Privacy Policy

Effective date: September 30, 2026

This Privacy Policy explains how Yavio GmbH ("we", "us", "our") handles information in connection with Commerce for Agents ("the Service"). The Service is an energy tariff comparison and switching service and a US fixed broadband, mobile phone plan and VPN plan comparison service designed to be used by AI agents on behalf of a human user. It is accessible through ChatGPT and, where available, other agentic clients via the Model Context Protocol (MCP). This website (commerceforagents.com) only describes the Service.

This Privacy Policy explains how Yavio GmbH ("we", "us", "our") handles information in connection with Commerce for Agents ("the Service"). The Service is an energy tariff comparison and switching service and a US fixed broadband and mobile phone plan comparison service designed to be used by AI agents on behalf of a human user. It is accessible through ChatGPT and, where available, other agentic clients via the Model Context Protocol (MCP). This website (commerceforagents.com) only describes the Service.

1. Data controller

2. What the Service does

The Service compares live electricity and gas tariffs for households in Germany and, on request, submits a contract application for a chosen tariff to the energy provider on the user's behalf ("concierge switch"). To produce a comparison, the Service forwards the inputs it receives in real time to our data partner, an energy tariff comparison provider based in Germany, which returns ranked offers.

3. Information we process

Comparison inputs. A German postal code, annual electricity or gas consumption in kWh, filter settings (for example eco tariffs, contract length, price guarantee, bonus handling, provider selection), and, if the user shares an energy bill with their agent, the current provider and tariff name, the future monthly payment, or the price components of the current contract. These inputs are transmitted to our data partner in real time to retrieve offers. The offers of a comparison are cached for up to 24 hours together with the postal code and consumption so that follow-up calls can refer to them; no name or contact data is part of this cache.

Booking data (concierge switch). If the user asks their agent to book a tariff, the Service receives the data required for the contract application: salutation, first and last name, date of birth, email address, phone number (optional), street and house number (the postal code and city come from the comparison), previous provider and customer number (or the move-in date for a move), meter number, desired start date, IBAN and account holder for the SEPA direct debit mandate, and the user's explicit consent. This data is stored encrypted (AES-256-GCM) on our infrastructure and used solely to submit the contract application to the chosen provider through our data partner's order form, to send the confirmation email, and to answer the user's questions about the request.

Emails. We send a confirmation email to the email address provided in a booking, and an internal notification to our operator that contains only the request reference, provider and tariff, never personal data.

Broadband comparison inputs (US). For a US fixed broadband comparison, the Service processes the street address or coordinates the user's agent supplies only to look up the US Census block it falls in. The address or coordinates are sent to the US Census Bureau Geocoder for that lookup (see Section 5) and are not stored or logged by Commerce for Agents. Analytics only counts broadband comparison calls (see below), so the address is not part of our analytics data either.

Mobile plan comparison inputs (US). For a US mobile phone plan comparison, the Service processes the number of lines, data need, budget per line, preferred network, prepaid or postpaid preference and must-have features the user's agent supplies. These are comparison inputs, matched against a catalog held by the Service; no address, location or phone number is requested, and nothing is sent to a carrier. Like the other comparison inputs, they are part of analytics data (see below).

VPN plan comparison inputs (US). For a VPN plan comparison, the Service processes the preferred term, minimum number of devices, needed features (streaming, p2p, dedicated IP), an optional two-letter country code and whether checkout links are wanted, all supplied by the user's agent. These are comparison inputs, matched against a catalog held by the Service; no address, precise location or account is requested, and nothing is sent to a VPN provider. Like the other comparison inputs, they are part of analytics data (see below).

Travel eSIM comparison inputs. For a travel eSIM comparison, the Service processes the destination country, trip length, data need, unlimited preference and provider filter the user's agent supplies. These are not personal data; the packages shown are cached for 24 hours so they can be referenced later.

Usage and analytics data. To operate and improve the Service we collect usage data through our own analytics system (Yavio SDK). For each tool call this includes the tool name, timing and status, the comparison inputs described above, the tool response, a pseudonymous user identifier and session identifier provided by the host platform, the language setting, the browser or client identification, and the approximate location the host platform relays with the request (country, region, city, and coordinates). Booking data is never part of analytics: the booking tool is excluded from input and output capture. For the broadband comparison tool, analytics records only that a call happened: the tool name, timing, status and the host platform (for example ChatGPT or Claude), plus random call and session identifiers. Its inputs and response, the user's address or coordinates, any location, language or client identification, and any error details are never captured by analytics. Analytics data is processed and stored on our Google Cloud infrastructure within the European Economic Area (EEA).

Website. This website is delivered through Cloudflare, which may process IP addresses in connection logs to serve and protect the site. We use Google Analytics 4 to measure how the website is used: pages viewed, time of the visit, referring page, device and browser information, and an approximate location derived from the IP address (Google Analytics 4 does not store IP addresses). For this, Google Analytics sets the cookies _ga and _ga_<ID> (lifetime up to 2 years). Google signals and advertising features are switched off. You can prevent the collection by blocking cookies or scripts from googletagmanager.com in your browser, or with Google's browser add-on (https://tools.google.com/dlpage/gaoptout). The MCP service itself does not use Google Analytics.

4. Legal basis for processing (GDPR)

Comparison (Art. 6(1)(b) GDPR). Processing the comparison inputs and forwarding them to our data partner is necessary to provide the comparison the user requested.

Concierge switch (Art. 6(1)(b) GDPR). Processing the booking data is necessary to perform the switching service the user requested, including submitting the contract application to the provider on the user's behalf and sending the confirmation email.

Analytics (Art. 6(1)(f) GDPR). The collection of usage data is based on our legitimate interest in operating, securing and improving the Service. You may object to this processing at any time by contacting us (see Section 12).

Broadband comparison (Art. 6(1)(b) GDPR). Processing the address or coordinates is necessary to provide the comparison the user requested.

Third-country transfer to the US Census Bureau (Art. 49(1)(b) GDPR). Sending the address to the US Census Bureau Geocoder is necessary for the performance of the broadband comparison the user requested.

Website analytics (Art. 6(1)(f) GDPR). The use of Google Analytics on this website is based on our legitimate interest in understanding how the website is used and improving it. You may object to this processing at any time (see Section 10 and the options in Section 3).

Where data does not constitute personal data, for example fully anonymized statistics, the GDPR does not apply to that processing.

5. Recipients and third-party services

Data partner. To provide comparisons and to submit contract applications, the Service transmits comparison inputs and, for a concierge switch, the booking data to our data partner, an energy tariff comparison provider based in Germany. The data partner and the energy provider process this data for the contract under their own privacy information and act as separate controllers for the contract relationship.

Energy providers. The provider of the chosen tariff receives the booking data as part of the contract application and becomes the user's contractual partner.

Host platforms. The Service operates through ChatGPT (OpenAI) and other clients that connect via MCP. Conversations within these clients, including any bill the user shares with their agent, are processed by the respective platform operator under its own privacy policy and terms. This processing is outside our control.

US Census Bureau Geocoder. To resolve a US broadband comparison to a census block, the Service sends the street address or coordinates the user's agent supplies to the US Census Bureau's Geocoder service, operated by the U.S. federal government. Only the address or coordinates are transmitted for this lookup; Commerce for Agents does not store or log them.

Hosting (Google Cloud). The Service, the booking store and the analytics system run on infrastructure provided by Google Cloud, operated by Google Cloud EMEA Limited (Ireland), which acts as a processor for Yavio GmbH under Art. 28 GDPR. Data is hosted in Google Cloud regions within the EEA. To the extent Google's U.S. parent company may have access to data, we rely on the EU Standard Contractual Clauses and the EU-US Data Privacy Framework as transfer safeguards.

Email delivery (Brevo). Confirmation emails are sent through Brevo (Sendinblue GmbH, Germany / Brevo SAS, France), which acts as a processor under Art. 28 GDPR and processes the recipient address and email content within the EEA.

Street directory (OpenPLZ API). When the booking form opens, our server asks the OpenPLZ API (an open-data service for the official German street register) for the street names of the supply postal code, so the form can suggest them. Only the postal code is transmitted, no personal data.

Website delivery (Cloudflare). This website is served by Cloudflare, Inc. under its data processing terms; Cloudflare may process connection data such as IP addresses to deliver and protect the site.

Website analytics (Google Analytics). Usage data of this website is processed by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, as our processor under Art. 28 GDPR. Data may be transferred to Google LLC in the USA (see Section 6).

6. International data transfers

Our data partner, our hosting and our email provider process data within the EEA. Host platforms such as OpenAI may process data on servers located outside the EEA. By using the Service through such a platform, the user acknowledges that inputs may be transmitted to servers in countries that may not provide the same level of data protection as the EEA. Where applicable, we rely on Art. 49(1)(b) GDPR (transfer necessary for the performance of the requested service) or on the safeguards put in place by the respective platform operator.

Google Analytics may transfer website usage data to Google LLC in the USA. Google LLC is certified under the EU-US Data Privacy Framework; the transfer relies on the European Commission's adequacy decision for it (Art. 45 GDPR).

7. Data storage and retention

Comparison inputs are cached for up to 24 hours together with the offers of that comparison and then deleted automatically.

Booking data is retained until the contract application has been submitted to the provider and the provider has confirmed it, and is deleted no later than 180 days after submission, unless a longer retention period is required to answer an open request of the user or by law.

Analytics data is retained for 90 days and then deleted automatically.

Google Analytics data of this website is retained for 2 months and then deleted automatically.

8. Cookies and tracking technologies

The Service (the MCP server) uses no cookies. This website uses cookies only for Google Analytics (see Section 3). There are no advertising trackers, and no data is shared with advertising providers. For the Service we use our own analytics system (Yavio SDK) as described in Section 3.

9. Children's privacy

The Service is not directed at children under the age of 13, and a contract application requires the user to be of legal age. We do not knowingly collect data from children. If you believe we hold information related to a child, please contact us and we will address the request promptly.

10. Your rights

Under the GDPR you generally have the right to access, rectification, erasure, restriction of processing, data portability, and objection. You also have the right to lodge a complaint with a data protection supervisory authority, in particular in the EU Member State of your habitual residence, place of work, or place of the alleged infringement. For requests concerning the contract itself, please also contact the energy provider, which acts as a separate controller for the contract relationship.

11. Changes to this policy

We may update this Privacy Policy from time to time. The updated version will be posted at this URL with a revised effective date.

12. Contact

Questions about this Privacy Policy or requests regarding your data: contact@commerceforagents.com, or by post to the address in Section 1.