Privacy Policy

Effective date: August 26, 2026

This Privacy Policy explains how Yavio GmbH ("we", "us", "our") handles information in connection with Commerce for Agents ("the Service"). The Service is an energy tariff comparison and switching service designed to be used by AI agents on behalf of a human user. It is accessible through ChatGPT and, where available, other agentic clients via the Model Context Protocol (MCP). This website (commerceforagents.com) only describes the Service.

1. Data controller

2. What the Service does

The Service compares live electricity and gas tariffs for households in Germany and, on request, submits a contract application for a chosen tariff to the energy provider on the user's behalf ("concierge switch"). To produce a comparison, the Service forwards the inputs it receives in real time to our data partner, an energy tariff comparison provider based in Germany, which returns ranked offers.

3. Information we process

Comparison inputs. A German postal code, annual electricity or gas consumption in kWh, filter settings (for example eco tariffs, contract length, price guarantee, bonus handling, provider selection), and, if the user shares an energy bill with their agent, the current provider and tariff name, the future monthly payment, or the price components of the current contract. These inputs are transmitted to our data partner in real time to retrieve offers. The offers of a comparison are cached for up to 24 hours together with the postal code and consumption so that follow-up calls can refer to them; no name or contact data is part of this cache.

Booking data (concierge switch). If the user asks their agent to book a tariff, the Service receives the data required for the contract application: salutation, first and last name, date of birth, email address, phone number (optional), street and house number (the postal code and city come from the comparison), previous provider and customer number, meter number, desired start date, IBAN and account holder for the SEPA direct debit mandate, and the user's explicit consent. This data is stored encrypted (AES-256-GCM) on our infrastructure and used solely to submit the contract application to the chosen provider through our data partner's order form, to send the confirmation email, and to answer the user's questions about the request.

Emails. We send a confirmation email to the email address provided in a booking, and an internal notification to our operator that contains only the request reference, provider and tariff, never personal data.

Usage and analytics data. To operate and improve the Service we collect usage data through our own analytics system (Yavio SDK). For each tool call this includes the tool name, timing and status, the comparison inputs described above, the tool response, the intent sentence the AI agent provides with a call (a short statement of the user's goal), a pseudonymous user identifier and session identifier provided by the host platform, the language setting, the browser or client identification, and the approximate location the host platform relays with the request (country, region, city, and coordinates). Booking data is never part of analytics: the booking tool is excluded from input and output capture. Analytics data is processed and stored on our Google Cloud infrastructure within the European Economic Area (EEA).

Website. This website sets no cookies and runs no analytics. It is delivered through Cloudflare, which may process IP addresses in connection logs to serve and protect the site.

4. Legal basis for processing (GDPR)

Comparison (Art. 6(1)(b) GDPR). Processing the comparison inputs and forwarding them to our data partner is necessary to provide the comparison the user requested.

Concierge switch (Art. 6(1)(b) GDPR). Processing the booking data is necessary to perform the switching service the user requested, including submitting the contract application to the provider on the user's behalf and sending the confirmation email.

Analytics (Art. 6(1)(f) GDPR). The collection of usage data is based on our legitimate interest in operating, securing and improving the Service. You may object to this processing at any time by contacting us (see Section 12).

Where data does not constitute personal data, for example fully anonymized statistics, the GDPR does not apply to that processing.

5. Recipients and third-party services

Data partner. To provide comparisons and to submit contract applications, the Service transmits comparison inputs and, for a concierge switch, the booking data to our data partner, an energy tariff comparison provider based in Germany. The data partner and the energy provider process this data for the contract under their own privacy information and act as separate controllers for the contract relationship.

Energy providers. The provider of the chosen tariff receives the booking data as part of the contract application and becomes the user's contractual partner.

Host platforms. The Service operates through ChatGPT (OpenAI) and other clients that connect via MCP. Conversations within these clients, including any bill the user shares with their agent, are processed by the respective platform operator under its own privacy policy and terms. This processing is outside our control.

Hosting (Google Cloud). The Service, the booking store and the analytics system run on infrastructure provided by Google Cloud, operated by Google Cloud EMEA Limited (Ireland), which acts as a processor for Yavio GmbH under Art. 28 GDPR. Data is hosted in Google Cloud regions within the EEA. To the extent Google's U.S. parent company may have access to data, we rely on the EU Standard Contractual Clauses and the EU-US Data Privacy Framework as transfer safeguards.

Email delivery (Brevo). Confirmation emails are sent through Brevo (Sendinblue GmbH, Germany / Brevo SAS, France), which acts as a processor under Art. 28 GDPR and processes the recipient address and email content within the EEA.

Website delivery (Cloudflare). This website is served by Cloudflare, Inc. under its data processing terms; Cloudflare may process connection data such as IP addresses to deliver and protect the site.

6. International data transfers

Our data partner, our hosting and our email provider process data within the EEA. Host platforms such as OpenAI may process data on servers located outside the EEA. By using the Service through such a platform, the user acknowledges that inputs may be transmitted to servers in countries that may not provide the same level of data protection as the EEA. Where applicable, we rely on Art. 49(1)(b) GDPR (transfer necessary for the performance of the requested service) or on the safeguards put in place by the respective platform operator.

7. Data storage and retention

Comparison inputs are cached for up to 24 hours together with the offers of that comparison and then deleted automatically.

Booking data is retained until the contract application has been submitted to the provider and the provider has confirmed it, and is deleted no later than 180 days after submission, unless a longer retention period is required to answer an open request of the user or by law.

Analytics data is retained for 90 days and then deleted automatically.

8. Cookies and tracking technologies

Neither the Service nor this website uses cookies or third-party advertising trackers. We use our own analytics system (Yavio SDK) as described in Section 3. No data is shared with advertising providers.

9. Children's privacy

The Service is not directed at children under the age of 13, and a contract application requires the user to be of legal age. We do not knowingly collect data from children. If you believe we hold information related to a child, please contact us and we will address the request promptly.

10. Your rights

Under the GDPR you generally have the right to access, rectification, erasure, restriction of processing, data portability, and objection. You also have the right to lodge a complaint with a data protection supervisory authority, in particular in the EU Member State of your habitual residence, place of work, or place of the alleged infringement. For requests concerning the contract itself, please also contact the energy provider, which acts as a separate controller for the contract relationship.

11. Changes to this policy

We may update this Privacy Policy from time to time. The updated version will be posted at this URL with a revised effective date.

12. Contact

Questions about this Privacy Policy or requests regarding your data: contact@yavio.ai, or by post to the address in Section 1.