Privacy Policy

We act in two different legal roles, and it matters which one applies to you:

1. You visit this website. We are the controller. Section 2 applies.
2. You use the Stonewake dashboard as a member of a customer bank. We are the controller for your account and usage data. Section 3 applies.
3. A public register publishes data about you (for example a commercial register entry naming you as a managing director) and our software mirrors that register. We are the controller for this processing. Section 4 summarizes it; the full transparency notice is the Public Records Notice.
4. A bank instructs research about you (for example an adverse-media screening as part of its statutory customer due diligence, or following you in its news and social media monitoring). The bank is the controller; we process on its documented instruction as a processor under Art. 28 GDPR. Section 5 explains what that means for you.
5. We write to you about Stonewake. We contact you in your professional capacity at your work address about our services, based on public professional data. We are the controller. Section 6 applies.

Hosting and server logs. This website is delivered by a specialised hosting provider over a global content delivery network; its server functions run in the provider's Frankfurt region, except the request routing step, which runs in the delivery network, and that network can answer a request from any of its regions (Section 8). When you open a page, the hosting infrastructure processes the technical data any web request carries: IP address, requested URL, timestamp, browser and device information (user agent), and the referring page. We use these server logs to deliver the site, keep it secure, and diagnose faults. Legal basis: Art. 6(1)(f) GDPR (our legitimate interest in operating a secure, functioning website). Log data is kept for the short rotation window of the hosting provider, at most three days, and is not merged with any other data.

No cookies, no tracking. The marketing website sets no cookies, uses no analytics, no tracking pixels, and no third-party advertising or social-media embeds.

Demo requests. If you submit the demo form, we process the data you enter (name, work email, institution, optional message) solely to respond to your request. The submission is delivered to our mailbox by a transactional email delivery provider operating in the United States (Section 8). We keep demo requests as ordinary business correspondence and delete them on request at any time. Legal basis: Art. 6(1)(b) GDPR (steps prior to entering into a contract, taken at your request) and Art. 6(1)(f) GDPR (our interest in answering inquiries). The form is protected by a rate limit that briefly holds request counts per IP address in memory; nothing about this is stored durably.

Email contact. If you email us, we process your address and message to handle the correspondence, on the same legal bases as demo requests.

If your bank is a customer of Stonewake and gives you access, we process:

• Account data: name, work email address, your role in the workspace (for example analyst or administrator), your bank (tenant) and team assignment, and authentication events. Authentication is operated through a managed authentication service hosted in the United Kingdom (Section 8); sign-in links can be sent by email. Legal basis: Art. 6(1)(b) GDPR (performance of the usage relationship) in conjunction with the contract with your bank.
• Strictly necessary session information stored in your browser. The dashboard stores sign-in session information in your browser (first-party cookies set by the sign-in client; the dashboard sends your session token to our API with each request) whose only purpose is to keep you signed in, and a small set of interface preferences (for example that you have completed the product tour). Both serve only the service you requested; no consent is needed for them (Section 25(2) TDDDG). The dashboard sets no tracking cookies and contains no analytics.
• Audit records. The product keeps an append-only audit ledger of material actions: who started a screening, who confirmed or dismissed a verdict, who exported a report, with timestamps and prior states. This ledger exists so that the work banks do in Stonewake is reviewable by them and by their auditors, and so that security incidents can be investigated. Legal basis: Art. 6(1)(f) GDPR (auditability and security of a tool used for regulated work) and, where applicable, Art. 6(1)(c) GDPR.
• Support communications: whatever you send us when something breaks, used to fix it.
• Monthly feedback. Where your bank has switched on the monthly feedback form, you are asked once a month to answer five questions in the dashboard. Answering is voluntary. We process your answers, the month, your user identifier and your work email address to measure the use of Stonewake against the success measures agreed with your bank, to write the monthly report to your bank and to improve the product. Each answer goes by email to the people your bank names as its feedback recipients, who are named users of your bank's workspace and are shown on the form. Please name no other person in your answers, only companies. The legal basis is Art. 6(1)(f) GDPR, our interest and your bank's interest in evaluating Stonewake as agreed with your bank and in improving the product. We are the controller for this processing, which is not processing on your bank's instruction.

We do not profile dashboard users, we run no usage analytics on individuals, and we never use product data for advertising.

Stonewake maintains a database of facts published by official company registers and gazettes: companies, their officers and beneficial owners, insolvency publications, entity identifiers. Where a register publishes data about a natural person acting in a business capacity (directors, authorized representatives, beneficial owners, sole traders), our software stores what the register publishes, with a citation to the register entry for every fact.

For this processing we are the controller, on the legal basis of Art. 6(1)(f) GDPR. The complete transparency notice under Art. 14 GDPR, including every named source, the retention clocks, the objection mechanism, and our no-scoring commitment, is published permanently at /public-records-notice. The short version:

• We process only what registers themselves publish, in professional capacity.
• Every fact carries a citation. We add nothing, we infer nothing, and we never compute a score, rating, or ranking of any person's creditworthiness, reliability or risk.
• Statutory deletion clocks of the source registers are enforced in code.
• We also hold the official sanctions lists the notice names and compare the persons the registers name with the persons on those lists; each result is a review candidate for a bank's analyst, never a match by itself.
• Customer banks receive this data, where it is switched on for their workspace, for know your customer, sanctions and credit due diligence, in the dashboard, the company reports, our API and our MCP server. The API sandbox and our public pages show no person.
• Objections go to contact@stonewake.ai and are answered within one month.

When a bank uses Stonewake to run a screening or assemble a research dossier on a named subject, including a natural person in a professional capacity as part of the bank's anti-money-laundering due diligence, or to follow a natural person in news and social media monitoring, the bank determines the purpose and is the controller under Art. 4(7) GDPR. We process on the bank's documented instruction under a data processing agreement per Art. 28 GDPR concluded with each customer bank.

Within that role: screenings run only on the bank's instruction, each with a recorded due-diligence purpose; results are isolated per customer bank; findings are quotes from cited public sources, and no score, rating, ranking, or probability value of a person's creditworthiness, reliability or risk exists anywhere in the product, and where a bank follows a person, the tone of the news and posts that name the person is shown to that bank as context, never as a score of the person and never for a sole trader; a screening can be erased on demand, and where a retention horizon is agreed with the bank, an automated purge enforces it.

If your data was processed in a bank-instructed screening, the bank is your first point of contact for GDPR rights; its own privacy notices govern. If you contact us instead, we will forward your request to the responsible bank and help resolve it within the processor role.

Stonewake is built for banks, development banks, export credit agencies, wealth managers, asset managers, family offices and advisory firms, in Germany and in other countries, among them Switzerland. To reach contacts there, we keep a small outreach list and write to these people at their work addresses about our services. We are the controller for this processing (Section 13 has our details). This section is the transparency notice under Art. 14 GDPR for that list; the first message you receive from us refers to it.

What we hold. Name, role or job title, organization, business contact details (work email address, office address), the URL of a public professional profile, and the public evidence for the role, for example a register entry, a conference program, or a trade-press article naming you in that role. We hold no private contact details, no special categories of data, and nothing about you outside your professional function.

Where it comes from. Public company registers, public lists of supervisory authorities (for example BaFin and FINMA), company websites, professional networks such as LinkedIn, press and trade media, conference materials, and B2B data providers.

Purpose and legal basis. The sole purpose is to contact you, in your professional capacity, about Stonewake's services. Legal basis: Art. 6(1)(f) GDPR (our legitimate interest in direct marketing to professionals, an interest recital 47 GDPR recognizes). The balancing is short. We hold only data with a business context, we approach you strictly in your professional role about a product built for your industry, and the volume of our outreach is low.

Recipients. This data is received by our hosting provider in the European Union, a language model provider established in Ireland, a code hosting provider operating in the United States (Section 8), an email delivery provider operating in the United States (Section 8), an email address verification provider established in the European Union, and a letter printing and postal delivery provider in Switzerland (Switzerland holds an adequacy decision of the European Commission). Letters are delivered by a postal service provider in the recipient's country, in Germany or in Switzerland. Section 7 describes these categories.

Retention. We keep outreach records until you object or until the outreach purpose ends, whichever comes first. After an objection we delete the record and keep only a minimal suppression entry (name, plus organization or email address) for as long as we run outreach at all, because honoring your objection permanently requires remembering not to contact you again.

Your rights, and how to object. Art. 21(2) GDPR gives you an unconditional right to object to direct marketing at any time. An objection needs no reason and takes immediate, permanent effect: we stop contacting you, and your data is never again processed for outreach. Reply to any message we send, or write to contact@stonewake.ai. You also have the rights of access, rectification, and erasure, and the right to lodge a complaint with a supervisory authority; Section 10 explains them and names the authority responsible for us.

People in Switzerland. If we write to you in Switzerland, the Swiss Federal Act on Data Protection (FADP) applies beside the GDPR, and this section is also the information under Art. 19 FADP. The controller is Stonewake in Germany, with the details in Section 13. We process your name, your role, your institution and its business address, as your institution publishes them itself, and your institution's entry in the public lists of the Swiss Financial Market Supervisory Authority FINMA. The sole purpose is a letter to you in your professional capacity. This information is generally accessible because your institution publishes it, and you have not prohibited its processing. Where you made it accessible yourself, Art. 30(3) FADP applies. In every case we rely on our overriding private interest in business contact with professionals (Art. 31(1) FADP). The data is processed in Germany and disclosed to the recipients named above, in Finland, Hungary, Ireland and the United States and, for printing and posting the letter, in Switzerland. For the United States the safeguards in Section 8 apply. You may object to the processing at any time and without giving a reason. We then stop writing to you and delete the record except for the suppression entry (Art. 30(2)(b) FADP). You may ask for access (Art. 25 FADP) and for rectification or erasure (Art. 32 FADP) with a message to contact@stonewake.ai. You may also turn to the Federal Data Protection and Information Commissioner (FDPIC), www.edoeb.admin.ch.

No automated decision-making. Outreach involves no decision within the meaning of Art. 22 GDPR (see Section 11). A person decides whom to contact.

We share personal data only with service providers in the categories listed here and with customer banks in the ways described above. We never sell personal data.

• Hosting and database infrastructure. The database, the API, the audit trail and the MCP server run on a dedicated server of a German provider in Helsinki, Finland. The web pages of the dashboard, the documentation and the website are delivered by Vercel, a US company, over its global delivery network, which also runs the request routing step of the website. All other server functions of the three run in its Frankfurt region. Sign-in runs through a managed service in London. The delivery network can answer a request from any of its regions, so the technical request data of Section 2 can be processed outside the European Union, under the safeguards described in Section 8.
• Email and postal delivery providers. Used for transactional email (demo requests) and for the outreach messages described in Section 6; the outreach delivery providers are described there. Processing takes place in the United States (EU standard contractual clauses and, where available, EU-US Data Privacy Framework certification, Section 8) and in Switzerland (EU adequacy decision). Letters within Germany are delivered by a postal service provider in Germany, letters to Switzerland by a postal service provider in Switzerland.
• Feedback mail. The monthly feedback answers of Section 3 are delivered to the recipients your bank names by a transactional email provider in Paris, France, which also delivers alert emails to the named users of customer banks. Processing takes place in the European Union.
• Email address verification. For the outreach described in Section 6, a provider established in the European Union checks before sending whether a work email address can receive mail.
• Business email and correspondence. Our mailbox, through which inquiries, data-subject requests, and notices to customer banks travel, is operated by a business email and productivity suite provider whose processing takes place in the United States under its EU-US Data Privacy Framework certification (Section 8).
• AI inference providers. Language-model and embedding APIs used for extraction, verification, and drafting over public web text. Processing may occur outside the EEA; Section 8 describes these transfers and the applicable safeguards.
• Web search and data providers. Search and data-access APIs used by the research engine to query and fetch public web content, primarily in the United States, under the safeguards described in Section 8.
• Observability. Our observability tooling stores prompts and model outputs only on our own infrastructure in the European Union.
• Source code hosting. Our source code and related project files are held by a code hosting provider operating in the United States (Section 8).

What actually reaches the AI and search providers: page text fetched from public web sources, search queries, and research prompts. For a bank-instructed person screening or person research, the subject's name necessarily appears in the search queries and the fetched text.

Product data at rest (the database, files, audit records) stays in the provider regions named above: Finland (European Union) and the United Kingdom. Transfers to the United Kingdom rest on the European Commission's adequacy decision for the UK (reviewed and renewed 2025), valid to 27 December 2031. Where a provider processes data in the United States, we rely on the provider's EU-US Data Privacy Framework certification where the provider is certified, and on the EU standard contractual clauses where the provider has incorporated them. Search queries naming individuals are routed only to providers with recognised transfer safeguards. Four providers in our search ensemble have no such safeguard in place with us (one of them wired but not yet enabled) and receive company and entity queries only; such a query can incidentally contain a personal name, for example where a business trades under its owner's name. Transfers to Israel (our provider for retrieving public pages and for search results on queries naming individuals) rest on the European Commission's adequacy decision for Israel.

Some of our service providers process data outside the European Economic Area. This includes our language-model provider, which stores prompts in the United States and may process them in other countries, on the basis of the EU standard contractual clauses that its data processing terms incorporate. Where that provider cannot be used, a fallback provider processes prompts in a country for which the European Commission has not issued an adequacy decision. The prompts consist of public web content, research queries and, where a bank instructs a screening, the name of the subject and the findings being summarised. We do not use customer data to train models. For the workspaces that a bank's order form places on our EU route, language-model and embedding processing takes place only in the European Union.

You have the rights of Art. 15 to 21 GDPR: access, rectification, erasure, restriction, data portability, and objection. Where processing rests on legitimate interest, Art. 21 GDPR gives you the right to object on grounds relating to your particular situation; for the public-records lane, the Public Records Notice describes exactly how we handle objections and how quickly (within one month). For people in Switzerland the rights under the Swiss FADP apply as well, and Section 6 lists them.

Requests go to contact@stonewake.ai. We answer within one month (Art. 12(3) GDPR). You also have the right to lodge a complaint with a data protection supervisory authority, in particular in the member state of your residence or workplace. The authority responsible for us is the Landesbeauftragte für den Datenschutz und für das Recht auf Akteneinsicht Brandenburg (LDA Brandenburg), Stahnsdorfer Damm 77, 14532 Kleinmachnow, lda.brandenburg.de.

We make no decisions producing legal or similarly significant effects on any person by solely automated means (Art. 22 GDPR). The product computes no score, rating, ranking, or probability value of any natural person's creditworthiness, reliability or risk. The tone of the news and posts about a person a bank watches is context shown to that bank, never a score of the person, and is never computed for a sole trader. The product's outputs are drafts that a human analyst must review. Banks are contractually prohibited from using Stonewake output as the sole basis for automated decisions about natural persons.

We update this policy when our processing of personal data changes. The version and effective date at the top tell you what you are reading, and changes for the public-records lane are reflected in the Public Records Notice as well.

Stonewake, Inhaber: Luca Diaz Hilterscheid, Märkische Heide 5, 14532 Kleinmachnow, Deutschland.
General and privacy contact: contact@stonewake.ai.