Privacy policy.

1. Controller and contact

The controller within the meaning of the General Data Protection Regulation (GDPR) is:

Authorised managing director: Oliver Diekmeier; Local Court of Charlottenburg (Berlin), HRB 289900 B; VAT ID: DE464420390

Data protection officer: No data protection officer has been appointed at present, as the statutory conditions (§ 38 German Federal Data Protection Act, BDSG) are not met. Please address any enquiries to the contact details above.

2. Two roles: controller and processor

Please note the distinction between two types of processing:

a) We act as controller for the data arising from the use of our website, from registration, contract performance, billing, support and the safeguarding of operations. These processing activities are described in sections 4 to 11.

b) We act as processor for all content our customers store in their workspaces, such as proposal texts, project ideas, budget data, contact persons at partner organisations, publication lists and uploaded files. Where such content contains personal data relating to third parties, we process it exclusively on the instructions of the customer concerned, on the basis of a data processing agreement under Art. 28 GDPR. The controller for that data is the customer, that is, as a rule, your university, your institute or your company.

3. Legal bases

We process personal data on the following legal bases:

Art. 6 (1) (b) GDPR

Performance of a contract or steps taken prior to entering into a contract (registration, provision of the application, billing, support).

Art. 6 (1) (c) GDPR

Compliance with legal obligations, in particular retention obligations under commercial and tax law.

Art. 6 (1) (f) GDPR

Pursuit of legitimate interests (security and stability of operations, prevention of misuse, further development of the application, assertion of legal claims).

Art. 6 (1) (a) GDPR

Consent, where we obtain it separately (for example for product news by email). You may withdraw consent at any time with effect for the future.

Art. 28 GDPR

Processing on behalf of our customers (see section 2 b).

4. Access to the website and the application (server log files)

Each time the website or application is accessed, our server automatically collects technical access data:

• the IP address of the requesting device (on meritevo.eu shortened before it is stored: the last 8 bits of an IPv4 address and the last 80 bits of an IPv6 address are removed),
• the date and time of access,
• the address requested (URL) and the HTTP status code,
• the volume of data transferred,
• the referrer URL,
• the browser type, browser version and operating system.

Purpose: provision of the website, safeguarding system stability, detecting and preventing attacks and misuse, error analysis.

Legal basis: Art. 6 (1) (f) GDPR (legitimate interest in secure and uninterrupted operation) and Art. 6 (1) (b) GDPR.

Retention period: log files are deleted or truncated after 30 days at the latest. In the event of a specific security incident, we retain the entries concerned until the matter has been finally resolved.

Reach measurement

To understand the reach of our website, we evaluate the shortened log entries of meritevo.eu once a night on the web server itself. We count which pages are viewed, in which language, from which country, with which type of browser, operating system and device, and through which websites, search engines or our own campaign links visitors arrive. To combine the page views of one visit, the evaluation uses the shortened IP address and the browser identifier, only in working memory and only within one calendar day; the same visitor is not recognised across days. The country is determined from the shortened IP address using a database kept on our server; city, region and internet provider are not determined. Of the referring page we keep only its domain, and only for domains on our own list; other websites are counted as "Others", and links from our own sites as direct visits. Of the parameters in the address we keep only campaign details we have assigned ourselves. Only daily totals leave the web server, for our own statistics system on our servers at Hetzner in Germany; in each breakdown, values that occur fewer than five times a day are combined under "Others". For this measurement no cookies are set and no script runs in your browser, and no data is passed to third parties.

Legal basis: Art. 6 (1) (f) GDPR (legitimate interest in understanding the use and reach of our website).

Retention period: no separate copy of the log entries is made for this; they are deleted as described above. The daily totals have no personal reference and are kept without time limit.

Right to object: you may object to this processing at any time (section 14); we then exclude your shortened IP address and browser identifier from future evaluations.

5. Cookies and local storage

We use necessary cookies for sign-in and local preferences. Our server-log reach measurement (section 4) uses no browser script or analytics identity. Optional Statistics uses local storage after your express consent, as described below.

Strictly necessary storage uses section 25(2) no. 2 TDDDG and Article 6(1)(b) and (f) GDPR. Optional Statistics has the separate consent basis described below.

You can delete cookies at any time through your browser settings. Deleting the session cookie signs you out.

Optional Statistics

With your consent, Quantevo GmbH uses Umami to understand website use and the steps from registration to a first workspace and proposal. We process page views, registration clicks, campaign details and the milestones registration, email verification, workspace creation, first workspace opening and first proposal. A random statistics ID links these events and, if you register with statistics enabled, your account. Umami is hosted on our servers at Hetzner in Germany (section 12).

Statistics are optional. Website collection lasts 90 days from your choice. If you register during that period with statistics enabled, personal app consent continues until withdrawal or account deletion. You can also enable app statistics separately in your account. Earlier choices keep their 30-day website and raw-event limits. Earlier bounded app choices end 14 days after signup or at the first proposal, whichever is sooner.

Storage and retention

Raw events and associated session data are kept for up to 90 days from occurrence. Minimal consent, account-linking and milestone records remain while app consent is active. After withdrawal or account deletion, the remaining withdrawal and deletion records expire when the corresponding collection, raw-data and recovery periods have ended. Anonymous aggregate reports may be kept indefinitely.

In your browser, mv-consent remembers your choice until you clear it. mv-stats holds the collection receipt and deadlines during the website period. mv-stats-pending coordinates a request for up to four seconds. The withdrawal receipt in mv-stats-rights remains for up to 194 days from the website choice. Earlier choices retain their shorter periods.

Legal basis and withdrawal

The legal basis for optional statistics and the associated local storage is your consent under section 25(1) TDDDG and Article 6(1)(a) GDPR. You may withdraw at any time under Article 7(3) GDPR without affecting the lawfulness of processing before withdrawal.

Use Statistics settings in the website footer while the browser receipt remains available, or Settings → Account in the app, to withdraw. A website withdrawal also covers app consent linked to that choice; a separate app-only choice is managed in the app. Your account preference is personal across workspaces. Account deletion also requests deletion of linked statistics. Further data-protection rights and contact details are set out below.

6. Registration and user account

A user account is required in order to use the application.

Data processed: name or display name, email address, password stored in encrypted form (hashing), time of registration and of email confirmation, times of sign-in and sign-out, membership of organisations and workspaces, role and permissions, and optionally details of two-factor authentication and of your own research profile (for example thematic focus, ORCID identifier).

Purposes: provision of access, authentication, permission management, confirmation of the email address, password reset, invitation of team members, prevention of misuse.

Legal basis: Art. 6 (1) (b) GDPR; for security measures additionally Art. 6 (1) (f) GDPR.

Prevention of misuse during registration: to protect against automated mass registrations, we limit the number of registration, sign-in and password requests per IP address within a given time window. For this purpose we briefly store counters relating to IP addresses (retention between 5 and 60 minutes, depending on the measure). We also check the email domain provided against a locally held list of disposable email providers; no data is transferred to third parties in this process. The legal basis is Art. 6 (1) (f) GDPR.

Retention period: until the account is deleted. After the contract ends, we delete account data in accordance with section 13.

7. Use of the application (customer content)

Content that you create or upload in your workspace, in particular project ideas, proposal texts and their versions, comments, chat messages, budget plans, partner and contact data, publication details and file attachments, is processed by us as a processor on behalf of the respective customer (section 2 b).

In addition, we log events within a workspace that are relevant to security and accountability (for example who granted which approval at what time, or who changed which record). These logs serve traceability and the prevention of misuse.

8. AI-assisted features

Our application includes features based on large language models and image generation models, such as the assessment of funding calls, the drafting of text, the critical review of sections, the drafting of budgets and the generation of images.

What is transmitted: in order to run an AI feature, the content required for it, for example the section concerned, the call text or the associated evidence, is transmitted to the respective model provider. Such content may contain personal data if you have included personal data in your documents.

Providers used: the default inference provider is the intermediary service OpenRouter, Inc. (USA), through which requests are routed to the respective model providers. For text inference, workspaces can instead use providers processing within the EU, currently Nebius and TensorX. The specific models used may change as the technology develops; the current list of recipients is set out in section 12.

EU image generation: Black Forest Labs (BFL GmbH, Freiburg) processes prompts, input images for revisions and generated images through api.eu.bfl.ai. This is an exception to the zero-retention and contractual no-training commitments described here, even when zero retention is enabled. We use BFL under its standard terms; a data processing agreement (DPA) is pending. Those terms permit training on inputs and outputs. We have requested a training opt-out; BFL's written confirmation and a defined retention period are still pending. BFL documents EU routing for this endpoint, but has not contractually committed to EU-only processing.

Semantic search: for semantic search we compute embeddings (vectors) using a model hosted in the EU by Nebius. This applies to all workspaces and cannot be changed; no transfer to a provider outside the EU takes place in this process.

The place of processing depends on your workspace configuration. We cannot give a general assurance that processing takes place exclusively within the EU. The application's servers, database and backups are located in Germany; for AI processing, the inference provider to be used, and whether only providers with a zero-retention commitment are permitted, is determined when the workspace is created. That setting can subsequently be changed only through our support team, not within the application itself.

Sandbox and free trial: in sandbox workspaces and during the free trial these settings cannot be configured. AI processing there runs through OpenRouter and therefore through a provider established in the USA that contractually guarantees zero retention. Please do not use confidential or personal content in these workspaces if that content must not leave the EU.

Training: we ourselves never use your content to train our own or any third-party models. Whether the same applies to the respective model provider depends on the zero-retention setting, which is enabled by default: where it is enabled, storage within the scope of the providers' zero-retention terms and any use for training purposes are contractually excluded, except for EU image generation with BFL as described above. If the workspace owner expressly disables the option, temporary storage and, depending on the provider's terms, use of the content to train its models cannot be ruled out.

How AI features are triggered: AI features that use credits run only when you expressly trigger them, for example by clicking "create draft". Funding calls are also screened automatically, without using credits; workspace owners and administrators can switch this screening off. Background processes that monitor and screen funding calls do not process proposal content.

No automated decision-making within the meaning of Art. 22 GDPR: the application's assessments and recommendations are decision aids. They have no legal effect and are always reviewed by, and remain the responsibility of, people.

Legal basis: Art. 6 (1) (b) GDPR (contractually owed functionality). Where the content contains personal data relating to third parties, processing takes place on behalf of the customer under Art. 28 GDPR.

9. Payment processing

For paid plans we use Stripe Payments Europe, Ltd. (Dublin, Ireland).

Data processed: name, email address, billing address, VAT ID where applicable, plan selected, payment amount, payment status. Payment instrument data (card numbers, bank details) is processed exclusively by Stripe; we neither receive nor store it.

Purpose: processing of payments, invoicing, detection of fraudulent transactions.

Legal basis: Art. 6 (1) (b) GDPR; for fraud prevention Art. 6 (1) (f) GDPR; for the retention of invoicing data Art. 6 (1) (c) GDPR.

Retention period: invoices and accounting records are retained for ten years in accordance with § 147 German Fiscal Code (AO) and § 257 German Commercial Code (HGB).

Stripe acts in part as an independent controller; its own privacy notices apply in addition.

10. Email delivery

We send operational emails, in particular to confirm your email address, to reset passwords, to issue workspace invitations and to provide information about your contract. We use the service Brevo (Brevo GmbH, Berlin / Sendinblue SAS, France) for delivery.

Data processed: email address, display name, content and time of the message, and technical delivery information.

Legal basis: Art. 6 (1) (b) GDPR (operational messages); for product information without a direct contractual connection, Art. 6 (1) (a) GDPR (consent), which may be withdrawn at any time.

Product news: messages about new features and product changes are sent only with express consent (opt-in). You can give and withdraw that consent yourself at any time in your account settings within the application; unsubscribing takes effect for the future and does not affect operational messages. Without consent you will not receive product news.

11. Contacting us

If you contact us through the contact form or by email, we process your name, your email address, optionally your organisation, and your message in order to respond to your enquiry.

Legal basis: Art. 6 (1) (b) GDPR for contract-related enquiries, otherwise Art. 6 (1) (f) GDPR (legitimate interest in responding).

Retention period: we delete enquiries once they have been finally dealt with and no retention obligations apply, and after 24 months at the latest.

Booking a demo

If you book a live demo on our website, we process your name, your email address, optionally your organisation and your note, and the time you choose, in order to arrange and hold the demo. The booking is entered in our calendar in Google Workspace; Google sends you the invitation and provides the video call through Google Meet. To show free times, our server reads only the busy periods of our calendars, never the content of other appointments.

Legal basis: Art. 6 (1) (b) GDPR (steps taken at your request prior to entering into a contract).

Retention period: we delete the calendar entry once the demo has taken place and nothing remains to follow up, and after 24 months at the latest. A transfer to the USA cannot be ruled out (section 12, transfers to third countries).

12. Recipients and processors

We disclose personal data only where this is necessary to provide our services, where we are legally obliged to do so, or where you have consented. Data processing agreements under Art. 28 GDPR are in place with service providers that process personal data on our behalf, with the exception of BFL for EU image generation: its DPA is pending (section 8).

In addition, we retrieve publicly available information from academic services to enrich records, including OpenAlex, Crossref, ORCID, CORDIS and publications of the German Federal Statistical Office. In doing so we generally transmit only search terms or identifiers (such as a DOI or an ORCID identifier), never account data. If you link your ORCID profile, the information you have published there is retrieved.

No disclosure for advertising purposes. We do not sell personal data and we do not pass it to third parties for advertising purposes.

Transfers to third countries

In the case of the providers listed in the table that are established outside the EU or the EEA, personal data is transferred to a third country. Such transfers take place on the basis of the European Commission's standard contractual clauses under Art. 46 (2) (c) GDPR, supplemented by technical and organisational safeguards (transport encryption, data minimisation, no transfer of account data to model providers), and, where applicable, on the basis of an adequacy decision (for example the EU-US Data Privacy Framework for certified companies).

We note that third countries may not offer a level of data protection equivalent to European law, and that access by public authorities cannot be excluded to the same extent.

13. Retention periods

We store personal data only for as long as it is necessary for the purposes described:

Server log files

max. 30 days (section 4).

Reach measurement

daily totals without personal reference: without time limit; individual visits are not stored separately (section 4).

Optional Statistics

Raw events: up to 90 days from occurrence; website collection: 90 days from your choice; app consent: until withdrawal or account deletion. Minimal consent and milestone records remain while app consent is active. Withdrawal and deletion records expire with the corresponding collection, raw-data and recovery periods. Earlier choices keep 30-day website and raw-event limits; earlier bounded app choices end after 14 days or at the first proposal, whichever is sooner. Anonymous reports may be kept indefinitely (section 5).

Account and usage data

until the account is deleted or the contractual relationship ends.

Customer content

after the contract ends, export remains possible for 30 days; complete deletion then follows within 90 days. For sandbox workspaces the shorter period stated in each case applies.

Backups

deletions take effect in backups with a delay of up to 35 days; the data is removed there afterwards.

Invoices and accounting records

10 years (§ 147 AO, § 257 HGB).

Commercial letters

6 years (including relevant business correspondence).

14. Your rights

You have the following rights against us in respect of personal data concerning you:

• access to the data processed (Art. 15 GDPR),
• rectification of inaccurate data (Art. 16 GDPR),
• erasure (Art. 17 GDPR),
• restriction of processing (Art. 18 GDPR),
• data portability in a structured, commonly used and machine-readable format (Art. 20 GDPR),
• withdrawal of consent with effect for the future (Art. 7 (3) GDPR).

To exercise your rights, a message to contact@meritevo.eu is sufficient. You can also view, change or export much of your data directly in your account settings.

Right to lodge a complaint

You have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority competent for us is:

15. Obligation to provide data

Providing your name, email address and, for paid plans, billing details is necessary in order to enter into a contract. Without this information we cannot set up an account or provide the application. All other information (such as details of your research profile) is voluntary; without it, individual features may be available only to a limited extent.

16. Data security

We take technical and organisational measures appropriate to the state of the art in order to protect your data. These include, in particular, transport encryption of all connections (TLS), storage of passwords solely as a cryptographic hash, role-based access control with strict separation of workspaces, optional two-factor authentication, regular backups and the logging of security-relevant events.