Privacy Policy

Last updated: 9 November 2026 · Version 1.3

We are happy that you are interested in fairyfly. Data protection is a particular priority for DataZoo GmbH. This privacy policy informs you, pursuant to Articles 13 and 14 of the General Data Protection Regulation (GDPR), about the nature, scope and purpose of the processing of personal data when you use fairyfly, and about your rights.

fairyfly consists of

• the website and web application at fairyfly.io (information page, sign-in, management of the organisation, users, desktops, AI connections, audit and billing),
• the fairyfly Gateway, a cloud service operated by us through which AI assistants (e.g. Claude, ChatGPT, Microsoft Copilot, Gemini Enterprise) access a signed-in SAP GUI session via the Model Context Protocol (MCP), and
• the fairyfly desktop application for Windows (installer from GitHub or the Microsoft Store), which runs on the user's PC and operates SAP GUI.

This policy covers the service operated by DataZoo GmbH at fairyfly.io. If a customer runs the gateway itself ("self-hosted"), that customer is responsible for the processing in its gateway. The website www.data-zoo.de has its own privacy policy.

This English version is a translation provided for convenience; only the German version is legally binding.

1. Definitions

This privacy policy uses the terms of the GDPR (Art. 4 GDPR), in particular:

• Personal data: any information relating to an identified or identifiable natural person ("data subject"), such as a name, e-mail address, identification number, online identifier or IP address.
• Data subject: any identified or identifiable natural person whose personal data is processed.
• Processing: any operation performed on personal data, such as collection, recording, storage, alteration, retrieval, use, disclosure by transmission, erasure.
• Restriction of processing: the marking of stored personal data with the aim of limiting its processing in the future.
• Profiling: automated processing to evaluate personal aspects of a person. fairyfly does not perform profiling.
• Pseudonymisation: processing in such a manner that the data can no longer be attributed to a person without additional information kept separately.
• Controller: the body which, alone or jointly with others, determines the purposes and means of the processing.
• Processor: a body which processes personal data on behalf of the controller.
• Recipient: a body to which personal data is disclosed, whether a third party or not.
• Third party: any body other than the data subject, the controller, the processor and the persons who, under their direct authority, are authorised to process the data.
• Consent: any freely given, specific, informed and unambiguous indication of the data subject's wishes by which he or she signifies agreement to the processing.

2. Name and address of the controller

Controller for the purposes of the GDPR and other data protection provisions:

DataZoo GmbH
Quellenstrasse 7
70376 Stuttgart
Germany
E-mail: contact@data-zoo.de
Phone: +49 177 3073737
Represented by the managing directors Dr. Simon Müller and Joachim Rosskopf
Commercial register: Amtsgericht Stuttgart, HRB 769481

Imprint: https://www.data-zoo.de/imprint.html

Please send data protection enquiries about fairyfly to cloud@fairyfly.io.

3. Our role: controller or processor

fairyfly is used by companies and organisations ("customer" or "organisation") for their staff. We therefore distinguish:

• We are the controller for data we process for our own purposes: visits to the website, sign-up and the contract with the organisation, billing, communication with us, security and abuse prevention of our service including the locked audit log (section 9), statutory retention obligations.
• We are a processor (Art. 28 GDPR) for data we process on behalf of the organisation: its staff's user accounts, the connected desktops, the AI assistants' calls, the content from SAP, the audit entries we show or export to the organisation or forward to its SIEM, and — if the organisation turns it on — the audit trail with screenshots. The organisation is the controller here, under the data processing agreement (DPA, https://fairyfly.io/dpa) that the organisation accepts together with the terms of service at sign-up (section 6). For organisations that signed up before this confirmation was introduced, the DPA applies only once an owner confirms it at their next sign-in; until then the organisation is paused and the service does not forward AI assistants' calls for it. If you use fairyfly as a member of an organisation, please address requests about this data to your organisation first; we support it in answering them.

The following sections describe both areas so that you can see everything that happens to your data.

4. Website fairyfly.io: access and server logs

When you open fairyfly.io, our hosting provider Google Cloud automatically processes technical data: IP address, date and time, requested page/URL, HTTP status, amount of data transferred, browser identifier (user agent) and, where applicable, the referring page. A web application firewall in front of the service (Google Cloud Armor) limits requests per IP address to protect against overload and attacks.

• Purpose: delivering the website, stability, security, defence against attacks.
• Legal basis: Art. 6(1)(f) GDPR (legitimate interest in a secure, working service).
• Retention: 30 days, after which the logs are deleted automatically.

The website uses no analytics or tracking tools, no advertising cookies and no external fonts; fonts are served from our own server.

5. Cookies and browser storage

We only set strictly necessary cookies:

In addition, the web application stores in your browser (localStorage/sessionStorage): the chosen language, which steps of the connection guide you ticked, briefly the pairing code while you pair a desktop, and on the billing page a technical marker for reloading the payment service. A service worker caches only the web application's program files, no content.

Legal basis: § 25(2) no. 2 TDDDG (strictly necessary for the service requested by the user) and Art. 6(1)(b) or (f) GDPR. No consent is required for this. You can delete cookies and local data in your browser at any time; without the session cookie you cannot sign in.

6. Sign-up and sign-in (Google and Microsoft)

You sign in with an existing Google account or a Microsoft work or school account (Microsoft Entra ID), in both cases via OpenID Connect with the scopes openid email profile. The provider you choose performs the sign-in under its own responsibility (section 14); we do not receive passwords. We receive:

• with Google: e-mail address, whether it is verified, name, the account identifier at Google (issuer and subject id) and, where applicable, the Google Workspace domain;
• with Microsoft (Microsoft Entra ID, sign-in via login.microsoftonline.com for accounts of any organisation): e-mail address (claim email, otherwise preferred_username), name, the account identifier at Microsoft (issuer and object id oid) and the id of your organisation's Entra tenant (tid). Microsoft does not tell us whether the e-mail address is verified; we treat it as unverified. We refuse personal Microsoft accounts (e.g. outlook.com).

We recognise accounts by issuer and account identifier, not by e-mail address. An organisation can restrict sign-in to its Google Workspace domain or its Entra tenant.

When an organisation signs up, we also store the organisation's name, the account of the person signing up (as owner) and settings. For the optional verification of the e-mail domain we check a DNS TXT record you set, using Google's public DNS service (dns.google).

Acceptance of the terms of service and the DPA: At sign-up, the person signing up confirms that they accept the terms of service and the DPA and act as a business; for existing organisations and after changes, an owner confirms at sign-in. For this we store: the organisation, the user id and e-mail address of the confirming person, the time of the confirmation and the confirmed versions of the terms of service and the DPA. The purpose is evidence of the contract; the legal basis is Art. 6(1)(b) GDPR and, for the evidence, Art. 6(1)(f) GDPR (legitimate interest in being able to prove contracts); we are the controller for this. We keep the confirmation while the organisation exists; it is deleted with the organisation (permanently 90 days after closure, copies in the backups at the latest 7 days later). In addition, the gateway writes an audit entry about the confirmation (without e-mail address), which follows the retention of the audit log (section 9).

For user accounts in an organisation we store: user id, e-mail, name, role (owner, admin, member), provider identifier, status, language, daily-summary preference, time of creation and of the last sign-in. Invitations contain the invitee's e-mail address, role, the inviting person and the validity (7 days by default). Invitations are permanently and automatically deleted 90 days after expiry, acceptance or revocation, also while the organisation exists (see Retention).

• Purpose: providing the service, access control, management of the organisation.
• Legal basis: Art. 6(1)(b) GDPR (contract with the organisation or pre-contractual steps); for the staff's accounts we act as the organisation's processor (section 3).
• Retention: for the term of the contract. When an admin removes a user, their access ends at once. When the owner closes the organisation, all users' e-mail addresses, names and provider identifiers are erased at once, desktops are revoked and host names erased. Removed users, desktops, invitations and closed organisations are permanently and automatically deleted 90 days after the respective event (daily deletion run). For closed organisations this covers all remaining records (the organisation with name and domain, users, desktops, invitations); only the organisation's id, its creation, closure and deletion times and the Paddle customer and subscription ids are kept, as the link to the billing records. This does not apply to the audit-trail step records without content (section 10) and the usage counters (section 12), which expire automatically after 400 days independently of the deletion run, to the locked audit log (section 9) and to billing records subject to statutory retention (section 12). Copies in the database backups are removed at the latest 7 days after each deletion (section 21).

7. Pairing desktops and the connection to the gateway

When you pair the desktop application with your account, it sends to the gateway: a public key of the device, the Windows computer name, the operating system and the fairyfly version. For the lifetime of the pairing offer (5 minutes) we also store your IP address truncated to its first three blocks (e.g. 203.0.113.x) and the approximate location (city and country) that our load balancer derives from the IP address. Both are shown to the person who approves the pairing in the browser, so they can check that the request comes from their PC. Permanently we store for the device: device id, the associated account and e-mail, computer name, version, public key, time of pairing and of the last connection, and the audit-trail setting.

After approval the desktop application receives the organisation's id and name, your e-mail address and the sign-in provider, for Microsoft accounts also the id of the Entra tenant.

The device's private key never leaves the PC; on Windows it is protected with DPAPI.

• Purpose: routing calls to the right PC, securing the connection.
• Legal basis: Art. 6(1)(b) GDPR; processing on behalf of the organisation.
• Retention: pairing offer (with truncated IP address and approximate location) 5 minutes; device data for the term of the contract. When the user is removed, the desktop is revoked at once; when the organisation is closed, computer name and e-mail are erased at once. The device records are permanently and automatically deleted 90 days after the respective event (daily deletion run).

8. Connecting AI assistants and processing SAP content

Your organisation can connect AI assistants (e.g. Claude, ChatGPT, Microsoft Copilot Studio, Gemini Enterprise) to fairyfly. The user signs in to fairyfly from the AI assistant (OAuth). For this we store the registered AI clients (name, platform, redirect addresses), the user's consent and, to keep the connection alive, only hashes of the refresh tokens. Access tokens are valid for 10 minutes, refresh tokens for 30 days (rolling). The records of the connections (registered clients, consent, token hashes) stay stored after the tokens expire; the daily deletion run permanently deletes them 90 days after the user's removal or the organisation's closure. For Gemini Enterprise we validate the user's Google access token with Google (tokeninfo).

SAP content: When an AI assistant calls a fairyfly function (e.g. read the screen, fill a field), the gateway forwards the call encrypted (TLS) to the user's desktop and the result back. Screen content, field values, arguments and results are not stored or logged by the gateway; they are held in memory only for the duration of the individual call. Actions that change SAP are blocked by default and require permission by the organisation and a confirmation at the desktop.

Important: Which data the AI assistant requests from SAP and what the AI provider does with it is governed by the contract between your organisation and that provider (e.g. Anthropic, OpenAI, Microsoft, Google). fairyfly itself does not send any data to AI model providers; the AI assistant is the organisation's client that calls fairyfly.

• Purpose: performing the contractually agreed function.
• Legal basis: processing on behalf of the organisation (Art. 28 GDPR); the organisation determines its own legal basis.

9. Audit log and security logs

For every call by an AI assistant and every administrative action the gateway writes an audit entry: time, organisation, user id, e-mail address, AI client, function called (name, no content), decision (allowed/denied), confirmation at the desktop, result status and error code, duration, device id, request id; for administrative actions, e.g. sign-in, invitation, pairing (with computer name), token issue, domain verification (with e-mail and domain), changes to the audit trail. Field values and SAP content are not included.

In addition there are technical operating logs that, for certain events, contain the e-mail address, the computer name or — for rejected sign-in tokens — the IP address.

• Purpose: accountability, security, detection of misuse, evidence towards the organisation, information security requirements (e.g. NIS2, ISO 27001).
• Role and legal basis: we keep the locked audit log as controller for the security of our service, based on Art. 6(1)(f) GDPR (legitimate interest in security, abuse prevention and accountability). Where we show or export the organisation's audit entries to it or forward them to its SIEM, we act as its processor. We also keep the technical operating logs as controller for the operation and security of the service (Art. 6(1)(f) GDPR).
• Retention: audit log 400 days in a locked store, after which it is deleted automatically. Early deletion is technically impossible, also when the organisation is closed; we answer erasure requests concerning these entries under Art. 17(3) GDPR. Operating logs 30 days.
• SIEM export: if the organisation has connected its own SIEM, audit entries are sent there; the recipient is then the organisation itself.

10. Audit trail with screenshots (optional, set by the organisation)

The organisation can turn on an audit trail for individual desktops (off by default). The desktop application then sends, for the AI assistant's actions, screenshots of SAP GUI before and after the step, a step description and the changed fields (old → new value). Screenshots and field changes can contain personal data shown in SAP (e.g. names, addresses). Password fields are always, bank fields (IBAN, account number, BIC etc.) by default, blurred on the PC already; a PC that cannot blur sends no screenshots. While the audit trail is on, the person at the PC sees a notice; without this notice nothing is recorded.

The images are stored in a private store in Frankfurt (europe-west3), encrypted with a dedicated key (Cloud KMS, HSM). Only the organisation's owners and admins, and the person at the PC for their own sessions, can view them; every view is logged.

• Purpose: accountability for what AI assistants did in SAP on the person's behalf. Monitoring staff performance or behaviour is not the purpose of the feature.
• Legal basis: processing on behalf of the organisation; the organisation, as controller, decides to turn it on, informs its staff and, where applicable, involves the works council (§ 87(1) no. 6 BetrVG).
• Retention: screenshots and field changes 30, 90 or 365 days as chosen by the organisation (automatic deletion, after 366 days at the latest; without delay when the organisation is closed, by an erasure job that runs automatically). Screenshots are not copied into backups. Step records without content (function, time, result, person, desktop) 400 days after the last step, also after the organisation is closed.

11. E-mails

We send e-mails from cloud@fairyfly.io via Google Workspace (Gmail):

• invitations to the invited person (e-mail address, organisation name, invitation link),
• budget notices to owners and admins,
• a daily usage summary to owners and admins; it contains only totals for the organisation (e.g. number of operations and budget status), no figures for individual users. The organisation can turn it off; each person can unsubscribe individually.
• notices of material changes to this privacy policy to the organisations' owners (section 23).

• Legal basis: Art. 6(1)(b) GDPR; processing on behalf of the organisation.
• Retention: copies of sent e-mails remain in the Sent folder of the Workspace mailbox of a DataZoo staff member that is used for sending. We keep them until any related support case is closed, at most 12 months, and delete them by then at the latest.

Support via GitHub issues: We also give support through GitHub issues (https://github.com/DataZooDE/fairyfly/issues). GitHub issues are public; GitHub, Inc. (USA) runs them under its own responsibility and privacy terms (section 14). Please do not post personal data, SAP content, screenshots or credentials there; send such matters by e-mail to cloud@fairyfly.io. We process what you publish in an issue to handle the request (Art. 6(1)(f) GDPR).

If you contact us by e-mail, we process your details to handle the request (Art. 6(1)(b) or (f) GDPR) and delete them when they are no longer needed and no retention obligation applies.

12. Usage metering and billing (Paddle)

For the free allowance (1,000 operations per organisation and month) and usage-based billing we count operations per organisation and month, broken down by AI platform and desktop id (counters kept for 400 days).

Use above the free allowance is billable (terms of service § 9). Payments are handled by Paddle.com Market Ltd. (London, United Kingdom) as reseller and merchant of record; Paddle is your contractual partner for the payment. Paddle is an independent controller for payment data; Paddle's privacy policy applies (https://www.paddle.com/legal/privacy). When an owner or admin adds a payment method, the billing page loads Paddle's checkout (cdn.paddle.com) — only then and only on that page. We send to Paddle: an internal identifier of the organisation, the e-mail address of the person setting up payment (as a pre-fill), and each month the number of packages to be charged. We do not send per-user usage data. Payment details (card, account) are entered directly at Paddle; we do not receive them, only customer, subscription and transaction identifiers, the payment status and invoices.

• Legal basis: Art. 6(1)(b) GDPR (contract); Art. 6(1)(c) GDPR in conjunction with § 147 AO and § 257 HGB for accounting records.
• Retention: billing data for the term of the contract. We keep records relevant under tax and commercial law for the statutory periods: accounting vouchers 8 years (§ 147 AO as amended by the Fourth Bureaucracy Relief Act, BEG IV), books and financial statements 10 years, commercial letters 6 years (§ 147 AO, § 257 HGB), each from the end of the calendar year in which the record was created.

13. fairyfly desktop application for Windows

Locally on your PC (in the folder %USERPROFILE%\.fairyfly, accessible only to you, SYSTEM and administrators) fairyfly stores:

• a local audit log (audit\YYYY-MM.jsonl): time, command or function, arguments with input values redacted, result status, error code, SAP system, client, SAP user, transaction, screen number, AI client and — for remote access on the local network — token name and client address. No screen content, results or field values;
• log files of the tray programs (logs\, rotating, max. approx. 20 MB), including approval decisions and the e-mail address;
• the pairing data with the DPAPI-protected device key, configuration and saved connections.

SAP passwords and access tokens are kept in the Windows Credential Manager. This data is not transferred to us. It remains after uninstalling and can be deleted by you or your IT at any time.

By default, the local audit log is not deleted automatically. From the next version of the desktop application, the setting audit.retention_days sets a retention period in days; fairyfly then deletes older entries automatically. We recommend that your organisation's IT sets a period that matches its own rules.

To the gateway the desktop application only transfers what is described in sections 7, 8 and 10.

Updates: the installer (MSI) version asks GitHub (GitHub, Inc., USA) once in the background whether a new version is available, and downloads updates only from GitHub; GitHub receives your IP address and a technical program identifier. The check can be turned off with the environment variable FAIRYFLY_UPDATE_CHECK=0. The Microsoft Store version does not check by itself; Windows delivers updates through the Store. Legal basis: Art. 6(1)(f) GDPR (security through up-to-date software).

No telemetry: the desktop application sends no usage statistics, crash reports or analytics.

Obtaining the software: when you download from GitHub or the Microsoft Store, these providers process data under their own responsibility according to their privacy terms (GitHub: https://docs.github.com/site-policy/privacy-policies; Microsoft: https://privacy.microsoft.com).

14. Recipients and processors

Within DataZoo GmbH, only the persons who need it for operations and support have access. Every access to stored data from outside the service is logged (section 21). Authorities receive data only where we are legally obliged to provide it.

15. Transfers to third countries

The service's data is processed in data centres in the EU (section 14). Some recipients belong to groups based in the USA (Google, Microsoft, GitHub) or are based in the United Kingdom (Paddle). For the United Kingdom there is an adequacy decision of the European Commission. We base transfers to the USA on the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR); where the recipient is certified under the EU-US Data Privacy Framework, additionally on the European Commission's adequacy decision of 10 July 2023 (Art. 45 GDPR). The Standard Contractual Clauses are contained in the data processing terms of Google Cloud and Google Workspace. For transfers by Paddle as an independent controller, Paddle's privacy policy applies. When you sign in, Google and Microsoft process your data under their own responsibility and privacy terms; Google LLC and Microsoft Corporation are certified under the EU-US Data Privacy Framework.

16. Retention and routine erasure

We process and store personal data only for as long as necessary for the respective purpose or as required by statutory retention periods. When the purpose ceases or a period expires, the data is routinely erased or blocked. The specific periods are given in sections 4 to 13; in summary:

Removed users, desktops, invitations and closed organisations are permanently and automatically deleted 90 days after the respective event (daily deletion run).

All deletions concern the active data. Copies in the database backups are also removed at the latest 7 days after each deletion; this also applies to data that is erased "at once".

17. Rights of the data subject

You have the following rights towards us. For data we process on behalf of your organisation (section 3), please address your request to your organisation; if you contact us, we forward it and support the organisation.

• Right of confirmation and access (Art. 15 GDPR): you may ask for confirmation whether we process data concerning you and obtain, free of charge, information about this data and a copy, including the purposes, categories, recipients, envisaged retention, source of the data, the existence of automated decision-making and the appropriate safeguards for transfers to third countries.
• Right to rectification (Art. 16 GDPR): rectification of inaccurate and completion of incomplete data without undue delay.
• Right to erasure (Art. 17 GDPR): erasure where the data is no longer necessary, you withdraw consent, you have objected with justification, the data was processed unlawfully or there is a legal obligation to erase — unless the processing is necessary, e.g. for compliance with a legal obligation or for the establishment, exercise or defence of legal claims (Art. 17(3) GDPR).
• Right to restriction of processing (Art. 18 GDPR): where you contest the accuracy, the processing is unlawful and you request restriction instead of erasure, we no longer need the data but you need it for legal claims, or you have objected and the balancing is pending.
• Right to data portability (Art. 20 GDPR): receiving the data you provided in a structured, commonly used and machine-readable format and transmitting it to another controller, where the processing is based on consent or contract and carried out by automated means. Organisations can export their audit log as CSV/JSON and audit-trail sessions as ZIP.
• Right to object (Art. 21 GDPR): you may object at any time, on grounds relating to your particular situation, to processing based on Art. 6(1)(e) or (f) GDPR. We will then no longer process the data unless we demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims. We do not use fairyfly for direct marketing.
• Withdrawal of consent (Art. 7(3) GDPR): at any time with effect for the future. fairyfly currently bases no processing on consent.

To exercise your rights, a message to the address in section 2 is sufficient.

18. Right to lodge a complaint with a supervisory authority

You have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), in particular in the Member State of your habitual residence, place of work or place of the alleged infringement. The authority competent for us is:

Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg
(State Commissioner for Data Protection and Freedom of Information of Baden-Württemberg)
Heilbronner Straße 35, 70191 Stuttgart, Germany
Postal address: Postfach 10 29 32, 70025 Stuttgart
https://www.baden-wuerttemberg.datenschutz.de

19. No automated decision-making

We do not use automated decision-making, including profiling, within the meaning of Art. 22 GDPR. The rules by which the gateway allows or refuses calls by AI assistants (the organisation's policies, budget, confirmation at the desktop) concern technical access rights and produce no legal effects on persons.

20. Obligation to provide data

Providing sign-in data (e-mail, account identifier) is necessary to use fairyfly; without it you cannot sign in. The website can be used without signing in and without providing personal data.

21. Data security

We apply technical and organisational measures, including: TLS 1.2+ for all connections, an encrypted connection between gateway and desktop, separation of organisations in every data path, signed calls with HSM-protected keys per organisation, encryption of stored data, dedicated HSM keys rotated every 90 days for audit-trail images, read-only access by default, confirmation of changing actions at the desktop.

Backups: The database is backed up daily; in addition, recovery to any point in time of the last 7 days is possible. Backups are kept in the EU (eur3: Belgium and Netherlands) and are deleted after 7 days; deleted data is removed from all backups at the latest 7 days after its deletion. Screenshots of the audit trail are not backed up.

Logging of access: Every access to stored data from outside the service (database and the screenshot store, e.g. by DataZoo staff for operations and support) is logged; these logs are deleted after 30 days.

Internet-based data transmissions may nevertheless have security gaps; absolute protection cannot be guaranteed.

22. Microsoft Store disclosure

For the Store's privacy disclosure of the desktop application (short version, referring to this policy):

fairyfly for Windows collects no telemetry, analytics or crash data. Locally, the app keeps an audit log of its actions (including SAP system, client and SAP user, without input values or screen content) and log files in the folder %USERPROFILE%\.fairyfly. Only when you pair the app with the fairyfly cloud service are the computer name, operating system, app version and a device key sent to fairyfly.io; AI assistants' calls and their results are relayed through the service to your PC but not stored by the service. If your organisation has turned on the audit trail, screenshots of SAP GUI (with password and bank fields blurred) are transferred and stored for 30–365 days; the app then shows a notice. The app needs the "runFullTrust" capability to operate SAP GUI; it does not access the camera, microphone, location or contacts. Privacy policy: https://fairyfly.io/privacy

23. Changes to this privacy policy

We update this privacy policy when fairyfly or the legal situation changes. The version published at https://fairyfly.io/datenschutz applies (English translation at https://fairyfly.io/privacy). We inform the owners of the organisations by e-mail about material changes.