Privacy
Last updated: October 7, 2026
Controller
M2 Holding GmbH, Lommelstraße 8, 81479 München, Germany, is responsible for the website and our account, billing and support data. Contact:hello@rccn.io. For personal data you store about your customers or staff, you are the controller and we act as your processor under Art. 28 GDPR.
Website and browser storage
AWS CloudFront delivers this website and processes your IP address, requested page and browser information for delivery and security (our legitimate interests, Art. 6(1)(f) GDPR). We do not keep website access logs. This site sets no analytics or tracking cookies.
If you choose a display currency, rc_currencyremembers it for one year. The application stores login tokens and your interface preferences in your browser. Storage needed for these requested functions is based on § 25(2)(2) TDDDG. You can remove it in your browser; this may sign you out or reset your preferences.
Contact
We use your contact details and message to answer enquiries: Art. 6(1)(b) GDPR for a contract with you or steps you request before one, otherwise Art. 6(1)(f) GDPR, our interest in handling enquiries. WhatsApp is optional; if you use it, Meta also processes your data underWhatsApp’s privacy policy. You can contact us by email instead.
Account and business data
We process your name, email address, login credentials and subscription and billing details to provide your account and services (Art. 6(1)(b) GDPR). If you act for an organisation, our basis is our legitimate interest in providing its account (Art. 6(1)(f) GDPR). Required account details are necessary to provide access. Billing records required by law are processed under Art. 6(1)(c) GDPR.
Business records, uploaded files, messages and AI conversations are stored on AWS in Frankfurt, Germany. Technical logs help us secure the application and investigate errors (Art. 6(1)(f) GDPR). Processing of your organisation’s personal data is governed by its data-processing agreement with us.
AI features
AI features such as chat, searches, document extraction and email drafts send the content and context needed for the task to Anthropic’s API. This can include personal data in your messages, files and business records. Processing may take place in the United States. We use the results to provide the requested feature, on the same basis as the underlying service.
We do not use your business data to train AI models. Anthropic’s commercial API does not use inputs and outputs for training by default. Its standard API retentionis up to 30 days, with exceptions for legal obligations, abuse prevention and services or agreements with different retention. AI suggestions can be wrong; changes to business records require your approval.
Providers and transfers
AWS provides hosting, storage and outgoing email; Anthropic provides AI processing. Their data-processing terms include EU standard contractual clauses for transfers where required:AWS andAnthropic. CloudFront uses a global network, so website requests may be processed outside the EEA. Contact us for a copy of the applicable transfer safeguards.
If you pay through Stripe, it receives the payment and billing details needed to process the payment. Stripe also acts as an independent controller for purposes such as fraud prevention and legal compliance; seeStripe’s privacy policy. Services you connect to Raccoon receive data according to the functions you enable.
Retention
We keep account and business data while needed to provide your account. Cancelling a paid plan does not delete it. Export needed records before requesting deletion. We delete enquiry data when no longer needed to handle the matter. Records needed to meet statutory retention duties or resolve legal claims are kept for the applicable period, then deleted. Application API access logs, including IP addresses, are kept for 30 days.
Your rights
Subject to the GDPR’s conditions, you can request access, correction, deletion, restriction and data portability. You may object to processing based on legitimate interests on grounds relating to your situation. Contact hello@rccn.io. We normally respond within one month; if a lawful extension is needed, we tell you within that month. For data held on behalf of a customer, please contact that organisation.
You may complain to a data-protection authority, including theBayerisches Landesamt für Datenschutzaufsicht (BayLDA), Promenade 18, 91522 Ansbach, Germany.