Privacy Policy

The controller within the meaning of Art. 4 No. 7 GDPR is:

André Bäcker
Klymeo (sole proprietorship)
Hopstener Straße 25
49479 Ibbenbüren
Germany
Email: support@klymeo.com
Phone: +49 176 21878801

The protection of your personal data is important to us. We process personal data exclusively in accordance with applicable data protection law, in particular the GDPR and the German Federal Data Protection Act (Bundesdatenschutzgesetz, BDSG). Personal data means any information relating to an identified or identifiable natural person.

Insofar as we process personal data, we rely, depending on the processing activity, on one of the legal bases under Art. 6(1) GDPR — in particular consent (lit. a), the performance of a contract or pre-contractual measures (lit. b), a legal obligation (lit. c), or our legitimate interest (lit. f). The applicable legal basis is named for each individual processing activity below. We have not appointed a data protection officer, as there is no statutory obligation to do so.

The web application is hosted by Vercel and delivered via their EU region (Frankfurt am Main); the infrastructure for the authentication service (self-hosted Zitadel) and the voice agent is operated by Hetzner in Germany. When you access our pages, the servers we use automatically collect information in so-called server log files, which your browser automatically transmits: browser type and version, operating system used, referrer URL, hostname of the accessing computer, time of the server request, and IP address. This data is not merged with other data sources.

This collection is carried out on the basis of our legitimate interest in technically error-free and secure operation (Art. 6(1)(f) GDPR). For security reasons, the log files are stored for a limited period and then deleted; storage beyond 30 days occurs only insofar as this is necessary to investigate a specific security incident.

We use exclusively technically necessary cookies as well as functional cookies you have actively chosen, and comparable storage technologies, which are required for operating the site, for logging in, and for chosen settings (e.g. language and display) (in particular, authentication session cookies). The legal basis for the technically necessary cookies is § 25(2) TDDDG (German Telecommunications-Digital-Services-Data-Protection Act) in conjunction with our legitimate interest in a functioning offering (Art. 6(1)(f) GDPR); no consent is required in this respect. The functional settings cookies (e.g. language and display) are first-party entries and do not serve advertising or analytics purposes. We currently do not use any analytics or marketing cookies or tracking services. A detailed overview of the cookies we use can be found in our Cookie Policy.

If you contact us by email, via a contact form, or by booking a demo appointment, we process the information you provide (e.g. name, email address, content of the inquiry, and any requested appointment time) in order to handle your request. The demo booking is processed via the scheduling service Cal.com (Cal.com, Inc.; operated via the EU instance cal.eu). The legal basis is Art. 6(1)(b) GDPR, insofar as the request is aimed at concluding or performing a contract, and otherwise our legitimate interest in responding to inquiries (Art. 6(1)(f) GDPR). The data will be deleted once your request has been conclusively processed and no statutory retention obligations preclude deletion (see Section 11).

For registration, sign-in, and the management of user accounts, we use the identity and login service Zitadel. Zitadel is operated by us ourselves on server infrastructure provided by Hetzner Online GmbH in Germany; login data is not transmitted to any external identity service provider in a third country. When an account is created and used, the data required for this is processed — in particular name, email address, login and authentication data, and any identifiers from a single sign-on used. The legal basis is Art. 6(1)(b) GDPR (provision of the user account). The session cookies set for login are first-party cookies of our own domain; details are provided in the Cookie Policy.

Our customers (researchers) conduct qualitative interviews via the platform. In doing so, information about the participating individuals is processed — depending on the type of study, in particular response texts, and for voice interviews, additionally audio recordings and their transcripts, as well as associated metadata (e.g. timestamps and technical session data) and, where applicable, screening or contact information collected by the customer.

We do not process this data for our own purposes, but on the instructions of, and on behalf of, the respective customer, for the purpose of conducting and analyzing the study; in this respect, we act as a processor within the meaning of Art. 28 GDPR, while the customer is the controller of the study data. This is based on a data processing agreement (DPA) between the customer and us. The legal basis for the processing vis-à-vis the participating individuals lies with the responsible customer (typically consent pursuant to Art. 6(1)(a) GDPR or legitimate interest pursuant to lit. f). Participants are informed transparently in advance about the use of AI in the interview.

The retention period is determined by the instructions of the responsible customer: the customer can set an automatic deletion deadline for interview and participant data on a per-study basis; if such a deadline is set, the relevant data is automatically and permanently deleted once it expires. In addition, the customer can delete individual participant data, an entire study, or their account at any time; deletion means the permanent removal of the data (including transcripts and analyses), not merely flagging it. Section 11 applies in all other respects.

To provide our offering, we use the following service providers. For each entry, the purpose, data categories, legal basis, server location, and any third country together with Standard Contractual Clauses (SCCs) are specified.

• Supabase (PostgreSQL database)Purpose: Database and storage of platform, account, and study dataData categories: Account, study, and interview data stored in the application (response texts, transcripts, contact and screening information)Legal basis: Art. 6(1)(b)/(f) GDPR; for study data, Art. 28 GDPR (data processing agreement)Server location: Supabase — EU region (Frankfurt am Main, eu-central-1)Third country & SCC: no third country (EU)
• Hetzner (Authentication & Voice Agent)Purpose: Server infrastructure for the self-hosted authentication service (Zitadel) and for the voice agent used in voice interviewsData categories: Login and authentication data of user accounts; connection and session data processed during voice interviewsLegal basis: Art. 6(1)(b)/(f) GDPR; Art. 28 GDPRServer location: Hetzner Online GmbH, GermanyThird country & SCC: no third country (EU)
• Vercel (Hosting)Purpose: Hosting and delivery of the web applicationData categories: Connection data and server log files (including IP address)Legal basis: Art. 6(1)(f) GDPR (secure, error-free operation)Server location: Vercel Inc., USA; delivery via EU region (Frankfurt am Main)Third country & SCC: Third country USA — EU Standard Contractual Clauses (Art. 46 GDPR)
• Anthropic (AI analysis)Purpose: AI-assisted conduct of interview conversations as well as analysis and synthesis of responses by the Claude language modelData categories: Interview content (response texts, transcripts) for processing by the language modelLegal basis: Art. 6(1)(b)/(f) GDPR; Art. 28 GDPRServer location: Anthropic PBC, USA (direct connection to the Anthropic API)Third country & SCC: Third country USA — EU Standard Contractual Clauses (Art. 46 GDPR)
• Deepgram (speech processing)Purpose: Speech-to-text and text-to-speech for voice interviewsData categories: Audio recordings of participants (for transcription) and the transcripts generated from them; question text read aloud (text-to-speech)Legal basis: Art. 6(1)(b)/(f) GDPR; Art. 28 GDPRServer location: Deepgram Inc., USA; processing via the EU endpoint (api.eu.deepgram.com)Third country & SCC: Third country USA — EU Standard Contractual Clauses (Art. 46 GDPR)
• LiveKit (real-time audio)Purpose: Real-time audio transmission during voice interviewsData categories: Audio stream and connection metadataLegal basis: Art. 6(1)(b)/(f) GDPR; Art. 28 GDPRServer location: LiveKit Inc., USA; operated via EU regionThird country & SCC: Third country USA — EU Standard Contractual Clauses (Art. 46 GDPR)
• Resend (email delivery)Purpose: Sending transactional emails (interview invitations, reminders, account and service notifications)Data categories: Recipient email address, name or display name, and the content of the respective email (including invitation link)Legal basis: Art. 6(1)(b)/(f) GDPR; Art. 28 GDPRServer location: Resend, Inc., USAThird country & SCC: Third country USA — EU Standard Contractual Clauses (Art. 46 GDPR)

Insofar as the above service providers process personal data on our behalf, data processing agreements pursuant to Art. 28 GDPR are in place with them. For service providers based in a third country (USA), these are supplemented with the EU Standard Contractual Clauses pursuant to Art. 46 GDPR.

Insofar as we transfer data to service providers in a third country (in particular the USA), this is done only if an adequate level of data protection is ensured — for example on the basis of an adequacy decision, the EU Standard Contractual Clauses (SCCs) pursuant to Art. 46 GDPR, or a certification of the recipient under the EU-US Data Privacy Framework (DPF). The basis applicable to each service is specified in the list in Section 9. Upon request, we will provide you with information on the safeguards in place.

We process and store personal data only for as long as necessary for the respective purposes or as required by statutory retention periods. Once the purpose no longer applies or the periods have expired, the data is routinely deleted or anonymized. Specifically:

• User accounts: until the account is deleted or the contract ends, then deleted subject to statutory retention obligations;
• Interview and participant data (including audio and transcripts): per the instructions of the responsible customer, at the latest upon termination of the respective processing engagement;
• Server log files: short-term, see Section 3;
• Billing and invoicing data: in accordance with statutory retention periods (§ 257 HGB (German Commercial Code), § 147 AO (German Fiscal Code) — 6 or 10 years, respectively);
• Contact and appointment inquiries: until conclusively processed, provided no retention obligation applies.

Under the GDPR, you have the following rights, among others, against the controller:

• Right of access (Art. 15 GDPR);
• Right to rectification (Art. 16 GDPR);
• Right to erasure (Art. 17 GDPR);
• Right to restriction of processing (Art. 18 GDPR);
• Right to data portability (Art. 20 GDPR);
• Right to object to processing (Art. 21 GDPR);
• Right to withdraw consent given, with effect for the future (Art. 7(3) GDPR).

To exercise these rights, an informal message to support@klymeo.com is sufficient. For data that we process on behalf of a customer (Section 8), we will forward your request to the responsible customer or support them in fulfilling it.

Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a data protection supervisory authority, in particular in the member state of your habitual residence, place of work, or the place of the alleged infringement, if you consider that the processing of your personal data infringes the GDPR.

The supervisory authority responsible for us is the North Rhine-Westphalia State Commissioner for Data Protection and Freedom of Information (Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen, LDI NRW), Kavalleriestraße 2–4, 40213 Düsseldorf (www.ldi.nrw.de).