1. Who we are
vanadio is a product of Vanilla Steel GmbH (“we”, “us”). We are the controller for the processing described in sections 3 and 4, and a processor for the processing described in section 5.
Vanilla Steel GmbH
Schönhauser Allee 36
10435 Berlin, Germany
Commercial register: Amtsgericht Charlottenburg, HRB 218619 B
Email: privacy@vanadio.ai
2. What vanadio does
vanadio is software for industrial-materials businesses. It classifies incoming business email (for example requests for quotation, orders, claims, and call-offs), extracts structured line items from inquiries, and supports the quoting workflow. It is offered to business customers, not to consumers.
3. Data processed when you visit this website
Hosting and server logs
This website is hosted by Vercel Inc., 440 N Barranca Avenue #4133, Covina, CA 91723, USA. When you access the site, Vercel processes the technical data your browser transmits (IP address, date and time of the request, requested page, referring page, browser type and version) in server logs. This is necessary to deliver the site securely and is based on our legitimate interest (Art. 6(1)(f) GDPR). Log data is retained only as long as needed for security and operations. Vercel acts as a processor; it is certified under the EU-U.S. Data Privacy Framework, and Standard Contractual Clauses apply in addition. The site is operated for us by EL Industries GmbH, Reiserdorf 147, 92721 Störnstein, Germany, as a processor under Art. 28 GDPR.
Privacy notice of Vercel: vercel.com/legal/privacy-notice
Language selection
The website is available in German, English, French, Spanish and Italian. On your first visit, the server chooses the language from the language setting of your browser and, if that does not match one of these languages, from the country derived from your IP address. This happens at the moment of the request; nothing is stored for it.
If you choose a language in the language menu, your choice is stored in a cookie named vanadio-lang for one year, so that the site opens in that language on your next visit. This cookie is strictly necessary to provide the function you requested (§ 25(2) no. 2 TDDDG) and is not used for tracking or analysis.
Settings stored in your browser
The site stores two settings in your browser’s local storage: vanadio-theme (light or dark display, if you switch it) and vanadio-pre (that the short opening animation has already been shown). Both are needed for functions you use and are not read by us or by third parties (§ 25(2) no. 2 TDDDG).
Visitor recognition (Leadinfo)
We use Leadinfo, a visitor recognition service provided by Leadinfo B.V., a company established in the Netherlands, acting as a processor on our behalf. Leadinfo compares the IP address of your request against publicly available business data in order to identify the organisation from which a visit originates, together with the pages viewed. The service is configured for cookie-less operation: it sets no cookies, carries out no device fingerprinting, and no screen recording or form tracking is enabled. It does not identify you as a natural person, and we make no attempt to link a visit to a named individual. The legal basis is our legitimate interest in learning which businesses are interested in our product (Art. 6(1)(f) GDPR). The data is processed within the EU.
You may object to this processing at any time under Art. 21 GDPR by writing to privacy@vanadio.ai. We will then exclude your organisation from further recognition.
Usage statistics (Vercel Web Analytics)
We use Vercel Web Analytics, a service of Vercel Inc. (address above), to count page views and see how the site is used in aggregate. It sets no cookies and stores nothing on your device. Instead of an identifier, a hash is formed from the incoming request; it is discarded after 24 hours. Recorded are the page visited, the referring page, the time, the approximate location (country, region, city), the browser, the operating system and the device type. The data cannot be traced back to you and is evaluated only as aggregate statistics. The legal basis is our legitimate interest in understanding and improving how the site is used (Art. 6(1)(f) GDPR). Vercel acts as a processor; it is certified under the EU-U.S. Data Privacy Framework, and Standard Contractual Clauses apply in addition. You can object to this processing at any time under Art. 21 GDPR by writing to privacy@vanadio.ai.
Fonts and external content
Fonts are served from our own server. No requests are made to third-party font services, and the site does not load content from social networks or video platforms.
4. Data processed when you contact us
Demo form
If you submit the demo form, we process your name, work email address, optional phone number, the number of inquiries per day you select, and your optional message, in order to reply and to arrange a demo (Art. 6(1)(b) GDPR, steps prior to entering into a contract). The form data is passed by our website to Brevo (Sendinblue SAS, 17 rue de Salneuve, 75017 Paris, France), which delivers it to us as an email. Brevo acts as a processor; the processing takes place in the EU. The form data is not stored in a database: it reaches us as an email only and is kept as long as needed to handle your request and to meet statutory retention duties.
Privacy notice of Brevo: brevo.com/legal/privacypolicy
If you email us, we process your email address, your name and the content of your message to respond (Art. 6(1)(b) and (f) GDPR). We keep this correspondence as long as needed to handle the matter and to meet statutory retention duties.
Booking a time in our calendar
If you use the link to book a time in our calendar, you leave this website for the appointment page of Google (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). The data you enter there is processed by Google for us to schedule the appointment (Art. 6(1)(b) GDPR). Privacy notice of Google: policies.google.com/privacy
5. Data processed in the vanadio platform and Outlook add-in
When a customer connects vanadio to their Microsoft 365 environment, vanadio accesses mailbox data through Microsoft APIs with the consent of the customer’s administrator and within the permissions granted in Microsoft Entra ID (Azure AD). Access to mailbox content is read-only, and we do not modify or delete anything in the mailbox. Messages classified as relevant (for example RFQs) are stored and processed in our EU infrastructure so we can extract and structure them; other messages are not retained.
For this processing we act as a processor on behalf of our customer (the controller) under a data processing agreement pursuant to Art. 28 GDPR. Details, including the categories of data, are defined in the DPA. In summary:
- Purpose: classification of incoming email, extraction of structured data from business inquiries, and support of the customer’s quoting workflow.
- Categories of data: email metadata (sender, recipient, timestamps, subject) and the content of business correspondence, including file attachments, which may contain contact details of the customer’s business partners.
- Hosting: all processing takes place on servers in the European Union.
- AI sub-processor: classification and extraction use OpenAI’s large-language-model API, called with EU data residency so content is processed in the European Union. Inputs and outputs are not stored at rest (zero data retention) and are not used to train models.
- No training for others without consent: customer data is not used to train or improve models made available to other customers without the customer’s explicit agreement.
- Tenant separation: standard customers are logically separated within a shared database; enterprise customers can request a dedicated database. Data from different customers is never mixed.
If you are an employee or business partner of one of our customers and have questions about this processing, please contact the customer (the controller) first; we support them in answering data-subject requests.
6. Sub-processors and recipients
We use a small number of service providers under Art. 28 GDPR contracts. Customer content is processed primarily within the European Union. Our main sub-processors are:
- Google Cloud (hosting and compute; EU region, Frankfurt and Berlin).
- OpenAI (AI classification and extraction; EU data residency, zero data retention, not used to train models).
- Dropbox (secure file exchange for data you provide during set-up; files stored in the EU, with limited metadata in the US).
Where limited residual transfers to the United States occur (for example certain metadata or fallback API routing), they are covered by EU Standard Contractual Clauses. The current full list of sub-processors is available on request via privacy@vanadio.ai and is annexed to the DPA.
We do not sell personal data and do not share it for advertising purposes.
7. Retention and deletion
We keep personal data only as long as needed for the purposes above or as required by law. For platform data, retention is governed by the DPA: on termination of the agreement, customer data is returned or deleted in line with our deletion concept per GDPR.
8. Security
We apply technical and organizational measures appropriate to the risk, including encryption in transit and at rest, strict tenant separation, role-based access controls, and logging. More detail is on our security page. ISO 27001 certification is in progress.
9. Your rights
Under the GDPR you have the right to access, rectification, erasure, restriction of processing, data portability, and to object to processing based on legitimate interests. You can reach us at privacy@vanadio.ai. You also have the right to lodge a complaint with a supervisory authority; the authority competent for us is the Berliner Beauftragte für Datenschutz und Informationsfreiheit, Berlin, Germany.
10. Changes to this policy
We update this policy when our processing or the legal framework changes. The date at the top shows the latest revision.