cal.com Privacy Policy.

Legal basis: Article 6(1)(a) GDPR: consent by loading the calendar; or Article 6(1)(b): pre-contractual steps when requesting an appointment.

Third-country connection (USA): Cal.com, Inc. is based in San Francisco, USA, and processes booking data there. We have a data processing agreement under Article 28 GDPR. Since the calendar loads only after clicking “Load calendar”, US transfers additionally rely on your explicit consent under Article 49(1)(a) GDPR. Without that click, no data is transferred. EU representative under Article 27 GDPR: legal+eu@cal.com.

5. Cookieless audience measurement

To improve this website and tailor it to visitors, we measure usage with Umami, privacy-friendly analytics software. Umami sets no cookies, creates no cross-device identifiers and builds no personal user profiles. Only aggregated anonymous metrics are collected, such as page views, approximate country, device type and referring page.

We self-host Umami on EU servers (Hetzner Online GmbH, Nuremberg, Germany). There is no sharing with third parties or transfer to third countries. Since no cookies are set and visitors are not individually tracked, no consent is required. The consent banner controls only the Meta marketing measurement described below.

Legal basis: Article 6(1)(f) GDPR: legitimate interest in data-minimising, cookieless measurement to improve this website. You may object with future effect at any time; see “Your rights”.

6. Marketing measurement with Meta Pixel

Choosing “Allow marketing” loads the Meta Pixel from Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland. This helps us identify whether Facebook or Instagram ads lead to page views and Vividomo® trials. Processing may include URL, time, browser/device information and Meta identifiers such as _fbp and _fbc . We do not send contact or registration form content through the Pixel.

Legal basis: Only your voluntary consent under Article 6(1)(a) GDPR and section 165(3) TKG 2021. Without consent, no Meta connection is made. Change your choice anytime using “Privacy settings” in the footer. On withdrawal, we delete Meta cookies on our Vividomo® subdomains.

Meta may process data in third countries, particularly the USA, relying on the EU-US Data Privacy Framework and/or Standard Contractual Clauses. Meta Business Tools terms apply where we jointly control event-data collection and transfer. Further information is in the Meta Privacy Policy.

7. Locally served fonts

This website uses the Geist font from Vercel. Font files are stored locally on our server and not loaded from an external CDN such as Google Fonts. Loading fonts therefore transfers no data to third parties.

8. Recipients and processors

The following recipients and providers receive or process data when this website operates:

Note on third countries: Several providers process data in the USA. Transfers rely on: Vercel and Resend — EU Standard Contractual Clauses under Article 46(2)(c) GDPR together with the EU-US Data Privacy Framework; Cal.com — an Article 28 GDPR DPA and your explicit Article 49(1)(a) consent by actively loading the calendar; Meta — your banner consent and Meta's stated safeguards (Data Privacy Framework and/or Standard Contractual Clauses). For Umami there is no third-country transfer.

9. Retention

We retain personal data only as long as needed for its purpose or required by statutory retention duties.

• Server/access logs: Deleted after 14 days. Backups are retained for a rolling 30 days ; deleted data disappears from them by the end of that cycle.
• Contact form data: Enquiries are retained until fully handled. Without a resulting contract, we delete them no later than 12 months after last contact. If a contract is formed, statutory retention applies, particularly 7 years under section 132 BAO for accounting records.
• Appointments (Cal.com): Booking data is deleted 12 months after the appointment ; if a contract follows, the statutory periods above apply.
• Marketing consent: Your choice is stored for 180 days in a first-party cookie. Meta cookies on our domains are deleted on withdrawal; Meta's other retention periods follow its privacy policy.

10. Your rights

As a data subject, you have these rights against us:

• Right of access (Article 15 GDPR): ask whether and which personal data we process about you.
• Right to rectification (Article 16 GDPR): request correction of inaccurate or incomplete data.
• Right to erasure (Article 17 GDPR): request deletion under certain conditions.
• Right to restrict processing (Article 18 GDPR): request restricted processing in certain cases.
• Right to data portability (Article 20 GDPR): receive your data in a structured, commonly used, machine-readable format.
• Right to object (Article 21 GDPR): object to processing based on legitimate interests.

To exercise your rights, send an informal email to info@vividomo.com. We respond as soon as possible, within one month at the latest.

Right to complain to the supervisory authority

You may complain to the competent data protection authority. In Austria, this is:

11. Data security

This website is served exclusively over encrypted HTTPS, protecting data transferred between your browser and our server against unauthorised access. We use appropriate technical and organisational safeguards against loss, misuse and unauthorised access.

12. Version & changes

This privacy policy is dated 22 August 2026.

We may update this policy when services or legal requirements change. The current version is always available on this page.