Skip to content

Updated: 2 November 2026

Privacy notice for the customer and admin portals

This notice covers app.thosia.com and admin.thosia.com: registration, accounts, workspace administration and use of the portal. The public website and its own support chat have a separate notice.

Personal interface language

Your German or English choice is saved as a personal account preference. A functional cookie on the respective portal address remembers the choice on this device for up to one year, including before sign-in. The Light, Dark or System appearance is stored for up to one year in a functional cookie for thosia.com and its portal addresses on this device. These choices change neither company content nor your website chatbox’s own language and design settings.

Controller and contact

AE24 GbR, jointly represented by Ahmed Shoihy and Eslam Mostafa, Taunusstraße 31, 71032 Böblingen, Germany. Contact for privacy requests: info@thosia.com.

Accounts, registration and security

We process your name, company name, email address, password hash, company memberships, roles, invitations and account status to provide and secure the portal. Passwords are stored as hashes. Session records also contain IP address, browser information, creation and last-use times, expiry and revocation status. These records support sign-in security and the signed-in devices view.

We send account confirmation, invitation and password-reset messages through STRATO. Confirmation and reset links are valid for 30 minutes. A link expiring does not itself delete its database record.

For a contract with you or steps you request before a contract, the basis is Article 6(1)(b) GDPR. For authorised users acting for a company and for preventing abuse, the basis is Article 6(1)(f): our and your company's interests in providing a secure workspace. Required account details are needed to create or use an account; providing other details is optional.

Company content and access

The portal stores website and assistant settings, knowledge texts and files, conversations, tasks, integration settings and usage information that your company submits or generates. Authorised company users can access data within their roles and website permissions. Authorised platform administrators operate the service; company support access follows the platform's grant and revocation controls and is recorded.

For personal data in your company's content or visitor conversations, your company normally decides the purposes and instructions, and AE24 processes it on its behalf. The applicable processing agreement and company privacy information govern that relationship. This notice is not a processing agreement. Please send content-related rights requests to the responsible company; AE24 assists it within its remit.

AI services and integrations

Saving a key or signing in does not activate AI for every website. Where an assistant is activated, the selected connection receives the current question, selected conversation context, relevant knowledge and instructions through the backend. Text you include can contain personal data; do not submit passwords, access keys or unnecessary sensitive information.

The current Thosia-operated cloud connection uses IONOS AI Model Hub. Its documentation states that inference takes place in Germany, prompt and answer content is not persistently stored or used for training, and separate service metadata is retained. This does not determine how long your company or AE24 stores its own data. Other selected connections or integrations require their own assessment and information before use. Order or other external actions require an enabled, authorised integration.

Billing

If an enabled paid checkout is used, Stripe receives the account email, company and tariff information, transaction identifiers and amounts needed to create and manage the subscription. Billing address, tax details and payment information are collected in Stripe's checkout. Thosia stores billing references and status, not complete payment-card details. Processing is for the requested contract and applicable accounting duties under Article 6(1)(b) and (c) GDPR.

Stripe acts as processor or independent controller depending on the activity. Its services may involve processing outside the EEA. Stripe describes adequacy decisions, standard contractual clauses and, where applicable, the EU–US Data Privacy Framework as transfer mechanisms. Its Privacy Center explains these safeguards and how to request a copy. Germany-based hosting of Thosia does not mean all billing data stays in Germany.

Cookies and browser storage

Sign-in uses necessary access, renewal and CSRF-protection cookies, separately for the customer and admin portals. The access cookie lasts up to 15 minutes; renewal and CSRF cookies up to 30 days. Renewal, sign-out, revocation and browser settings affect their use. The requested sign-in and security functions are the purpose of these cookies; they are not advertising cookies. Necessary storage is based on section 25(2)(2) TDDDG; related personal-data processing uses the bases described above.

The customer portal remembers your selected website in localStorage until it is changed, removed or cleared in your browser. This supports your workspace selection. The portal does not load advertising or third-party analytics trackers.

Retention and deletion

Account, company and permission data is kept while needed for the workspace and the contractual relationship. After the purpose ends, deletion, return of company content and any necessary restricted retention are handled according to the applicable contract, instructions, legal duties and justified security or claims needs. Token or session expiry limits access; it is not a promise of automatic deletion of every related record. Contact info@thosia.com for an account-data or deletion request.

Visitor-chat retention depends on the responsible company's configured policy. The separate public Thosia support chat uses 30 days after its last message, followed by the next successful cleanup. Separate completed support tasks and detailed AI usage have their own 90-day rules. These periods are not a blanket lifetime for portal accounts, billing records or every customer's content.

Operational logs and security records have separate purposes and retention rules. Encrypted backups can contain older data: the daily VPS rotation keeps seven completed generations; additional recovery copies on the VPS and the operator's Mac are managed separately. After recovery, expired data and deletion requests must be accounted for before reuse. A deletion request is not represented as immediate removal of every backup copy.

Recipients and locations

STRATO provides the server infrastructure in Germany and transactional email. IONOS provides the described cloud AI service when used. Stripe is used when the enabled billing service is requested. Other connected services receive only data used by their enabled functions and must be covered by the company's instructions and relevant agreements. There is no automatic transfer of all portal content to every listed provider.

Your rights

Subject to the applicable legal conditions, you may request access, correction, deletion, restriction and portability, and object to processing based on legitimate interests on grounds relating to your situation. Any consent can be withdrawn for the future. We may ask for proportionate information to securely locate and verify a request; do not send passwords, API keys or session tokens. Requests are generally answered within one month, with any permitted extension explained in time.

You may complain to a supervisory authority, including the Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg. Thosia's general support assistant does not make decisions about you with legal or similarly significant effects.