How this website handles personal data.

The controller for this website is Mainhattan Labs UG (haftungsbeschränkt), Große Gallusstraße 14, 60315 Frankfurt am Main, Germany. Ailpa is an operating brand of Mainhattan Labs UG (haftungsbeschränkt) and is not a separate legal entity.

Data protection enquiries: [email protected].

The public website at ailpa.ai, the contact form, and email correspondence that begins from the website.

If a mandate proceeds, the parties agree separate confidentiality, security and data processing terms appropriate to the transaction.

• Access data: IP address, request time, page requested, browser and device information, referrer and security events.
• Contact data: the subject you select, your name, email address, company and message, with basic technical metadata.
• Email: the content of your message, its headers, and anything you choose to attach.

Please do not send confidential documents through the public form.

Typefaces are served from this website and not from an external font service, so loading a page does not disclose your IP address to a third party font provider. We do not use analytics cookies, advertising cookies, retargeting pixels or third party tracking tags.

The site keeps two small settings in your browser's local storage, your theme choice and your answer to the cookie notice, and Cloudflare may set a security cookie. The cookies page lists them.

To deliver and secure the website, which is our legitimate interest. To receive, assess and answer enquiries, which are steps taken before entering a possible advisory relationship at your request. To keep appropriate business records, which is our legitimate interest and in some cases a legal obligation.

Submissions are posted to a Cloudflare Pages Function, validated, and stored in Cloudflare KV so we can respond. A notification is sent to us by email through Resend. Submissions are never sold, never used for advertising profiles, and never used to train public AI models.

Cloudflare for hosting, security and storage. Resend for the notification email. Our own business email provider. We do not sell personal data.

Some providers operate global infrastructure. Where personal data leaves the EEA we rely on safeguards such as adequacy decisions or standard contractual clauses.

Security logs are kept for as long as the provider requires. Contact submissions are kept for up to 24 months unless a longer period is necessary. Email correspondence may be kept longer where it forms part of business records.

Subject to applicable law you may request access, rectification, erasure, restriction or portability, and you may object to processing based on legitimate interests.

You may also complain to the Hessian Commissioner for Data Protection and Freedom of Information at datenschutz.hessen.de.

We update this notice when the website or the law changes. The date above shows the current version.