Privacy Policy

1. Data Controller (GDPR)

René Gäng
Kolpingstraße 62
68753 Waghäusel
Germany

Email: info@digibeg.de

2. Data Collected and Processed

2.1 Account Data (stored server-side)

Email address, encrypted password, selected language, role (user / companion), subscription plan and credit balance (coins).

2.2 Voice and Text Input

Your voice input is first recorded locally, then transmitted to OpenAI (Whisper) for transcription. The resulting text – like all chat requests – is forwarded via the AI gateway OpenRouter to Anthropic (Claude) for processing. Web search queries are processed via Perplexity. Microsoft Azure is used exclusively for voice output (text-to-speech). Inputs are not permanently stored by third-party providers (max. 30 days as per their API policies).

2.3 Conversation History and Assistant Context

Conversation histories and permanently stored context information (e.g. people you have mentioned, habits, preferences) are stored on our servers. This information is used to provide the AI assistant with personalised context in each conversation.

2.4 Calendar Entries, Reminders and Comments (stored server-side)

Appointments, reminder templates, daily reminder entries and comments on calendar days are stored on our servers. Uninstalling the app does not automatically delete this data — complete deletion only occurs upon explicit request (see Section 7).

Comments are visible to linked companions (see Section 2.7).

2.5 Documents and Images

Uploaded documents and photos are stored on our servers. For AI analysis, content is temporarily transmitted to third-party providers: document/image recognition (OCR, vision) is performed via Google (Gemini), while text analysis and summarisation are performed via OpenAI (GPT-4o). The analysis result is permanently stored alongside the document on our servers.

2.6 Subscription and Payment Data

Payment processing is handled by:

• Stripe Inc. (Web): Stripe processes payment data in accordance with its own privacy policy. We only receive confirmation of subscription status.
• RevenueCat Inc. (iOS/Android): In-app purchases are processed via the Apple App Store or Google Play Store. RevenueCat synchronises the plan status with our backend.

Full payment details (card numbers etc.) are not stored by us.

2.7 Companion Functionality

When you as a user invite a companion, that person is granted read access to your reminders and calendar comments, as well as the ability to mark reminders as completed on your behalf. This access remains until the connection is removed. You can disconnect the companion at any time within the app.

2.8 Technical Data

Authentication tokens (JWT) are stored locally on your device and transmitted with every API call. IP address and basic device information are processed as part of normal server logs.

3. Purpose and Legal Basis

• Performance of contract (Art. 6(1)(b) GDPR): Account management, calendar, reminders, document storage.
• Consent (Art. 6(1)(a) GDPR): AI features, voice processing, assistant relationship memory.
• Legitimate interests (Art. 6(1)(f) GDPR): Security, abuse prevention, technical operation.

4. Data Sharing with Third Parties

We only share data with the following providers:

AI processing:

• OpenRouter, Inc. (USA): AI gateway, routing of AI requests to the respective models. Transfer based on Standard Contractual Clauses (SCC).
• Anthropic (USA): Chat processing. Transfer based on SCC. API data is not used for model training.
• Google (USA): Document/image analysis (OCR/Vision). Transfer based on SCC.
• OpenAI LLC (USA): Document text analysis and speech transcription. Transfer based on SCC. API data is stored for a maximum of 30 days and is not used for model training.
• Perplexity (USA): Web search queries. Transfer based on SCC.

Voice output:

• Microsoft Azure (Germany, region Germany West Central): Voice output (text-to-speech). Processing in Germany.

Payments:

• Stripe Inc. (USA/EU): Payment processing for web subscriptions. SCC basis.
• RevenueCat Inc. (USA): Subscription management for iOS/Android (App Store/Play Store). SCC basis.

Operations/infrastructure:

• Hetzner Online GmbH (Germany): Hosting and server operation. Processing in Germany.
• IONOS SE (Germany): Email delivery (SMTP) and DNS. Processing in Germany.
• Sentry (Functional Software Inc., USA): Error and crash monitoring. Transfer based on SCC.
• Expo (650 Industries, Inc., USA): Push notifications. Transfer based on SCC.

All third-party providers are contractually obligated to maintain GDPR-equivalent protection standards.

5. Data Retention

• Account data: Until account deletion.
• Conversation history and context: Until account deletion or upon request.
• Calendar entries, reminders, comments: Until account deletion or upon explicit request.
• Documents: Until manually deleted in the app or account deletion.
• Payment data: In accordance with statutory retention obligations (§ 147 AO: 10 years for tax-relevant data).
• At AI providers (OpenAI, OpenRouter, Anthropic, Google, Perplexity, Azure): Max. 30 days for API processing data.

6. Your Rights (GDPR Art. 15–21)

You have the right to:

• Access (Art. 15)
• Rectification (Art. 16)
• Erasure (Art. 17)
• Restriction of processing (Art. 18)
• Data portability (Art. 20)
• Object (Art. 21)
• Withdraw consent with effect for the future

Right to lodge a complaint with: State Commissioner for Data Protection and Freedom of Information Baden-Württemberg, Lautenschlagerstraße 20, 70173 Stuttgart.

7. Data Deletion and Account Deletion

To fully delete your account and all stored data:

1. In the app: Settings → Account → Delete Account
2. By email to info@digibeg.de with the subject line "Data Deletion – [your email address]"

We will confirm the deletion within 30 days. Tax-relevant data will be retained in accordance with statutory retention obligations and then deleted.

Note: Uninstalling the app alone does not delete any server-side stored data (appointments, reminders, comments, documents, conversation history).

8. Permissions

• Microphone: For voice input (Easy Mode, chat, calendar). Only during active use.
• Camera: For photographing documents.
• Storage / Media Library: For saving and loading documents.
• Push Notifications: For appointment reminders. Delivery is handled via the Expo push service (650 Industries, Inc.) and the push services of Apple and Google (see Section 4).

All permissions can be revoked at any time in your device's system settings.

9. Data Security

All data transmissions are encrypted via HTTPS/TLS. Authentication is handled via short-lived JWT access tokens in combination with refresh tokens.

10. Changes to This Policy

For material changes, we will notify you by email or in-app notice. The current version is always available in the app and at digibeg.de/datenschutz.

← Back to homepage