Privacy notice

Updated: 13 November 2026. This notice describes the revised GatwAI application with a public catalogue and optional personal saved-tool lists.

Controller and contact

WISTRA – Gesellschaft für Wissens- und Informationstransfer mbH, Wildensteinstraße 25, 72461 Albstadt, Germany. Managing director: Gerd H. Schick. You can send privacy questions and requests concerning your data through our contact form, to info@gatwai.com or to the postal address above. Further operator details are provided in the legal notice.

Public catalogue and hosting

You can read the catalogue, articles and guides without signing in. GatwAI is provided through OpenAI's ChatGPT Sites using Cloudflare infrastructure. When you visit a page, these services process connection and request data needed to provide it, including your IP address, requested address, time, and browser and device information. This processing supports delivery, troubleshooting and website security. The legal basis is our legitimate interest in a reliable and secure service under Article 6(1)(f) GDPR.

Optional sign-in and saved tools

If you choose Sign in with ChatGPT, GatwAI receives a user identifier, your email address and, where available, your name from the platform. The application uses these details to recognise your sign-in and display your name. Cloudflare D1 stores your user identifier and the identifiers of your saved tools. Your saved-tool list is not public. Article 6(1)(b) GDPR is the legal basis for providing this feature at your request. Without signing in, you cannot maintain a personal list on the server, but you can still use the public catalogue.

You can remove saved tools individually. You can also request deletion of your GatwAI data using the contact details above. Your ChatGPT account is managed separately by OpenAI. This sign-in does not give GatwAI your password or the contents of your ChatGPT conversations. OpenAI's privacy notice explains processing by the sign-in service.

Comparison, browser storage and tracking

Your tool-comparison selection is kept in your browser's sessionStorage and may be included in the address of a comparison page. You can clear your selection or browser storage. This storage supports the comparison feature you choose to use. Where access to your device is necessary for that feature, Section 25(2)(2) TDDDG is the basis for it. The sign-in service may use its own session cookies for the requested sign-in; its notices and settings apply.

The hosting platform may set Cloudflare's __cf_bm cookie even when you are not signed in. It supports detection and prevention of malicious automated requests. According to Cloudflare's cookie documentation, it contains encrypted bot-detection information and expires after 30 minutes of continuous inactivity. The exemption from consent under Section 25(2)(2) TDDDG applies only insofar as its use is strictly necessary to provide the secure website access requested by the user.

The GatwAI application does not include Google Analytics, Google Ads, remarketing pixels or its own marketing-tracking scripts. Search and filter inputs are used for catalogue searches. GatwAI does not make automated decisions about visitors that produce legal or similarly significant effects.

Contact and editorial administration

You can use the contact form and feedback form without an account. When you submit a form, we process your name, email address, message, enquiry type and submission time. If you are signed in, your user identifier may also be associated with the enquiry. These details are stored in Cloudflare D1 in the restricted GatwAI inbox and used to handle your request. Please provide only information necessary for your enquiry.

GatwAI also attempts to forward the enquiry by email for internal handling. The form details are sent through the existing hosting mail server hosting9.tn-rechenzentrum1.de to the responsible internal mailbox. The sending status, last attempt time and any technical error code are stored to monitor and retry forwarding. Successful storage in the GatwAI inbox does not mean that the email has already been delivered; the saved enquiry remains available there if sending fails.

The legal basis is Article 6(1)(b) GDPR for contract-related enquiries, otherwise our legitimate interest in responding under Article 6(1)(f) GDPR. If you contact us directly by email, we process your sender address, message and any additional contact details for the same purpose. An email link initially only opens your email application.

The inbox, including any earlier preview enquiries, is accessible only to authorised editorial accounts. Authorised staff also handle internal email notifications. Authorised email addresses and editing-account identifiers are processed to control editorial access and record who changed content.

Recipients and international processing

The service uses OpenAI for Sites and sign-in, Cloudflare for delivery and database storage, and the existing hosting and email infrastructure with the mail server hosting9.tn-rechenzentrum1.de. Authorised staff receive data as needed for their work. When you follow a link to a provider's website, you leave GatwAI and that provider's privacy notice applies.

The platform providers operate internationally; processing exclusively in Germany or the European Economic Area is not promised. OpenAI describes transfers based on adequacy decisions or standard contractual clauses in its Sites Data Processing Addendum. Cloudflare publishes further information. You can request information about the recipients and transfer arrangements applicable to GatwAI through our privacy contact.

Retention

Saved-tool entries remain stored until you remove them or request their deletion; GatwAI does not automatically delete them after a fixed period. Enquiry retention depends on handling the request and, where applicable, statutory retention obligations or the need to establish or defend legal claims. Technical platform logs and backup copies follow the retention rules of the services used. You may ask us for specific information concerning your data.

Your rights

Subject to GDPR conditions, you have rights of access, rectification, erasure, restriction and portability. You may object to processing based on legitimate interests for reasons relating to your particular situation. Where you have given consent, you may withdraw it for the future. Use our contact form or the contact details above. You may also complain to a data protection authority, including the State Commissioner for Data Protection and Freedom of Information Baden-Württemberg.