How we protect your data

In short

• Before an AI model sees your question, the software ShinrAI replaces the personal details that it detects with placeholders. Examples are names and phone numbers.
• ShinrAI runs on servers that we operate ourselves.
• The cloud models of the application run at Microsoft (Azure OpenAI Service) in the Azure region Germany West Central. Our own model “Qwen 3.6” runs on servers of Innovius UG.
• Only “Qwen” on our own servers answers a question with a note about an emergency.
• Our server does not store conversations. Only your browser stores your conversations.
• The application writes no conversation content and no IP addresses into its logs.
• Our reverse proxy at the edge of the network logs each connection with the IP address and the time. We delete these logs after 31 days at the latest.

No software detects every personal detail. So give only the details that your question needs.

The path of your question

The label above each step shows on whose systems it runs.

1. Your device

   Your browser sends the question

   You write your question. Your browser sends it to our server through an encrypted connection. It also sends the conversation so far, in the version with placeholders. If you gave a place or a postcode, your browser sends this detail too.

   Your browser reads photos of letters itself. The photo stays on your device. Only the text that you send goes to our server.

2. Servers of Innovius UG

   Our server checks the question

   Our server first checks your question in its memory. If it detects signs of an emergency, the application shows help lines and emergency numbers at once. Our server does not send the part of your message with these signs to the AI model. At most, the model gets your actual question. Only our own AI model “Qwen” on servers of Innovius UG then answers this question. So a request with a note about an emergency goes to no external provider. If the question belongs to the emergency, for example “Where can I get help tonight?”, “Qwen” also gets a note that it is about a personal crisis, with its coarse kind, for example violence. It does not get your sentences about it.

   If the server detects details that data protection law protects in a special way, it replaces them with a general placeholder, for example “[health information 1]”. This applies, for example, to details about health, religion, ethnic origin or sexual identity. Some of these terms stay readable because the answer needs them, for example a pregnancy.

3. Servers of Innovius UG

   ShinrAI replaces personal details

   Then our server gives the text to ShinrAI. ShinrAI is software of Innovius UG. It runs on servers that we operate ourselves. ShinrAI replaces the personal details that it detects with placeholders. Examples are names, street and house number, phone numbers, email addresses, bank account numbers and other identification numbers.

   The placeholders look like real details, for example like a different name. The same detail gets the same placeholder in the whole conversation. This step is called pseudonymisation.

   Place, postcode, company names, dates and ages stay readable. This lets the application find the responsible office and your deadlines. ShinrAI is built so that it does not store the texts. If ShinrAI cannot check the text, your question goes to no AI model.

4. Microsoft (Azure) or Innovius UG

   An AI model writes the answer

   Only then does our server send the text to an AI model. The model gets the text with the placeholders and the place that you gave. It gets neither your IP address nor an identifier for you.

   The request goes through the LLM gateway of Innovius UG. The gateway asks for the EU route for each request. The cloud models of the application run at Microsoft (Azure OpenAI Service) in the Azure region Germany West Central, in the EU data zone. The contracting entity is Microsoft Ireland Operations Ltd.

   You choose the model in the application. The default is “Auto” with “GPT-6 Luna”. At Microsoft, you can also choose “GPT-5.6 Luna” and “GPT-5.4 mini”. Our own model “Qwen 3.6” runs on servers of Innovius UG. The public application offers no other models.

5. Public sources

   Public sources supply current facts

   For a lot of information, our server first uses its own copies of public data. For these it queries no source. The section “What we store” lists these copies.

   Otherwise our server queries public sources, for example administration portals, legal databases and open directories. The sources get the details that the search needs, usually a search term and the place. If you ask about a specific address, for example for a journey search, a source can also get this address.

   Some queries contain less. For the meeting dates of a municipal council, our server loads lists from the council information system of the town. The request contains only the address of the list and a period of time. Our server itself looks for the committee and the topic of your question in the lists. For figures about a municipality, the portal Wegweiser Kommune of the Bertelsmann Stiftung gets the name or the official code of the municipality. For 94 towns and districts, these figures are already on our server. For a search on the website of a town, no source gets your search words, because the search runs in our own copy.

   The sources see the IP address of our server, not yours. Before the AI model reads the answers of the sources, our server replaces your personal details in them with the placeholders again.

6. Your device

   Your browser shows the answer

   The answer of the AI model still contains the placeholders. Your browser puts your real details back in and shows the answer.

   Only your browser stores which placeholder stands for which detail. Your browser sends this list with each question to our server. Our server uses it only for the current answer and does not store it.

What we store

On our servers

• No conversations, no profile and no list of placeholders. Our server processes your question only in its memory, while it writes the answer.
• The server keeps answers of public sources in its memory for at most 24 hours, together with the request to the source. So it does not have to query the same source again for each question. Requests with your own details, for example an address for a journey search, it keeps for at most 15 minutes.
• The server stores only public data permanently. The list follows below.
• To protect itself against overload, the server counts the requests per sender address. It deletes the counter per minute 10 minutes after the last request. For the counters per day it stores only a check value computed from the address, not the address, and deletes them at midnight. These counters are only in memory and contain no content.

Public data on our servers

Programs on our servers load public data at fixed times. They process no questions of users.

• Every night: descriptions of public services and details of public offices from the Portalverbund Online-Gateway (PVOG) of the German federal and state governments. These include the public contact channels of the offices, for example the phone number and the opening hours. The program does not take lists of staff, names and contact details of contact persons, or names of editors. It deletes entries that it has not renewed for 14 days.
• Every week: texts of laws, details of decisions of the Federal Social Court and the Federal Administrative Court, and the technical instructions (Fachliche Weisungen) of the Federal Employment Agency. Of a decision, the program stores details such as the court, the date and the file number, the official headnote and the link, not the full text.
• Every month: pages and news of the websites of towns. The program follows robots.txt and reservations against text and data mining. If a website refuses the access, the program skips the town. It does not take pages with a login, pages with forms for your own input, or pages about private persons, for example death notices or congratulations. It removes email addresses from the texts. On each run it replaces the pages of a town with the new state. The application no longer shows pages that the town has not confirmed for 70 days.
• Every week: a check whether the official forms have changed. The program stores only checksums and check results.
• Built into the application: figures of Wegweiser Kommune for 94 towns and districts, and short key facts about common public services, for example deadlines and fees. Each key fact names the legal provision and the day on which we read the text of the provision.

Official forms

Our server loads an empty official form from the website of the public office and passes it on to your browser. It loads only forms from its own list and keeps them for up to 24 hours. The public office sees the IP address of our server, not yours. Your browser enters your details into the form on your device. For this, your browser does not send these details to our server.

In your browser

Your browser stores on your device:

• your conversations, in your version and in the version with placeholders,
• the list of placeholders and your real details,
• your profile for forms, if you create one,
• your cases under “My cases”: saved plans and services with the place, steps, dates and documents,
• reminders of deadlines, ticked items of checklists and your settings.

You set how long your browser keeps conversations: one day, 7, 30 or 90 days, or until you delete them. The default is: until you delete them. This period applies to conversations only. Cases, reminders and ticked items stay until you delete them. You can delete single conversations or all conversations in the application at any time. To delete all data, use the settings of your browser.

Anybody who can use your browser can read these data. You can encrypt your profile with a passphrase. On a shared device, set a short storage time or use a private window.

What we log

At the edge of our network

The encrypted connection ends at a reverse proxy at the edge of our network. Innovius UG operates it itself. To defend against attacks, it logs each connection with the IP address and the time. The entry contains neither the requested page nor any content. These logs stay on our own systems, and we delete them after 31 days at the latest.

Behind the reverse proxy, the data travel only between our own systems. The internal router there keeps no access logs.

This website

Our web server writes one entry for each request to this website, without the IP address: time, domain, request method, path without parameters, status code and amount of data. Details are in the privacy policy.

On buergerpilot.de, buergerpilot.at, buergerpilot.ch and civcnct.com, our web server passes some requests on to the application. These are requests to the MCP server (/mcp), to the interface (/api) and to the files with which AI assistants find the application. It logs these requests in the same format too, without the IP address and without parameters. It passes your IP address on to the application. The application uses it to protect itself against overload.

The application

The application keeps no access log. Its technical logs contain operating data, for example the time, country and language, the AI model used, the name and the duration of a tool, types of errors and counts. Such a count is, for example, how many details ShinrAI replaced. For tools about health, care, counselling, legal aid and debt, a general note replaces the name.

Whether a protection function found something, for example an emergency, is not logged for any single question. For this the application writes totals only, at the earliest after 10 minutes and five questions.

The logs are set up so that they contain no text of your questions and answers, no search terms and no IP addresses. They stay on our own servers. We do not send them to a logging service. The server overwrites them on a rolling basis when they reach a fixed size. There is no fixed retention period yet.

The backups of our servers also contain these logs. We keep the backups for about four weeks.

The programs that load public data log counts, names of towns and types of errors. They process no questions of users.

At Microsoft

Microsoft checks requests to the Azure OpenAI Service automatically for abuse. For this, Microsoft can store the requests for up to 30 days. This does not apply if Microsoft has granted an exemption for our access. The requests contain the text with the placeholders of ShinrAI, and neither your IP address nor an identifier for you.

Limits of the protection

• ShinrAI does not detect every personal detail. Detection also depends on the language. In some languages, ShinrAI detects only fixed patterns such as email addresses, phone numbers and bank account numbers. There, ShinrAI can miss names and addresses. The application shows a notice in these languages.
• Place, postcode, dates and some terms about health or religion stay readable because the answer needs them.
• Pseudonymised data are still personal data under data protection law.
• The application does not detect every emergency. In an acute emergency, please call the emergency number directly, in Europe 112.
• You can also use the tools of CIVCNCT in your own AI assistant, through the Model Context Protocol (MCP). Then the provider of the assistant processes your conversation under its own terms. ShinrAI protects only the path through our server.
• Voice input uses the speech recognition of your browser. Depending on the browser, the browser sends your voice to its maker for this. We get no audio, only the text that you send.
• When you open a link to a public office or an online service, your browser connects directly to that website. Its own privacy rules apply there.
• Websites of towns sometimes name persons with their phone numbers, for example staff of the town. Such details stay in our copy and can appear in a short excerpt in an answer.
• Our copies of public data can be out of date. So answers from these copies give their date.

Questions and reports

Send questions about privacy to privacy@civcnct.com. Please report security issues to security@civcnct.com.

This page describes the technology. The privacy policy applies to this website. The application has its own privacy policy.