Privacy Policy

1 Controller and contact

No data protection officer has been appointed; there is currently no statutory duty to appoint one. The contact point above is not an appointment within the meaning of Articles 37 et seq. GDPR.

2 Guide

This policy covers two separate areas. Which one applies to you depends on how you come into contact with us.

3 Our website

3.1 Server log files

When you call up our website, data that your browser transmits is collected automatically: IP address, date and time, page accessed, referrer, browser type and operating system. The purpose is technically fault-free delivery and the defence against attacks. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in secure operation. Storage period: 48 hours at most.

3.2 Cookies and consent management

We distinguish three categories:

We operate the consent management ourselves; no external service is used. We store your selection in the cookie danic_consent for about six months. Logging on our server takes place without storing the raw IP address. You may withdraw your consent at any time with effect for the future; the lawfulness of processing carried out until then remains unaffected.

3.3 Web analytics with PostHog

With your consent we use PostHog to measure reach. The provider is PostHog, Inc., San Francisco, USA. Usage behaviour, device and browser information and a truncated IP address are collected. Cross-site tracking does not take place. Recording of sessions is optional. The legal basis is Art. 6(1)(a) GDPR. We base the transfer to the USA on the provider’s certification under the EU-U.S. Data Privacy Framework.

3.4 Contact

If you write to us via the contact form or by email, we process the information you provide in order to handle your request. The legal basis is Art. 6(1)(b) GDPR insofar as it concerns the initiation or performance of a contract, and otherwise Art. 6(1)(f) GDPR. We delete the information once the purpose has ceased — as a rule after the conversation has ended, unless statutory retention periods stand in the way. We delete technical metadata such as IP address and timestamp after seven days at most.

3.5 Applications

We process application documents in order to carry out the application procedure on the basis of § 26(1) BDSG and Art. 6(1)(b) GDPR. We delete them six months after the procedure has ended at the latest, unless you have agreed to longer storage.

3.6 Newsletter and transactional emails

We use Brevo for sending. The provider is Sendinblue SAS, Paris, France; the servers are located exclusively in the EU (France, Germany, Belgium). Brevo is our processor. For the newsletter the legal basis is your consent under Art. 6(1)(a) GDPR; you may withdraw it at any time via the unsubscribe link. For operational transactional emails — such as invitations and sign-in links — the legal basis is Art. 6(1)(b) GDPR.

If you gave your consent when downloading a whitepaper (3.7), you will receive invitations to events, publications, newsletters and surveys from us by email. With your consent we evaluate opens and clicks in this context (see 3.7). We also send the confirmation link of the double opt-in procedure via Brevo. Every marketing email contains an unsubscribe link.

3.7 Whitepaper download

On our website we offer whitepapers for free download. To do so, you fill in a form. We then send you an email with a link. By clicking it you confirm your email address and receive the whitepaper (double opt-in procedure).

What data we process

The form contains an invisible field to protect against automated entries (spam). We do not store what is entered in this field.

Purposes and legal bases

Wording of the marketing consent

(Translation for information; the consent is given with the German wording shown in the form.)

Provision of the whitepaper

We provide the whitepaper via this form if you consent to marketing communication. If you do not wish to receive marketing communication, we will also send you the whitepaper without this consent on request to [email protected].

Evaluation of usage behaviour

With your consent we evaluate whether and when you open our emails and which links in them you click. For this purpose the emails contain a small tracking pixel and individual links. This tells us which topics interest you, and we send you more relevant content. There is no linking with the web analytics under 3.3.

Download

The whitepaper is stored as a PDF in non-public object storage at Cloudflare (EU jurisdiction). After your confirmation you receive a personal download link that is valid for a few minutes. When you call up the download, server log files are created under 3.1.

Recipients

For any transfer to third countries, 4.8 applies accordingly.

Storage period

Withdrawal

You may withdraw your consent at any time with effect for the future: by email to [email protected] or via the unsubscribe link in every marketing email. The lawfulness of the processing until withdrawal remains unaffected. After withdrawal we no longer send you marketing emails and end the evaluation.

3.8 Booking appointments via Google Calendar

On our contact page you can book an appointment with us directly via an embedded booking tool from Google (Google Calendar Appointment Scheduling). The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. The tool loads content from Google servers. To prevent data from being transmitted to Google without being asked, we load it only when you expressly activate it with a click.

On activation, your IP address and browser data are transmitted to Google; Google may set cookies in the process. We process the appointment data you enter (name, email address, selected time, occasion) to prepare and hold the appointment. The legal basis for loading the tool is your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG), and for arranging the appointment Art. 6(1)(b) GDPR. For the operation of the booking tool, Google is our processor (Google Workspace); for cookies set by Google for its own purposes, Google is an independent controller. For the transfer to the USA, 4.8 applies accordingly.

3.9 Embedded videos (YouTube)

On individual pages we embed videos from YouTube. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. The videos are embedded in privacy-enhanced mode and load only when you expressly start them with a click. Only then is a connection to YouTube established, your IP address and browser data are transmitted to Google, and Google may set cookies. The legal basis is your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG). Google is an independent controller for this processing. For the transfer to the USA, 4.8 applies accordingly.

3.10 Application for the Agentic Dev Benchmark 2026

At danic.ai/en/agentic-dev-benchmark-2026, development teams can apply for a free assessment as part of the Agentic Dev Benchmark 2026. To apply, you answer a few questions and provide your contact details.

What data we process

The form contains an invisible field to protect against automated submissions (spam). We do not store what is entered in this field.

Purposes and legal bases

Recipients

Within DANIC, only the people involved in the selection have access. For transfers to third countries, 4.8 applies accordingly.

Storage period

We store your application until 31 July 2027 (six months after the report is published) and delete it afterwards. If your team is selected, we transfer the information required for the engagement into our project records; the statutory retention periods apply to these. On request we delete your application earlier — an email to [email protected] is sufficient.

4 Use of our products: BeeHive, BeeKeeper and the customer portal

4.1 Scope

This section applies to registration for and use of our customer portal and of the development environment BeeKeeper installed locally on your device, with BeeHive content. Section 3 applies to our website.

4.2 Who is responsible for what

Where a company, as our customer, creates employees in a workspace or invites them, we process that data on behalf of the customer on the basis of a data processing agreement under Art. 28 GDPR. The customer is the controller in that respect. Please address your rights as a data subject to your employer; we will support the employer in doing so.

We are independently responsible for operation, registration and authentication, enforcement of the licence, defence against misuse and fraud, for records of the contract, billing and operational metrics. The following sections apply to that.

4.3 Registration and sequence

Access comes into being in a fixed sequence:

1. The person authorised to represent the customer signs the contract including the data processing agreement and sends both back to us. The contract and the data processing agreement are thereby concluded. (Alternatively, the data processing agreement may be accepted electronically later.)
2. We record the signed data processing agreement with a timestamp and send that person a link to download BeeKeeper together with an invitation.
3. That person installs BeeKeeper, signs in there and then to BeeHive, and creates the organisation. The trial period starts when the organisation is created.
4. That person invites the people who are to collaborate.
5. The invited people accept the invitation, sign in to BeeKeeper and can use BeeHive.

Without acceptance of the data processing agreement, no further people can be invited and no permissions can be assigned. We therefore do not process any personal data on behalf of the customer before that contract has been concluded (Art. 28(3) GDPR).

Invitation by us. If we invite prospective customers to a trial on our own initiative, we process for this purpose the email address available to us, a name, an internal note and the sending status as an independent controller (Art. 6(1)(f) GDPR — interest in initiating a business relationship). If no organisation results from this, we delete this data 180 days after the last mailing.

The sign-in data of the person authorised to represent the customer from step 3 (sign-in) arises before processing on behalf of the customer. We are independently responsible for it: we process it in order to perform the contract already signed, on the basis of Art. 6(1)(b) GDPR. The details are set out in Section 4.4.

If you were invited: your employer entered your business email address. We process it on behalf of your employer, on the basis of the data processing agreement that already exists at that time. Your employer is the controller; see Section 4.2.

For sign-in you may choose Google or GitHub as an identity provider or use a sign-in link by email. If you choose an identity provider, we receive an identity confirmation from that provider; the provider acts as its own controller for your account there. We also record which of these routes you used to sign in and whether it is an organisation or a personal workspace.

Before the contract is concluded we process only the contact details required for sending and returning the contract, together with the technical data that arises in any event when our pages are called up: the server log files under Section 3.1 and the bot protection. The legal basis is Art. 6(1)(b) GDPR for pre-contractual measures and Art. 6(1)(f) GDPR for protecting sign-in against automated access.

4.4 Data, purposes and legal bases

Sign-in and usage time per member. For each membership we store the time of the first sign-in or licence query per calendar day — also triggered by BeeKeeper’s licence query in the background. Purpose: licence management and a notice to us if an organisation with a plan remains unused for 30 days. We are independently responsible for this (Art. 6(1)(f), supplemented by (b)). The owners and admins of your organisation see the value per member in the portal; if you act as an employer, observe employee data protection and any co-determination rights in this respect. Only the most recent value is stored; it is deleted together with the membership.

4.5 What we do not process

Where the products are used as intended, inputs to the language model (prompts), model responses, source code, repository contents and work results do not reach us. The agents run exclusively on your device — depending on the operating mode in a protected area or via the Danic Runtime — and, from there, speak via your AI tool directly with your own account at the language model provider. We have no access to that connection.

• Sign-in with the model provider takes place locally on your device; the credentials remain there and do not reach us.
• Access to your repositories takes place exclusively locally on your device and under your own credentials. Our systems are not involved.
• From use of the product we store no IP addresses and no full payment-card data.
• Settings and project data that you enter locally in BeeKeeper remain in a local database on your device and do not reach us. The display name you assigned when signing in is, by contrast, account data (Section 4.4) and appears in member lists and invitations.
• The usage data under Section 4.4 contains no content. We see that a command was invoked — not with what. It is pseudonymised and is not used to assess the behaviour of individual persons.
• We do not use customer content for training or fine-tuning AI models.

The only exception is material that someone deliberately sends us for error analysis. We do not review such transmissions for their content in advance; we process them only for the support case in question. The same applies if you grant us time-limited access, approved by you, to a running session for error analysis (support/co-op session): you retain control, can end it at any time, and every action is logged under the identity of the acting person.

• Chat attachments remain on your device and go only to the AI tool you have chosen or its provider, not to us. Notices and campaigns in the IDE are selected locally on the basis of your licence; no data reaches us in the process.

4.6 Automatic updates

BeeKeeper updates itself automatically. In doing so, version information is retrieved and signed program files are loaded. Content from your device is not transferred. The legal basis is Art. 6(1)(b) GDPR, supplemented by point (f) on account of our interest in a secure and up-to-date state of the software.

4.7 Recipients and places of processing

The provider of the language model and your own development platform are not on this list. You use them on the basis of your own contracts; we are not involved and receive no data from there.

We process operational messages about licences, deletion and inactivity in our internal communication service (Google Workspace). These messages contain only the tenant ID (organisation identifier), the plan and dates — no further organisation details and no product content.

4.8 Transfers to third countries

Where a transfer to a third country takes place, we base it on an adequacy decision — including the EU-U.S. Data Privacy Framework for certified recipients — or on the standard contractual clauses of the European Commission pursuant to Implementing Decision (EU) 2021/914, supplemented by encryption in transit and at rest and by data minimisation. We provide the contracts in force with our service providers on request, to a reasonable extent.

4.9 Storage period

4.10 Data processing agreement

For processing that we carry out on behalf of a customer, the data processing agreement applies which the person authorised to represent the customer as a rule signs together with the main contract (or, alternatively, accepts electronically after signing in). It describes the subject matter, nature and purpose of the processing, the categories of data and data subjects, the technical and organisational measures, the sub-processors and the deletion concept. Customers receive it with the contract or in the customer portal. If the contract is signed outside the portal on paper or as a PDF, we record the signed copy with the name and position of the signatory and the date of signature as a contractual record.

5 Your rights

Under the General Data Protection Regulation you have the following rights:

Please contact [email protected] for this purpose.

You can also conveniently withdraw consent to marketing communication (3.6, 3.7) via the unsubscribe link in every marketing email.

6 Competent supervisory authority

7 Changes to this policy

We adapt this policy when our processing activities or the legal situation change. Each version carries a version number and a date. We keep earlier versions available for retrieval, because our contracts refer to the version in force when the contract was concluded.