Last updated: 4 October 2026
The controller within the meaning of the General Data Protection Regulation (GDPR) is:
Scalableloops GmbHRepresented by the managing directors Jeremias Burger and Nikolai Schöbel.
Email: hello@scalableloops.ai · Phone: +49 151 15765566
We are not required to appoint a data protection officer (Art. 37 GDPR, § 38 BDSG): fewer than 20 people at our company are regularly engaged in the automated processing of personal data, and our core activity does not consist of large-scale processing of special categories of data. Please send data protection questions to the address in section 1.
We process personal data only to the extent necessary to operate this website, answer your enquiries and provide the services you request from us. We rely on the following legal bases:
Art. 6(1)(a) GDPR where you have given consent (for example to the newsletter or to Google Analytics). Art. 6(1)(b) GDPR where processing is necessary for a contract or steps prior to it (for example an enquiry). Art. 6(1)(c) GDPR where the law requires processing (for example retention under commercial and tax law). Art. 6(1)(f) GDPR where we have a legitimate interest that is not overridden by your interests (for example the security of this website).
Storing information on your device and accessing it is additionally governed by § 25 of the German Telecommunications Digital Services Data Protection Act (TDDDG), see section 10.
We do not sell personal data and do not use it for automated decision-making or profiling within the meaning of Art. 22 GDPR.
This website is hosted by STRATO GmbH, Otto-Ostrowski-Straße 7, 10249 Berlin, Germany, on servers in Germany. With every request, the server records log files (anonymised IP address, date and time, referrer, browser identifier, requested resource). We need them to detect technical errors and fend off attacks. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in stability and security). The log files are deleted after 7 days.
The data from the contact form, the newsletter and white paper requests (sections 5, 7 and 8) are stored on the same server. We have a data processing agreement with Strato under Art. 28 GDPR.
When you write to us via the form, we process your name, email address, message and the selected topic, and, if you provide them, your company and phone number, as well as the page on which you submitted the form. We use the data to answer your enquiry and follow-up questions.
How you found us. With your enquiry we also transmit the page through which you reached our website (referrer), if your browser provides it, and the landing address including campaign parameters (for example utm values or an ad identifier). Your browser keeps this information locally for up to 30 days (localStorage); it is only sent to us when you submit the form.
Delivery. Your enquiry is sent by email to our mailbox hello@scalableloops.ai (Google Workspace, see section 6) and to schoebel media & marketing GmbH, which maintains the website for us and helps handle enquiries. It acts as our processor under Art. 28 GDPR. So that no enquiry is lost, we also keep a copy on our server at Strato and delete it after 180 days.
Spam protection. We do not use third-party captcha services. Instead, your browser solves a small computational task when you submit. To stop the form being submitted in bulk, we count enquiries per connection. For this we store the IP address only as a checksum (hash), shortened for IPv6, and delete it after 24 hours. The legal basis is Art. 6(1)(f) GDPR.
Legal basis and retention. Art. 6(1)(b) GDPR (steps prior to a contract) and your consent via the checkbox (Art. 6(1)(a) GDPR). You can withdraw your consent at any time. We delete your enquiry once it has been dealt with, unless a statutory retention obligation applies. If the enquiry leads to an order, we keep business correspondence for up to six or ten years under § 257 of the German Commercial Code (HGB) and § 147 of the German Fiscal Code (AO).
When you contact us by email or phone, we process your details to handle your request (Art. 6(1)(b) or (f) GDPR). For email we use Google Workspace by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. We have a data processing agreement with Google. A transfer to the USA is possible; Google LLC is certified under the EU-US Data Privacy Framework (adequacy decision of the European Commission under Art. 45 GDPR). Section 5 applies accordingly to retention.
If you subscribe to our AI newsletter, we process your email address and, if provided, your first name to send it to you. It is published about once a month and contains articles on AI in business, information about training courses and our offers. The legal basis is your consent (Art. 6(1)(a) GDPR).
Double opt-in and proof. After you sign up, we send you an email with a confirmation link. You only receive the newsletter after confirming. We store the time, IP address and browser identifier of the sign-up, the time and IP address of the confirmation, the page on which you signed up and the wording of the consent. This is how we prove your consent (Art. 7(1) GDPR; Art. 6(1)(f) GDPR). If the sign-up is not confirmed within 30 days, the link expires.
Analysis. The newsletter contains an invisible image and links that tell us whether you opened an issue and which links you clicked. This analysis is linked to you personally and helps us improve the newsletter and choose topics that interest you. It is part of your consent. If you do not want this analysis, please unsubscribe.
Sending and storage. The data are stored on our server at Strato (section 4); emails are sent via Strato’s mail server.
Unsubscribing. You can unsubscribe at any time via the link in every issue or by email to hello@scalableloops.ai; this withdraws your consent. After that we no longer send you the newsletter. We keep proof of your earlier consent for up to three years after you unsubscribe in order to defend against claims (Art. 6(1)(f) GDPR) and then delete it.
Our white papers and guides are free of charge. In return, requesting one subscribes you to our newsletter. We state this expressly in the form before you submit. The subscription uses double opt-in as described in section 7; after confirming, you receive a personal download link by email.
We store which document you requested and when you downloaded it. The legal basis is your consent (Art. 6(1)(a) GDPR). If you later unsubscribe from the newsletter, your download link remains valid.
We run an Instagram account. If you comment a keyword we have named under one of our posts, we automatically send you the requested material as a direct message. For this we use the ManyChat service of ManyChat, Inc., West Hollywood, California, USA, as a processor. We process your Instagram username, your comment, your messages with us and whether you follow our account.
The legal basis is Art. 6(1)(b) GDPR, because you request the material with your comment. ManyChat is certified under the EU-US Data Privacy Framework; the transfer to the USA is based on the European Commission’s adequacy decision (Art. 45 GDPR). We delete the data at ManyChat as soon as they are no longer needed to answer your request and no retention obligation applies.
Meta Platforms Ireland Limited, Merrion Road, Dublin 4, Ireland, is additionally responsible for processing on Instagram itself. Its privacy policy applies.
We store your choice in the cookie banner in your browser’s local storage (LocalStorage) so that we do not ask you again on every visit. Under § 25(2) no. 2 TDDDG this does not require consent, because it is strictly necessary for the service you have requested.
If you consent to the “Analytics” category in the cookie banner, we use Google Analytics 4, a web analytics service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Without your consent, Google Analytics is not loaded. The legal basis is your consent under § 25(1) TDDDG in conjunction with Art. 6(1)(a) GDPR.
Google Analytics helps us understand which pages are visited and how visitors use the website so that we can improve our content. For this, Google Analytics sets the cookies “_ga” and “_ga_<ID>” with a lifetime of two years. It records, among other things, pages viewed, time on page, approximate location, browser and device type. According to Google, IP addresses are not logged or stored in Google Analytics 4. We have disabled Google Signals and advertising features. Event data are deleted after two months.
A transfer to the USA is possible; Google LLC is certified under the EU-US Data Privacy Framework (adequacy decision of the European Commission of 10 July 2023). We have a data processing agreement with Google. You can withdraw your consent at any time via the “Cookie settings” link in the footer; the analytics cookies are then deleted.
All fonts are hosted on our own server. Visiting the website does not create a connection to Google Fonts or any other font provider.
We link to our profiles on LinkedIn, Instagram and YouTube and to WhatsApp with plain links only. No data are transferred to these providers when you visit our website. Only when you click such a link do you leave our website; the privacy policy of the respective provider then applies.
You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). You can withdraw consent you have given at any time with effect for the future (Art. 7(3) GDPR). An informal message to the address in section 1 is sufficient.
Right to object (Art. 21 GDPR). Where we process data on the basis of Art. 6(1)(f) GDPR, you may object at any time on grounds relating to your particular situation. We will then no longer process the data unless we can demonstrate compelling legitimate grounds that override your interests, or the processing serves the establishment, exercise or defence of legal claims. You may object to processing for direct marketing at any time without giving reasons.
You may lodge a complaint with a data protection supervisory authority if you believe that the processing of your personal data infringes the GDPR (Art. 77 GDPR). The authority responsible for us is:
Bayerisches Landesamt für Datenschutzaufsicht (BayLDA)You are under no statutory or contractual obligation to provide personal data. Without the required fields in the contact form, however, we cannot process your enquiry, and without an email address we cannot send you the newsletter or a white paper.
We update this privacy policy when our processing or the legal situation changes. The version published here applies. In case of doubt, the German version prevails.