Privacy policy

Last updated: 6 October 2026

1. Controller

The controller responsible for processing personal data on getteddy.ai within the meaning of the EU General Data Protection Regulation (GDPR) is:

We have not appointed a data protection officer, as we are not currently required to do so under Art. 37 GDPR and § 38 BDSG. For all data protection matters, please contact privacy@getteddy.ai.

2. Overview

This policy explains which personal data we process when you visit getteddy.ai, fill in one of our forms, subscribe to product updates, apply as a partner, panel member or employee, or use the Teddy platform as a customer. Personal data is any information relating to an identified or identifiable person, such as your name, email address or IP address.

We process personal data on the following legal bases: your consent (Art. 6(1)(a) GDPR), the performance of a contract or steps before entering into one (Art. 6(1)(b) GDPR), legal obligations (Art. 6(1)(c) GDPR) and our legitimate interests (Art. 6(1)(f) GDPR). For each processing activity below, we name the legal basis.

3. Visiting the website

Hosting and server logs

Our website is hosted by Webflow, Inc., 398 11th Street, San Francisco, CA 94103, USA. When you visit the website, the hosting provider automatically processes technical data that your browser sends: IP address, date and time of the request, the page requested, referrer URL, browser type and operating system. This is necessary to deliver the website, keep it secure and detect misuse.

Legal basis: our legitimate interest in a secure and functioning website (Art. 6(1)(f) GDPR). We have concluded a data processing agreement with Webflow. Server logs are deleted after a short period unless they are needed to investigate a security incident.

Content delivery and fonts

Images, fonts and scripts on this website are delivered through the content delivery network of our hosting provider, so that pages load quickly. The same technical data as above is processed for this purpose. All fonts are hosted on our own website infrastructure. We do not load fonts from Google Fonts or other third-party font services.

4. Cookies and consent

We use the consent management platform of Usercentrics GmbH, Sendlinger Str. 7, 80331 Munich, Germany, to obtain and store your consent for cookies and similar technologies. Usercentrics processes your consent decision, a consent ID, the date and time of the decision, your browser information and an anonymised IP address.

Strictly necessary cookies and technologies are used without consent because the website cannot work properly without them (§ 25(2) TDDDG, Art. 6(1)(f) GDPR). All other cookies and technologies are only used if you agree (§ 25(1) TDDDG, Art. 6(1)(a) GDPR). You can change or withdraw your consent at any time through the privacy settings on this website. Withdrawing consent does not affect the lawfulness of processing before the withdrawal.

The services that are currently active, their purposes and storage periods are listed in the privacy settings of the consent banner.

5. Forms on this website

How our forms work

The forms on this website are provided by HubSpot, a customer relationship management system of HubSpot Ireland Ltd., One Sir John Rogerson's Quay, Dublin 2, Ireland, part of HubSpot, Inc., USA. When you open a page with a form, the form is loaded from HubSpot's servers in the EU, which means your IP address and browser information are transmitted to HubSpot. When you submit a form, your entries are stored in our HubSpot account together with the page you sent it from and the time of submission. HubSpot processes the data on our behalf under a data processing agreement. See section 13 for international transfers.

We only accept business email addresses, so the form may reject addresses from free email providers.

Contact and demo requests

When you use our contact form or book a demo, we process your first and last name, work email address, phone number if given, and your message. We use this data to answer your request and, if you ask for a demo, to prepare and hold it.

Antler portfolio offer

When you request the Antler portfolio offer, we process your first and last name, work email address and your message, for example the name of your startup and your Antler cohort. We use this data to check your eligibility and to send you the offer.

CISO Panel applications

When you apply to join the Teddy CISO Panel, we process your first and last name, work email address and any further details you provide. We use this data to review your application, to arrange an introductory call and, if you join, to invite you to panel sessions and webinars.

Partner applications

When you apply to our partner program, we process the details you submit, such as your first and last name, work email address, website, partner type, number of clients, the frameworks you work with and your message. We use them to assess your application and to contact you about a possible partnership.

Legal basis for all forms: steps prior to entering into a contract (Art. 6(1)(b) GDPR) where your request relates to our services, a partnership or panel membership, otherwise our legitimate interest in answering enquiries (Art. 6(1)(f) GDPR).

6. Spam protection (Google reCAPTCHA)

To protect our forms against spam and automated abuse, we use reCAPTCHA, a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. reCAPTCHA checks whether a form is filled in by a human or by an automated program. For this purpose, it analyses information such as your IP address, browser and device information, the time spent on the page and your interaction with it, and may set cookies. This data is transmitted to Google and may be processed by Google LLC in the USA.

Legal basis: our legitimate interest in protecting our website and forms against abuse and spam (Art. 6(1)(f) GDPR). For more information, see Google's privacy policy and terms of service.

7. Product update emails

If you tick the box “Send me occasional product updates” in one of our forms, we send you occasional emails about new features, guides and events from Teddy. We only process your name and email address for this purpose and store your consent with the date, time and the text you agreed to.

We send these emails with HubSpot. To improve our emails, we measure whether an email was opened and which links were clicked. You can unsubscribe at any time using the link in every email or by writing to privacy@getteddy.ai.

Legal basis: your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time with effect for the future.

8. Website optimisation (Webflow Optimize)

With your consent, we use Webflow Optimize, a service of Webflow, Inc., to test different versions of our pages and to improve their content. For this purpose, a pseudonymous identifier is stored in your browser and information about the pages you view and your interactions with them is processed. We do not use this information to identify you personally.

Legal basis: your consent (§ 25(1) TDDDG, Art. 6(1)(a) GDPR), which you can withdraw at any time through the privacy settings on this website.

9. Job applications

If you apply for a position by email to jobs@getteddy.ai, we process the data contained in your application, such as your CV, cover letter, certificates and contact details, to run the application process.

Legal basis: steps prior to entering into an employment contract (Art. 6(1)(b) GDPR). If we do not hire you, we delete your application six months after the end of the process, unless you have agreed that we keep it longer for future positions (Art. 6(1)(a) GDPR).

10. Email communication

If you write to us by email, we process your email address, the content of your message and any attachments to answer you. Legal basis: Art. 6(1)(b) or (f) GDPR, depending on the subject of your message.

Our email and office communication runs on Google Workspace, provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google processes the data on our behalf under a data processing agreement. See section 13 for international transfers.

11. Customers and the Teddy platform

When your company uses the Teddy platform, we process the data your company provides or connects to the platform on your company's behalf, as a processor under Art. 28 GDPR. The details, including subprocessors and technical and organisational measures, are set out in our data processing agreement, which we provide on request.

For the customer relationship itself, such as contract management, billing and support, we act as controller. Legal basis: performance of the contract (Art. 6(1)(b) GDPR) and legal retention obligations (Art. 6(1)(c) GDPR).

Teddy does not use customer data to train AI models.

12. Recipients and processors

We share personal data only where this is necessary for the purposes described above. For this website and our communication, we use the following service providers:

Webflow, Usercentrics, HubSpot and Google Workspace process data on our behalf under data processing agreements. Subprocessors of the Teddy platform are listed in our data processing agreement, available on request. We may also disclose data to public authorities where we are legally required to do so. We never sell personal data.

13. International transfers

Some of our service providers are located in, or may access data from, the United States. Where this is the case, we transfer data on the basis of the European Commission's adequacy decision for the EU-U.S. Data Privacy Framework (Art. 45 GDPR), if the provider is certified, and otherwise on the basis of the European Commission's standard contractual clauses (Art. 46(2)(c) GDPR). You can request a copy of the safeguards from us.

14. Retention

We keep personal data only as long as it is needed for the purpose it was collected for. Enquiries and applications are deleted when they have been fully dealt with and there is no ongoing business relationship, usually after two years at the latest. If you have subscribed to product updates, we keep your name and email address until you unsubscribe, and keep a record of your consent and withdrawal as long as we need to prove it. Where statutory retention periods apply, for example under the German Commercial Code (HGB) or Fiscal Code (AO), we keep the relevant data for six or ten years and restrict its processing in the meantime.

15. Your rights

You have the following rights regarding your personal data:

• Access to your data (Art. 15 GDPR)
• Rectification of inaccurate data (Art. 16 GDPR)
• Erasure (Art. 17 GDPR)
• Restriction of processing (Art. 18 GDPR)
• Data portability (Art. 20 GDPR)
• Withdrawal of consent at any time, with effect for the future (Art. 7(3) GDPR)

To exercise your rights, write to privacy@getteddy.ai or to our postal address above. You also have the right to lodge a complaint with a supervisory authority. The authority responsible for us is the Berlin Commissioner for Data Protection and Freedom of Information (Berliner Beauftragte für Datenschutz und Informationsfreiheit), Alt-Moabit 59–61, 10555 Berlin, Germany.

We do not use automated decision-making, including profiling, that produces legal effects concerning you or similarly significantly affects you (Art. 22 GDPR).

16. Security

This website is served exclusively over encrypted connections (TLS). We use technical and organisational measures to protect personal data against loss, misuse and unauthorised access, and review them regularly. More information is available on our security page.

17. Changes to this policy

We update this policy when our services or the law change. The current version is always available on this page, with the date of the last update at the top.