Version: September 26, 2026
Company data, email and AI
These notices include the attachments Service providers and processing locations, technical protective measures as well as Retention and deletion. They will be documented together with this version upon confirmation.
1. Responsibility for operational content
Your company decides which customer, employee, supplier and communication data is processed in Klarvexo, for what purposes and with what access rights. It must have a suitable legal basis for this and inform the people affected. Confirmation of this information does not replace this information or any consent that may be required from the data subjects.
Where Klarvexo processes personal company data on your behalf, a data processing agreement under Article 28 GDPR is required before processing those data in production. The specific service providers, subprocessors, processing locations, safeguards and deletion rules must match the actual service in use. You can obtain the current contractual and service-provider information from info@sc-v.de. These instructions do not conclude any AVV.
2. Mailboxes and messages
A connected work mailbox can transfer sender and recipient addresses, names, subjects, message bodies, HTML content, times, folders, processing status and attachments to Klarvexo. Access data or connection keys are required for the connection to be set up. Only set up mailboxes that you are authorized to process and use, and limit access to those responsible.
When replying or forwarding, the selected recipients receive the sent content and attachments via the email provider set up. Check To, Cc, Bcc, reply history and attachments before sending. When retrieved, external mail images can also trigger a response to the image provider via a server proxy.
3. From the email to the project record
Information from messages can be copied into or linked to projects, customer contacts, tasks, appointments, notes, documents, and draft quotes and invoices. This creates independent operational data sets. The storage can become visible to other authorized people. Check attribution, content, and approval before accepting or sharing data.
Removing an email does not automatically delete an already saved project task, document copy or receipt. Retention, deletion and rights must therefore also be taken into account in the downstream areas.
4. AI, OCR and automation
For activated and set up AI/OCR functions, the required message texts, contact details, project information, file names, document contents or images can be transferred to the configured processing service. The existing AI connection uses the OpenAI API. What processing actually takes place depends on the tariff, permissions, configuration and triggered flow. Document analyzes can start automatically after a takeover; not every analysis requires another click.
This acknowledgement does not activate an AI integration or permit unrestricted disclosure. Before use, check the applicable data processing agreement (AVV), recipients, retention periods and possible transfers to third countries. Exclusive processing in Germany or the EU is not guaranteed here. If data are processed outside the EEA, the requirements of Articles 44 et seq. GDPR must be met.
Submit only necessary content. Particularly sensitive information, such as health data, copies of ID cards or confidential employee data, does not belong in email or AI processes without special checking. AI suggestions can be wrong. Check them before taking them over, shipping them or releasing them; a suggestion does not replace a professional decision.
5. Collaboration and external sharing
Projects, tasks, comments, chat messages, time bookings and editing histories are assigned to the company accounts and users involved. Roles and permissions determine the accessible scope. Customer portals, document links, partner shares, and enabled external integrations can further make content accessible to select recipients. Check their scope and validity and revoke releases that are no longer required.
6. Files, Mobile Devices and Backups
In addition to visible content, uploaded files and attachments may also contain metadata and personal information. The additional ones apply to cameras, scanners, push notifications and local offline data Notes on the iOS and Android app. Use protected devices and personal user accounts.
Operational and legal retention obligations may conflict with the immediate deletion of documents or histories. Backup copies follow the agreed backup and deletion concept; A deletion in the interface is not a promise of immediate removal from any backup. Clarify the deadlines for your deployment before transferring productive data.
7. Evidence and contact person
When a request is made and activated for the first time, we save the confirmed version, the associated document and confirmation texts, the server-side time as well as the assignment to the request and, when activated, to the company and administrator. An unconfirmed request is not proof that the specified person actually has access to the email address. Email confirmation and activation are separate steps.
For questions and data protection rights, please contact info@sc-v.de. For data that your company processes as the controller, its responsible data protection office is also the contact person. Further information on the person responsible and rights can be found in the Privacy Policy.