Privacy Policy

1. Data Controller

Strengthmaker UG (haftungsbeschränkt), Ulf Kossol, Dresden, Germany
Email: hello@strengthmaker.de

2. Collection and Storage of Personal Data

When you visit this website, the browser on your device automatically sends information to our web server. This information is temporarily stored in a log file:

• IP address of the requesting device
• Date and time of the request
• Name and URL of the retrieved file
• Referring website (referrer URL)
• Browser used and, where applicable, the operating system

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in technically sound and secure operation).

3. Cookies and Local Storage

We only use strictly necessary cookies and, subject to your consent via our cookie banner, anonymised analytics cookies for our self-hosted, cookie-free reach measurement and for the analytics service HeyCatch (see below). No tracking by Google Analytics or Facebook Pixel takes place.

Reach measurement and detection of company networks: To measure visits we derive an anonymous hash from IP address, browser identifier and a daily rotating random value; the IP address itself is not stored and the hash cannot be linked after 24 hours. On the first page view of a session we also briefly transmit the IP address to IPinfo, Inc. (USA) to determine the country and – if it is a company network – the organisation name. We only store the country and organisation name/domain; residential, mobile and hosting connections are discarded. We do not draw conclusions about individuals. Legal basis is our legitimate interest in analysing and improving our services and in B2B business development (Art. 6(1)(f) GDPR). Transfers to the USA are based on standard contractual clauses. You can object at any time (email us).

Usage analytics with HeyCatch: Only if you choose “Accept” in the cookie banner do we use the analytics service HeyCatch (heycatch.ai) on our website and in the Personal App. Page views, clicks and page changes as well as a random identifier stored in your browser are transmitted to HeyCatch. If you are signed in to the Personal App, usage is linked to your account (email, name, plan, sign-up date). Studio, Coach Workspace and the client portal are not tracked. The purpose is to analyse and improve our services. Legal basis is your consent (Art. 6(1)(a) GDPR, Sec. 25(1) TDDDG); you can withdraw it at any time with effect for the future via the cookie banner or by clearing your browser data. Independently of this, our server reports three business events to HeyCatch: completed sign-up (email, name, plan, sign-up date), premium purchase (plan, amount) and coach session booking (session type, coach; for guests without an account only with a pseudonymous ID). Legal basis is our legitimate interest in measuring the success of our services (Art. 6(1)(f) GDPR); you can object at any time by email.

4. User Accounts (Studio & App)

When creating an account we store: name, email address, organisation affiliation (if applicable), strengths results, journal entries and usage data on an ongoing basis. Legal basis: Art. 6(1)(b) GDPR (performance of contract). Data will be deleted when you close your account or after statutory retention periods expire.

5. Newsletter & ROI Calculator (Double Opt-In)

For newsletter sign-ups and sending PDF reports we use a double opt-in process via our email service provider Brevo (Sendinblue GmbH, Berlin). Legal basis: Art. 6(1)(a) GDPR (consent). You can withdraw your consent at any time by clicking the unsubscribe link in any email.

6. AI Service Providers

For AI-powered analyses and our chatbot we use the APIs of Mistral AI (Paris) and OpenAI Ireland Ltd. Only the pseudonymised data required for the specific request is transmitted. Processing is carried out under standard contractual clauses.

7. Payment Processing

Paid subscriptions are processed by Stripe (Stripe Payments Europe, Limited, Ireland). Payment data is processed solely by Stripe and never stored on our servers.

8. Your Rights

As a data subject you have the following rights:

• Right of access (Art. 15 GDPR)
• Right to rectification (Art. 16 GDPR)
• Right to erasure (Art. 17 GDPR)
• Restriction of processing (Art. 18 GDPR)
• Data portability (Art. 20 GDPR)
• Right to object (Art. 21 GDPR)
• Withdrawal of consent (Art. 7(3) GDPR)
• Right to lodge a complaint with a supervisory authority (Art. 77 GDPR)

You can exercise several of these rights directly in the product: Settings → Privacy → "Export my data" / "Delete account and all data".

For other requests please write to: hello@strengthmaker.de.

9. Data Security

We use HTTPS-encrypted connections (TLS 1.3) and hashed passwords (bcrypt).

10. Changes to this Policy

We reserve the right to amend this privacy policy to reflect changes in law or in our services. The current version is always available on this page.