Privacy policy

1. Who is responsible

Feldmann Consult, owner Richard Lutz Feldmann

Niedergasse 43, 64319 Pfungstadt, Germany

Email: lf@feldmannconsult.com · Phone: +49 176 3172 2853

No data protection officer has been appointed; under § 38 BDSG none is required.

2. What this is about

KI-Praxis is an online course with exercises and AI support. This notice describes which data the app processes about you, for what purpose, on which legal basis, who receives it and how long it is kept. It was written from the data the app actually holds.

3. Your account and signing in

• What: your email address, optionally a name and a password. The password is stored only as an irreversible hash. Your sign-in session comes on top.
• Sign-in links by email: to sign in, we send you a link. If you change your address, we keep the new address until you confirm it, for at most 24 hours.
• Purpose and legal basis: to provide the course you bought, Art. 6(1)(b) GDPR.
• How long: until you delete your account.

4. The purchase via Digistore24

• Sale and payment are handled by Digistore24 (Digistore24 GmbH, Germany). Depending on the contract, Digistore24 is the contracting party and a controller of the purchase data in its own right; in that case Digistore24's privacy policy applies as well.
• What we receive: the order data Digistore24 sends us after the purchase — order number, product, amount, time, the buyer's email address and name. We keep the complete technical message from Digistore24 for 60 days so that access problems can be cleared up.
• Purpose and legal basis: to unlock the course (Art. 6(1)(b) GDPR) and to meet statutory retention duties (Art. 6(1)(c) GDPR).
• How long: orders are accounting records and are kept for six to ten years under § 147 AO and § 257 HGB — even if you delete your account. The link to your account is removed when you do.

5. Course, exercises and your task in the business

• What: which lessons you marked as done, your results in the self-checks and the learning game, what you entered about your business (sector, size, where things get stuck) and what you write down about the tasks you carried out.
• Purpose and legal basis: to provide the course, your progress and suggestions that fit, Art. 6(1)(b) GDPR.
• How long: until you delete your account; then completely.
• Please do not enter names or data of your own customers in these fields — the tasks do not need them.

6. The AI features

The app uses AI in two places. Both are marked as AI in the app.

• Lisa, the AI assistant: she receives your questions and our handbook about the app. She receives nothing from your account — no name, no address, no purchase.
• My task in the business: here the AI receives what you entered about your business, what you wrote about your tasks, the course of the conversation on that topic and the title of the lesson.
• Recipient: OpenAI, L.L.C., USA. This is a transfer to a country outside the EU. [To be filled in before launch: the basis of the transfer — adequacy decision (EU-US Data Privacy Framework) or standard contractual clauses — and the data processing agreement with OpenAI.]
• Legal basis: Art. 6(1)(b) GDPR — the AI suggestions and feedback are part of the course you bought.
• What is stored: the conversation in our database until your account is deleted. For every AI request, additionally a cost record (time, model, volume) without the content of your request; it is deleted after 12 months, and loses its link to you earlier if you delete your account.
• The AI makes no decisions about you. Its answers can be wrong.

7. Security and operation

• IP addresses are counted in memory only and for 15 minutes only, to stop passwords from being tried out. They are not stored.
• For troubleshooting, the app keeps the last lines of its error log in memory; email addresses and keys are masked in it. The host's own log (section 9) can contain complete lines.
• Legal basis: our legitimate interest in secure operation, Art. 6(1)(f) GDPR.

8. Cookies

The app only sets cookies that are needed to run it or that you trigger yourself: the sign-in session, your language setting and your display mode (light/dark). There is no tracking, no analytics and no advertising. No consent is required for this (§ 25(2) TDDDG).

9. Who else receives your data

• Digistore24 — purchase and payment (section 4).
• OpenAI — AI features (section 6).
• The hosting provider that runs the app and the database — [to be filled in before launch: name, seat, server location].
• The email delivery service that sends sign-in links and confirmations; it receives your email address and the content of those emails — [to be filled in before launch: name, seat, basis of any transfer outside the EU].

Data processing agreements under Art. 28 GDPR are in place with these service providers or will be concluded before launch.

10. Access in support

For support, the operator can sign in as your account to see what you see. Every such sign-in is recorded (who, when, for how long). What is looked at is not recorded. On request we tell you whether and when this happened. The record is deleted after 12 months. Legal basis: Art. 6(1)(f) GDPR (support with problems in your account).

11. How long we keep data — overview

• Account, course progress, exercise results, business details, task reports, conversations with the AI: until your account is deleted
• Orders: 6–10 years (§ 147 AO, § 257 HGB), with no link to you after account deletion
• Complete purchase message from Digistore24: 60 days
• New email address until confirmed: at most 24 hours
• IP addresses: 15 minutes, in memory only
• AI cost record (no content): 12 months, with no link to you after account deletion
• Record of support sign-ins: 12 months

12. Your rights

You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21 GDPR).

• Do it yourself: on your account page you can download all the data the app holds about you and delete your account. When you delete it, only the orders remain (section 4) — with no link to you.
• By email: to lf@feldmannconsult.com. We answer within one month.
• Complaint: you can complain to a data protection supervisory authority, for example the Hessian Commissioner for Data Protection and Freedom of Information, Wiesbaden.

13. What you have to provide

For an account we need your email address; without it you cannot use the course. Everything else — name, password, business details — is voluntary.

14. No automated decisions

The app makes no decisions about you based solely on automated processing (Art. 22 GDPR). The self-checks and the learning game show your result to you alone.