Privacy Policy

Last updated: 16 September 2026

1. Controller

The controller responsible for data processing on this website is:

WhiteNode Holding GmbH
Volmerswerther Str. 32
40221 Düsseldorf
Germany

Email: info@labelloop.app
Website: labelloop.app

2. General Information on Data Processing

We process personal data only to the extent necessary to provide a functional website and deliver our services. Personal data is only processed with your consent or where legally permitted. We implement appropriate technical and organizational measures to protect your data against unauthorized access, loss, or modification.

3. Data Collected When Visiting This Website

When you visit this website, technical access data is processed to deliver the pages and protect the service. This data may include:

  • IP address
  • Date and time of the request
  • Browser type and version
  • Operating system
  • Referrer URL
  • Pages visited

We process this technical access data to operate the website, prevent abuse and investigate security incidents. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in operating a secure and functional website).

4. Demo Request Form

When you submit a demo request via the contact form on this website, we collect the following data:

  • Name
  • Company name
  • Topics you are interested in (optional)
  • Preferred date and time for a call (optional)
  • Email address
  • Optional: message

We use this data to respond to your inquiry and schedule a product demonstration. Art. 6(1)(b) GDPR applies where you personally request pre-contractual steps towards your own contract. If you contact us on behalf of an organization, processing is based on Art. 6(1)(f) GDPR and our legitimate interest in responding to its business inquiry, subject to your rights.

The demo request service also processes your full IP address to limit repeated requests and prevent abuse. Where a separate rate-limiting service is configured, it also receives this IP address for that purpose. This security processing is based on Art. 6(1)(f) GDPR (legitimate interest in protecting the inquiry service).

We use service providers where needed to operate and protect the demo request service and deliver inquiries, including transactional email. The specific providers and safeguards depend on the active service configuration; contact info@labelloop.app for current details.

5. Cookies and Similar Storage

This website does not use advertising cookies. We may use technically necessary cookies or comparable browser storage to provide a service you request. Optional analytics storage is not used unless you have first given separate informed consent under the applicable terminal-device rules.

6. Website Analytics

We use first-party website analytics only with your separate consent to understand use of this website and the performance of our public campaigns. You can allow, refuse or withdraw it through Analytics settings at the foot of every page. Do Not Track and an analytics opt-out stop collection. No analytics identifier or event is created without a current choice. After consent, we record a pseudonymous browser identifier, page paths without query parameters, same-site referrer paths, device category and size, clicked control labels and internal destinations, and confirmed demo requests without form contents. Only the campaign codes utm_source, utm_medium and utm_campaign are considered; they must not contain personal information. Their attribution is stored only for the current browser tab and cleared on withdrawal. Your choice is valid for up to 180 days and is stored with its version and time in local browser storage. The analytics browser identifier is removed on withdrawal or when an expired or invalid choice is checked. Withdrawing consent stops future collection; it does not automatically erase previously collected events. New analytics events collected under this notice have a retention period of 365 days, followed by regular automatic cleanup. This new cleanup rule does not apply to older records. The legal basis is Art. 6(1)(a) GDPR together with the applicable terminal-device rules. Analytics is optional and does not affect access to the website or submission of an inquiry.

7. Third-Party Services

Fonts: The fonts used on this website are self-hosted and served directly from labelloop.app. Your browser does not connect to Google Fonts or another font provider when loading this website.

Email: Our mailboxes run on Google Workspace. Emails you send us, including attachments, and our replies are stored and processed there. This also applies to demo inquiries and applications that reach our mailboxes. The provider is Google Cloud EMEA Limited, 70 Sir John Rogerson’s Quay, Dublin 2, Ireland. Google processes this data on our behalf as a processor under its Cloud Data Processing Addendum (Art. 28 GDPR). No separate legal basis is needed for this. The legal basis of the respective communication applies, as described in this policy.

Google and its subprocessors may also process this data outside the EU, in particular in the USA. For transfers to the USA, Google relies on the EU-U.S. Data Privacy Framework, under which Google LLC is certified (certification). The European Commission has adopted an adequacy decision for this framework (Art. 45 GDPR). For transfers to other third countries, and if the framework no longer applies, the EU standard contractual clauses apply (Art. 46(2)(c) GDPR, Google’s standard contractual clauses). In exceptional cases, Google may rely on Art. 49(1) GDPR.

8. Labelloop Platform and AI-Assisted Processing

This privacy policy covers this marketing website only. The use of the Labelloop platform (accessible at my.labelloop.app) is governed by the separate platform privacy policy, available at my.labelloop.app/legal/privacy.

Labelloop offers configurable AI-assisted document imports, questions to the analysis assistant (copilot), and message and comment translations through Requesty. When used, document imports process document files, page images or extracted text, related email text and limited business context; the copilot processes business records visible to your role together with your questions; translations process message and comment text. Requesty acts as a gateway to separately selected model providers. Labelloop configures these requests to disable response storage and automatic prompt caching. These settings alone do not guarantee zero retention or exclusion from training. The applicable processing regions, retention and deletion rules, training restrictions and contractual safeguards depend on Requesty, the selected model provider and the active service configuration. Selecting an EU gateway alone does not guarantee that all data processing and storage takes place in the EU. The platform privacy policy describes the relevant data flows and your rights; contact info@labelloop.app for further details.

9. Data Retention

The retention period for demo inquiries depends on the time needed to handle the inquiry and any resulting business relationship. Further retention requires a separate lawful purpose, such as an applicable statutory record-keeping duty or the establishment or defence of legal claims. These criteria also apply to inquiry emails held in our mailboxes and by delivery providers. Closing an inquiry does not itself trigger automatic deletion from those systems. You can exercise your rights using the contact details below.

10. Applications

If you apply to us, for example by email to info@labelloop.app, we process the data you send us. This usually includes your name, contact details, CV, certificates and your message. We use this data to decide on your application and to prepare a possible employment relationship.

The legal basis is Art. 6(1)(b) GDPR (steps prior to entering into a contract at your request). If your application contains special categories of personal data, such as health information or a severe disability, we process them only where this is necessary to exercise rights or meet obligations under employment, social security or social protection law. The legal basis for this is Art. 9(2)(b) GDPR in conjunction with Section 26(3) BDSG. Please send such data only if it matters for your application.

After a rejection, we keep your application for up to six months to establish or defend legal claims, in particular under the German General Equal Treatment Act (AGG). The legal basis is Art. 6(1)(f) GDPR, and Art. 9(2)(f) GDPR for special categories. Our legitimate interest is defending ourselves against such claims. We keep your application for later roles only if you consent in writing or by email under Art. 6(1)(a) GDPR. You can withdraw this consent at any time.

Applications arrive in our shared team inbox and are handled by the people involved in the hiring decision. Our email provider processes emails on our behalf (see section 7). We do not make automated decisions on applications. If we do not hire you, we delete your application no later than six months after we have told you our decision. If we do not reply, we delete it no later than six months after we received it. We keep it longer only if you have consented or if legal proceedings are pending. This also applies to copies in our mailboxes. If we hire you, your data becomes part of your personnel file.

You are not required by law or contract to apply or to send us data. Without the information we need to assess your application, we cannot consider it.

11. Your Rights

Under the GDPR, you have the following rights:

  • Right of access (Art. 15 GDPR): You may request information about the personal data we hold about you.
  • Right to rectification (Art. 16 GDPR): You may request correction of inaccurate data.
  • Right to erasure (Art. 17 GDPR): You may request deletion of your data, subject to legal retention obligations.
  • Right to restriction (Art. 18 GDPR): You may request restriction of processing under certain circumstances.
  • Right to data portability (Art. 20 GDPR): You may request your data in a structured, machine-readable format.
  • Right to object (Art. 21 GDPR): You may object to processing based on our legitimate interest.
  • Right to withdraw consent (Art. 7(3) GDPR): You may withdraw consent at any time with effect for the future, as easily as you gave it.

To exercise any of these rights, contact us at info@labelloop.app.

You also have the right to lodge a complaint with the competent data protection supervisory authority. The authority for North Rhine-Westphalia is:

Landesbeauftragte für Datenschutz und Informationsfreiheit NRW
Postfach 20 04 44
40102 Düsseldorf
www.ldi.nrw.de

12. Changes to This Policy

We reserve the right to update this privacy policy to reflect changes in our data processing practices or legal requirements. The current version is always available at this URL. We recommend checking back periodically.