Privacy policy

for hellowhiteparrot.com · Last updated: September 2026

The protection of your personal data matters to us. This policy explains which data we process on this website, why we do so and what rights you have. In brief: this site loads fonts, images and scripts from its own server and does not set any cookies of its own accord. Only if you select “Accept all” in the notice at the bottom of the page do we use Google Analytics to measure how our site is used and Google Ads conversion tracking to measure whether our ads lead to enquiries (see 3). Otherwise, a connection to third-party providers is only established if you start an embedded video yourself (see 3a). We process personal data when you write to us via the contact form or subscribe to the newsletter.

1. Controller

Hello White Parrot GmbH
Gerhofstraße 40, 20354 Hamburg
Managing director: Florian Pagel
Phone: +49 40 340 686 20
Email: hello@hellowhiteparrot.com

2. Hosting and server log files

This website is hosted by ALL-INKL.COM - Neue Medien Münnich, Hauptstraße 68, 02742 Friedersdorf. We have concluded a contract with the host for data processing on our behalf pursuant to Art. 28 GDPR. The servers are located in Germany.

When you access the website, the server automatically records information transmitted by your browser: IP address, date and time of access, page accessed, amount of data transferred, browser type and operating system, and the previously visited page (referrer). These data are technically necessary to deliver the website and to ensure its security and stability. The legal basis is our legitimate interest pursuant to Art. 6(1)(f) GDPR. The host deletes the log files after 14 days at the latest. These data are not combined with other data.

3. Cookies, consent, Google Analytics and Google Ads conversion tracking

Principle. Fonts (Montserrat, Open Sans, Literata), images and scripts are stored on our own server and loaded from there. No content is loaded from Google Fonts, content delivery networks or social media platforms. We only use Google Analytics with your consent (see below). Embedded videos are only loaded when you click on them (see 3a).

Google Analytics 4 (only with your consent). To understand which pages are accessed, how often, and where visitors come from, we use Google Analytics 4, a service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google Analytics is only loaded once you select “Accept all” in the notice at the bottom of the page. Before that, no connection to Google is established. After you give your consent, Google sets cookies (_ga and _ga_*, retention period up to 2 years) that allow your browser to be recognised. IP addresses are truncated by Google Analytics 4 and not stored. We have deactivated Google signals and personalised advertising. We only see aggregated statistics (page views, time spent on the site, origin, device type) and no information that would allow us to identify you personally. The data are deleted by Google after 14 months. In this context, data may be transferred to the USA; Google LLC is certified under the EU-US Data Privacy Framework. The legal basis is your consent pursuant to Art. 6(1)(a) GDPR and § 25(1) TDDDG (German Telecommunications Digital Services Data Protection Act). Further information is available at policies.google.com/privacy and support.google.com/analytics.

Google Ads conversion tracking (only with your consent). We run ads on Google Ads (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). To measure whether an ad has led to an enquiry, we use Google Ads conversion tracking. The tracking is only loaded once you select “Accept all” in the notice at the bottom of the page. Before that, no connection to Google is established. After you give your consent, Google sets cookies for this purpose (for example _gcl_au, retention period 90 days) and learns when you have submitted the intro call form after clicking on one of our ads. We only receive aggregated figures (for example: ad X led to Y enquiries) and no information that would allow us to identify you personally. Google may link these data to your Google account if you are logged in to it. In this context, data may be transferred to the USA; Google LLC is certified under the EU-US Data Privacy Framework. The legal basis is your consent pursuant to Art. 6(1)(a) GDPR and § 25(1) TDDDG. Further information is available at policies.google.com/privacy and business.safety.google/adscookies.

Your choice. If you select “Essential only”, everything remains switched off. We store your decision in your browser’s local storage (entry hwp-zustimmung, not a cookie) so that we do not ask you again on every visit; this is technically necessary and does not require consent. You can change or withdraw your consent at any time via the “Cookie settings” link in the footer of every page. The withdrawal applies to the future and deletes the cookies set by Google on this domain.

3a. Embedded videos and LinkedIn links

Videos. The home page and the “Work” page contain embedded videos from YouTube (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, in privacy-enhanced mode via youtube-nocookie.com) and Vimeo (Vimeo.com, Inc., 330 West 34th Street, New York, NY 10001, USA, with the “Do Not Track” setting enabled). The videos are not loaded automatically. Initially, you only see a preview image from our server with a notice that playing the video transfers data to the provider. Only when you click on the preview image is a connection to the provider’s servers established; in the process, your IP address and technical information about your browser are transmitted, and the provider may set its own cookies. The legal basis is the consent you give by clicking (Art. 6(1)(a) GDPR, § 25(1) TDDDG). It applies only to the respective page view; clicking on another video likewise starts that video. In the case of Vimeo, data may be transferred to the USA; Vimeo is certified under the EU-US Data Privacy Framework. For details, please refer to the privacy notices of Google (policies.google.com/privacy) and Vimeo (vimeo.com/privacy).

LinkedIn. Posts link to LinkedIn (LinkedIn Ireland Unlimited Company). Merely displaying our site does not transfer any data to LinkedIn; LinkedIn’s privacy notices only apply once you click on a link.

4. Intro call request (contact form)

If you arrange an intro call via the form, we process the information you provide there: name, email address, optionally company and phone number, the preferred course format and your message. In addition, we store the date and time of the request and your truncated (anonymised) IP address as proof of your consent.

Double opt-in. After submitting the form, you will receive an email with a confirmation link. Your request is only forwarded to us and processed once you click this link. If you do not confirm, your details are automatically deleted after 7 days.

Spam protection. To prevent misuse of our form, your browser solves a small computational task, retrieved from our own server, while you fill it in. No cookies are set and no data are transferred to third parties in the process. To curb mass requests, we count for 24 hours how often requests have been made from an IP address and for an email address. For this purpose, only a checksum generated with a secret key is stored, not the addresses themselves; it is deleted after two days at the latest. The legal basis is our legitimate interest in the secure operation of the website and in protecting third parties from unwanted emails (Art. 6(1)(f) GDPR).

Purpose and legal basis. We process the data in order to answer your request, arrange the intro call and, where applicable, prepare a contract for the course. The legal basis is your consent (Art. 6(1)(a) GDPR) and the implementation of pre-contractual measures (Art. 6(1)(b) GDPR).

Storage period. We store your request for as long as is necessary to process it, but no longer than 12 months after the last contact. If a contract is concluded, the statutory retention periods apply. We retain the confirmation of your consent (time, truncated IP address) as proof for as long as the consent is valid and for up to three years thereafter.

Recipients and email service provider. Your request is sent to our mailbox fp@hellowhiteparrot.com. We send the confirmation email to you and the notification to us via the email service Resend (Resend, Inc., San Francisco, USA) as a processor acting on our behalf pursuant to Art. 28 GDPR. In this process, your email address and the content of the respective email are transmitted. As Resend is based in the USA, data may be transferred to a third country; such transfer is safeguarded by the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR). The form data themselves are stored exclusively on our server in Germany. The data are not disclosed to any other third parties.

5. Newsletter

You can subscribe to our newsletter on our newsletter page or via the additional option in the contact form. For this purpose, we process your email address, your first and last name, optionally your company, as well as the time and truncated IP address of your subscription and confirmation, the page of subscription and the wording of your consent.

Double opt-in. You will receive an email with a confirmation link. We only add your address to the mailing list after you click it. Without confirmation, the address is deleted after 7 days.

Content. At irregular intervals, usually every two weeks, you will receive insights into our AI projects and practical tips on working with AI in companies, as well as occasional information about our courses, talks and the book “Der KI-Knigge”.

The legal basis is your consent pursuant to Art. 6(1)(a) GDPR in conjunction with § 7(2) No. 2 UWG (German Act against Unfair Competition). You can withdraw your consent at any time with effect for the future, via the unsubscribe link in every email or with a short message to hello@hellowhiteparrot.com. After withdrawal, we delete your address from the mailing list; we retain proof of your previous consent for up to three years.

Storage. The subscription data is stored on our server at the host ALL-INKL.COM. After your confirmation, we additionally transfer the details listed above to our subscriber list at Airtable (Formagrid, Inc., San Francisco, USA), which we use as a processor pursuant to Art. 28 GDPR. As Airtable is based in the USA, data is transferred to a third country. Airtable is certified under the EU-US Data Privacy Framework (Art. 45 GDPR); the EU standard contractual clauses also apply. Unconfirmed subscriptions are not transferred to Airtable.

Dispatch. We send confirmation emails via the service Resend mentioned under 4. No external newsletter service provider is currently used. Should this change, we will inform you here.

5a. Self-learning guides (Startklar)

For our click-along guides (currently on nuwacom, Langdock, n8n and Claude), you create a personal account. For this purpose, we process your first name, your email address, your password (only as a hash value) and the time of registration and of your logins. So that you can continue at any time, we store your learning progress: which pages and chapters you have completed, where you were last and how long you spent on the pages. The legal basis is Art. 6(1)(b) GDPR (provision of the guide).

Protection against misuse. An access is personal and may not be passed on. To detect shared accesses, we store your IP address on registration, on login and when your internet address changes, but only in encrypted form as a hash value, together with the time and a shortened browser identifier. These entries are deleted automatically after 90 days. An access can be signed in on at most two devices at the same time. If you sign in on a third device, the oldest session ends. If an access stands out, for example through many different addresses within a short time, we review this personally and may block the access. No automated decision-making within the meaning of Art. 22 GDPR takes place. The legal basis is our legitimate interest in protecting our content against unauthorised use (Art. 6(1)(f) GDPR). To limit failed login attempts, we also use short-lived counters that are deleted after 24 hours at the latest.

Storage, emails and cookie. All data is stored on our server at the host ALL-INKL.COM in Germany. Emails about your access (welcome, password reset) are sent via this server. For signing in, we set a technically necessary session cookie. We delete your account including your progress at any time on request, a short message to hello@hellowhiteparrot.com is all it takes.

5b. Launch offer “100 places”

If you sign up for a free place on hellowhiteparrot.com/en/academy/launch/, we process your first name, last name, email address, your company, the chosen course, your self-assessment of your experience with the tool, your note on what you want to use it for, the time of sign-up and confirmation, your shortened IP address and the wording of the accepted terms of use. The purpose is our review of your request (no automated decision), issuing your personal access code and limiting the offer to 100 places. We create the code with your name, email address and company in the code directory of the chosen guide (see section 5a). The legal basis is Art. 6(1)(b) GDPR (providing the free access) and, for the proof of confirmation, Art. 6(1)(f) GDPR.

The data is stored on our server at the hosting provider ALL-INKL.COM in Germany. We send the emails via the same service as for our forms (see above). Unconfirmed sign-ups are deleted after 7 days. We keep the record of assigned places for as long as your access exists, waiting list entries until the end of the offer or until you object. You only receive the newsletter if you tick the separate, optional box and confirm it (Art. 6(1)(a) GDPR). You can request deletion at any time at hello@hellowhiteparrot.com.

6. Contact by email or phone

If you contact us directly by email or phone, we process your details in order to handle your enquiry (Art. 6(1)(b) and (f) GDPR). We delete the data as soon as they are no longer required for the purpose and no statutory retention obligations prevent deletion.

7. Links to other websites

This site links to, among others, ki-knigge.com, unlocktomorrow.ai, nuwacom.ai and LinkedIn. The privacy policies of the respective sites apply to data processing there. Merely displaying this site does not transfer any data to the linked sites.

8. Your rights

You have the following rights vis-à-vis us with regard to the personal data concerning you:

Access (Art. 15 GDPR)
Rectification (Art. 16 GDPR)
Erasure (Art. 17 GDPR)
Restriction of processing (Art. 18 GDPR)
Data portability (Art. 20 GDPR)
Objection to processing based on legitimate interests (Art. 21 GDPR)
Withdrawal of consent given, with effect for the future (Art. 7(3) GDPR)

To exercise these rights, simply contact hello@hellowhiteparrot.com. You also have the right to lodge a complaint with a data protection supervisory authority. The authority responsible for us is the Hamburg Commissioner for Data Protection and Freedom of Information (Hamburgische Beauftragte für Datenschutz und Informationsfreiheit), Ludwig-Erhard-Straße 22, 20459 Hamburg, datenschutz-hamburg.de.

9. Data security

The website is accessible via HTTPS encryption. Form data are transmitted in encrypted form and stored on the server in a directory that cannot be accessed from outside.

10. Changes

We update this privacy policy when the website or the legal situation changes. The version published here applies in each case.