Privacy Policy

Last updated: October 2026.

This Privacy Policy informs you about the nature, scope, and purpose of the collection and processing of personal data when you visit our website routine.solutions, submit inquiry or registration forms, or use the client portal and our automated agent services. We are committed to processing your personal data strictly in accordance with the European General Data Protection Regulation (GDPR / DSGVO) and the German Telecommunications-Telemedia Data Protection Act (TDDDG).

1. Data Controller & Contact

The controller responsible for data processing within the meaning of Art. 4(7) GDPR is:

YAR Axiom GmbH
Siedlungsstr. 5
82538 Geretsried
Germany
Commercial Register: Amtsgericht München, HRB 264120
Managing Director (Geschäftsführerin): Dr. Mahya Karbalaii
Email: hello@routine.solutions
Website: https://routine.solutions

2. General Principles, Legal Bases & Data Security

We process personal data only when permitted by statutory law. Where the GDPR applies, processing is based on:

  • Art. 6(1)(a) GDPR (Consent): When you have granted explicit consent for specific processing operations (e.g. voluntary cookie preferences).
  • Art. 6(1)(b) GDPR (Performance of Contract & Pre-contractual steps): For responding to your inquiries, executing onboarding, creating client accounts, and providing contracted AI automation services.
  • Art. 6(1)(c) GDPR (Legal Obligation): Where processing is required to comply with statutory commercial, accounting, and tax retention duties.
  • Art. 6(1)(f) GDPR (Legitimate Interests): For maintaining technical stability, IT security, fraud prevention, and continuous improvement of our services.

Technical and Organizational Security Measures (TOMs): We employ end-to-end TLS/HTTPS encryption across all public and portal endpoints, role-based access restrictions, firewall protections, and cryptographic secretbox encryption (libsodium / AES-256) for stored client credentials.

3. Data Collection on Our Website

3.1 Server Log Files & Hosting

When you access our website, our web servers and content delivery network (Cloudflare) automatically collect and temporarily store technical connection data transmitted by your browser. This includes: IP address, date and time of the request, time zone offset, requested page/file path, HTTP status code, volume of data transmitted, referrer URL, and browser type/version and operating system. The processing of this data is necessary to deliver the website, ensure stability and cybersecurity, and prevent denial-of-service attacks (Legal basis: Art. 6(1)(f) GDPR). Log files are routinely deleted or anonymized after a maximum of 14 days, unless longer retention is required for security incident investigation.

3.2 Contact & Onboarding Forms

When you contact us via contact forms, registration forms, or email, we collect the information you submit (e.g. your full name, email address, phone number, company name, team size, location, and message details). We process this data exclusively to evaluate your automation requirements, communicate with you, and prepare the contractual relationship (Legal basis: Art. 6(1)(b) and Art. 6(1)(f) GDPR).

4. Client Portal, Task Execution & Agent Workflows

For onboarded business clients using the routine.solutions platform, additional specialized processing takes place:

  • Client Accounts & Access: We store login credentials, business names, assigned automation services, language preferences, and portal activity to administer client accounts (Art. 6(1)(b) GDPR).
  • Encrypted Credential Vault: To enable automated task execution (such as reading an email inbox or preparing drafts), the Client connects its mailbox or business tools. The credentials (e.g. IMAP passwords) are stored strictly encrypted server-side using cryptographic secretbox encryption and are only decrypted into memory during the execution of authorized tasks.
  • Task Execution & Data Processing Agreement (DPA): When Agents process business documents, customer emails, invoices, or records on behalf of the Client, routine.solutions acts as a Data Processor pursuant to Art. 28 GDPR. A formal DPA forms an integral part of every client agreement.
  • Telegram Bot & Messaging: If the Client connects our Telegram bot for task notifications and chat, we process the Client’s Telegram chat ID and message stream. Voice notes sent via Telegram are transcribed to text and deleted immediately after transcription.
  • Confirmation Audit Trail: Confirmations and approvals given by authorized client personnel are stored in an immutable, timestamped audit log for evidentiary and compliance purposes (retained for the contract term plus statutory limitation period of 3 years under § 195 BGB).

5. Cookies, Local Storage & Cookie Preferences

Our website uses cookies and browser local storage. Cookies are small text files placed on your device by your browser.

5.1 Strictly Necessary Cookies & Storage

These technical cookies and local storage tokens are essential for the operation, security, and multilingual functionality of our website and client portal. They do not require consent under § 25(2) No. 2 TDDDG and Art. 6(1)(f) GDPR:

  • rco_language (Cookie): Stores your selected language preference (English, German, Italian). Lifespan: 365 days.
  • rco_cookie_consent_v1 (Local Storage & Cookie): Records your cookie preference selection so that the consent banner does not appear repeatedly. Lifespan: 365 days.
  • wordpress_logged_in_* / wordpress_sec_* (Session Cookies): Necessary for authenticating logged-in clients and administrators in the portal. Lifespan: session / 14 days.

5.2 No Invasive Third-Party Tracking

We do not use invasive third-party ad networks, tracking pixels, or cross-site behavioral profiling cookies. If optional performance or analytics tools are introduced, they will only be activated with your prior affirmative consent pursuant to Art. 6(1)(a) GDPR and § 25(1) TDDDG.

5.3 Managing Your Cookie Preferences

You can view, adjust, or withdraw your cookie consent at any time by clicking the “Cookie Preferences” link in the footer of our website. You can also delete or block cookies directly in your browser settings.

6. Subprocessors & Third-Party Services

To operate our platform and deliver our services securely, we collaborate with selected enterprise service providers:

  • Cloudflare Inc. (USA / EU): Provides Content Delivery Network (CDN), SSL termination, DDoS protection, and secure routing tunnels. Standard Contractual Clauses (SCCs) are in place to ensure compliance with Art. 44 ff. GDPR.
  • Anthropic PBC (USA): Provides enterprise large language model (LLM) API inference for AI agent reasoning. Under our enterprise agreement, Anthropic does NOT retain customer API prompt data and does NOT use client data to train foundation models. Data transfers are secured by EU Standard Contractual Clauses.
  • Telegram FZ-LLC: Used exclusively when a client voluntarily connects the Telegram notification bot for task alerts and confirmations.
  • EU Hosting & Infrastructure Providers: Core database and portal infrastructure are hosted in ISO 27001 certified data centers within the European Union.

7. Retention Schedules & Data Deletion

We retain personal data only for as long as necessary to fulfill the respective purpose or as mandated by statutory retention periods (such as 6 to 10 years for accounting and tax records under § 147 AO and § 257 HGB). Specifically:

  • Inquiry data from non-contracting visitors: deleted after 6 months.
  • Client portal and task interaction logs: retained for the contract duration plus 12 months.
  • Confirmation Audit Trail: retained for the contract duration plus 3 years (§ 195 BGB).
  • Encrypted credentials: permanently purged immediately upon disconnection or contract termination.

8. Your Rights as a Data Subject

Under the GDPR, you have the following statutory rights regarding your personal data:

  • Right of Access (Art. 15 GDPR): The right to obtain confirmation and information about the personal data we process concerning you.
  • Right to Rectification (Art. 16 GDPR): The right to have inaccurate or incomplete data corrected.
  • Right to Erasure (“Right to be Forgotten”, Art. 17 GDPR): The right to request the deletion of your personal data, subject to statutory retention obligations.
  • Right to Restriction of Processing (Art. 18 GDPR): The right to restrict processing under certain conditions.
  • Right to Data Portability (Art. 20 GDPR): The right to receive your data in a structured, commonly used, and machine-readable format.
  • Right to Object (Art. 21 GDPR): The right to object at any time, on grounds relating to your particular situation, to the processing of personal data based on Art. 6(1)(f) GDPR (legitimate interests).
  • Right to Withdraw Consent (Art. 7(3) GDPR): The right to withdraw any previously given consent at any time with effect for the future.

To exercise any of these rights, please contact us at: hello@routine.solutions.

9. Right to Lodge a Complaint with a Supervisory Authority

Without prejudice to any other administrative or judicial remedy, you have the right under Art. 77 GDPR to lodge a complaint with a data protection supervisory authority, in particular in the Member State of your habitual residence, place of work, or the place of the alleged infringement. The competent lead supervisory authority for YAR Axiom GmbH is:

Bayerisches Landesamt für Datenschutzaufsicht (BayLDA)
Promenade 18, 91522 Ansbach, Germany
Website: https://www.lda.bayern.de

10. Updates to this Privacy Policy

We may update this Privacy Policy from time to time to adapt to technical changes, service enhancements, or evolving legal standards. The latest version published on this page is always applicable.