Privacy policy
Processing of personal data under the GDPR
1 Controller
The controller under the GDPR is Jordi Bravo, 8, Rue de Stavelot, L-2553 Luxembourg. Data protection enquiries: kontakt@fspreif.com.
2 Account and usage
An account requires an email address and account data to be processed. The basis is performance of the usage contract.
3 Voice recordings
Consent is obtained before the first voice block. The transcript is stored because the assessment report draws its evidence from it. The audio file is deleted automatically after 30 days by default; longer storage is only possible with express consent and can be revoked at any time.
4 Processors
We use OpenAI for language models, speech recognition and speech synthesis, Cloudflare for hosting and delivery, Neon for the database inside the EU, Stripe for payment processing and the platform's mail service for email. Data processing agreements are in place with each of them; transfers to third countries rely on the European Commission's standard contractual clauses.
5 Retention
Audio for 30 days unless expressly requested otherwise. Transcripts and reports until the account is deleted. Invoice data for the statutory retention periods.
6 Your rights
Access, rectification, erasure, restriction, portability and objection. Export and full account deletion are additionally available directly in settings.
7 Right to complain
The competent supervisory authority is the Commission nationale pour la protection des données (CNPD), 15, Boulevard du Jazz, L-4370 Belvaux, Luxembourg. You may also contact the supervisory authority where you live.
8 Analytics and cookies
Without consent only strictly necessary cookies are set: a session cookie for signing in, and a cookie that stores your cookie decision itself. Usage events are stored in our own database and evaluated in aggregate only; the legal basis is Art. 6(1)(f) GDPR. Third-party measurement and advertising technology is loaded only after explicit consent — see section 9.
9 Meta Pixel and Conversions API
Only with your explicit consent do we use the Meta Pixel and the Conversions API of Meta Platforms Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland, in order to measure which advertisement leads to a registration or a purchase. What is transmitted: the event (page view, pricing page view, start of checkout, completed registration, purchase), its time and page URL, the Meta cookies _fbp and _fbc, your IP address and your browser identification (user agent), and for registration and purchase additionally your email address solely as an irreversible SHA-256 hash, plus amount and currency for a purchase. Your email address is never transmitted to Meta in plain text. Some events are sent directly by your browser (pixel) and some by our server (Conversions API); both carry the same event id so that Meta does not count the same event twice. The legal basis is exclusively your consent under Art. 6(1)(a) GDPR and section 25(1) TDDDG. Without consent the pixel is not loaded and no server-side event is sent to Meta either; if you refuse at checkout, nothing is transmitted for the subsequent purchase either. For the collection and transmission of this data we and Meta are joint controllers under Art. 26 GDPR on the basis of the agreement provided by Meta; Meta's further processing is its sole responsibility. The data may also be processed in the USA, based on the EU-US Data Privacy Framework and the standard contractual clauses. You can withdraw your consent at any time with effect for the future via “Cookie settings” in the footer.