1. Who we are (data controller)
HoloChart is offered by AVAA Marketing Ltd, Alexander Ratter, Polykarpou Smyrnis 6, 4044 Germasogeia, Cyprus — a privacy-first browser extension that visualizes LLM answers locally. Contact: info@avaa.agency, +49 30 2096 5233. German version: Datenschutzerklärung.
2. What we process — and where
When you use a supported LLM website (ChatGPT, Claude.ai, Gemini, Mistral, Perplexity, DeepSeek, Grok, Copilot, Poe, HuggingFace, Qwen/Tongyi, Kimi, Baidu Ernie, Google AI Studio, Meta AI, local Ollama/Open WebUI, and others), the extension reads the visible answer text in your browser to detect tables, JSON, and comparisons and render a chart. This processing is:
- Local only — it happens in the page, on your machine.
- Rule-based — no second LLM, no AI inference, no external service.
- Not transmitted — there are zero network calls containing your content. This is enforced by an automated build-time "no-egress" gate.
3. What we store
- Local preferences (e.g. language, tier) in your browser's
storage.local. Never uploaded. - Local usage counters (e.g. how often a chart was offered) in
storage.local, shown only to you in the popup. We never receive them. - License key (paid plans only), stored encrypted at rest in your browser.
4. The only network requests
For Nautilus / Team plans, the extension contacts our license server (api.holochart.app) to
validate your key and entitlement. This request contains the license key and plan identifier —
never your prompts, answers, or any content. Legal basis: Art. 6(1)(b) GDPR (performance of
contract). Payments are processed by Paddle.com Market Ltd. (UK) as Merchant of Record; we
never receive your card details. The transfer to the UK is covered by the EU–UK adequacy decision.
5. Sub-processors
- Paddle.com Market Ltd. (UK) — payment processing and invoicing as Merchant of Record.
- Webgo GmbH (Germany, EU) — web and license server hosting. A data processing agreement under Art. 28 GDPR is in place.
- Google Ireland Ltd. (Ireland, EU) — website analytics via Google Analytics 4, used only with your consent (Art. 6(1)(a) GDPR). Data transfers to third countries are covered by EU Standard Contractual Clauses. Privacy policy: policies.google.com/privacy.
6. Retention
License data (key, plan, activation date) is retained for as long as the license is active, and thereafter for the statutory bookkeeping retention period (typically 7 years), after which it is deleted. Local browser data (preferences, counters) stays on your device and is fully removed when you uninstall the extension.
7. Website Analytics (Google Analytics)
This website uses Google Analytics 4, a web analytics service by Google Ireland Ltd. (Gordon House, Barrow Street, Dublin 4, Ireland). The service is activated only with your explicit consent (opt-in cookie banner, Art. 6(1)(a) GDPR).
Google Analytics uses cookies to analyse how you use the site (pages visited, time on site,
approximate location). IP anonymisation is enabled. No user profile is linked to personal identifiers,
and no remarketing takes place. Before you consent, no Google script is loaded and no contact is made
with Google servers. With your consent, GA4 sets the cookies _ga (distinguishing unique
visitors, 2 years) and _ga_FGXSCKQ2FH (session state, 2 years).
Legal basis: Art. 6(1)(a) GDPR (consent). Withdrawal: you can withdraw your consent at any
time via the “Cookie settings” link in the footer of every page — the banner will reappear and
you can choose “Decline”; existing GA cookies are removed. Alternatively, clear the
hc_cookie_consent key from your browser's localStorage.
More information: policies.google.com/privacy · GA opt-out add-on.
7a. Launch waitlist
If you join the launch waitlist (on this website), we process your e-mail address for the sole purpose of notifying you about the launch and delivering the announced founder offer. The address is stored on our own server (hosted by Webgo GmbH, Germany, EU); a one-off confirmation e-mail is sent via the e-mail delivery service Resend (Resend, Inc., USA — transfer covered by EU Standard Contractual Clauses) or our own mail server. Legal basis: Art. 6(1)(b) GDPR (steps prior to entering into a contract, at your request). The address is deleted after the launch notification has been sent, or earlier if you unsubscribe — simply reply with “unsubscribe” or e-mail info@avaa.agency. No newsletter, no marketing list.
8. What we do NOT do
- No analytics or telemetry in the extension. The extension never sends usage data.
- No fingerprinting, no advertising, no selling or sharing of data.
- No tracking in the share watermark — it is static text and a logo, with no pixel, ID, or callback.
- Website analytics (Google Analytics) only after your explicit opt-in consent — see section 7.
9. Your rights (GDPR)
You have the right of access, rectification, erasure, restriction, portability, and objection (Arts. 15–22 GDPR). Because we hold very little server-side data, requests typically concern the license record for paid plans. Contact: info@avaa.agency.
You also have the right to lodge a complaint with a supervisory authority. As a Cyprus-incorporated company, our lead supervisory authority is the Commissioner for Personal Data Protection, 1 Iasonos Street, 1082 Nicosia, Cyprus (www.dataprotection.gov.cy). You may also contact the supervisory authority in your country of residence.
10. EU AI Act
HoloChart is a rule-based visualizer of third-party model output. It does not perform inference or generate content, and is not a provider of an AI system under Regulation (EU) 2024/1689.
11. Changes
If this policy changes materially, we'll update the date at the top and note it in the extension's release notes.