ImpresaLens Privacy Policy
Version of 2 November 2026.
This policy explains which personal data ImpresaLens processes, why, where it goes and what rights you have under the EU General Data Protection Regulation (GDPR) and the German Telecommunications Digital Services Data Protection Act (TDDDG).
1. Who Is Responsible
The controller under Art. 4(7) GDPR is:
Privacy Responsible:
Apoorva Zinzuvadia
40474 Dusseldorf, Germany
info@zinzuvadia-online.com
A data protection officer is not required (fewer than 20 people process personal data regularly, § 38 BDSG). Questions about this policy and requests about your data go to the address above.
2. What ImpresaLens Does
ImpresaLens turns a US-listed company into a company analysis: a brief grounded in cited sources from the web and from the company's SEC filings, a chat assistant (LensBot) that answers questions about the company, and financial data from the company's 10-K filings. It is a tool for consultants and analysts.
The app is meant for research on public companies. Do not enter confidential client information or other people's personal data into the chat. What you type is sent to the AI and search providers listed in section 5 so they can answer.
3. Our Commitments
- No training, no marketing. We do not use your chats, questions or uploaded content to train AI models, and we do not use them for marketing, advertising or profiling. We do not sell or rent your data.
- No tracking. The app sets no analytics, advertising or tracking cookies and loads no third-party trackers. Its fonts are served from our own server.
- Provider choice for privacy. We send AI requests only to providers whose terms say they do not train on them, and we ask for no retention where a provider offers that. The exception is the web search providers, whose terms allow training on search queries: the app says so in each web-search question and in Settings (section 5).
- Careful with costs. We do our best to keep costs down, with relevant checks along the way: LensBot asks before bigger jobs such as a research search, a brief or a reading. These questions are a cost check, not a privacy setting.
- Hosted in Germany. The app, its database and its logs run on our own server in Germany. If you use the Google sign-in address, your connection passes through Cloudflare on its way there (section 5).
4. The Data We Process
| Data | Examples | Why | Legal basis |
|---|---|---|---|
| Account data | user id, login ID, name, email (if set), password hash, sign-in times, role, active state, monthly budget | to sign you in and keep your data separate from other users', and to keep your account on record, deactivated, while your usage must be kept for billing | Art. 6(1)(b) GDPR (providing the service you asked for); Art. 6(1)(c) GDPR with § 147 AO and § 257 HGB for the record kept for billing |
| Google sign-in | the email address Google confirms through Cloudflare; if your account has an email, that address on the list of accounts allowed to sign in | to sign you in by Google, if you use that address | Art. 6(1)(b) GDPR |
| Session cookie | one signed cookie, valid for 7 days | to keep you signed in | Art. 6(1)(b) GDPR; strictly necessary, so no consent needed (§ 25(2) no. 2 TDDDG) |
| Settings | chosen models, keys switched on, language, voice, theme; the date of the policy whose notice you last closed | to apply your choices to every request | Art. 6(1)(b) GDPR |
| Chats | your messages, LensBot's answers, the steps it took | to answer you and to show you your chat history | Art. 6(1)(b) GDPR |
| Company work | briefs and their translations, sources, verification results, financial data, read-aloud recordings | the analysis itself; it concerns public companies, and is stored once per company for every user | Art. 6(1)(b) GDPR |
| Cost records | for each AI call: purpose, model, tokens, cost, time, how long it took and why it stopped, you and the chat it belongs to | to bill your usage per calendar month and show it to you in the app | Art. 6(1)(b) and (f) GDPR (legitimate interest: cost control); Art. 6(1)(c) GDPR with § 147 AO and § 257 HGB (records we must keep) |
| Technical logs and traces | time, request, errors, the model calls of a chat turn (including their text) | to run the service, find errors and keep it secure | Art. 6(1)(f) GDPR (legitimate interest: a working, secure service) |
You do not have to provide any data, but without an account and your messages the app cannot work. ImpresaLens makes no decisions about you that are based solely on automated processing (Art. 22 GDPR). The AI answers are research aids about companies, not decisions about people.
5. Who Receives Data
To answer you, ImpresaLens sends parts of your work to the services below. They process it under their own terms and privacy policies, which we link to. We choose their settings to keep training and retention out wherever they allow it.
| Service | What it receives | When | Its terms on training and retention |
|---|---|---|---|
| OpenRouter (OpenRouter, Inc., USA), routing to the model vendor that serves the request, e.g. OpenAI, Google, Microsoft Azure, Nebius, DeepInfra | your messages and the company context for chat answers; brief, translation and verification texts, including LensBot's answers and the sentences of a brief when you use the app in German; texts to index for search; text read aloud | each AI call on an OpenRouter model | OpenRouter does not use inputs or outputs for training and does not store prompts or responses unless the customer opts in (we do not). We send every request with data_collection: deny, so OpenRouter routes it only to vendors it lists as not collecting user data. Google, which serves the Gemini models (the standard translator and the standard German reading voice), says it does not use prompts or responses of its paid services to improve its products; it keeps them for a limited period, solely to detect and prevent violations of its policies. Privacy policy, data collection, Gemini API terms |
| Cerebras (Cerebras Systems Inc., USA) | the same as a chat model, when you choose a Cerebras model | each call on a Cerebras model | Its terms do not give Cerebras the right to use your content "for the purpose of training or fine-tuning models"; it does not retain inputs and outputs of its inference service. Terms, privacy policy |
| TypeSafe AI (USA), the Jev judge | the sentence being verified and its sources; each LensBot answer, for the check that keeps it from giving investment, financial or legal advice | only when you choose Jev · TypeSafe as the judge in Settings; the standard judge, Jev through OpenRouter, reaches TypeSafe as an OpenRouter provider (row above) | It will not train or fine-tune models on your input and does not share it with third parties other than its own service providers. Privacy policy |
| Exa (Exa Labs, Inc., USA), web search | a search query LensBot writes from your question; for a shareholder or analyst-rating lookup, a query made from the company's name and identifiers | when LensBot needs the web. It asks before a research search, unless you switched the questions off for that chat; a shareholder or analyst-rating lookup that no other source can answer searches without asking | Its privacy policy says query data may be used to improve its products, including training models. Keep personal or confidential details out of questions that need a web search. The app says so in each web-search question. Privacy policy |
| Tavily (USA), web search, if chosen in Settings | as Exa | as Exa | Its terms let Tavily and its AI providers use and keep queries and results "for purposes of training, improving, developing, and enhancing artificial intelligence models", with no opt-out; it may pass a query to a search-index provider. Terms, privacy policy |
Cloudflare (Cloudflare, Inc., USA), the secure connection and sign-in check for impresalens.zinzuvadia-online.com | your connection to that address, including your messages and the answers; for each sign-in your email, IP address, country and time; the list of email addresses allowed to sign in | Connections are encrypted. As with services of this kind, they are decrypted on Cloudflare's network to be checked, then passed to our server over a new encrypted connection. Cloudflare acts as our processor and may use this data only to provide its services, not for marketing or advertising. It states that traffic is handled in memory by automated systems, is not written to disk except for cached content, and that automated controls prevent its staff from accessing it. Its sign-in logs are kept for 24 hours. Privacy policy, data processing addendum, log periods, traffic handling | |
| Google (Google Ireland Limited for users in the EEA) | you sign in at Google with your own Google account; Google passes on your name, email address and profile picture, and the app reads only the email address | when you use Google sign-in | Google handles your sign-in under its own terms and says it does not use information from Sign in with Google for ads or other Google products. How it works, privacy policy |
| SEC EDGAR and OpenFIGI (USA) | the company name or identifier you look up | when you name or confirm a company | public company data only; no personal data is sent |
Within our own operation, data stays on our server in Germany: the database, logs, traces (we run our own trace viewer) and backups, which are copied to our own network storage. The home server's read-aloud service (Kokoro and Piper, Local) also runs there.
6. When a Choice Differs From the Standard
Every model in Settings names the provider and the key it uses. Each web-search question, and the search provider in Settings, says that Exa or Tavily may use the query to train its models.
7. Transfers Outside the EU
The providers in section 5 are based in the USA, so using them transfers data there. What each provider offers for such transfers, as we found it in its own published documents (checked 30 October 2026; Cloudflare and Google 1 November 2026):
| Provider | Transfer safeguard |
|---|---|
| OpenRouter | Its data processing agreement includes the European Commission's Standard Contractual Clauses (controller to processor, Art. 46(2)(c) GDPR) and applies to every customer. It covers all models we use through OpenRouter. |
| Cerebras | Its terms refer to a data processing agreement, which it does not publish; its privacy policy relies on consent for transfers. |
| TypeSafe AI | Its privacy policy states that its services are hosted in the USA; it names no transfer safeguard. |
| Exa | Its terms incorporate its data processing addendum, which includes the Standard Contractual Clauses (controller to processor). |
| Tavily | It applies the Standard Contractual Clauses to its own service providers; it publishes no customer agreement. |
| Cloudflare | It states that it complies with the EU–US Data Privacy Framework. Its data processing addendum also includes the Standard Contractual Clauses (controller to processor), for transfers that framework does not cover. |
| It states that Google LLC is certified under the EU–US Data Privacy Framework, and that it relies on Standard Contractual Clauses where required. |
Apart from Cloudflare and Google, none of these providers states in its own documents that it is certified under the EU–US Data Privacy Framework. Where a provider offers no Standard Contractual Clauses, the transfer is necessary to carry out what you asked for (Art. 49(1)(b) GDPR): a Cerebras model, Tavily or Jev directly at TypeSafe runs only when you choose it in Settings; every standard setting runs through OpenRouter.
8. How Long We Keep Data
Our retention periods for each kind of data:
| Data | Kept |
|---|---|
| Account and Settings | as long as your account exists; once it is closed, the account is kept deactivated (no sign-in) while your usage must be kept for billing, then deleted |
| Chats | until you delete them (one chat, or all at once, in the app) or your account is closed |
| Company work (briefs and their translations, sources, read-aloud recordings, financial data) | until it is refreshed or removed; it concerns public companies and is shared by all users |
| Cost records | 10 years after the end of the year of the call (§ 147 AO, § 257 HGB), then made anonymous; deleting a chat keeps its cost records, which still name you, so your bills stay complete |
| Technical logs | 90 days. The server's console logs have a size limit instead (5 × 10 MB per container, oldest first), so in a quiet time they can hold older lines |
| Traces | 30 days. A frozen copy for our documentation holds only our own test accounts' traces, with no time limit |
| Backups | weekly, copied to our own network storage; the latest two backups are kept long-term; a deleted chat stays in a backup until that backup is deleted |
| Google sign-in list and logs at Cloudflare | your email stays on the list while your account is active and has one; it is removed within a minute of deactivating the account or removing the email. Cloudflare keeps its sign-in logs for 24 hours |
9. Your Rights
You have the right to:
- access the data we hold about you (Art. 15 GDPR);
- have it corrected (Art. 16) or erased (Art. 17);
- restrict its processing (Art. 18);
- receive it in a common, machine-readable format (portability, Art. 20);
- object to processing based on legitimate interest (Art. 21), on grounds relating to your situation;
- withdraw any consent you gave, with effect for the future (Art. 7(3)).
You can see every AI call you caused, with its cost, and your monthly totals in the app (Usage Log and Billing), and export them.
If you ask us to erase your data, we delete your chats and your account's name, email and password; logs and traces follow within their periods above, and backups as they are replaced. We must keep your cost records for their legal period (Art. 17(3)(b) GDPR), still under your user number, and we tell you so in our answer.
Write to the address in section 1. You also have the right to lodge a complaint with a supervisory authority (Art. 77 GDPR), for example the one responsible for us:
Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW) Kavalleriestraße 2–4, 40213 Düsseldorf www.ldi.nrw.de
10. Security
Access needs a signed-in account; each user sees only their own chats. API keys stay on the server and are never sent to your browser. The database, logs and backups are on our own server and network, and production and test environments are kept apart. No system is perfectly secure, but we act promptly on any incident and notify you where the law requires.
11. Changes
We update this policy when the app or its providers change. The date at the top shows the current version. When it changes, you see a notice the next time you sign in.