Controller: Hyground GmbH, Versmannstraße 2, 20457 Hamburg, Germany
Last updated: 15.09.2026

We, Hyground GmbH ("Hyground" or "we"/"us"), would like to thank you for visiting our website and for your interest in our services. This privacy policy, in accordance with Article 13 of the EU General Data Protection Regulation ("GDPR"), outlines how we handle, protect, and process your personal data in connection with your use of our services, our online offer and your browsing activities on our website.

A. General Information

I. Definitions

• "Personal data" – Any information relating to an identified or identifiable natural person (e.g. name, address, email addresses, user behaviour).

• "Processing" – Any operation performed on personal data, such as collection, recording, storage, use, disclosure or destruction.

• "Controller" – The natural or legal person which determines the purposes and means of the processing of personal data.

• "Processor" – A natural or legal person which processes personal data on behalf of the controller.

• "Profiling" – Automated processing of personal data to evaluate certain personal aspects relating to a natural person.

II. Controller

Hyground GmbH
Versmannstraße 2
20457 Hamburg
Germany
E-Mail: info@hyground.ai

B. Processing of Personal Data

I. Visiting the Website

When you visit our website without transmitting data in any other way, we collect the following data temporarily via server log files:

• IP address

• Date and time of the enquiry

• Time zone difference to Greenwich Mean Time (GMT)

• Content of the request (page visited)

• Access status / HTTP status code

• Amount of data transferred

• Previously visited page

• Browser type

• Operating system used

• Language and version of the browser software

• Host name of the accessing computer

Legal basis: Art. 6 para. 1 sentence 1 lit. f GDPR (legitimate interest) and Art. 6 para. 1 sentence 1 lit. c GDPR (legal obligation / data security).

Our website is hosted by Framer B.V., Rozengracht 207B, 1016 LZ Amsterdam, the Netherlands, which processes the server log data listed above on our behalf to deliver the website to you (see "Third-Party Tools → Framer").

II. Contacting Us

We process data provided through our contact form:

• Name

• Company name

• Company email

• Reason for contacting us

• Any additional information in the message field

Legal basis: Art. 6 para. 1 sentence 1 lit. b GDPR (contract / pre-contractual measures), Art. 6 para. 1 sentence 1 lit. a GDPR (consent), or Art. 6 para. 1 sentence 1 lit. f GDPR (legitimate interest).

III. Cookies

We use cookies on certain areas of our website. Some are session cookies (deleted after your visit); others remain until you delete them.

Technically Necessary Cookies

Used to ensure basic functionality, security and proper operation of our website.
Legal basis: Section 25 para. 2 TDDDG.

This includes the consent cookie set by our consent management platform:

Analytics and Marketing Cookies (Consent-Based)

Only set with your explicit consent.
Legal basis: Art. 6 para. 1 sentence 1 lit. a GDPR and Section 25 para. 1 TDDDG.
You may revoke consent at any time via the cookie settings link in the footer.

Consent Management and Google Consent Mode

We use Cookiebot (Usercentrics A/S, Havnegade 39, 1058 Copenhagen, Denmark) as our consent management platform to obtain and document your cookie choices; your consent is stored in the technically necessary CookieConsent cookie (see above). We also use Google Consent Mode: your choices are transmitted to Google as signals that govern whether Google services may set cookies and process your data. If you do not consent, Google services may still receive cookieless pings that contain no identifiers and are used only for aggregated statistical modeling.

Analytics Cookies – Google Analytics (GA4)

Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

IP addresses are anonymised before storage. A data processing agreement has been concluded with Google.

The _ga cookies are set on the root domain (.hyground.ai) and shared across our subdomains, including sandbox.hyground.ai and auth.sandbox.hyground.ai, so a session stays consistent across our website, authentication and sandbox environments.

Analytics Cookies – PostHog

Provider: PostHog, Inc., 2261 Market Street #4008, San Francisco, CA 94114, USA.

The IP address is not stored. A data processing agreement has been concluded with PostHog. Data is hosted on PostHog's EU Cloud (Frankfurt, Germany); any transfers to the USA are covered by EU Standard Contractual Clauses (SCCs).

Marketing Cookies – Google Ads

Provider: Google Ireland Limited.

Enhanced Conversions: When you complete a conversion (e.g. booking a demo) and have consented to marketing cookies, a hashed, irreversible version (SHA-256) of data you provide — in particular your email address — is transmitted to Google to match the conversion to your ad interaction. The data is hashed in your browser before transmission; it is not transmitted in plain text. Legal basis: Art. 6 para. 1 sentence 1 lit. a GDPR / Section 25 para. 1 TDDDG (consent).

Marketing Cookies – LinkedIn Insight Tag

Provider: LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland.

See LinkedIn's Cookie Policy for a complete list.

Marketing Cookies – Meta Pixel

Provider: Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland.

Automatic Advanced Matching: If you have consented to marketing cookies and enter data into a form on our website (e.g. the contact form or a demo booking), the Meta Pixel reads contact details from the form fields, in particular your email address, first and last name, phone number and location. It hashes this data in your browser using SHA-256 and sends only the hashed values to Meta. Meta compares these values with its user accounts to match your visit or conversion to an interaction with one of our ads. No plain-text data is sent. Legal basis: Art. 6 para. 1 sentence 1 lit. a GDPR / Section 25 para. 1 TDDDG (consent).

See Meta's Cookie Policy for a complete list.

Marketing Cookies – HubSpot

Provider: HubSpot, Inc., 25 First Street, 2nd Floor, Cambridge, MA 02141, USA.

See HubSpot's Cookie Documentation.

Marketing Cookies – Leadfeeder (Dealfront)

Provider: Dealfront Germany GmbH, Karlsruhe, Germany.

Google Tag Manager

Used solely as a technical tool to deploy other tags (Google Analytics, Google Ads, LinkedIn, Meta) in a consent-based manner. Does not itself set cookies or process personal data. GTM itself loads to manage consent; the tags it deploys fire only in line with your consent choices.

IV. Customers, Business Partners and Interested Parties

Data processed in the context of contractual or pre-contractual relationships:

• Inventory data (name, address, company, location)

• Contact details (email, telephone)

• Payment data (bank details, billing information, payment history)

Legal basis: Art. 6 para. 1 sentence 1 lit. b, c and f GDPR.

V. Newsletter / E-Mail Marketing

We require your email address to send newsletters. Registration uses a double opt-in process.

Legal basis: Art. 6 para. 1 sentence 1 lit. a GDPR (consent).

You may unsubscribe at any time via the unsubscribe link in each newsletter or by contacting us. If your email address was obtained in connection with a sale, we may use it for similar product marketing under § 7 para. 3 UWG and Art. 6 para. 1 sentence 1 lit. f GDPR, unless you object.

VI. Third-Party Tools

1. Google Tag Manager

Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.
Data transfers to the USA are covered by the EU-US Data Privacy Framework (DPF) and EU Standard Contractual Clauses (SCCs).
Legal basis: Art. 6 para. 1 sentence 1 lit. a GDPR / Section 25 para. 1 TDDDG.
More info: Google Privacy Policy

2. Google Analytics (GA4)

Provider: Google Ireland Limited.
IP addresses are anonymised. A data processing agreement has been concluded. Transfers to the USA are covered by DPF and SCCs.
Legal basis: Art. 6 para. 1 sentence 1 lit. a GDPR / Section 25 para. 1 TDDDG.
More info: Google Privacy Policy | Google Cookies Documentation

3. Google Ads

Provider: Google Ireland Limited (and, for certain processing, Google LLC, USA). We use Google Ads for:

• Conversion tracking and remarketing via the cookies listed above.

• Enhanced Conversions: with your consent, a hashed (SHA-256) version of data you provide on conversion (in particular your email address) is sent to Google to attribute conversions to ad interactions. Hashing occurs in your browser; no plain-text data is transmitted.

• Offline conversion measurement: we store the Google Click ID (gclid) appended when you reach our site via a Google ad and, together with our CRM provider HubSpot, transmit later conversion events (e.g. when a contact becomes a qualified lead or customer) back to Google Ads to measure our ads' contribution across the sales funnel.

Transfers to the USA are covered by the EU-US DPF and SCCs. Legal basis: Art. 6 para. 1 sentence 1 lit. a GDPR / Section 25 para. 1 TDDDG (consent). More info: Google Privacy Policy.

4. LinkedIn Insight Tag

Provider: LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland.
Used for conversion tracking, retargeting and analytics. Data is encrypted and pseudonymised within 7 days. LinkedIn provides only aggregated reports.
Transfers to the USA are covered by DPF and SCCs.
Legal basis: Art. 6 para. 1 sentence 1 lit. a GDPR / Section 25 para. 1 TDDDG.
More info: LinkedIn Privacy Policy | LinkedIn Cookie Policy

5. HubSpot

Provider: HubSpot, Inc., 25 First Street, 2nd Floor, Cambridge, MA 02141, USA.

HubSpot Forms – Collects: name, company name, company email, reason for contact, additional message field content.
Legal basis: Art. 6 para. 1 sentence 1 lit. b or f GDPR.

HubSpot Meetings – Collects: name, email, selected date/time, additional booking information. If you have consented to statistics cookies, the first name, last name and email address you provide when booking a demo are additionally linked to your usage profile in our analytics tool PostHog (see "PostHog" below).
Legal basis: Art. 6 para. 1 sentence 1 lit. b and f GDPR.

HubSpot Tracking – See cookies section above.
HubSpot ↔ Google Ads: where you consented to marketing cookies and arrived via a Google ad, HubSpot transmits conversion/lifecycle events together with the Google Click ID (gclid) to Google Ads for offline conversion measurement (see "Google Ads" above).
Legal basis: Art. 6 para. 1 sentence 1 lit. f GDPR / Art. 6 para. 1 sentence 1 lit. a GDPR (where consent required).

HubSpot is certified under the EU-US DPF and SCCs have been concluded.
More info: HubSpot Privacy Policy

6. Microsoft Bookings

Provider: Microsoft Ireland Operations Ltd., One Microsoft Place, South County Business Park, Carmanhall and Leopardstown, Dublin, D18 P521, Ireland.
Used to manage and schedule appointments. Data collected includes name, email and appointment details.
A DPA has been concluded with Microsoft. Microsoft may process data for its own business purposes as an independent controller. Transfers to the USA are covered by DPF and SCCs.
More info: Microsoft Privacy Statement

7. PostHog

Provider: PostHog, Inc., 2261 Market Street #4008, San Francisco, CA 94114, USA. We use PostHog for product and website analytics — e.g. page views, clicks, feature usage, device/browser information, referral source (UTM parameters) and approximate location (country, region, city) derived from the IP address. The IP address itself is not stored. PostHog sets a cookie across our subdomains (*.hyground.ai), allowing us to recognise the same visitor across our website and our sandbox environment and to analyse the user journey across these services as a single session. Data is hosted on PostHog's EU Cloud (servers in Frankfurt, Germany), so processing takes place within the EU/EEA. To the extent any data is transferred to the USA, such transfers are covered by EU Standard Contractual Clauses (SCCs). A data processing agreement has been concluded. Legal basis: Art. 6 para. 1 sentence 1 lit. a GDPR / Section 25 para. 1 TDDDG.

Person profiles and identification when booking a demo. By default, your website usage is recorded pseudonymously under a random visitor ID; we only create a person profile in PostHog when you identify yourself to us. If you book a demo through our website and have consented to statistics cookies, we link this visitor ID with the contact details you provide in the booking form: your first name, last name and email address. From that point on, the website usage recorded by PostHog before and after the booking (pages visited, referral source, interactions) is associated with your person. We use this to understand which content and channels lead to demo requests and to prepare the conversation you requested. Legal basis: Art. 6 para. 1 sentence 1 lit. a GDPR / Section 25 para. 1 TDDDG (consent). You may withdraw your consent at any time via the cookie settings in the footer and may request deletion of your usage profile at any time via info@hyground.ai. We store identified usage profiles only for as long as necessary for the purposes described above; the general provisions on storage and deletion in section B.VIII apply.

Session recordings. With your consent to statistics cookies, PostHog also records how our website is used during a visit (mouse movements, clicks, scrolling, pages viewed) as a session replay. We use these recordings to identify usability problems and improve our website. Text you enter into input fields is masked and not transmitted; browser console logs and technical performance data of the page visit are also captured. Recordings are deleted automatically after 30 days. If you book a demo, recordings of your sessions may be associated with your person (see above). Legal basis: Art. 6 para. 1 sentence 1 lit. a GDPR / Section 25 para. 1 TDDDG (consent).

More info: PostHog Privacy Policy

8. Leadfeeder (Dealfront)

Provider: Dealfront Germany GmbH, Karlsruhe, Germany. We use Leadfeeder to identify the companies (not individuals) visiting our website, based on the IP address, to support our B2B sales. The IP address is processed to look up the associated company and is not used to identify individual visitors. As the provider is established in Germany, no transfer to a third country takes place.
Legal basis: Art. 6 para. 1 sentence 1 lit. a GDPR / Section 25 para. 1 TDDDG (consent).
More info: Dealfront Privacy Policy

9. Meta Pixel (Facebook / Instagram)

Provider: Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland (and, for certain processing, Meta Platforms, Inc., USA).

We use the Meta Pixel to measure how well our ads on Facebook and Instagram work, to match conversions (e.g. demo bookings) to ad interactions, and to show our ads to people who have visited our website (retargeting). The Pixel processes the pages you visit, the actions you take on our website, device and browser information, your IP address and the cookies listed above.

Automatic Advanced Matching: With your consent, the Meta Pixel also reads contact details you enter into forms on our website, in particular your email address, first and last name, phone number and location. It hashes them in your browser (SHA-256) and sends only the hashed values to Meta to match them with Meta user accounts. No plain-text data is sent.

Joint controllership: For collecting this data on our website and sending it to Meta, we and Meta Platforms Ireland Limited are joint controllers under Art. 26 GDPR. We have an agreement with Meta covering this (Meta Controller Addendum). Meta alone is responsible for anything it does with the data once it has received it. You can exercise your data subject rights for Meta's processing directly with Meta, or contact us.

Meta Platforms, Inc. is certified under the EU-US Data Privacy Framework (DPF), and transfers to the USA are also covered by EU Standard Contractual Clauses (SCCs).

Legal basis: Art. 6 para. 1 sentence 1 lit. a GDPR / Section 25 para. 1 TDDDG (consent). You can withdraw your consent at any time via the cookie settings link in the footer.

More info: Meta Privacy Policy | Meta Cookie Policy

10. Framer (Website Hosting and A/B Testing)

Provider: Framer B.V., Rozengracht 207B, 1016 LZ Amsterdam, the Netherlands.

Hosting: Our website is built and hosted with Framer. When you visit our website, Framer processes the data listed under "Visiting the Website" (in particular your IP address, browser information and the pages you request) on our behalf to deliver the website to you and keep it secure. Framer uses Amazon Web Services (AWS) as its hosting provider, so data may be processed in the USA. A data processing agreement has been concluded with Framer. Transfers to the USA are covered by EU Standard Contractual Clauses (SCCs) and, where applicable, the EU-US Data Privacy Framework (DPF). Legal basis: Art. 6 para. 1 sentence 1 lit. f GDPR (our legitimate interest in providing a secure and reliable website).

A/B testing: We use Framer's built-in A/B testing to show different versions of some pages to different visitors and to measure which version works better, for example which one leads to more demo requests. Framer does not set cookies for this. Instead, it creates an anonymous identifier from your IP address and browser information so that you see the same version of a page throughout the day. The identifier is reset daily and cannot be used to recognise you across several days or devices. Legal basis: Art. 6 para. 1 sentence 1 lit. f GDPR (our legitimate interest in improving our website). You can object to this processing at any time (see section C).

More info: Framer Privacy Statement

VII. Online Presence on Social Media

We operate social media presences on:

• LinkedIn – LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland | Privacy Policy

• Xing – New Work SE, Am Strandkai 1, 20457 Hamburg, Germany | Privacy Policy

Use of these platforms and their features is at your own responsibility. When you visit our social media sites, the platform providers may collect your IP address and other data via cookies, including for transfer to countries outside the EU.

Legal basis: Art. 6 para. 1 sentence 1 lit. f GDPR.

VIII. Storage and Deletion of Data

Personal data is deleted when:

• Consent is revoked, or

• The purpose for processing no longer applies, or

• Statutory retention periods expire.

We only store data as long as necessary for the respective processing purpose.

C. Your Rights as a Data Subject

You have the right to:

• Access your personal data (Art. 15 GDPR)

• Rectification of inaccurate data (Art. 16 GDPR)

• Erasure of your data (Art. 17 GDPR)

• Restriction of processing (Art. 18 GDPR)

• Object to processing (Art. 21 GDPR)

• Data portability (Art. 20 GDPR)

• Withdraw consent at any time (for future processing only)

Right to Object: You may object at any time to processing based on Art. 6 para. 1 lit. e or f GDPR, including profiling. We will stop processing unless we can demonstrate compelling legitimate grounds.

To exercise your rights, contact: info@hyground.ai

You also have the right to lodge a complaint with a data protection supervisory authority.

D. Data Processing When Accessing Linked Content

This privacy policy applies only to this website. External links lead to third-party sites outside our control. Please consult those sites' privacy policies for information on their data handling.

E. Automated Decision-Making / Profiling

No automated decision-making within the meaning of Art. 22 GDPR takes place: no decision that produces legal effects concerning you, or similarly significantly affects you, is based solely on automated processing. With your consent, we create usage profiles linked to your person as described under "Third-Party Tools → PostHog"; you may withdraw your consent or object to this at any time (see section C).

F. Changes to This Privacy Policy

This privacy policy may be amended from time to time due to website development, changes to our services, or legal requirements.

For questions regarding the processing of your data, contact us at any time:
contact@hyground.ai