Data Protection & AI Processing
The automation uses an AI model for three tasks: classifying incoming activities and emails, detecting genuine customer replies, and drafting follow-up emails in your writing style. This page describes what data is processed in the course of that — and what the AI model never sees in clear form.
The principle: placeholders instead of real names
Before any text is transmitted to the AI model, it passes through a pseudonymization layer. It runs entirely on the application infrastructure in Frankfurt and is based on Microsoft Presidio (open source). Personal data is replaced with neutral placeholders — the AI model works on the structure of the text, not on identifiable persons. The model's response is then translated back.
The mapping between placeholders and clear text exists exclusively in memory for the duration of the individual request. It is never stored and never logged.
Example:
Your text:
Hello Mr. Mustermann, we have received your IBAN
DE89 3704 0044 0532 0130 00. Questions to max@acme-gmbh.de.
What the AI model sees:
Hello Mr. [Person1_Nachname], we have received your IBAN
[IBAN1]. Questions to [Email1].
What gets replaced
Two mechanisms work together:
Known contact data — always replaced. The name, company, and email address of the contact in question are known to the system from Pipedrive and are directly replaced with placeholders before every AI call, without relying on detection.
Detected data in free text. In addition, the pseudonymization layer scans the entire text and replaces: further person names, company names, and locations, as well as — pattern-based and therefore highly reliable — email addresses, phone numbers, IBANs, German tax identification numbers, tax numbers, VAT identification numbers, and credit card numbers. This in particular covers the data typically found in B2B email signatures.
Dates and links are deliberately kept: they usually contain no personal reference but are important context — delivery dates or links to documents, for example.
When pseudonymization is unavailable
A strict rule applies here: no pseudonymization, no AI call. If the pseudonymization layer is temporarily unavailable, the AI call is not made with clear text — it does not happen at all. Affected operations are retried automatically or flagged for manual review; the processes are logged.
Reading the Outlook inbox
Vita-Drive.Ai detects replies to follow-ups through the inbox Pipedrive synchronizes for the owner of your organization. On request, the operator also switches on reading the Outlook inboxes of all other members of your organization who have connected Outlook. The following applies:
- Current members only: an inbox is read only while its user is a member of your organization. If someone is removed from the organization, Vita-Drive.Ai no longer reads their inbox. If it cannot be determined who is a member, Vita-Drive.Ai reads no inbox in that run.
- Header data first, then text: at first, only sender, subject, time of receipt and technical identifiers of new emails in the inbox are retrieved. Vita-Drive.Ai loads the text of an email only if the sender is a contact in a deal with a running follow-up automation, and even then only the new part without the quoted history.
- Everything else is discarded: emails from other senders are discarded right after the check. Their text is never loaded, and nothing about them is stored. Vita-Drive.Ai does not read other folders or attachments.
- What is stored: for a processed email, the Message-ID, the sender address, the related deal, whether it was a real reply, and the time; these are deleted after 30 days. Here too, the activity log contains hashes only, no addresses or subject lines. For each mailbox, the read position is added: a technical reference from Microsoft without content.
- AI check: whether an email is a real reply is checked by the AI model as for emails from Pipedrive, with pseudonymized text. If pseudonymization is unavailable, the check is repeated on the next retrieval.
Storage & logs
The placeholder mapping is — as described above — never persisted. Beyond that: the activity log contains no email addresses or subject lines in clear text; a hashing scheme is used for technical correlation. The writing-style profile is generated from pseudonymized emails. The CRM data required for operation (deals, contacts) resides in a database in the EU region. Credentials for your connected services (Pipedrive, Microsoft 365) are stored encrypted with AES-256-GCM.
Retention periods
Data is not kept indefinitely. A nightly job clears it out automatically:
| Data | Period |
|---|---|
| Contents of incoming Pipedrive events | Cleared after 48 hours |
| Processed Pipedrive events | 14 days |
| Failed Pipedrive events | 90 days |
| Completed follow-up jobs including email text | 90 days |
| Processed incoming emails (Message-ID, sender, deal) | 30 days |
| Activity log | 180 days |
The first row is the important one: these events hold the complete raw data from Pipedrive, including notes, contact details and phone numbers. The content is removed after two days; the record itself is kept a little longer for traceability.
Work still in progress is excluded for as long as it is unfinished.
Hosting & providers
| Component | Provider | Location |
|---|---|---|
| Application & pseudonymization | Codesphere | Frankfurt, Germany |
| Database | Supabase | EU region |
| AI model | Anthropic | USA — receives pseudonymized content only |
| Email sending and, if switched on, reading the inbox | Your own Microsoft 365 account | per your Microsoft configuration |
Content transmitted to Anthropic is not used there for training the models and is subject to limited retention periods. You receive the complete data-processing documentation, including the list of sub-processors, as part of the data processing agreement.
Settings
Under Settings → App → Data Protection & GDPR you will find the switch for PII anonymization. It is enabled by default; disabling it is possible but remains your responsibility as the data controller. Two further options are already prepared there: human approval before generated emails are sent, and an AI disclosure notice in the email footer (transparency under Art. 50 EU AI Act).
Frequently asked questions
Does the AI model see our customers' names?
Contact data known from Pipedrive is replaced before every call; names additionally detected in the text are replaced as well. The model works with placeholders such as [Person1].
What happens if pseudonymization fails? No AI call takes place — the system is deliberately built to stop in that case rather than send clear text.
Can we switch pseudonymization off? Yes, via the settings. It is not recommended; the data-protection assessment of disabling it is yours to make.