Privacy Policy

The data controller is Celonis B.V., Beethovenstraat 505, 1083 HK Amsterdam, Netherlands. You can reach our privacy team at [email protected].

• Account data: name, email, workspace name, billing address, VAT number.
• Order data: credit purchases, invoices, applied promo codes, payment method (bank transfer reference).
• Product data: chatbot configurations, prompts, connected integrations, message logs generated when you use the product.
• Technical data: IP address, browser, device, timestamps, referrer, product interaction events.
• Support data: messages you send to us via email, forms, or chat.

• Providing the service and fulfilling your order — performance of a contract (Art. 6(1)(b) GDPR).
• Invoicing, tax and accounting — legal obligation (Art. 6(1)(c)).
• Security, fraud prevention, service improvement — legitimate interests (Art. 6(1)(f)).
• Product analytics and marketing cookies — consent (Art. 6(1)(a)), which you can withdraw at any time.

We share data only with vetted sub-processors that help us run Celonis (hosting, email delivery, error monitoring, analytics, and payment processing). All sub-processors are bound by a Data Processing Agreement (DPA) and, when applicable, EU Standard Contractual Clauses.

Your data is primarily hosted in the European Economic Area. Where a sub-processor is located outside the EEA, transfers rely on Standard Contractual Clauses and supplementary safeguards.

• Account and product data — for as long as your workspace exists, then deleted within 90 days after termination.
• Invoices and tax records — 7 years, as required by Dutch law.
• Support tickets and marketing data — up to 24 months from last interaction.

You have the right to access, rectify, erase, restrict, port, and object to processing of your personal data, and to withdraw consent at any time. To exercise these rights, email [email protected]. You may also lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).

We use TLS in transit, encryption at rest, least-privilege access, audit logs, and regular backups. No system is 100% secure, but we work continuously to protect your data.

We may update this policy. Material changes will be announced by email or in-product notice at least 30 days before they take effect.