This Privacy Policy consists of two parts: Part A covers general use of our website and app (registration, course purchases, cookies, etc.). Part B specifically covers data processing within the AI Coach "LUMI". In case of conflict, Part B takes precedence for the "AI Coach" feature.

Part A — General Privacy Policy for Website and App (except the ZPP certified course on stress management)

This English translation is provided for convenience only. In the event of any discrepancies or inconsistencies, the German version shall prevail.

Dear website and app visitors, thank you very much for your visit!

With this Privacy Policy, we would like to inform you about the processing of your personal data (hereinafter "data") that results from visiting our websites and using our app.

We ask that you read this Privacy Policy carefully before using our websites and our app as well as the features contained therein.

This Privacy Policy applies only to our websites and our app and not to third-party websites.

Data Protection and Data Security

The protection of your privacy is very important to us. To protect your data, our company implements a wide range of technical and organizational measures in order to effectively prevent unauthorized access and disclosure, manipulation, loss and unauthorized deletion.

The measures we take are subject to continuous updating. We base them on legal requirements, best-practice approaches and technological developments.

Below, we inform you about the nature, scope and purpose of the collection, processing and storage of your data within our company, insofar as this occurs through visiting or using the functions of our websites and our app.

Controller for this Privacy Policy

EmoTrain GmbH

Am Buchet 8a

82057 Icking

Phone: +49 (0) 8178 9589940

Contact for Data Protection Matters at the Controller

EmoTrain GmbH

Am Buchet 8a

82057 Icking

[email protected]

General Information

Personal Data

Personal data, within the meaning of Art. 4(1) GDPR, is any information relating to an identifiable natural person. This includes, for example, information such as first and last name, address, email address, telephone or mobile number, but as a rule also the IP address.

Scope of Data Processing

In principle, we pursue the goal of limiting the processing of data during your visit to our websites and our app to the necessary minimum. As a rule, we also only collect data from you that we strictly need in order to fulfil the respective purpose.

Use only by Adults

Our app, our AI Coach and our websites are intended exclusively for adults (aged 18 and over). Persons under the age of 18 may not use our services and may not transmit any personal data to us. When purchasing our products, as well as before first using the AI Coach, we obtain active confirmation of legal age in each case: you actively confirm via checkbox "I am of legal age (at least 18 years old) and fully legally competent." The checkbox is not pre-selected but must be actively clicked; no date-of-birth query takes place. Should we become aware that we are processing the data of a minor, we will delete it without undue delay.

Storage Period

Unless otherwise stated in this Privacy Policy, we store data only for as long as necessary to achieve the processing purpose or to fulfill our contractual or legal obligations. Such legal retention obligations may arise in particular from commercial or tax law. From the end of the calendar year in which the data was collected, we will retain such data contained in our accounting records for ten years, and data contained in business letters and contracts for six years. In addition, we will retain data relating to consents subject to documentation requirements, as well as to complaints and claims, for the duration of the statutory limitation periods. Data stored for advertising purposes will be deleted if you object to the processing for this purpose.

Retention period for application documents: max. 6 months, unless a longer retention period has been agreed with the respective applicant.

Retention period for inquiries: If inquiries lead to a business relationship, until the end of the business relationship, observing the commercial and tax law requirements under the German Commercial Code (HGB) and the Fiscal Code (AO); in these cases between 6 and 10 years, depending on the nature of the communication content and the type of document (e.g. business letter, invoice, contracts, etc.).

Retention period for user account data: Data that we require to manage your user account will be stored until your user account is deleted. You can have your user account deleted either yourself in the app or by contacting our service team.

Transfer or Disclosure of Your Data

A transfer to third parties or a disclosure to our partners or affiliated companies of the data processed by us generally does not take place without your explicit consent, unless this:

is necessary to perform our contractually agreed services.
becomes necessary to enforce our claims.
is legitimized by a statutory permission or we are legally obliged to disclose the data.
is required for purposes of law enforcement, to avert danger, or to protect our websites.
is required to enforce the rights of third parties or within the scope of statutory disclosure obligations or a court order to provide information.

Profiling (= automated decision-making)

Profiling is any kind of automated processing of personal data consisting of the use of such personal data to evaluate certain personal aspects relating to a natural person, in particular to analyze or predict aspects concerning that natural person's performance at work, economic situation, health, personal preferences, interests, reliability, behavior, location or movements.

We do not make any automated decision with legal effect within the meaning of Art. 22 GDPR.

Online Application

If you apply to us and send us your application documents in electronic form, we process this data, which you provide to us voluntarily, exclusively for the purpose of handling the application procedure and possibly initiating an employment relationship within our company. Your data is disclosed to third parties only in cases where you expressly and in writing authorize us to do so, specifying the recipients.

Online Contact

If you provide us with your data in the context of an inquiry, feedback or a message regarding our products, we process this data exclusively to handle your request or to improve our products, so that we can provide you with an even better product.

If your inquiry concerns the conclusion or performance of a contract with us, Art. 6(1)(b) GDPR is the legal basis for the data processing. Otherwise, we process the data on the basis of our legitimate interest in getting in contact with inquiring persons. The legal basis for the data processing in this case is Art. 6(1)(f) GDPR.

Withdrawal from a Contract (Withdrawal Form)

If you declare the withdrawal from a contract concluded with us via the form on our website (lumeus-app.de/vertrag-widerrufen), we process the data you provide — name, email address, the affected product, an optional order number, and a supplementary message — exclusively to process your withdrawal, send you a confirmation of receipt, and match your details against an existing order.

The legal basis for this processing is Art. 6(1)(b) GDPR (performance of the contract from which you are withdrawing) as well as Art. 6(1)(c) GDPR, since we are legally required under § 356a BGB (German Civil Code) to accept and process such a withdrawal declaration.

Your details are forwarded internally to our support team for processing; we send the automatic confirmation of receipt as well as the internal notification via the service "Resend" (see the information on Resend elsewhere in this Privacy Policy). We store your details for as long as is necessary to process your withdrawal and to comply with any applicable statutory retention obligations (see the section "General Information").

Cancellation of a Contract (Cancellation Button)

If you declare the cancellation of a contract concluded with us via the cancellation button on our website (lumeus-app.de/vertraege-kuendigen), we process the data you provide — name, email address, the designation of the affected contract, the type of cancellation, in the case of an extraordinary cancellation the reason for the cancellation, an optional order number, and the desired end date — exclusively to process your cancellation, send you the legally required confirmation, and match your details against an existing contract.

The legal basis for this processing is Art. 6(1)(b) GDPR (performance or termination of the cancelled contract) as well as Art. 6(1)(c) GDPR, since we are legally required under § 312k BGB (German Civil Code) to accept such a cancellation declaration via a cancellation button and to confirm its receipt.

Your details are forwarded internally to our support team for processing; we send the automatic confirmation of receipt as well as the internal notification via the service "Resend" (see the information on Resend elsewhere in this Privacy Policy). We store your details for as long as is necessary to process your cancellation and to comply with any applicable statutory retention obligations (see the section "General Information").

We offer you the opportunity to subscribe to our newsletter in various places. After signing up, we will regularly inform you about news regarding our offers. To sign up for the newsletter, we require a valid email address. When you subscribe to a newsletter on our websites, we process data such as your email address and your name on the basis of the consent you have given. The legal basis for the processing is Art. 6(1)(a) GDPR. You can withdraw the consent given at any time with effect for the future, e.g. via the "unsubscribe" link in the newsletter or by contacting us at [email protected]. The lawfulness of processing already carried out remains unaffected by a withdrawal.

When you sign up for the newsletter, we store your registration data and the date of registration. The processing of this data is necessary to be able to prove a consent that has been given. The legal basis results from our legal obligation to document your consent pursuant to Art. 7(1) GDPR.

To manage, send and analyze the newsletters, we use the newsletter system "Klaviyo" of klaviyo Inc., 125 Summer St Floor 6, Boston MA 02111, USA (hereinafter "Klaviyo"). We have concluded a data processing agreement with Klaviyo to ensure that your data is processed by Klaviyo lawfully and only in accordance with our instructions. With Klaviyo, a transfer of data to the USA cannot be excluded. Please refer to the information in the section "Data Transfers to Third Countries" of this Privacy Policy. Further information on data protection at Klaviyo can be found in Klaviyo's privacy notice at https://www.klaviyo.com/legal/privacy/privacy-notice.

Newsletter Analysis

When you open the newsletter email, various tracking methods (e.g. link and click tracking) are activated and, at the same time, certain information about you is transmitted, e.g. whether and when the email was opened and which links were clicked. This analysis is carried out on the basis of the consent you have given. The legal basis for the processing is Art. 6(1)(a) GDPR. You can withdraw the consent given at any time with effect for the future, e.g. via the "unsubscribe" link in the newsletter or by contacting us at [email protected]. The lawfulness of processing already carried out is not affected by the withdrawal.

Participation in Surveys

If you have given us your consent to participate in a survey – e.g. when registering in our app – we will send you questionnaires by email and through the app in order to evaluate our methods and to review the progress and success of our app. It is also possible that we place survey forms on our websites or otherwise make them available to you.

Insofar as you voluntarily provide us with your data for the purposes mentioned, we process, for example, the following data:

email address
basic data (e.g. date of birth, gender)
information about your psychological and physical wellbeing (e.g. information on mood, stress, sleep, weight, energy or migraine)

The aforementioned information about your wellbeing constitutes health-related data and therefore special categories of personal data within the meaning of Art. 9 GDPR.

The legal basis for processing your information is your consent pursuant to Art. 6(1)(a) GDPR; insofar as health-related data is processed in this context, such data is processed solely on the basis of your explicit consent pursuant to Art. 9(2)(a) GDPR. We obtain this explicit consent separately before any such information is collected.

In addition, we process the data in anonymized form for the purpose of statistical analysis, in order to obtain an overall assessment of the success of our app and to be able to share it with interested parties.

You can withdraw your consent at any time with effect for the future by contacting us at [email protected]. The lawfulness of processing carried out up to the point of withdrawal remains unaffected.

To facilitate the distribution and analysis of the surveys, we use "Typeform" of Typeform S.L. (Carrer Bac de Roda, 163, 08018 Barcelona, Spain). With Typeform, a transfer of data to insecure third countries such as the USA cannot be excluded. Please refer to the information in the section "Data Transfers to Third Countries".

User-Generated Content

If you voluntarily provide us with your data, for example by publishing topics and comments in the community, commenting on various parts of the products, and uploading or publishing photos, videos and audio recordings, we may use this data, for example, to

examine trends or categories, or
carry out marketing and advertising activities with your consent

The legal basis for handling your communications and for improving our services is our legitimate interest pursuant to Art. 6(1)(f) GDPR. Insofar as we use or publish your content for marketing and advertising purposes, this is done solely on the basis of your consent pursuant to Art. 6(1)(a) GDPR, which you can withdraw at any time with effect for the future.

Opinion and Satisfaction Analysis

If you voluntarily provide us with your data to communicate praise, feedback, suggestions and criticism, we process this data exclusively in order to

respond appropriately to your criticism and, after reviewing your request, take appropriate improvement measures where necessary.
take your suggestions and feedback as an opportunity to further improve our services.
pass on your praise as appreciation to the relevant departments.
share it completely anonymously with other participants, the LUMEUS community, or for marketing purposes.

Company Accounts on "Facebook" and "Instagram"

To present our company externally and to increase our visibility, we operate company accounts (also called "fan pages") on the social media platforms "Facebook" and "Instagram" of Meta Platforms Ireland Limited (Serpentine Avenue, Block J, Dublin 4, Ireland), hereinafter referred to as "Meta".

In order to provide us with anonymous statistics (so-called "page insights") about the visibility of our company accounts, the interactions with our company accounts and information about our followers (e.g. number as well as gains and losses compared to the previous month), Meta processes all personal data connected with the interaction with our company account.

For this purpose, we have concluded a joint controllership agreement with Meta. The key contents of this agreement are:

Meta is responsible for enabling you to exercise your rights under the GDPR. You can contact Meta about this at https://www.facebook.com/help/contact/1650115808681298 or via the contact details in Meta's privacy policy. You can reach Meta's data protection officer at https://www.facebook.com/help/contact/540977946302970.
You can also contact us at our stated contact details regarding the exercise of your rights in connection with the processing of personal data within the scope of page insights. In such a case, we will forward your request to Meta.
The lead supervisory authority for monitoring the processing of page insights is the Irish Data Protection Commission. You have the right to lodge a complaint with the Irish Data Protection Commission at www.dataprotection.ie or with any other supervisory authority.

If you interact with our company accounts and our published posts (e.g. by commenting on, liking, or sharing our posts, or by leaving a direct message), we process your data (e.g. username, name and other personal data provided by you) in order to interact and communicate with you. The legal basis for this data processing is our legitimate interest in interacting and communicating with interested parties (Art. 6(1)(f) GDPR).

If you visit our company accounts on Facebook and Instagram, Meta also processes your personal data for its own purposes. Regardless of whether you have a Facebook or Instagram account or not, your personal data such as your IP address and characteristics of your device (e.g. manufacturer, device type, operating system) as well as, where applicable, your username and other data that you have published in your Facebook or Instagram account, is processed by Meta. Further information on this can be found in Meta's privacy policy (https://www.facebook.com/privacy/policy) or in the information on page insights (https://de-de.facebook.com/legal/terms/information_about_page_insights_data).

Through Meta, a transfer of personal data to the USA or another third country cannot be excluded. Please refer to Meta's information on data transfers: https://www.facebook.com/privacy/policy?section_id=9-HowDoWeTransfer

Meta Marketing and Advertising Technologies (Custom Audiences, Lookalike Audiences, Conversion Tracking)

Provided that you have given us your consent, we use marketing and analytics functions of Meta Platforms Ireland Limited, Serpentine Avenue, Block J, Dublin 4, Ireland ("Meta").

The contracting party for the "Meta Business Tools" used within the scope of these marketing and advertising technologies is Meta Platforms, Inc. (USA).

These functions allow us to analyze and optimize our marketing activities and to display interest-based advertising to users on Meta platforms (e.g. Facebook and Instagram).

For this purpose, various technologies may be used, including in particular:

Meta Pixel
Meta Conversion API
Meta SDK for mobile apps
Custom Audience features
Lookalike Audience features

These technologies enable Meta to recognize users of our websites or our app or to assign them to specific target audiences.

Purpose of Processing

The data processing is carried out for the following purposes:

analysis and optimization of our marketing campaigns
measurement of the effectiveness of our advertising
re-targeting of visitors to our websites or app
creation of target audiences for advertising campaigns ("Custom Audiences")
creation of similar audiences based on existing users ("Lookalike Audiences")

Processed Data

Within the scope of these functions, the following data may in particular be processed:

IP address
device information (e.g. operating system, device type, browser information)
event data (e.g. page views, registrations, use of specific features, purchases)
interactions with our websites, apps or advertisements
timestamps of interactions
approximate location information

In addition, if you have given your consent, we may transmit contact data (e.g. email addresses) to Meta in encrypted or hashed form.

Meta may compare this data with existing user data in order to:

re-target existing users on Meta platforms, or
identify new users with similar interests.

Meta may combine this information with other data from your Meta profile and process it for its own purposes in accordance with Meta's privacy policy.

Legal Basis

The processing takes place solely on the basis of your consent pursuant to Art. 6(1)(a) GDPR and Section 25 TDDDG.

You can withdraw your consent at any time with effect for the future by:

adjusting your cookie or tracking settings, or
contacting us at [email protected].

Joint Controllership

For certain processing activities (in particular in connection with the Meta Pixel or conversion tracking), joint controllership pursuant to Art. 26 GDPR may exist between us and Meta.

Meta is primarily responsible for the processing of personal data within the Meta platforms.

Further information can be found here: https://www.facebook.com/legal/controller_addendum

Data Transfers to Third Countries by Meta

A transfer of personal data to servers of Meta Platforms, Inc. in the United States cannot be excluded.

Meta participates in the EU-US Data Privacy Framework, which is intended to ensure an adequate level of data protection pursuant to Art. 45 GDPR.

Further information on Meta's data protection practices can be found at: https://www.facebook.com/privacy/policy

Website Hosting

When you visit our websites, log files are created that are necessary for the operation and security of our websites. No analysis of user behavior or profiling is carried out through the evaluation of the log files. The log files are deleted after 30 days.

The log files contain, among others, the following data:

browser type / version,
operating system used,
page accessed,
the previously visited page (referrer URL),
IP address,
date and time of the server request, and
HTTP status code

The processing of the data is based on the legal basis of Art. 6(1)(f) GDPR (= legitimate interest).

YouTube and Vimeo

On our websites we use the service "YouTube" of Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland) or "Vimeo" of Vimeo.com, Inc., 330 West 34th Street, 10th Floor, New York, New York 10001, USA, for embedding videos.

When embedding the videos, we use YouTube's "enhanced privacy mode", under which data is only transmitted to Google once a video is played.

If you have consented to the display of YouTube videos, your IP address and information about the website you accessed is transmitted to YouTube. If you are logged into your YouTube account, YouTube assigns your browsing behavior or interests directly to your YouTube account.

The use of YouTube takes place only with your consent pursuant to Art. 6(1)(a) GDPR and can be withdrawn at any time with effect for the future.

With YouTube and Vimeo, a transfer of data to Google Inc., YouTube LLC and Vimeo.com, Inc. in the USA cannot be excluded. Please refer to the information in the section "Data Transfers to Third Countries" of this Privacy Policy.

Further information on data protection at Google can be found in Google's privacy notice at https://policies.google.com/privacy.

Further information on data protection at Vimeo can be found in Vimeo's privacy notice: https://vimeo.com/legal/privacy/policy

For direct questions regarding data protection at Vimeo, please contact: https://edpo.com/gdpr-data-request

DigiStore24 & Stripe

For payment processing, we use the platform Digistore24, operated by Digistore24 GmbH (St.-Godehard-Straße 32, 31139 Hildesheim, Germany), as well as Stripe, operated by Stripe Payments Europe, Limited (Ireland).

Digistore24 and Stripe handle the payment processing as well as invoicing and process data such as name, address, email address and payment information.

The processing of this data at Digistore24 is carried out for the purpose of performing pre-contractual measures pursuant to Art. 6(1)(b) GDPR. Further information on data protection at Digistore24 can be found at: https://www.digistore24.com/page/privacy

Stripe Payments Europe, Limited is a company established in Ireland (EU). A transfer of data to companies affiliated with Stripe in the USA cannot be excluded in this connection; such a transfer is carried out on the basis of the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR).

Further information on data protection at Stripe can be found at: https://stripe.com/de/privacy

Zapier

We use the automation software Zapier, a service of Zapier Inc. (548 Market Street 6241, San Francisco, CA 94104, USA). Zapier allows us to connect various web applications and systems and to automate workflows in order to make our processes more efficient. We have concluded a data processing agreement with Zapier to ensure the protection of your data.

Within the scope of using Zapier, data such as name, email address, and order information may be processed.

In addition, a transfer of data to the USA cannot be excluded. Zapier Inc. is an active participant in the EU-US Data Privacy Framework, which ensures a secure data transfer to the USA.

The legal basis for the processing is our legitimate interest in automating and efficiently structuring our internal processes pursuant to Art. 6(1)(f) GDPR.

Coachy

We use the services of Coachy, operated by Coachy OOD (104 Simeonovsko shose Blvd, 1700 Sofia, Bulgaria). Coachy enables us to manage user accounts and course content as well as to track progress within the trainings. For this purpose, we have concluded a data processing agreement with Coachy to ensure the protection of your data.

Within the scope of using Coachy, personal data such as your username, your email address, the courses, and your progress in the courses is processed.

The processing of the data is necessary for the performance of the contract between you and us pursuant to Art. 6(1)(b) GDPR.

Google Analytics

On our websites we use the service Google Analytics of Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland). Google Analytics serves to analyze the behavior of our visitors and to optimize our websites based on these insights. We have concluded a data processing agreement with Google Ireland Limited.

IP anonymization: We use Google Analytics exclusively with IP anonymization activated. This means that your IP address is truncated by Google within member states of the European Union or in other contracting states of the Agreement on the European Economic Area. Only in exceptional cases is the full IP address transmitted to a Google server in the USA and truncated there.

Data processing & consent: Within the scope of the analysis, data such as the (truncated) IP address, device type, timestamp, visited websites as well as device information (e.g. browser, operating system) is processed. The use of Google Analytics takes place only after your explicit consent pursuant to Art. 6(1)(a) GDPR and Section 25(1) TDDDG. You can withdraw your consent at any time via our cookie settings with effect for the future.

Third-country transfer: As Google is a US company, a transfer of data to the USA cannot be excluded. Google Ireland Limited relies on the EU-US Data Privacy Framework, insofar as the parent company (Google LLC) is certified accordingly, as well as on EU Standard Contractual Clauses. Further information can be found in Google's privacy policy: https://policies.google.com/privacy.

Linked Websites

Our websites contain links to external websites. We have no influence over the content of these websites and therefore assume no responsibility or liability for the permissibility, accuracy, presentation and completeness of the content published, displayed, or made available there.

We hereby inform you that, when accessing these external websites, your IP address may be logged by the respective responsible website operator.

When you leave our websites, we recommend that you review the privacy policy of the external website operators before accessing the websites or using the functions offered there.

Cookies & Consent Management

Cookies

On our websites, we use "cookies". Cookies are text files that are placed in the storage of the device from which you accessed our websites.

We use both persistent cookies and temporary cookies (so-called session cookies). Persistent cookies can be stored on your device for a few seconds up to several years. Temporary cookies are automatically deleted as soon as you close your browser or end the session.

Cookies help us, for example, to

enable the sharing of content from our websites on social media platforms,
understand how visitors interact with our websites (e.g. number of visitors, bounce rate),
display targeted advertising to visitors and evaluate the success of our marketing campaigns,
recognize the preferences of our website visitors and design the websites accordingly in an optimal way,
retain information over a certain period and identify the computer of website visitors as soon as they return to our websites. This makes it possible, for example, to use the settings you previously selected, so that you do not have to make the settings again (e.g. language settings, log-in information).

The use of cookies is in part technically necessary for the operation of our websites and is therefore permissible without the user's consent.

In addition, we may use cookies to offer special functions and content as well as for analysis and marketing purposes. These may also include cookies of third-party providers (so-called third-party cookies). We use such technically non-essential cookies only with your consent pursuant to Section 25 TDDDG and Art. 6(1)(a) GDPR.

If you do not want cookies to be stored on your device, you can set your browser to notify you about the placement of cookies or not to accept them. You can also decide whether you want to accept or block only a few or all categories of cookies. Further information on how to handle cookies can be found in the online help of the browser you use.

If you block cookies used by us, we would like to inform you that you may not be able to use individual functions of our website, or only to a limited extent.

Necessary Cookies (without consent)

These cookies are required for:

login and session control
security functions
shopping cart functions
basic technical functions of the website

Legal basis: Art. 6(1)(f) GDPR, Section 25(2) TDDDG

Cookies with Consent (Analytics & Marketing)

The following services are only activated after consent:

Google Analytics (usage behavior, page views) – legal basis: Art. 6(1)(a) GDPR
Klaviyo Tracking (marketing + course flows, open rates, click behavior, course-accompanying email flows) – legal basis: Art. 6(1)(a) GDPR

Withdrawal possible at any time.

Cookieless Checkout Analytics (without consent)

We use a fully anonymized procedure to optimize the ordering process. Key characteristics:

No cookies
No IP address
No user-agent data
No recognition between sessions
No personal identifiers
No persistent storage in the browser

Recorded events (anonymous):

Step views
Dwell time
Device type
Drop-off points
Voucher attempts (without code)

As the processing serves to optimize the service and no information is stored on your device, this is carried out on the basis of our legitimate interest pursuant to Art. 6(1)(f) GDPR.

Regional Traffic Analysis (without consent)

For the geographic evaluation of visitor traffic, we store the approximate region (federal state/canton) for visitors from Germany, Austria and Switzerland, on the same legal basis as country-specific data. No precise location data or IP addresses are stored.

App Registration

If you register in our app, we process the following data for the purpose of contract initiation as well as the creation and management of your user account:

email address
name data (e.g. first and last name, username)

The processing of the data is based on the legal basis of Art. 6(1)(b) GDPR (= contract initiation and performance of a contract).

To verify your email address, we use the service "Resend" of Plus Five Five, Inc. (2261 Market Street #5039, San Francisco, CA 94114, USA). The transmission of your email address to Resend takes place on the basis of Art. 6(1)(f) GDPR (= legitimate interest). With Resend, a transfer of data to the USA cannot be excluded. Please refer to the information in the section "Data Transfers to Third Countries" of this Privacy Policy. Further information on data protection at Resend can be found in the privacy notices at: https://resend.com/legal/privacy-policy or https://resend.com/legal/dpa

Storage of User Data

Supabase

To store user data, we use the service "Supabase" of Supabase Pte. Ltd. (65 Chulia Street #38-02/03, OCBC Centre, Singapore 049513). If you use our app, the following data, among others, is processed in order to ensure the functionality and usability of the app:

account data (e.g. email address, name)
usage data (e.g. course progress)
if you use the AI Coach (LUMI), your chat inputs and the corresponding responses

Your data is stored primarily in a data center within the European Union (AWS eu-central-1 region, Frankfurt am Main, Germany).

The processing of this data is based on the legal basis of Art. 6(1)(b) GDPR (= performance of a contract). Insofar as health-related data within the meaning of Art. 9 GDPR is processed in this context – such as content from the AI Coach as well as answers from wellbeing questionnaires – such data is processed and stored on the basis of your explicit consent pursuant to Art. 9(2)(a) GDPR.

We concluded a data processing agreement (DPA) with Supabase pursuant to Art. 28 GDPR on 09.06.2026. The contracting party and data importer is Supabase Pte. Ltd. (Singapore); the transfer to Supabase is based on the EU Standard Contractual Clauses (Module 2, Irish law). To provide the service, Supabase engages its own subcontractors (sub-processors), including hosting providers in the USA (e.g. AWS, Google LLC); Supabase provides the current list of sub-processors at https://supabase.com/legal/subprocessors.

With Supabase, therefore, in addition to the transfer to Singapore, indirect access by US authorities via these US sub-processors also cannot be excluded. For this risk, Supabase has carried out its own Transfer Impact Assessment (TIA), which in particular assesses the legal situation regarding FISA 702 / EO 12333 in relation to the US sub-processors used, and concludes that there is no high risk to the data transfer.

In addition to these contractual safeguards, we take our own technical measures: the content of the AI Coach, session summaries and your user memory are stored AES-GCM encrypted; key management takes place exclusively within the EU. Due to this encryption, Supabase itself cannot access this content — only the ciphertext is available there. These supplementary measures are documented in our internal security concept.

Further information on data protection at Supabase can be found in Supabase's privacy notice at: https://supabase.com/privacy

Hetzner

For the operation of our backend servers and our infrastructure, we use Hetzner Online GmbH (Industriestr. 25, 91710 Gunzenhausen, Germany). The server-side processing of requests (API) takes place via these servers. In the course of operation, technical log data is also processed, which is necessary for the security, stability and traceability of system operation. The processing takes place in a data center in Germany (EU). The legal basis is Art. 6(1)(b) GDPR (performance of a contract) as well as Art. 6(1)(f) GDPR (legitimate interest in secure and stable operation). We have concluded a data processing agreement with Hetzner pursuant to Art. 28 GDPR. Further information: https://www.hetzner.de/de/privacy

Internal Development Processes (AI Support)

For the maintenance and further development of our services, we internally use the AI-assisted development tool "Claude Code" of Anthropic PBC (548 Market Street, Suite 72220, San Francisco, CA 94104, USA) – for example to adjust the database structure, to check system processes (whether entries and processes take place correctly), and for error analysis. The tool does not serve to evaluate personal user data.

In exceptional cases, this tool may be given read-only access, as part of error analyses or optimization measures, to systems that contain personal data. In doing so, the following data may be processed:

account data (e.g. email address, name)
usage data (e.g. course progress, app activity)
order data (e.g. product purchases, subscription status)
technical log data (e.g. error messages, system events)

Health-related data within the meaning of Art. 9 GDPR (e.g. content from the AI Coach) is always encrypted in this context and accessible to the tool only as ciphertext; no decryption takes place in this connection. We work in a data-minimizing manner and primarily access structural and metadata; we document the balancing of interests and individual instances of access internally.

The processing is carried out on the basis of our legitimate interest in maintaining and further developing our technical infrastructure pursuant to Art. 6(1)(f) GDPR.

We have concluded a data processing agreement with Anthropic (Anthropic Commercial Data Processing Addendum). Under this agreement, Anthropic does not use your data for training purposes. Further information can be found at: https://www.anthropic.com/legal/data-processing-addendum

As Anthropic is a US company, a transfer of data to the USA cannot be excluded. This transfer is based on the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR, Module 2/3). Further information on data protection at Anthropic can be found at: https://www.anthropic.com/legal/privacy

Data Transfers to Third Countries

Visiting our websites and using our app may involve the transfer of certain data to third countries, i.e. countries in which the GDPR is not applicable law. Such a transfer takes place in a permissible manner if the European Commission has determined that an adequate level of data protection is provided in such a third country. If such an adequacy decision of the European Commission does not exist, a transfer of data to a third country only takes place where appropriate safeguards pursuant to Art. 46 GDPR exist or where one of the conditions of Art. 49 GDPR is met.

Unless otherwise stated below, we use as appropriate safeguards the EU Standard Contractual Clauses for the transfer of data to processors in third countries: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=celex%3A32021D0914.

Insofar as you consent to the transfer of data to third countries, the transfer takes place on the legal basis of Art. 49(1)(a) GDPR.

Right of Access

Visitors to our online presence have the right, pursuant to Art. 15 GDPR, to obtain information, on request, at any time and free of charge, about the data processed by our company relating to them. The scope of the information follows from Art. 15 GDPR.

Please address your request for information by email to the following address: [email protected].

Right to Rectification of Your Data

Pursuant to Art. 16 GDPR, you have the right, where incorrect or incomplete data about you exists, to request its rectification or completion. We will review such requests and, in justified cases, take the necessary measures.

Right to Erasure and Blocking of Your Data

Pursuant to Art. 17 GDPR, you have the right to erasure of your data.

The data stored by us about you is destroyed or deleted in a data-protection-compliant manner if:

the statutory retention periods have expired, or
the collection or processing is or was unlawful, or
the data is no longer necessary for fulfilling the purposes for which it was collected, or
you have withdrawn your consent to the processing and use, or
you object to the processing of your data pursuant to Art. 21 GDPR and there are no overriding legitimate grounds for the processing

We inform you that complete erasure only takes place after the expiry of the corresponding periods under tax and commercial law provisions. Until these periods expire and until final deletion, your data will be blocked accordingly and not further processed by us.

Right to Restriction of Processing

Pursuant to Art. 18 GDPR, you have the right to request that we restrict the processing of your data in the cases and to the extent set out in Art. 18 GDPR. We will review such requests and, in justified cases, take the necessary measures.

Right to Data Portability

Pursuant to Art. 20 GDPR, you have the right to receive the data we process about you in a structured, commonly used and machine-readable format. At your express request, we will transmit your data to the recipients clearly designated by you, insofar as this is technically feasible for us and permissible under data protection law.

Right of Withdrawal and Objection

You have the right, at any time and without giving reasons, to withdraw free of charge the consent you have given us to process your data with effect for the future, or to object to the processing of your data pursuant to Art. 21 GDPR. Please address your withdrawal of consent or objection by email to the following address: [email protected].

Right to Lodge a Complaint with a Supervisory Authority

Pursuant to Art. 14 in conjunction with Art. 77 GDPR, you have the right to lodge a complaint with a data protection supervisory authority if you believe that the processing of your data violates the GDPR. The competent supervisory authority is the one in which our company has its head office.

Right to an Effective Judicial Remedy against the Controller

Pursuant to Art. 79 GDPR, you have the right to an effective judicial remedy if you believe that your rights listed above have been infringed as a result of processing of your data that is not in compliance with the requirements of the GDPR by us or by a processor engaged by us.

Liability and Right to Compensation

Pursuant to Art. 82 GDPR, you have a right to compensation, which you can assert against us or the processors engaged by us, if you have suffered material or non-material damage as a result of a violation of the GDPR.

Amendments to the Privacy Policy

This Privacy Policy will be updated with effect for the future in the event of new legal requirements or significant changes to the scope of functions of our websites. We therefore recommend that you read our Privacy Policy at regular intervals.

Last updated: 18.08.2026

Part B — Privacy Notice for the LUMEUS AI Coach

This section supplements the general Privacy Policy of LUMEUS and specifically describes the processing carried out in connection with the AI Coach ("LUMI"). In the event of any conflict, this specific section takes precedence for the "AI Coach" feature.

1. Controller

Responsible for data processing within the meaning of the GDPR is:

EmoTrain GmbH, Am Buchet 8a, 82057 Icking, Germany, Phone: +49 (0) 8178 9589940, Email: [email protected]. Represented by the management: Verena Herzog-Pohl.

Contact for data protection matters: [email protected]

2. What is the LUMEUS AI Coach?

The LUMEUS AI Coach is an optional, dialogue-based feature module within the LUMEUS app or as a web app. It provides general information and motivation on the topics of stress management, sleep and emotional wellbeing as well as weight management. To generate its responses, LUMEUS uses an AI language model from the provider Anthropic PBC.

The AI Coach does not replace medical or psychotherapeutic advice, diagnosis or treatment.

3. What data is processed?

Within the scope of using the AI Coach, we process:

your inputs in the chat (e.g. questions, descriptions of how you are feeling, free-text entries),
when using the voice feature, your voice recordings (these are processed solely for conversion into text and are stored neither by us nor persistently by Google),
the responses generated by the AI model,
technical accompanying data of the processing (e.g. time of the request, the device used, duration of the request).

Since you enter topics such as mood, stress, sleep or eating behavior, your information may include health-related data within the meaning of Art. 9 GDPR. Please share only what is necessary for your concern, and do not enter any data about other persons. Avoid unnecessary information that directly identifies you or third parties (e.g. full names, addresses).

Technical note: Direct identifying features from your user profile (e.g. first and last name, place of residence) are replaced with placeholders before transmission to the AI service. The actual content of your message is not automatically anonymized by this – please therefore observe the note above and avoid unnecessary direct identifying features in your entries. For storage in our database, your inputs and the corresponding responses are encrypted (AES-GCM); key management takes place exclusively within the EU.

4. Purposes of Processing

We process this data exclusively in order to:

respond to your requests to the AI Coach,
provide you with the described content and functions,
display your conversation history within the chat,
ensure the security and functionality of the service.

5. Legal Bases

Processing and storage of health-related data (Art. 9 GDPR): Insofar as your entries include health data, both their transmission to the AI service and their storage in our database are based on your explicit consent pursuant to Art. 9(2)(a) GDPR in conjunction with Art. 6(1)(a) GDPR. You give this consent before first using the AI Coach via the corresponding consent dialogue. This consent dialogue explicitly informs you of the transmission of your data to the USA (Anthropic) as well as – when using the voice feature – to Google Cloud, and contains a directly clickable link to this Privacy Policy.
The AI Coach can only be used on the basis of your consent; without consent, no processing takes place. When you withdraw your consent, the AI Coach can no longer be used.

6. Recipients / Processors

6.1 Anthropic

To respond to your requests, your inputs are transmitted to the following service provider:

Anthropic PBC, 548 Market Street, Suite 72220, San Francisco, CA 94104, USA

Anthropic processes the data as our processor on the basis of a data processing agreement (Data Processing Addendum, Art. 28 GDPR; see https://www.anthropic.com/legal/data-processing-addendum). Under the API terms of use we apply, Anthropic does not process your inputs for its own training purposes.

Note: This processing via the AI Coach is to be distinguished from the purely internal use of the development tool "Claude Code" described elsewhere; these are two separate processing purposes.

6.2 Google Cloud (Voice Feature)

The AI Coach optionally offers a voice feature: you can speak your message via microphone (speech recognition) and have the AI Coach's responses read aloud to you (speech synthesis). If you use the voice feature, your voice recording is transmitted in encrypted form for conversion into text, as well as the AI Coach's response text for conversion into speech, to the following service provider:

Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; parent company: Google LLC, USA; services used: Cloud Speech-to-Text and Cloud Text-to-Speech.

Google processes this data as our processor on the basis of the Google Cloud Data Processing Addendum (Art. 28 GDPR; available at https://cloud.google.com/terms/data-processing-addendum). Under the Google Cloud terms of use, the transmitted audio and text data are not stored and are not used for Google's own training purposes. We also do not store your voice recordings: only the text generated from your voice input is stored — like your other chat inputs — in encrypted form in our database. The voice feature is voluntary — you can always use the AI Coach with text input only. Further information on data protection at Google: https://policies.google.com/privacy

Your data is not disclosed to any further third parties, unless we are legally obliged to do so.

7. Transfer to Third Countries (USA)

Processing by Anthropic takes place in the USA and therefore in a third country.

This transfer is carried out on the basis of the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR, Module 2/3) that we have agreed with Anthropic. An adequacy decision of the European Commission pursuant to Art. 45 GDPR (EU-US Data Privacy Framework) does not exist for this transfer.

Further information on data protection at Anthropic can be found at: https://www.anthropic.com/legal/privacy

Processing by Google Cloud (when using the voice feature) also takes place in a third country. Insofar as your voice inputs contain health-related data within the meaning of Art. 9 GDPR, processing takes place — as with text inputs — on the basis of your explicit consent (Art. 9(2)(a) GDPR). The transfer to the USA is based on the EU Standard Contractual Clauses that we have agreed with Google as part of the Google Cloud Data Processing Addendum, as well as — insofar as the parent company Google LLC is certified accordingly — additionally on the EU-US Data Privacy Framework (Art. 45 GDPR).

Further information on data protection at Google can be found at: https://policies.google.com/privacy

8. Storage Period

Your inputs and the corresponding responses are stored in our database (Supabase) so that your conversation history is available to you while using the AI Coach. With each request, your inputs are transmitted to the AI service (Anthropic) for the purpose of responding; they are stored by us. Storage takes place for the duration of your active user account. Your data is deleted as soon as your account is deleted – either by you or by us. If you would like the data you entered in the AI Coach to be deleted while your account remains active, you can withdraw your consent for this purpose (see item 11) – this results in the automatic deletion of your Coach data. Alternatively, you can contact us at [email protected].

At the AI service (Anthropic), your transmitted requests are stored only temporarily – for up to 30 days to ensure security and abuse detection – and are then deleted. We do not currently offer customer-specific zero retention (i.e. immediate deletion without this transitional storage). They are not used for its own training purposes.

For the content stored in our database, the information in the sections "Storage of User Data" and "Data Transfers to Third Countries" of this Privacy Policy additionally applies.

9. No Automated Decision with Legal Effect

The AI Coach generates text responses automatically, but does not make any automated decision within the meaning of Art. 22 GDPR that has a legal effect on you or similarly significantly affects you. The content serves exclusively for information and motivation.

10. Voluntary Nature and Consequences of Non-Provision

Giving consent and entering your data are voluntary. You are neither legally nor contractually obliged to use the AI Coach.

Without your consent, you cannot use the "AI Coach" feature module. All other functions of the LUMEUS app remain available to you even without this consent.

11. Your Rights

You have the following rights with regard to your personal data:

Withdrawal of consent (Art. 7(3) GDPR): You can withdraw your consent at any time with effect for the future directly in your settings – in the app or in the web chatbot under "Settings → LUMI AI Chatbot", or in your website account under "Consents & Privacy". The withdrawal automatically leads to the deletion of your data stored in the AI Coach. Alternatively, you can also send us an email at [email protected]. The lawfulness of processing carried out up to the point of withdrawal remains unaffected.
Access (Art. 15 GDPR)
Rectification (Art. 16 GDPR)
Erasure (Art. 17 GDPR)
Restriction of processing (Art. 18 GDPR)
Data portability (Art. 20 GDPR)

To exercise these rights, an informal message to [email protected] is sufficient.

12. Right to Lodge a Complaint with a Supervisory Authority

You have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). For EmoTrain GmbH (registered office in Icking, Bavaria), this is:

Bavarian State Office for Data Protection Supervision (Bayerisches Landesamt für Datenschutzaufsicht, BayLDA), Ansbach.

Last updated: 18.08.2026.