Privacy policy

1. Controller

The controller responsible for processing personal data is Infofy GmbH, Cumberlandstraße 4/1, 1140 Vienna, Austria. Representative office: Stöckenhoop 27a, D-21465 Wentorf bei Hamburg, Germany. Email: info@infofy.de, phone: +49 (0) 40 32890 7201.

CompaPulse is a service of Infofy GmbH.

2. Data we process

Account and sign-in data: email address and password (stored as a hash only), language preference and chosen plan.

Usage data: the companies you add to your watchlist (name, website, category customer/competitor/prospect, research focus), notes, alert and analysis settings, and the signals, company reports and portfolio reports generated from them.

Billing data: company name, contact person, billing email, billing address, VAT ID or tax number and purchase order reference, if you enter them in your account settings.

Team data: email addresses and roles of team members you invite.

Technical data: IP address, browser and device information, and request timestamps in server and security logs.

3. Purposes and legal bases

Providing and operating the service, account management, running the monitoring, creating reports and billing: performance of a contract (Art. 6(1)(b) GDPR).

Keeping the service stable and secure, preventing abuse and analysing errors: legitimate interest (Art. 6(1)(f) GDPR).

Meeting tax and commercial retention obligations: legal obligation (Art. 6(1)(c) GDPR).

The monitoring itself only collects publicly available information about companies (websites, news, social media profiles and other public sources). Personal data of third parties (e.g. names of managing directors or contact persons) is only processed where it appears in those public sources; the legal basis is our legitimate interest in providing a B2B monitoring service (Art. 6(1)(f) GDPR).

4. Cookies and local storage

We only use technically necessary storage: a cookie for your language choice (cp_locale) and entries in your browser's local storage for your sign-in session. There is no tracking, no analytics and no advertising.

5. Recipients and processors

Hosting, database and authentication are provided by our hosting and platform provider in data centres inside the European Union.

For AI evaluations (summaries, scoring, address lookup), the publicly available company information being analysed is sent to the AI service of Infofy GmbH (infofy.headwai.org). No credentials are transmitted, and the personal content of your notes is not used for AI evaluations.

For researching publicly available sources (websites, news, social media) we use Firecrawl (Firecrawl, Inc., USA). Only public company details (name, website, research focus) are transmitted. Transfers to the USA rely on standard contractual clauses (Art. 46(2)(c) GDPR).

Data processing agreements (Art. 28 GDPR) are in place with all providers.

6. Retention

Account data is stored until you delete your account. Watchlist, signals, notes, reports and analysis settings are removed within 30 days of account deletion.

Billing data is retained in line with statutory retention periods (generally 7 years in Austria).

Server and security logs are deleted after 90 days at the latest.

7. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection to processing (Art. 21).

To exercise your rights, simply contact info@infofy.de.

You also have the right to lodge a complaint with a supervisory authority. The authority competent for Infofy GmbH is the Austrian Data Protection Authority (DSB), Barichgasse 40-42, 1030 Vienna, www.dsb.gv.at.

8. Data security

All traffic is encrypted (TLS). Credentials are stored exclusively as hashes, and access to stored data is restricted to the respective account by database-level access controls.

9. Changes to this policy

We update this privacy policy when our processing changes. The current version is always available on this page. Last updated: September 2026.