Legal

Imprint.

Operator

Only You FZE LLC
Ajman Free Zone, United Arab Emirates
License No. ANCFZ-2024 (valid through 17.04.2027)
Managing Directors: Maximilian Geiger, Armin Herbert

Contact

Email: info@only-you-agency.com
WhatsApp: +49 151 47055377

VAT & Registration

UAE Free Zone Entity — no EU VAT-ID required for B2B services. Tax registration: UAE FTA. For EU customer-side invoicing, reverse-charge procedure applies (§13b UStG).

Responsible for content under § 55 RStV

Maximilian Geiger, address as above.

Privacy.

The short version

You text Alfred on WhatsApp. The conversation runs end-to-end encrypted between your phone and ours. We process your messages on EU-located infrastructure (Hetzner Frankfurt) to generate replies. We don't sell, share, or train public models on your data.

Who's the controller

Only You FZE LLC (see Imprint). For data processed on behalf of business customers, a separate Data Processing Agreement (DPA / AVV) can be signed before onboarding. Request the DPA template →

What we collect

• Conversation content: the messages you send Alfred, and his responses
• Contact metadata: phone number used for WhatsApp routing
• Operational logs: timestamps, error states (no message content), retained 30 days
• If you choose to share: documents, files, structured business data you explicitly hand over to your Alfred-vault

Legal basis

• Performance of the service requested (Art. 6 (1) (b) GDPR)
• Legitimate operational interests, balanced against your rights (Art. 6 (1) (f))
• For non-essential analytics (none currently used): explicit consent (Art. 6 (1) (a))

Where we host

Primary processing: Hetzner Online GmbH, Frankfurt am Main, Germany. Conversational AI models: routed through providers under EU SCC (Standard Contractual Clauses) where extraterritorial transfer occurs. No data is stored in the United States as a primary location. Full sub-processor list available in the DPA.

Retention

• Active conversation history: as long as you hold an account
• After deletion request: 30 days for backup expiry, then permanent purge
• Financial/legal records (invoices, contracts): 10 years per German & UAE commercial law

Your rights

Access, rectification, erasure, restriction, portability, objection, withdrawal of consent — all guaranteed under Art. 15–22 GDPR. Email info@only-you-agency.com with your request; reply within 30 days.

Supervisory authority

For complaints: any EU Data Protection Authority. For German residents: BayLDA Bayern recommended as primary contact.

Cookies & tracking.

What that means in practice

• No consent banner — because there's nothing to consent to
• No Google Analytics, no Facebook Pixel, no LinkedIn Insight Tag
• No A/B-testing scripts, no session replay, no heatmaps
• No third-party CDN that tracks you (fonts load from Google Fonts under their no-cookies API)

What's technically necessary

Your browser caches static files (HTML, images, video) for performance — this is standard browser behaviour, not a cookie. Netlify (our static host) logs the IP making the request in standard server-log format for security and abuse prevention; logs rotate after 30 days and are not used for marketing.

If you ever start tracking

If we ever add analytics, a CMP (consent management platform) will go up first. Until then: this is a clean page.

Data & jurisdiction.

Why the split

Only You FZE LLC is a UAE Free Zone entity for operational and tax reasons. None of that affects where your data lives. We deliberately host on European infrastructure because the people we work with — Family Offices, principals, compliance-bound founders — need EU GDPR as the data-jurisdiction floor.

Who's liable for data

Only You FZE LLC, as data controller, is contractually bound to GDPR-equivalent standards regardless of UAE residency. This is enforced through the Data Processing Agreement (DPA / AVV) we sign with every business customer before onboarding.

If you need a specific assurance

• Data residency clause: EU-only processing & storage, written into the DPA
• Choice of law: German contract law selectable for the MSA
• Right of audit: annual, on request, for tier > €4k/Mo
• Sub-processor list: full disclosure, with 30-day notice on any change

Request the full data-and-jurisdiction package →

EU AI Act compliance.

Classification

Alfred is a general-purpose AI system deployed through a defined business-assistant interface. Under the Act's risk-tiering, it is classified as limited-risk (Title IV, Art. 50): no biometric ID, no social scoring, no critical infrastructure use, no employment-decision automation.

Transparency obligations we meet

• Disclosure of AI nature: users are told they are talking to an AI assistant (Art. 50 (1))
• Output labelling: AI-generated drafts, summaries, and recommendations are marked as such
• No covert manipulation: Alfred does not pretend to be human

Human oversight

Final decisions on contracts, payments, or external communication always require explicit user confirmation. Alfred drafts and suggests; you sign and send.

Training data & foundation models

Alfred's reasoning runs on third-party foundation models (provider list in the DPA). We do not train these models on your conversation content. Your data may be cached in-flight (under EU SCC) but is not used for model training.

If a member-state authority asks

We will cooperate with EU and member-state market-surveillance authorities. Technical documentation per Annex IV of the Act is maintained internally and provided on regulatory request.

Contact.

If you need a copy of the DPA, the sub-processor list, an audit report template, or a specific clause negotiated before signing:

info@only-you-agency.com
+49 151 47055377 (WhatsApp)

Typical reply: same business day. For DPA-stamped responses (signed PDFs), allow up to 3 working days.