Skip to content
Log in Try for free
TR DE EN

Privacy Policy

Updated: 19 October 2026

This Privacy Policy explains which personal data is processed when you use the CXR App platform and the associated website, for what purposes and on what legal basis this is done, to whom data is disclosed, and what rights you have. It also contains the information required under Art. 13 and 14 of the General Data Protection Regulation (GDPR).

CXR App is offered and operated by Visual Memory Works GmbH (“VMW”). VMW is your contact for sales, billing, payment processing and support.

This notice applies to everyone who visits the website, creates an account, uses the services, makes contact, or processes content or data through the platform. If users upload data of their own customers to the platform, their obligations under the applicable legal provisions remain unaffected.

The following also apply: the GDPR / DSGVO Data Protection Notice, the Contact and Support Privacy Notice, the Cookie Policy and Preference Management, Data Processing and Infrastructure Policy, Data Retention, Deletion and Anonymization Policy, Security and Infrastructure Policy, and Third-Party Services, Data Processors and Sub-processors.

CONTROLLER

The controller within the meaning of Art. 4(7) GDPR for the processing operations described in this policy (account, billing, support, contact forms, security logs, website and cookies) is:

Visual Memory Works GmbH
Elbestraße 10, 45768 Marl, Germany
Managing Director: Ilker Secaat KARA
Local Court (Amtsgericht) Gelsenkirchen, HRB 18062
Telephone: +49 2365 5033557 · Fax: +49 2365 5033550 · Mobile: +49 172 5333358 · WhatsApp: +49 172 5333358
E-mail: info@visualmemoryworks.de

Contact person for data protection requests: Prof. Ergün Kalaycı, e-mail: erguen.kalayci@visualmemoryworks.de. He receives data protection requests for Visual Memory Works GmbH. This role does not involve a formal appointment as a data protection officer within the meaning of Art. 37 GDPR.

ROLES IN DATA PROCESSING

VMW is the controller for data relating to your account, billing, support, contact requests and the security of the platform.

If businesses, as customers, upload content to their apps (for example customer photos, guest and visitor data, orders or inquiries), those businesses are the controllers for the processing; they are also the contractual partners of their own end customers. In this case, VMW acts as a technical service provider and processor under Art. 28 GDPR on the basis of a data processing agreement and processes the data only on the instructions of the business concerned. If you are a data subject in this situation, please contact the business concerned first.

DATA COLLECTED

The following types of data may be collected when you use the platform:

  • Identity and contact data (first and last name, e-mail address, telephone number, etc.)
  • Account and subscription data
  • Invoice and payment data
  • Usage and transaction data
  • Technical data (IP address, browser information, device information, session logs, etc.)
  • Information from contact forms and support requests

Users can enter data of their own customers into the system through the platform. In this case, they are responsible for ensuring that this data is collected lawfully.

PURPOSES AND LEGAL BASES OF PROCESSING

Personal data is processed for the following purposes and on the following legal bases:

  • Account creation and account management, provision of subscriptions and services, and handling of user requests, insofar as they serve the performance of a contract or pre-contractual measures: Art. 6(1)(b) GDPR
  • Payment processing and invoicing: Art. 6(1)(b) GDPR; retention of invoice records: Art. 6(1)(c) GDPR (legal obligation)
  • Technical support: Art. 6(1)(b) GDPR, otherwise Art. 6(1)(f) GDPR
  • Ensuring the security of the platform and developing and improving the services: Art. 6(1)(f) GDPR (legitimate interests of VMW)
  • Compliance with legal obligations: Art. 6(1)(c) GDPR
  • Processing that requires consent: Art. 6(1)(a) GDPR

Where processing is based on legitimate interests, we have weighed these against your interests, fundamental rights and freedoms. You may object to the processing on grounds relating to your particular situation (see the section “YOUR RIGHTS”).

PROVISION OF DATA

Certain information is required to create an account, to conclude and perform the contract, and to handle requests. Without this information, we cannot conclude or perform the contract or handle your request. Where information is voluntary, this is indicated when you enter it.

CONTACT FORMS AND SUPPORT REQUESTS

If you contact us through a contact or support form, by e-mail, by telephone or via WhatsApp, we process the information you provide (for example your name, contact details and the content of your message) in order to handle and answer your request. For details, see the Contact and Support Privacy Notice.

The legal basis is Art. 6(1)(b) GDPR if your request relates to an existing contract or to pre-contractual measures. In all other cases, the legal basis is Art. 6(1)(f) GDPR (legitimate interest in properly answering requests). Consent is not required for this, and neither a newsletter nor marketing is offered through these forms.

COOKIES AND SIMILAR TECHNOLOGIES

Section 25 TDDDG applies to accessing information in your terminal equipment and to storing information on it. We use non-essential cookies and comparable technologies only with your consent under Section 25(1) TDDDG. Technically necessary access that is strictly required for us to provide a digital service that you have expressly requested is based on Section 25(2) No. 2 TDDDG. The subsequent processing of personal data is governed by the GDPR. For details and your options for adjusting settings, see the Cookie Policy and Preference Management. You can withdraw any consent you have given at any time with effect for the future.

USE OF AUTOMATED SYSTEMS AND AI

Some services of the platform may be provided using automated systems or AI-supported technologies. These systems may be used to make content suggestions, analyze texts or data, simplify business processes, or improve the user experience.

Results of such systems may be generated automatically and are not subject to human review in every case. Users should check results before using them and accept technical errors and limitations that may result from the nature of automated processing. For more information, see the notices on the Use of Artificial Intelligence and Data Processing Notice.

Decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you (Art. 22 GDPR) will be explained separately if they take place.

DISCLOSURE OF DATA

Where necessary to provide the services, personal data may be disclosed to the following recipients or categories of recipients:

  • Hosting and infrastructure providers (Hetzner, Germany, once the planned migration is completed; web server of the information website in Turkey)
  • Payment service providers (Stripe)
  • E-mail and communication service providers
  • Providers of AI functions (OpenAI, Anthropic and Google)
  • Competent public authorities, where there is a legal obligation

We disclose data to service providers only to the extent necessary for hosting, payment processing, communication or AI functions and only if these services are actually used. Disclosure to other third parties takes place only if we are legally obliged to do so or you have consented.

The role of service providers under data protection law depends on the processing concerned. Hosting, e-mail and comparable infrastructure providers generally act as processors on behalf of and on the instructions of VMW (Art. 28 GDPR). Providers of AI functions may, depending on the service and configuration, be processors or, for their own purposes, independent controllers. Payment service providers such as Stripe process payment data partly on behalf of their business customers and partly as independent controllers for their own purposes, for example for fraud prevention or to comply with their own legal obligations; the providers describe the details in their privacy notices (for Stripe: Stripe Privacy Center). Transfers to countries outside the EU/EEA take place only if the requirements of Art. 44 et seq. GDPR are met.

To process payments for the CXR subscription and, where applicable, the setup, we process information such as transaction ID, amount, currency, payment and refund status, and invoice data. Full card numbers and comparable payment instrument data are intended to be collected directly by the payment service provider and not stored on VMW’s systems. The role of the payment service provider under data protection law is not the same for every transaction.

The information website cxr.app is operated on a web server in Turkey. When the website is accessed, the technically necessary access data transmitted by your browser (for example IP address, date and time, page accessed) is processed there.

The CXR App applications (Linke, Catalog, Menux, Eventix, Momento and Selecto) are to be migrated to Hetzner infrastructure in Germany for the European service; this migration is planned and not completed. The target infrastructure is to consist of three servers in Germany and a separate backup or cloud environment with a takeover arrangement (failover). Until the migration is completed, processing may take place on the existing infrastructure; we will update this text once it is completed.

E-mail hosting for the mailbox info@visualmemoryworks.de is in Germany. The website and the applications are separate systems with their own data flows; the hosting location cannot be inferred from the language of a page.

TRANSFERS TO THIRD COUNTRIES

Personal data is transferred to a country outside the European Union and the European Economic Area (third country) only if the requirements of Art. 44 et seq. GDPR are met, that is, where there is an adequacy decision of the European Commission, with appropriate safeguards such as standard contractual clauses, or in the exceptional cases of Art. 49 GDPR.

Because there is no adequacy decision of the European Commission under Art. 45 GDPR for Turkey, the processing of access data on the web server in Turkey is governed by Art. 46 or Art. 49 GDPR. On request, we will tell you which safeguard applies to this transfer.

Services of OpenAI, Anthropic and Google may be used for AI functions. Contractual partners, processing locations and transfer bases depend on the service actually used and the contractual terms of the respective provider. The fact that the applications are to be operated on servers in Germany does not mean that all AI processing takes place in Germany; it may also take place outside Germany and outside the EU or EEA. Any such transfer takes place only under the conditions of Art. 44 et seq. GDPR.

Payment processing via Stripe and the integration of further service providers are subject to the same requirements. For more information, see the document “International Data Transfers”.

RETENTION PERIOD

We store personal data only for as long as necessary for the stated purposes or as long as statutory retention obligations apply. After that, the data is deleted or anonymized. In detail:

  • Account and customer content: These are stored as long as the account is active. If the account is terminated, access is closed and deletion is carried out without delay. Account and customer content are removed from the active systems and from the associated backups within 30 days at the latest. When restoring from a backup, data that has already been deleted must not be made usable again.
  • AI chat history: Where necessary, the history of a conversation is stored for a maximum of six months from the last interaction in that conversation. After that, it is deleted or actually anonymized. Justified requests for earlier deletion are examined separately.
  • Invoices and accounting records: These are stored for the duration of the applicable statutory retention obligations. Statutory obligations and specific legal disputes are each handled with their own required periods; they do not justify retaining all account content.
  • Support correspondence and technical logs: These are stored for as long as necessary for processing, traceability and security; after that, they are deleted or anonymized. No fixed period applies to them. The support targets of 24 and 48 hours are response targets and not retention periods.

For further information, see the document “Data Retention, Deletion and Anonymization Policy”.

CHAT HISTORY OF THE AI FUNCTIONS

Chat history is distinguished for three purposes: (1) to provide and continue the service (for example so that a conversation stays in context), (2) for error analysis and quality improvement, and (3) for training AI models.

On (2): Where VMW uses chat content for error analysis and quality improvement, this is not done across the board or without limit for all conversations, but only for this specific purpose, to the extent necessary for it, and on the basis of Art. 6(1)(f) GDPR. In doing so, we first examine whether the objective can also be achieved with anonymized or non-personal data; where this is possible, data is actually anonymized. Our interests are weighed against your interests, fundamental rights and freedoms. You may object to this processing under Art. 21 GDPR on grounds relating to your particular situation.

On (3): We do not use personal chat content to train AI models. If such use should be considered in the future, we will inform you separately in advance and ensure the required legal basis. Whether providers of AI functions use inputs for their own purposes under their own terms depends on the service used and the configuration; the providers describe the details in their privacy notices.

DATA SECURITY

Technical and organizational security measures are implemented to protect personal data against unauthorized access, loss or misuse. Nevertheless, absolute security cannot be guaranteed for data transmissions over the internet. For more information, see the document “Security and Infrastructure Policy”.

YOUR RIGHTS

Under the GDPR, you have the following rights, provided the respective statutory requirements are met:

  • Access to your personal data (Art. 15 GDPR)
  • Rectification of inaccurate or incomplete data (Art. 16 GDPR)
  • Erasure (Art. 17 GDPR)
  • Restriction of processing (Art. 18 GDPR)
  • Data portability (Art. 20 GDPR)
  • Objection to processing based on legitimate interests (Art. 21 GDPR); in the case of direct marketing, you can object at any time without giving reasons
  • Withdrawal of consent you have given, with effect for the future (Art. 7(3) GDPR); the lawfulness of processing carried out until the withdrawal remains unaffected

You can send your requests through the contact channels stated on the platform, in particular, for data protection requests, to erguen.kalayci@visualmemoryworks.de (contact person: Prof. Ergün Kalaycı). For further information on requests, see the document “Personal Data Requests — Access, Correction, Export and Deletion”.

RIGHT TO LODGE A COMPLAINT WITH THE SUPERVISORY AUTHORITY

Without prejudice to other remedies, you have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR) if you believe that the processing of your personal data violates the GDPR. The supervisory authority responsible for VMW is:

Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW)
Postfach 20 04 44, 40102 Düsseldorf
Telephone: +49 211 38424-0
E-mail: poststelle@ldi.nrw.de
Internet: www.ldi.nrw.de

CHANGES

This Privacy Policy may be updated in the event of changes in the law or changes to the services. The current text as published applies from the time of its publication on the platform.

DATA COLLECTION AND CONTACT

Data is collected electronically through the channels of registration, use, payment and support and, where necessary, through written communication with us. Account and service data is processed to establish and perform the contract, invoice records on the basis of a legal obligation, and security and legal inquiries on the basis of the respective applicable legal bases. For processing that requires consent, consent is obtained separately. For processing based on legitimate interests, care is taken to ensure that your fundamental rights and freedoms are not impaired.

Contact: Visual Memory Works GmbH, Elbestraße 10, 45768 Marl, Germany · General inquiries and sales: hello@cxr.app · Support: support@cxr.app · Data protection requests (EN/DE): erguen.kalayci@visualmemoryworks.de (contact person: Prof. Ergün Kalaycı) · Legal and company inquiries: info@visualmemoryworks.de · Telephone +49 2365 5033557 · Fax +49 2365 5033550 · Mobile/WhatsApp +49 172 5333358.