Privacy policy

The controller under the GDPR is AcousticIndex GbR, Strelitzer Straße 19, 10115 Berlin, Germany. Contact: leo@acousticindex.com.

This privacy policy explains how personal data is processed on the Acoustic Index platform. The platform provides a database for acoustic materials and products.

We process personal data on the following GDPR bases:

• Art. 6(1)(a) — consent, for example when using Google OAuth.
• Art. 6(1)(b) — contract performance for platform and account features.
• Art. 6(1)(f) — legitimate interests such as security and error analysis.

The platform is hosted by Vercel Inc. Database and authentication services are provided by Supabase Inc. Transfers to the United States are protected through EU Standard Contractual Clauses where required.

Transactional emails, such as account and API-access notifications, are sent through Plus Five Five, Inc. (Resend). For this purpose, the recipient address, name and email content are transmitted to Resend. The legal basis is performance of the contract or steps requested before entering into a contract (Art. 6(1)(b) GDPR).

When you visit the site, server logs may include IP address, timestamp, URL, browser and operating-system information and referrer URL. These logs are required to provide the website and are deleted after no more than 30 days.

When you create an account, we store your email address, authentication data and registration timestamp. Manufacturer accounts may also store company, product and measurement data, which can be publicly displayed where this matches the purpose of the platform.

If you contact us, we store the information you submit so we can process and respond to the request.

If you send a product inquiry via the inquiry button on a product page, we forward your details (type of request, name, company, email address, optional phone number and message, and the product concerned) to the respective manufacturer. The manufacturer answers the inquiry on its own responsibility and is an independent controller for any further processing. We keep a copy of the inquiry to trace delivery and handling. Legal basis: Art. 6(1)(b) GDPR (pre-contractual steps at your request).

The platform uses technically necessary cookies only, for authentication and session management. No tracking, marketing or analytics cookies are set, so no separate consent is required (Section 25(2) TDDDG).

If you sign in with Google, Google may provide your name, email address and profile image URL after your approval. Data may be processed by Vercel, Supabase, Resend and Google where those services are used. Product inquiries are forwarded to the manufacturer you selected.

Personal data is deleted when it is no longer required for the processing purpose. Account data is removed when the account is deleted, unless legal retention duties apply. Product inquiries are deleted 24 months after receipt.

You have GDPR rights to access, rectification, erasure, restriction, portability, objection and withdrawal of consent. To exercise these rights, contact leo@acousticindex.com. You may also lodge a complaint with a data protection authority.

Acoustic Index operates an MCP server (Model Context Protocol) at https://acousticindex.com/api/mcp/v1. It lets you use Acoustic Index as an app in ChatGPT (OpenAI) and as a connector in Claude (Anthropic). In Claude, connecting requires signing in with your Acoustic Index account via OAuth 2.1; in ChatGPT only saving and sharing do (see below). The authorization server is our Supabase project; requested scopes are email and profile. Legal basis: contract performance and your consent on the dedicated consent page (Art. 6(1)(a) and 6(1)(b) GDPR).

The app searches the product catalog and creates rooms in the reverberation calculator. Rooms you create or change through the app are stored under your account exactly like rooms saved in the calculator (project, room name, use, dimensions, surfaces, furnishing, selected products, calculated reverberation times). They are private to you, appear under /konto/gespeichert and can be deleted there at any time.

In ChatGPT, rooms can be calculated, products searched and target values looked up through this server without connecting an account. Without an account we receive with each call a pseudonymous identifier that OpenAI assigns for this app (no name, no email address) and the language setting. Rooms the app calculates without saving are stored as drafts under this identifier (room name, use, dimensions, surfaces, furnishing, selected products, calculated reverberation times) so that you can keep planning them in the chat and open them in the calculator through their link; anyone with the link can view the room. Drafts are deleted 24 months after their last change. Only when you save or share a room, open your saved rooms or ask for measured values per octave band does ChatGPT connect your account as described above. Legal basis: Art. 6(1)(b) and 6(1)(f) GDPR (providing the function you call).

For each tool call we log: timestamp, internal user id (without an account, ChatGPT’s pseudonymous identifier), the identifier of the connected assistant (OAuth client), the tool name, the values the assistant passes to the tool (such as a search term, room dimensions or product ids), a summary of the result (such as the number of matches, the products shown or the room id), and error code and duration. We use this to operate the app, find errors and improve the service (Art. 6(1)(b) and 6(1)(f) GDPR). Retention: 24 months. We do not receive your conversation with the assistant, only what the assistant passes to the tools.

Links from the app carry the parameter utm_source (chatgpt or claude) so that we can recognize visits from the app in our statistics.

Each approve / deny decision on the consent page is written to an OAuth consent audit log (user id, OAuth client, scopes, decision, IP address, user agent) for traceability under GDPR Art. 7(1).

OpenAI (ChatGPT) and Anthropic (Claude) are separately responsible for processing your prompts as operators of the assistants; their privacy policies apply in parallel. You can disconnect the app at any time in your ChatGPT or Claude settings.

For approved partners we operate a programming interface at acousticindex.com/api/v1. To approve access we process the details of the request (name, account e-mail address, organisation, website, description of the use case, expected volume) to perform the contract (GDPR Art. 6(1)(b)).

For each request we log the time, API key, installation identifier, endpoint, status code, records returned, search terms, response time and the IP address hashed with a secret key. We do this to operate the interface, enforce request limits and verify compliance with the API Terms, based on our legitimate interest (GDPR Art. 6(1)(f)). We delete the logs after 24 months unless they are needed to clarify a specific suspected breach. Please do not send personal data in search terms.