Privacy notice
This is a translation provided for convenience. The binding version is the German one at underwritable.ai/datenschutz.
1. Controller
The controller within the meaning of the GDPR is:
underwritable GmbH, Birketweg 37, 80639 Munich, Germany, represented by its managing director Joel Krenke.
Email: contact@underwritable.ai
We are not required by law to appoint a data protection officer and have not appointed one. For any privacy question, write to the address above.
2. Principles
We process personal data only within the limits of the law (GDPR, BDSG). What follows sets out the nature, scope and purpose of the processing on this website, and your rights.
3. Serving the website and server logs
Opening this website processes the data technically required to deliver it securely and reliably. That can include your IP address, the date and time of the request, the page requested, the referring page, and browser and device information. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is the secure, stable and functioning delivery of the website. The data is kept only as long as those purposes require and is deleted afterwards.
4. Hosting
This website runs on Microsoft Azure (Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland). Processing takes place in the German data centre region (Germany West Central, Frankfurt am Main). Microsoft processes the data named above on our behalf as a processor under Art. 28 GDPR, on the basis of the Microsoft Data Protection Addendum. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is the secure and stable operation of the website.
5. TLS encryption
This website uses TLS encryption. You can recognise an encrypted connection by the “https” in your browser’s address bar.
6. Contacting us
When you contact us through the form or by email, we process what you tell us (for example first name, last name, business email address, phone number, company and role, and the content of your enquiry) in order to deal with it. Submitting the form transmits your entries to our server and stores them in our database, which runs in the same German data centre region as this website. To keep automated submissions out, we also store the time of submission and your IP address solely as a cryptographic hash, which cannot be turned back into the original address. The legal basis is Art. 6(1)(b) GDPR for pre-contractual and contractual communication, or Art. 6(1)(f) GDPR for handling general business enquiries and protecting against abuse. We keep the data until your enquiry is settled and no statutory retention period stands in the way.
7. Fonts and third-party content
Every font, image and script on this website is served from our own server. Nothing is loaded from third-party servers; in particular, Google Fonts is not embedded. Opening this website therefore establishes no connection to a third party and transmits no IP address to one.
8. Cookies and analytics
We currently use no analytics, marketing or tracking cookies. Technically necessary cookies may be required to operate the site. The only cookie we currently set is the one that remembers your chosen language when you use the language switch. Should non-essential cookies or comparable technologies be used in future, that will happen only after your explicit consent (§ 25(1) TDDDG, Art. 6(1)(a) GDPR), which you can withdraw at any time with effect for the future.
9. Recipients
The recipient, or category of recipient, is our hosting provider (as a processor, see section 4). Beyond that we disclose data only where the law obliges us to or where you have consented.
10. Retention
We process personal data only as long as the respective purpose requires or statutory retention periods apply. After that, the data is deleted.
11. Your rights
You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection (Art. 21). Consent once given can be withdrawn at any time with effect for the future (Art. 7(3) GDPR).
12. Right to object
Where we process personal data on the basis of Art. 6(1)(f) GDPR, you may object at any time on grounds relating to your particular situation (Art. 21 GDPR).
13. Right to lodge a complaint
You have the right to lodge a complaint with a data protection supervisory authority. The authority responsible for us is the Bayerisches Landesamt für Datenschutzaufsicht (BayLDA), Promenade 18, 91522 Ansbach, Germany (lda.bayern.de). You may also contact the authority where you habitually reside.
14. No automated decision-making
Automated decision-making, including profiling, within the meaning of Art. 22 GDPR does not take place.
15. Changes to this notice
We update this notice whenever the actual processing, the services we use, or the legal requirements change.
16. Confidentiality of engagement and deal information
What you tell us in the course of an engagement, in particular the target company, your investment thesis and your hypotheses, we treat as confidential and use solely to produce the analysis you commissioned. To produce it we rely on service providers, in particular providers of language models and research services, bound as processors under Art. 28 GDPR. Your input is not used to train language models. The research itself draws on publicly accessible sources; for an outside-in analysis we do not approach the target company, its customers or its competitors, so commissioning us sends no signal to the market.
Last updated: September 2026