Privacy Policy

This is a courtesy translation. The German version (Datenschutzerklärung) is legally binding.

Preamble

With the following privacy policy, we would like to inform you about the types of your personal data (hereinafter also referred to briefly as “data”) we process, for what purposes and to what extent. This privacy policy applies to all processing of personal data carried out by us, both in the provision of our services and, in particular, on our websites, in mobile applications and within external online presences, such as our social media profiles (hereinafter collectively referred to as our “online offering”).

The terms used are not gender-specific.

Last updated: 26 October 2026

Table of contents

• Preamble
• Controller
• Overview of processing
• Applicable legal bases
• Security measures
• Transfer of personal data
• International data transfers
• General information on data storage and deletion
• Rights of data subjects
• Business services
• Provision of the online offering and web hosting
• Use of cookies
• Registration, sign-in and user account
• Single sign-on
• Contact and enquiry management
• Social media presences
• Plug-ins and embedded functions and content
• Hosting through Lovable, database and content delivery network
• Use of the meinekapa app and processing through artificial intelligence
• Browser storage and offline functionality (home-screen app)
• Audience measurement without cookies
• Feedback
• Changes and updates
• Definitions

Controller

Daria Hacker
Selma-Lagerlöf-Str. 4
13189 Berlin

Email address: hallo@meinekapa.de

Telephone: +4917670697783

Legal notice: https://meinekapa.de/impressum

Overview of processing

The following overview summarises the types of data processed and the purposes of their processing and refers to the data subjects.

Types of data processed

• Master data.
• Payment data.
• Contact data.
• Content data.
• Contract data.
• Usage data.
• Metadata, communication and procedural data.
• Log data.

Categories of data subjects

• Service recipients and clients.
• Prospective customers.
• Communication partners.
• Users.
• Business and contractual partners.
• Education and course participants.

Purposes of processing

• Provision of contractual services and fulfilment of contractual obligations.
• Communication.
• Security measures.
• Office and organisational procedures.
• Organisational and administrative procedures.
• Feedback.
• Sign-in procedures.
• Provision of our online offering and user-friendliness.
• Information technology infrastructure.
• Public relations.
• Business processes and business management procedures.

Applicable legal bases

Applicable legal bases under the GDPR: Below you will find an overview of the legal bases under the GDPR on which we process personal data. Please note that, in addition to the provisions of the GDPR, national data protection requirements may apply in your or our country of residence or establishment. If more specific legal bases apply in individual cases, we will inform you of these in the privacy policy.

• Consent (Art. 6(1), first sentence, point (a) GDPR) — The data subject has given consent to the processing of their personal data for a specific purpose or several specific purposes.
• Performance of a contract and pre-contractual enquiries (Art. 6(1), first sentence, point (b) GDPR) — Processing is necessary for the performance of a contract to which the data subject is party or to take steps at the data subject’s request prior to entering into a contract.
• Legal obligation (Art. 6(1), first sentence, point (c) GDPR) — Processing is necessary for compliance with a legal obligation to which the controller is subject.
• Legitimate interests (Art. 6(1), first sentence, point (f) GDPR) — Processing is necessary to safeguard the legitimate interests of the controller or a third party, provided that the interests, fundamental rights and freedoms of the data subject requiring protection of personal data do not override those interests.

National data protection provisions in Germany: In addition to the data protection provisions of the GDPR, national data protection provisions apply in Germany. These include, in particular, the Federal Data Protection Act (BDSG). The BDSG contains, in particular, special provisions on the right of access, the right to erasure, the right to object, processing of special categories of personal data, processing for other purposes and transfer, as well as automated decision-making in individual cases, including profiling. The data protection laws of individual federal states may also apply.

Security measures

In accordance with legal requirements, taking into account the state of the art, implementation costs, the nature, scope, circumstances and purposes of processing, as well as the varying likelihood and severity of threats to the rights and freedoms of natural persons, we take appropriate technical and organisational measures to ensure a level of security appropriate to the risk.

These measures include, in particular, safeguarding the confidentiality, integrity and availability of data by controlling physical and electronic access to data, as well as access concerning its input, disclosure, availability and separation. Furthermore, we have established procedures that ensure the exercise of data subject rights, deletion of data and responses to risks to data. We also take protection of personal data into account when developing or selecting hardware, software and procedures, in accordance with the principle of data protection by design and by privacy-friendly default settings.

Securing online connections through TLS/SSL encryption technology (HTTPS): To protect users’ data transmitted through our online services against unauthorised access, we use TLS/SSL encryption technology. Secure Sockets Layer (SSL) and Transport Layer Security (TLS) are the cornerstones of secure data transmission on the internet. These technologies encrypt the information transmitted between the website or app and the user’s browser (or between two servers), protecting data against unauthorised access. TLS, as the further developed and more secure version of SSL, ensures that all data transfers meet the highest security standards. When a website is secured by an SSL/TLS certificate, this is signalled by HTTPS in the URL. This serves as an indication to users that their data is transmitted securely and in encrypted form.

Transfer of personal data

In the course of our processing of personal data, data may be transferred to or disclosed to other bodies, companies, legally independent organisational units or persons. Recipients of such data may include, for example, service providers entrusted with IT tasks or providers of services and content embedded in a website. In such cases, we observe legal requirements and, in particular, conclude appropriate contracts or agreements with the recipients of your data that serve to protect your data.

International data transfers

Data processing in third countries: If we transfer data to a third country (i.e. outside the European Union (EU) or the European Economic Area (EEA)), or if this occurs in the course of using third-party services or disclosing or transferring data to other persons, bodies or companies (as can be recognised from the respective provider’s postal address or where the third-country transfer is expressly mentioned in the privacy policy), this always takes place in accordance with legal requirements.

For data transfers to the USA, we primarily rely on the Data Privacy Framework (DPF), which was recognised as a secure legal framework by an adequacy decision of the European Commission dated 10 July 2023. In addition, we have concluded standard contractual clauses with the respective providers that comply with the requirements of the European Commission and establish contractual obligations to protect your data.

This dual safeguard ensures comprehensive protection of your data: the DPF forms the primary layer of protection, while the standard contractual clauses serve as additional security. Should changes occur in the DPF, the standard contractual clauses provide a reliable fallback option. In this way, we ensure that your data remains appropriately protected even in the event of political or legal changes.

For individual service providers, we inform you whether they are certified under the DPF and whether standard contractual clauses are in place. Further information about the DPF and a list of certified companies can be found on the US Department of Commerce website at https://www.dataprivacyframework.gov/ (in English).

For data transfers to other third countries, appropriate safeguards apply, in particular standard contractual clauses, explicit consent or transfers required by law. Information on third-country transfers and applicable adequacy decisions can be found in the European Commission’s information offering: https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection_en?prefLang=de.

General information on data storage and deletion

We delete personal data that we process in accordance with statutory provisions as soon as the underlying consents are withdrawn or no further legal bases for processing exist. This concerns cases in which the original processing purpose ceases to apply or the data is no longer required. Exceptions to this rule apply where legal obligations or special interests require longer retention or archiving of the data.

In particular, data that must be retained for commercial or tax reasons, or whose storage is necessary for pursuing legal claims or protecting the rights of other natural or legal persons, must be archived accordingly.

Our privacy information contains additional information on retention and deletion of data that applies specifically to certain processing operations.

Where several retention periods or deletion deadlines are specified for a piece of data, the longest period always applies. Data that we no longer process for its original purpose but retain because of legal requirements or other reasons is processed exclusively for the reasons justifying its retention.

Retention and deletion of data: The following general periods apply to retention and archiving under German law:

• 10 years — Retention period for books and records, annual financial statements, inventories, management reports, opening balance sheets and the work instructions and other organisational documents required to understand them (§ 147 Abs. 1 Nr. 1 i.V.m. Abs. 3 AO, § 257 Abs. 1 Nr. 1 i.V.m. Abs. 4 HGB).
• 8 years — Accounting vouchers, such as invoices and expense receipts (§ 147 Abs. 1 Nr. 4 und 4a i.V.m. Abs. 3 Satz 1 AO, § 14b Abs. 1 UStG sowie § 257 Abs. 1 Nr. 4 i.V.m. Abs. 4 HGB).
• 6 years — Other business documents: received commercial or business letters, reproductions of sent commercial or business letters, and other documents relevant to taxation, such as timesheets, operating cost statements, calculation documents, price labels, as well as payroll documents insofar as these are not already accounting vouchers, and cash register tapes (§ 147 Abs. 1 Nr. 2, 3, 5 i.V.m. Abs. 3 AO, § 257 Abs. 1 Nr. 2 u. 3 i.V.m. Abs. 4 HGB).
• 3 years — Data required to consider potential warranty and compensation claims or similar contractual claims and rights, as well as to handle related enquiries, is stored for the duration of the regular statutory limitation period of three years, based on previous business experience and customary industry practices (§§ 195, 199 BGB).

Period beginning at the end of the year: If a period does not expressly begin on a particular date and is at least one year long, it starts automatically at the end of the calendar year in which the event triggering the period occurred. In the case of ongoing contractual relationships in which data is stored, the event triggering the period is the time at which termination or another ending of the contractual relationship takes effect.

Rights of data subjects

Rights of data subjects under the GDPR: As a data subject, you have various rights under the GDPR, arising in particular from Articles 15 to 21 GDPR:

• Right to object: You have the right, on grounds relating to your particular situation, to object at any time to processing of personal data concerning you based on Art. 6(1), point (e) or (f) GDPR; this also applies to profiling based on these provisions. Where personal data concerning you is processed for direct marketing purposes, you have the right to object at any time to processing of personal data concerning you for such marketing; this also applies to profiling insofar as it is related to such direct marketing.
• Right to withdraw consent: You have the right to withdraw consent you have given at any time.
• Right of access: You have the right to request confirmation as to whether relevant data is being processed, access to that data, further information and a copy of the data in accordance with statutory requirements.
• Right to rectification: In accordance with statutory requirements, you have the right to request completion of data concerning you or rectification of inaccurate data concerning you.
• Right to erasure and restriction of processing: In accordance with statutory requirements, you have the right to request that relevant data be erased without undue delay or, alternatively, to request restriction of processing of the data.
• Right to data portability: You have the right to receive data concerning you that you have provided to us in a structured, commonly used and machine-readable format in accordance with statutory requirements, or to request its transmission to another controller.
• Right to lodge a complaint with a supervisory authority: Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a data protection supervisory authority if you consider that processing of personal data concerning you infringes the GDPR. The complaint may be lodged, in particular, with a supervisory authority in the Member State of your habitual residence, place of work or the place of the alleged infringement.

Business services

We process personal data of our contractual and business partners, such as customers, clients, prospective customers, suppliers and other cooperation partners (collectively “contractual partners”), to initiate, perform and settle contractual relationships and comparable legal relationships. This also includes pre-contractual measures taken upon request and communication in connection with the respective contractual relationship.

Processing serves, in particular, to fulfil our main and ancillary contractual obligations. These include provision of the agreed services, any updating and information obligations, handling of warranty claims and other performance disruptions, processing of withdrawals, termination of continuing contractual relationships, reversals, refunds, and handling of other contract-related declarations and enquiries. Both one-off contracts and ongoing contractual relationships are covered.

In particular, we process master data such as name, address and, where applicable, company, contact data such as email address and telephone number, contract and service data such as the subject matter and duration of the contract, order or transaction number, usage and performance data, payment and billing data, as well as communication content and history. Where necessary, we also process data disclosed or transferred to us in the course of carrying out an assignment.

We also process data to safeguard our rights and fulfil legal obligations. This includes, in particular, commercial and tax retention obligations, documentation obligations and, where applicable, evidence and accountability obligations. Processing also takes place on the basis of our legitimate interests in proper business management, internal administration, risk management and IT security, and in protecting our business operations and contractual partners against misuse, threats to data, secrets and other legally protected interests. This may also involve external service providers such as IT and telecommunications providers, transport and logistics companies, payment service providers, banks, tax and legal advisers or other agents, insofar as necessary to perform the contract or fulfil legal obligations.

Personal data is disclosed to third parties exclusively insofar as necessary to perform the contract, carry out pre-contractual measures, safeguard legitimate interests or fulfil legal obligations. We provide separate information in this privacy policy about any processing beyond this, in particular for marketing purposes.

We inform contractual partners which data is required in each case when collecting it, for example through appropriate markings in online forms or during personal contact.

Data is deleted as soon as it is no longer required for the aforementioned purposes and no legal retention obligations prevent deletion. Statutory retention periods, particularly under commercial and tax law, may require longer storage. We delete data transferred in the context of a specific assignment after completion of the assignment and expiry of any retention periods, provided there are no further statutory or contractual obligations to store it.

The legal basis for processing is Art. 6(1), point (b) GDPR for carrying out pre-contractual measures and performing the respective contractual relationship, and Art. 6(1), point (c) GDPR for fulfilling legal obligations. Where processing is based on legitimate interests, it takes place on the basis of Art. 6(1), point (f) GDPR. Where processing is based on Art. 6(1), point (f) GDPR, it serves to safeguard our legitimate interests in a proper and efficient business organisation, internal administration and documentation of business transactions, assertion and defence of legal claims, ensuring IT and data security, preventing misuse and fraud, and economic management and development of our business operations. These interests consist, in particular, in ensuring secure and legally compliant business operations and maintaining our entrepreneurial ability to act.

• Types of data processed: Master data (e.g. full name, residential address, contact information, customer number, etc.); payment data (e.g. bank details, invoices, payment history); contact data (e.g. postal and email addresses or telephone numbers). Contract data (e.g. subject matter, duration, customer category).
• Data subjects: Service recipients and clients; prospective customers; business and contractual partners. Education and course participants.
• Purposes of processing and legitimate interests: Provision of contractual services and fulfilment of contractual obligations; communication; office and organisational procedures; organisational and administrative procedures. Business processes and business management procedures.
• Retention and deletion: Deletion in accordance with the information in the section “General information on data storage and deletion”.
• Legal bases: Performance of a contract and pre-contractual enquiries (Art. 6(1), first sentence, point (b) GDPR); legal obligation (Art. 6(1), first sentence, point (c) GDPR). Legitimate interests (Art. 6(1), first sentence, point (f) GDPR).

Further information on processing operations, procedures and services:

• Education and training services: We process the data of participants in our education and training offerings (uniformly referred to as “trainees”) to provide our training services to them. The data processed, its type, scope, purpose and necessity are determined by the underlying contractual and training relationship. Forms of processing also include performance assessment and evaluation of our services and those of the teachers. In the course of our activities, we may also process special categories of data, in particular information concerning trainees’ health and data revealing ethnic origin, political opinions, religious or philosophical beliefs. Where necessary, we obtain explicit consent from trainees for this and otherwise process special categories of data only where necessary to provide training services, for purposes of preventive healthcare, social protection or protection of trainees’ vital interests; Legal bases: Performance of a contract and pre-contractual enquiries (Art. 6(1), first sentence, point (b) GDPR).

Provision of the online offering and web hosting

We process users’ data to make our online services available to them. For this purpose, we process the user’s IP address, which is necessary to transmit the content and functions of our online services to the user’s browser or device.

• Types of data processed: Usage data (e.g. page views and time spent, click paths, intensity and frequency of use, device types and operating systems used, interactions with content and functions); metadata, communication and procedural data (e.g. IP addresses, times, identification numbers, persons involved); log data (e.g. log files concerning sign-ins, data retrieval or access times). Content data (e.g. text or image messages and posts and related information, such as authorship details or time of creation).
• Data subjects: Users (e.g. website visitors, users of online services).
• Purposes of processing and legitimate interests: Provision of our online offering and user-friendliness; information technology infrastructure (operation and provision of information systems and technical equipment such as computers, servers, etc.). Security measures.
• Retention and deletion: Deletion in accordance with the information in the section “General information on data storage and deletion”.
• Legal bases: Legitimate interests (Art. 6(1), first sentence, point (f) GDPR).

Further information on processing operations, procedures and services:

• Provision of the online offering on rented storage space: To provide our online offering, we use storage space, computing capacity and software that we rent or otherwise obtain from an appropriate server provider (also referred to as a “web host”); Legal bases: Legitimate interests (Art. 6(1), first sentence, point (f) GDPR).
• Collection of access data and log files: Access to our online offering is recorded in the form of “server log files”. Server log files may include the address and name of retrieved websites and files, date and time of retrieval, data volumes transmitted, notification of successful retrieval, browser type and version, the user’s operating system, referrer URL (the previously visited page) and, as a rule, IP addresses and the requesting provider. Server log files may be used for security purposes, for example to prevent server overload (particularly in the case of abusive attacks, known as DDoS attacks), and to ensure server utilisation and stability; Legal bases: Legitimate interests (Art. 6(1), first sentence, point (f) GDPR). Deletion of data: Log file information is stored for a maximum of 30 days and then deleted or anonymised. Data whose further retention is required for evidentiary purposes is excluded from deletion until the respective incident has been conclusively clarified.
• Email sending and hosting: The web hosting services we use also include sending, receiving and storing emails. For these purposes, recipient and sender addresses, other information concerning email sending (e.g. providers involved), and the contents of the respective emails are processed. This data may also be processed to detect spam. Please note that emails on the internet are generally not sent in encrypted form. As a rule, emails are encrypted during transport, but, unless end-to-end encryption is used, not on the servers from which they are sent and received. We therefore cannot accept responsibility for the transmission path of emails between the sender and receipt on our server; Legal bases: Legitimate interests (Art. 6(1), first sentence, point (f) GDPR).
• Content delivery network: We use a “content delivery network” (CDN). A CDN is a service that allows content of an online offering, particularly large media files such as graphics or program scripts, to be delivered faster and more securely through regionally distributed servers connected via the internet; Legal bases: Legitimate interests (Art. 6(1), first sentence, point (f) GDPR).

Use of cookies

The term “cookies” refers to functions that store information on users’ devices and read it from those devices. Cookies can also be used for various purposes, such as functionality, security and convenience of online offerings and analysis of visitor flows. We use cookies in accordance with legal provisions. For this purpose, we obtain users’ prior consent where necessary. Where consent is not necessary, we rely on our legitimate interests. This applies where storing and reading information is essential to provide expressly requested content and functions. This includes, for example, storing settings and ensuring the functionality and security of our online offering. Consent can be withdrawn at any time. We provide clear information about its scope and which cookies are used.

Information on legal bases under data protection law: Whether we process personal data using cookies depends on consent. If consent has been given, it serves as the legal basis. Without consent, we rely on our legitimate interests, which are explained above in this section and in the context of the respective services and procedures.

Storage duration: With regard to storage duration, the following types of cookies are distinguished:

• Temporary cookies (also: session cookies): Temporary cookies are deleted at the latest after a user has left an online offering and closed their device (e.g. browser or mobile application).
• Permanent cookies: Permanent cookies remain stored even after the device is closed. For example, the sign-in status may be stored and preferred content displayed directly when a user revisits a website. User data collected using cookies may also be used for audience measurement. Unless we provide users with explicit information on the type and storage duration of cookies (e.g. when obtaining consent), they should assume that these are permanent and may be stored for up to two years.

General information on withdrawal and objection (opt-out): Users may withdraw consents they have given at any time and may also object to processing in accordance with statutory requirements, including through their browser’s privacy settings.

• Types of data processed: Metadata, communication and procedural data (e.g. IP addresses, times, identification numbers, persons involved).
• Data subjects: Users (e.g. website visitors, users of online services).
• Legal bases: Legitimate interests (Art. 6(1), first sentence, point (f) GDPR).

Registration, sign-in and user account

Users can create a user account. During registration, users are informed of the required mandatory information, which is processed to provide the user account on the basis of fulfilment of contractual obligations. The data processed includes, in particular, sign-in information (username, password and an email address).

When users use our registration and sign-in functions and their user account, we store the IP address and time of the respective user action. Storage takes place on the basis of our legitimate interests and those of users in protection against misuse and other unauthorised use. As a rule, this data is not disclosed to third parties unless necessary to pursue our claims or there is a legal obligation to do so.

Users may be informed by email about matters relevant to their user account, such as technical changes.

• Types of data processed: Master data (e.g. full name, residential address, contact information, customer number, etc.); contact data (e.g. postal and email addresses or telephone numbers); content data (e.g. text or image messages and posts and related information, such as authorship details or time of creation); usage data (e.g. page views and time spent, click paths, intensity and frequency of use, device types and operating systems used, interactions with content and functions). Log data (e.g. log files concerning sign-ins, data retrieval or access times).
• Data subjects: Users (e.g. website visitors, users of online services).
• Purposes of processing and legitimate interests: Provision of contractual services and fulfilment of contractual obligations; security measures; organisational and administrative procedures. Provision of our online offering and user-friendliness.
• Retention and deletion: Deletion in accordance with the information in the section “General information on data storage and deletion”. Deletion after termination.
• Legal bases: Performance of a contract and pre-contractual enquiries (Art. 6(1), first sentence, point (b) GDPR). Legitimate interests (Art. 6(1), first sentence, point (f) GDPR).

Further information on processing operations, procedures and services:

• Registration with pseudonyms: Users may use pseudonyms as usernames instead of real names; Legal bases: Performance of a contract and pre-contractual enquiries (Art. 6(1), first sentence, point (b) GDPR).
• User profiles are not public: Users’ profiles are not publicly visible or accessible.
• Deletion of data after termination: If users have terminated their user account, their data relating to the user account is deleted, subject to statutory permission, obligation or consent; Legal bases: Performance of a contract and pre-contractual enquiries (Art. 6(1), first sentence, point (b) GDPR).
• No obligation to retain data: Users are responsible for backing up their data before the end of the contract following termination. We are entitled to irretrievably delete all of the user’s data stored during the contractual period; Legal bases: Performance of a contract and pre-contractual enquiries (Art. 6(1), first sentence, point (b) GDPR).

Single sign-on

“Single sign-on”, “single sign-on registration” or “single sign-on authentication” refers to procedures that allow users to sign in to our online offering using a user account with a provider of single sign-on procedures (e.g. a social network). Single sign-on authentication requires users to be registered with the respective single sign-on provider and to enter the required access details in the online form provided for this purpose, or already be signed in with the single sign-on provider and confirm single sign-on using a button.

Authentication takes place directly with the respective single sign-on provider. In the course of such authentication, we receive a user ID with information that the user is signed in under this user ID with the respective single sign-on provider, and an ID that we cannot otherwise use for other purposes (a “user handle”). Whether additional data is transferred to us depends solely on the single sign-on procedure used, the data-sharing choices made during authentication, and the data users have shared in the privacy or other settings of their user account with the single sign-on provider. Depending on the single sign-on provider and users’ choices, various data may be involved, generally the email address and username. The password entered with the single sign-on provider as part of the single sign-on procedure is neither visible to us nor stored by us.

Users are asked to note that their details stored with us may be automatically compared with their user account with the single sign-on provider, although this is not always possible or actually carried out. If, for example, users’ email addresses change, they must change them manually in their user account with us.

We may use single sign-on, where agreed with users, in the course of or prior to performance of a contract insofar as users have requested it; process it on the basis of consent; and otherwise use it on the basis of our legitimate interests and users’ interests in an effective and secure sign-in system.

If users decide that they no longer wish to use the connection of their user account with the single sign-on provider for single sign-on, they must remove this connection within their user account with the single sign-on provider. If users wish to delete their data with us, they must terminate their registration with us.

• Types of data processed: Master data (e.g. full name, residential address, contact information, customer number, etc.); contact data (e.g. postal and email addresses or telephone numbers); usage data (e.g. page views and time spent, click paths, intensity and frequency of use, device types and operating systems used, interactions with content and functions). Metadata, communication and procedural data (e.g. IP addresses, times, identification numbers, persons involved).
• Data subjects: Users (e.g. website visitors, users of online services).
• Purposes of processing and legitimate interests: Provision of contractual services and fulfilment of contractual obligations; security measures; sign-in procedures. Provision of our online offering and user-friendliness.
• Retention and deletion: Deletion in accordance with the information in the section “General information on data storage and deletion”.
• Legal bases: Legitimate interests (Art. 6(1), first sentence, point (f) GDPR).

Further information on processing operations, procedures and services:

• Google single sign-on: Authentication services for user sign-ins, provision of single sign-on functions, management of identity information and application integrations; Service provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; Legal bases: Legitimate interests (Art. 6(1), first sentence, point (f) GDPR); Website: https://www.google.com/; Privacy policy: https://business.safety.google/privacy/; Basis for third-country transfers: Data Privacy Framework (DPF). Option to object (opt-out): Settings for displaying advertisements: https://myadcenter.google.com/.

Contact and enquiry management

When you contact us (e.g. by post, contact form, email, telephone or social media), and in the context of existing user and business relationships, the details of the enquiring persons are processed insofar as necessary to respond to contact enquiries and any requested measures.

• Types of data processed: Contact data (e.g. postal and email addresses or telephone numbers). Content data (e.g. text or image messages and posts and related information, such as authorship details or time of creation).
• Data subjects: Communication partners.
• Purposes of processing and legitimate interests: Communication; organisational and administrative procedures; feedback (e.g. collecting feedback through an online form). Provision of our online offering and user-friendliness.
• Retention and deletion: Deletion in accordance with the information in the section “General information on data storage and deletion”.
• Legal bases: Legitimate interests (Art. 6(1), first sentence, point (f) GDPR).

Social media presences

We maintain online presences within social networks and process user data in this context to communicate with users active there or provide information about us.

We point out that user data may be processed outside the European Union. This may entail risks for users because, for example, enforcing users’ rights may be more difficult.

Furthermore, users’ data within social networks is generally processed for market research and advertising purposes. For example, usage profiles may be created on the basis of users’ behaviour and the resulting interests. These profiles may in turn be used to display advertisements within and outside the networks that presumably correspond to users’ interests. For this reason, cookies are generally stored on users’ computers that record users’ behaviour and interests. Data may also be stored in usage profiles independently of the devices used by users (particularly if they are members of the respective platforms and signed in to them).

For a detailed description of the respective forms of processing and the options to object (opt-out), we refer you to the privacy policies and information provided by the operators of the respective networks.

In the case of requests for information and the exercise of data subject rights, we also point out that these can be asserted most effectively with the providers. Only the providers have access to users’ data and can take appropriate measures and provide information directly. If you nevertheless need help, you can contact us.

• Types of data processed: Contact data (e.g. postal and email addresses or telephone numbers); content data (e.g. text or image messages and posts and related information, such as authorship details or time of creation). Usage data (e.g. page views and time spent, click paths, intensity and frequency of use, device types and operating systems used, interactions with content and functions).
• Data subjects: Users (e.g. website visitors, users of online services).
• Purposes of processing and legitimate interests: Communication; feedback (e.g. collecting feedback through an online form). Public relations.
• Retention and deletion: Deletion in accordance with the information in the section “General information on data storage and deletion”.
• Legal bases: Legitimate interests (Art. 6(1), first sentence, point (f) GDPR).

Further information on processing operations, procedures and services:

• Instagram: Social network enabling sharing of photos and videos, commenting on and favouriting posts, sending messages, subscribing to profiles and pages; Service provider: Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland; Legal bases: Legitimate interests (Art. 6(1), first sentence, point (f) GDPR); Website: https://www.instagram.com; Privacy policy: https://privacycenter.instagram.com/policy/. Basis for third-country transfers: Data Privacy Framework (DPF).

Plug-ins and embedded functions and content

We embed functional and content elements in our online offering that are obtained from the servers of their respective providers (hereinafter referred to as “third-party providers”). These may include, for example, graphics, videos or maps (hereinafter collectively referred to as “content”).

Embedding always requires the third-party providers of this content to process users’ IP addresses, as they cannot send the content to users’ browsers without the IP address. The IP address is therefore required to display this content or these functions. We endeavour to use only content whose respective providers use the IP address solely to deliver the content. Third-party providers may also use pixel tags (invisible graphics, also known as “web beacons”) for statistical or marketing purposes. Pixel tags allow information such as visitor traffic on the pages of this website to be evaluated. The pseudonymous information may also be stored in cookies on users’ devices and may include technical information about the browser and operating system, referring websites, time of visit and other details concerning use of our online offering, and may also be linked to such information from other sources.

Information on legal bases: Where we ask users for their consent to use third-party providers, the legal basis for processing is consent. Otherwise, users’ data is processed on the basis of our legitimate interests (i.e. an interest in efficient, economical and recipient-friendly services). In this context, we would also like to refer you to the information on use of cookies in this privacy policy.

• Types of data processed: Usage data (e.g. page views and time spent, click paths, intensity and frequency of use, device types and operating systems used, interactions with content and functions). Metadata, communication and procedural data (e.g. IP addresses, times, identification numbers, persons involved).
• Data subjects: Users (e.g. website visitors, users of online services).
• Purposes of processing and legitimate interests: Provision of our online offering and user-friendliness.
• Retention and deletion: Deletion in accordance with the information in the section “General information on data storage and deletion”. Storage of cookies for up to 2 years (unless stated otherwise, cookies and similar storage methods may be stored on users’ devices for a period of two years).
• Legal bases: Consent (Art. 6(1), first sentence, point (a) GDPR). Legitimate interests (Art. 6(1), first sentence, point (f) GDPR).

Further information on processing operations, procedures and services:

• Google Fonts (provided on our own server): Provision of font files for a user-friendly display of our online offering; Service provider: Google Fonts are hosted on our server; no data is transferred to Google; Legal bases: Legitimate interests (Art. 6(1), first sentence, point (f) GDPR).

Hosting through Lovable, database and content delivery network

Our website and app meinekapa.de is operated through the Lovable platform (Lovable Labs Incorporated, 1 Lincoln St, Boston, MA 02111, USA). Lovable provides web hosting, the database, user management (sign-in) and the app’s server-side functions. The database is operated in a data centre in Frankfurt am Main (Germany). A content delivery network is used for fast and secure delivery of the website (Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA); a technically necessary security cookie may be set to defend against bot attacks.

Lovable and Cloudflare are based in the USA. Personal data is transferred to the USA on the basis of the EU standard contractual clauses that these providers have concluded with their service providers or — insofar as the provider is certified — the Data Privacy Framework (see the section “International data transfers”).

• Types of data processed: Usage data; metadata, communication and procedural data (e.g. IP addresses); master data and content data of registered users.
• Legal bases: Legitimate interests (Art. 6(1), first sentence, point (f) GDPR) in secure and efficient operation; performance of a contract (Art. 6(1), first sentence, point (b) GDPR), insofar as a user account exists.
• Privacy policies: https://lovable.dev/privacy; https://www.cloudflare.com/privacypolicy/.

Use of the meinekapa app and processing through artificial intelligence

How it works: In meinekapa, you describe a situation in your own words (by typing or using voice input). The app creates suitable suggestions (“cards”) from it. For this purpose, your text is transmitted through a server-side function to Lovable’s AI gateway (Lovable Labs Incorporated) and from there to the AI provider OpenAI (USA). Your browser does not connect directly to OpenAI.

Varied suggestions: To keep the suggestions varied, we store which card templates were shown to you recently (only the template identifier, never your text) – when signed in, in your account for at most 60 days; when not signed in, only in your browser.

No storage of your text: The text you enter is processed exclusively to create your cards. The request to OpenAI is made with the setting that OpenAI does not store the content. We do not store your text in our database, log files, error reports or statistics — unless you expressly enable the “Memory” function (see below).

Voice input: If you use the microphone, the audio recording is created in the browser and transmitted to OpenAI through Lovable’s AI gateway to be converted into text. Neither the audio recording nor the resulting text is stored by us; the text appears only in your input field. Browser speech recognition (e.g. from Google) is not used.

Use without an account: You can use meinekapa three times without signing in. To prevent misuse of these free uses, we store a random device identifier in your browser (local storage) and an encrypted hash value of your IP address, which we delete after 24 hours. Your inputs (text or voice) are not stored. Legal basis: legitimate interest in preventing misuse (Art. 6(1)(1)(f) GDPR); storing the device identifier is strictly necessary for this function you have requested (Section 25(2) no. 2 TDDDG).

Please do not provide sensitive information: Please do not enter other people’s names or health details. The app is a coaching tool and does not replace medical or psychotherapeutic treatment. If your input nevertheless contains health information, we process it exclusively because you voluntarily enter it to create your cards (Art. 9(2), point (a) GDPR), and do not store it without your explicit consent to the “Memory” function.

“Memory” function (optional): Only if you are signed in and expressly enable the “Memory” function do we store your input in encrypted form so that the app can show you recurring patterns later. These entries are automatically deleted after 90 days. You can remove all entries at any time using “Delete all my entries” or turn the function off; you can withdraw your consent at any time with effect for the future. Legal basis: consent (Art. 6(1), first sentence, point (a) and Art. 9(2), point (a) GDPR).

Saved cards, role and feedback: If you are signed in, we store the cards you choose to save, your selected role (e.g. employee, manager, founder) and your voluntary feedback on individual cards (“helpful yes/no”, optionally a short note). This data remains stored until you delete it or delete your user account. Legal basis: performance of a contract (Art. 6(1), first sentence, point (b) GDPR) or, for feedback, legitimate interests in improving the app (Art. 6(1), first sentence, point (f) GDPR).

Usage statistics without content: To understand which functions are used, we count simple events (e.g. “Input”, “Copy”, “Save”, “Another idea”, “Quick rating (thumbs up/down)”). Neither your text nor your IP address is stored in the process. Legal basis: legitimate interests (Art. 6(1), first sentence, point (f) GDPR).

• AI service provider: OpenAI (USA), integrated as a subprocessor through Lovable Labs Incorporated; privacy policy: https://openai.com/policies/privacy-policy.
• Basis for third-country transfers: EU standard contractual clauses or, where available, Data Privacy Framework (DPF).

Browser storage and offline functionality (home-screen app)

meinekapa stores some information in your browser’s local storage (localStorage) so that the app works as requested: your selected language, whether the “Memory” function is enabled (and evidence of your consent to it), saved cards when using the app without an account, your selected role, an offline copy of your saved cards and — only if you are signed in — a sign-in token so that you remain signed in. This storage is strictly necessary to provide the functions you have expressly requested (§ 25 Abs. 2 Nr. 2 TDDDG). You can delete the data at any time through your browser settings.

If you install meinekapa on your device’s home screen, a so-called service worker stores only the app’s technical files (e.g. program code, images, fonts) so that it loads faster. Personal data is not cached in this process. We do not use tracking or advertising cookies.

Audience measurement without cookies

We use the visitor statistics integrated into Lovable. They count page views, visits, referring pages (referrers), countries and device types in aggregate form. No cookies are set and no information is stored on your device; each visit receives a random identifier that is discarded after the visit. No user profiles are created and visits are not linked across multiple visits. Legal basis: legitimate interests (Art. 6(1), first sentence, point (f) GDPR) in improving our offering.

Audience measurement without cookies: To understand how many people visit meinekapa.de and which channels they come from, we record the page visited, the referring website (domain only), campaign parameters from the link, the device type and the country when a page is opened. To count unique visits, we form a hash from the IP address and browser identifier using a key that changes daily; the IP address is not stored, and visits on different days cannot be linked to each other. No cookies are set and no data is stored in your browser. When you make a purchase, we store the source of the visit with the purchase. Legal basis: legitimate interest in improving our offering (Art. 6(1) sentence 1 lit. f GDPR). We delete the statistics data after 14 months.

Feedback

Feedback: If you send us a message via the feedback form, we store your text, the date and whether you have paid access. Only if you expressly agree do we quote your text with your first name or initials on our website; you can withdraw this consent at any time by email to hallo@meinekapa.de. Legal bases: legitimate interest in improving the app (Art. 6(1)(1)(f) GDPR) or your consent to publication (Art. 6(1)(1)(a) GDPR). We delete feedback that has not been published after 2 years.

Changes and updates

We ask you to regularly familiarise yourself with the contents of our privacy policy. We adapt the privacy policy as soon as changes to the data processing we carry out make this necessary. We inform you as soon as the changes require your participation (e.g. consent) or other individual notification.

Where we provide addresses and contact information of companies and organisations in this privacy policy, please note that addresses may change over time and check the information before making contact.

Berliner Beauftragte für Datenschutz und Informationsfreiheit
Alt-Moabit 59–61
10555 Berlin
Email: mailbox@datenschutz-berlin.de
Website: www.datenschutz-berlin.de

Definitions

This section provides an overview of the terminology used in this privacy policy. Insofar as terms are defined by law, their statutory definitions apply. The following explanations, however, are intended primarily to aid understanding.

• Master data: Master data comprises essential information required to identify and manage contractual partners, user accounts, profiles and similar allocations. This data may include personal and demographic details such as names, contact information (addresses, telephone numbers, email addresses), dates of birth and specific identifiers (user IDs). Master data forms the basis of all formal interaction between persons and services, institutions or systems by enabling clear identification and communication.
• Content data: Content data comprises information generated in the course of creating, editing and publishing content of all kinds. This category of data may include text, images, videos, audio files and other multimedia content published on various platforms and media. Content data is not limited to the actual content but also includes metadata providing information about the content itself, such as tags, descriptions, authorship information and publication dates.
• Contact data: Contact data is essential information enabling communication with persons or organisations. It includes telephone numbers, postal addresses and email addresses, as well as means of communication such as social media handles and instant messaging identifiers.
• Metadata, communication and procedural data: Metadata, communication and procedural data are categories containing information about how data is processed, transmitted and managed. Metadata, also known as data about data, includes information describing the context, origin and structure of other data. It may include details of file size, creation date, document author, change histories and timestamps. Communication data records the exchange of information between users through various channels, such as email traffic, call logs, messages on social networks and chat histories, including the persons involved, timestamps and transmission paths. Procedural data describes processes and workflows within systems or organisations, including workflow documentation, logs of transactions and activities, and audit logs used to track and verify processes.
• Usage data: Usage data refers to information recording how users interact with digital products, services or platforms. This data encompasses a broad range of information showing how users use applications, which functions they prefer, how long they stay on particular pages and through which paths they navigate an application. Usage data may also include frequency of use, timestamps of activities, IP addresses, device information and location data. It is particularly valuable for analysing user behaviour, optimising user experiences, personalising content and improving products or services. Usage data also plays a decisive role in identifying trends, preferences and possible problem areas within digital offerings.
• Personal data: “Personal data” means any information relating to an identified or identifiable natural person (hereinafter “data subject”); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier (e.g. a cookie), or one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.
• Log data: Log data is information about events or activities recorded in a system or network. This data typically contains information such as timestamps, IP addresses, user actions, error messages and other details concerning the use or operation of a system. Log data is often used to analyse system problems, monitor security or prepare performance reports.
• Controller: “Controller” means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of processing personal data.
• Processing: “Processing” means any operation or set of operations performed on personal data, whether or not by automated means. The term is broad and covers virtually any handling of data, including collection, evaluation, storage, transmission or deletion.
• Contract data: Contract data is specific information relating to the formalisation of an agreement between two or more parties. This category of data is essential to managing and fulfilling contractual obligations and includes both identification of the contracting parties and the specific terms of the agreement. Contract data may include start and end dates of the contract, the type of services or products agreed, pricing arrangements, payment terms, termination rights, renewal options and special conditions or clauses. It serves as the legal basis for the relationship between the parties and is crucial to clarifying rights and obligations, enforcing claims and resolving disputes.
• Payment data: Payment data includes all information required to process payment transactions between buyers and sellers. This data is of crucial importance to electronic commerce, online banking and any other form of financial transaction. It includes details such as credit card numbers, bank details, payment amounts, transaction data, verification numbers and invoice information. Payment data may also include information on payment status, refunds, authorisations and fees.

Erstellt mit kostenlosem Datenschutz-Generator.de von Dr. Thomas Schwenke