Privacy Policy

1. Data Controller

The controller responsible for data processing is:

Kaufmann Elsner GbR

Email: [email protected]

2. Overview

This privacy policy explains how Workshop Weaver ("we", "our" or "us") collects, processes and protects your personal data when you visit our website (workshopweaver.com) or use our AI-powered workshop planning platform (app.workshopweaver.com). We process this data in compliance with the EU General Data Protection Regulation (GDPR), the German Federal Data Protection Act (BDSG) and the German Telecommunications-Telemedia Data Protection Act (TTDSG).

3. Data We Collect

3.1 Data you provide directly

• Account information: Name, email address and password when you register. The password is stored solely as a cryptographic hash.
• Workshop content: Goals, agendas, descriptions, notes, target audiences, location and scheduling data, and all planning data you create.
• Chat history: Your messages to the AI companion and its replies are stored permanently with the relevant workshop so that context is preserved across sessions.
• Uploaded files: PDF, DOCX, TXT and Markdown files as well as images (PNG, JPEG, WebP) up to 5 MB that you upload into the chat — including the text extracted from them.
• Voice recordings: If you use voice input, the recording is processed to convert it into text. We do not store the audio file itself; only the resulting text is kept.
• Contact inquiries: Name, email and message content when you use our contact form.
• Payment information: Billing data processed by our payment provider Stripe — full card details never reach our servers.
• Consent records: The time you accepted the Terms of Service and this privacy policy, together with your answer to the question about product emails and when you gave it.

3.2 Data collected automatically

• Server log data: IP address, browser type, operating system, referring URL, pages visited, and the date and time of access.
• Cookies and local storage: See Section 5.
• Product and usage data: Which features you open, when you create a workshop or generate an agenda, and technical measurements of AI calls (model, token count, cost, duration). The content of your prompts is not transmitted.
• Email delivery logs: Whether an email we sent was delivered, opened, or a link within it was clicked, each with a timestamp and the recipient address.
• Security data: Your IP address and bot-detection signals during registration and sign-in, to defend against automated attacks. Failed attempts are counted per account; the email address is only processed as a hash for this purpose.

4. Legal Basis for Processing

We process your personal data on the following legal bases under Art. 6(1) GDPR:

• Consent (Art. 6(1)(a) GDPR): For analytics and marketing cookies on our website and for product and marketing emails. You may withdraw your consent at any time with future effect.
• Contract performance (Art. 6(1)(b) GDPR): For providing the platform, managing your account, processing payments and all AI features — agenda generation is the core service.
• Legal obligations (Art. 6(1)(c) GDPR): For tax and accounting records and statutory retention requirements.
• Legitimate interests (Art. 6(1)(f) GDPR): For server logs and error diagnostics (IT security and operability), for defending registration and sign-in against automated attacks, for delivery logs of our emails (proof of deliverability), and for product analytics inside the signed-in application. The latter rests on our legitimate interest in understanding which features of the application are actually used; it is not part of the cookie consent and you may object to it at any time under Art. 21 GDPR.

5. Cookies and Local Storage

We use cookies and comparable technologies. In accordance with § 25 TTDSG, we set non-essential cookies on our website only after your explicit consent via the cookie banner.

5.1 Necessary cookies

These cookies are required for operation and cannot be disabled.

5.2 Analytics cookies (consent required)

These services help us understand how visitors interact with our website.

5.3 Marketing cookies (consent required)

These services are used for marketing and for attributing inquiries.

5.4 Local storage in the application

Within the application itself we store some entries in your browser's local storage. This data does not leave your device and is not transmitted to us; it is removed when you sign out or clear your browser storage.

*Google may transfer data to the USA. This transfer is based on the EU-US Data Privacy Framework (adequacy decision by the European Commission, July 2023); Google LLC is certified under that framework.

6. Processors and Recipients

We use the following service providers as processors or recipients. A complete and continuously maintained list including addresses and data categories is available on our page Sub-processors.

7. Collaboration, Share Links and Guests

Workshop Weaver is built for collaboration. The following features make data visible to other people — please consider what you share through them:

• Teams: If you assign a workshop to a team, every member of that team can see its full content — including goals, context, chat history and uploaded files. Team members also see each other's names and email addresses. Personal workshops with no team assignment remain private.
• Public participant links: You can share an agenda via a link that is accessible without signing in. Anyone who knows the link sees the agenda including location, times and any stored video-conference address. The page is excluded from search engines, but the link itself carries no further protection. You can revoke the share at any time in the application.
• Collaboration links: For feedback you can generate a separate link, which can optionally carry a password and an expiry date.
• Comments from guests: Anyone commenting via a collaboration link provides a name and may voluntarily leave an email address. These details are stored and are visible to the person who shared the link; other guests see only the name. If you pass such a link on, please inform the recipients about this processing. Guests may request deletion of their details at any time at [email protected].

8. Data Transfers to Third Countries

Some of our service providers are based in the USA. Where personal data is transferred there, this is safeguarded as follows:

• EU-US Data Privacy Framework: For providers certified under the framework — Google and Stripe.
• Standard Contractual Clauses (SCCs): For providers not covered by an adequacy decision — in particular Anthropic, OpenAI and Sentry.
• Processing in the EU: PostHog, Mailgun and HubSpot process in their EU data centres; our servers, databases and file storage are located exclusively in the EU.

9. Data Retention

We retain your data only for as long as necessary for the purposes described:

• Account data: For the duration of your account. Following a deletion request it is deleted within 30 days.
• Workshop content and chat history: For the duration of your account; deleted together with the account.
• Uploaded files: 30 days after you archive the associated workshop, after which they are deleted automatically. If you delete a workshop permanently, they are removed immediately.
• Unconfirmed registrations: 14 days, after which the account is deleted in full.
• Empty drafts: 7 days.
• Email delivery logs: 180 days.
• Server log data: 7 days. It arises at our hosting providers and is deleted automatically thereafter; longer storage occurs only insofar as a specific security incident requires it.
• Security and abuse data: 2 hours (counters for sign-in attempts and request rates).
• Payment and billing records: 10 years after the end of the contract (§ 147 AO, § 257 HGB).
• Contact inquiries: 3 years after the last communication, or longer where required for legal claims.
• Product analytics data: 12 months.
• Error diagnostics data: 90 days.

Where statutory retention obligations prevent deletion, processing is restricted instead and the data is deleted once the period expires.

10. Your Rights Under GDPR

You have the following rights regarding your personal data:

• Right of access (Art. 15 GDPR): Obtain confirmation of whether we process your data and request a copy.
• Right to rectification (Art. 16 GDPR): Request correction of inaccurate personal data.
• Right to erasure (Art. 17 GDPR): Request deletion of your personal data ("right to be forgotten").
• Right to restriction (Art. 18 GDPR): Request restriction of processing in certain circumstances.
• Right to data portability (Art. 20 GDPR): Receive your data in a structured, commonly used and machine-readable format. We provide this on request.
• Right to object (Art. 21 GDPR): Object at any time to processing based on legitimate interests — this expressly includes product analytics in the signed-in area.
• Right to withdraw consent (Art. 7(3) GDPR): Withdraw consent at any time without affecting the lawfulness of prior processing.

To exercise these rights, contact us at [email protected].

11. Right to Lodge a Complaint

You have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The competent authority for us is:

Unabhängiges Landeszentrum für Datenschutz Schleswig-Holstein (ULD)

Holstenstraße 98, 24103 Kiel, Germany

Phone: +49 431 988-1200

Website: www.datenschutzzentrum.de

12. AI Processing and Automated Decision-Making

Workshop Weaver uses artificial intelligence to generate workshop agendas, suggest methods, analyse uploaded documents and convert speech into text. This AI processing:

• is based on the information you provide — goals, context, constraints, uploaded files and chat messages;
• makes no legal or similarly significant decisions about you; automated decision-making within the meaning of Art. 22 GDPR does not take place;
• does not use your content to train AI models — the interfaces of Anthropic and OpenAI do not use submitted inputs and outputs for that purpose by default;
• is provided by Anthropic and OpenAI (see Section 6.2); your input is transferred to the USA for this purpose;
• also extends to content you upload: images and scanned documents are transmitted in full to the AI provider for text recognition.

Recommendation: Do not enter sensitive personal data about third parties (e.g. employees or participants) into AI input fields, and do not upload documents containing such data. Describe goals and context in general terms where possible. You remain responsible for the content you enter into the application.

13. Data Security

We take appropriate technical and organisational measures to protect your personal data: TLS encryption of all transmissions, encryption of stored data, passwords held only as hashes, encrypted storage of any keys you deposit, protection of registration and sign-in against automated attacks, access controls limited to authorised personnel, and regular updates of the components we use.

14. Changes to This Privacy Policy

We may update this privacy policy to reflect changes in our processing or in the legal framework. We will notify registered users of material changes by email. The current version is always available at: workshopweaver.com/privacy

15. Contact

For questions about this privacy policy or your personal data, you can reach us at:

Kaufmann Elsner GbR

Email: [email protected]