Privacy Policy

kommunikationstrainer.ai

1. Privacy at a Glance

In this privacy policy we inform you, in accordance with Art. 13 and 14 GDPR, which personal data is processed when you use our website kommunikationstrainer.ai and our training platform, for which purposes and on which legal basis this happens, how long the data is stored, to whom it is transferred and which rights you have.

Key points:

  • If you use the platform through your employer or another organization, that organization is responsible for your data. We process the data on its behalf (Section 3).
  • We store your data on servers of Hetzner Online GmbH in Germany; database backups are kept within the EU. For speech recognition, speech output and AI functions we use Mistral AI (France). For this purpose, your microphone audio is streamed live to Mistral AI.
  • OpenAI is used for speech recognition only if your organization explicitly selects it. In that case data is transferred to the USA (Sections 18 and 19).
  • We do not use any analytics, tracking or advertising tools (Section 21).
  • Scores and feedback are generated automatically by AI and serve training purposes only. We do not make automated decisions with legal effect (Section 17).
  • Your right to object under Art. 21 GDPR is set out separately in Section 27.

2. Controller and Contact

ImmBlend GmbH

Unterer Geisberg 26

96129 Strullendorf

Germany

Managing Director: Stephan Lohß

Register court: Amtsgericht Bamberg, HRB 10562

Phone: +49 15731589006

Email: info@immblend.de

For all questions about data protection and to exercise your rights, you can reach us at info@immblend.de or at the postal address above. Further details can be found in our Imprint.

3. Who Is Responsible for Your Data?

Which party is responsible for your data depends on how you use our services.

ImmBlend is the controller (Art. 4(7) GDPR) for:

  • visits to our website, including the server log files (Section 4),
  • inquiries to us by email or phone (Section 5),
  • contract, billing and contact data of our customers and their contact persons (Section 6),
  • the demo mode without a user account (Section 8),
  • users without an organization, i.e. after self-registration or with an individual plan (hereinafter “direct users”),
  • sending login codes by email for accounts for which we are responsible ourselves.

Your organization is the controller, ImmBlend is the processor (Art. 28 GDPR):

If you use the platform through the customer account of an organization, for example your employer (as organization owner, trainer or invited user), that organization is the controller for the processing of your data on the platform. We process this data exclusively on its behalf and according to its instructions on the basis of a data processing agreement. This applies in particular to your user account, recordings, transcripts, scores, dialog trainer conversations, quiz results, learning time, certificates, messages and company knowledge.

The legal basis for this processing is determined by your organization, in an employment relationship for example Art. 6(1) GDPR in conjunction with Section 26 of the German Federal Data Protection Act (BDSG). For which purposes your organization uses the platform, how long it has data retained and how to reach its data protection officer is described in the privacy notice of your employer or organization.

Note for members of an organization: To exercise your rights, please contact your organization or its data protection officer. If you contact us, we will forward your request to your organization and support it in responding.

Sections 7 and 9 to 17 describe how the platform processes data. For direct users, ImmBlend is the controller there; the legal basis is then Art. 6(1)(b) GDPR (contract for the use of the platform).

4. Hosting, Server Log Files and Test System

The website and the platform are operated by Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany. The application server is located in Falkenstein and the database server in Nuremberg (both Germany). We store uploaded files and recordings in Hetzner Object Storage at the Falkenstein location (encrypted since 18 September 2026), and database backups in a Hetzner Storage Box within the EU (encrypted since 14 September 2026; details in Section 22).

When you access the website and the platform, the server automatically records information in so-called server log files:

  • IP address of the requesting device
  • Date and time of access
  • Requested address (URL), HTTP status code and amount of data transferred
  • Where applicable, the previously visited page (referrer URL)
  • Browser and operating system used (user agent)

Login tokens are masked in the logs. When you log in with a code, the requested address contains your email address and the login code; both are therefore contained in the server log files for up to 14 days. Since 23 September 2026, our application logs no longer contain any content from training sessions, messages or AI responses.

Purpose of processing:

  • Delivering the website and establishing the connection
  • System security and stability, for example to defend against attacks and to analyze errors
  • Technical administration

For internal testing, we also operate a separate test system on a Hetzner server in Nuremberg. It accesses the same database and the same file storage as the platform, is subject to the same security measures, is used by ImmBlend staff to test new versions and is excluded from indexing by search engines.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in secure and stable operation). If you use the platform through an organization, the processing is carried out on its behalf.

Retention: Server log files are deleted by rotation after 14 days.

5. Contacting Us

If you contact us by email or phone, we process the information you provide (for example name, email address, phone number and the content of your inquiry) in order to handle your request.

Legal basis: Art. 6(1)(b) GDPR where your inquiry concerns a contract or pre-contractual measures; Art. 6(1)(c) GDPR for requests concerning your data protection rights; otherwise Art. 6(1)(f) GDPR (legitimate interest in answering inquiries).

Retention: until your request has been fully handled. If the inquiry is part of business correspondence, the statutory retention periods apply (Section 257 German Commercial Code (HGB), Section 147 German Fiscal Code (AO)).

6. Customers, Contract Data and Contact Persons

For the initiation, conclusion, performance and billing of contracts with organizations and direct users, we process contract, billing and contact data, for example company name, address, contact email address, phone number, names of contact persons, the booked plan and the scope of use.

In the data processing agreement, our customers name their data protection officer and inform us of changes in text form. We receive these contact details from the respective organization (Art. 14 GDPR). We use them to fulfil our obligations as a processor, for example to forward requests from data subjects or to report personal data breaches (Art. 33(2) GDPR).

The name and logo of an organization are displayed publicly on its own login page of the platform.

Legal basis: Art. 6(1)(b) GDPR (contract), Art. 6(1)(c) GDPR (legal obligations, for example retention obligations as well as Art. 30(2) and Art. 33(2) GDPR) and Art. 6(1)(f) GDPR (legitimate interest in communicating with the contact persons of our customers).

Retention: for the duration of the business relationship; thereafter only as long as statutory retention obligations apply (in particular Section 257 HGB and Section 147 AO, up to ten years).

7. Login and User Account

Role: Processing on behalf of your organization; for direct users, ImmBlend is the controller.

Your account is usually created by your organization or your trainer, or you register via an invitation or registration link of your organization. In these cases we receive your account data from your organization (Art. 14 GDPR).

Account Data

Username, first and last name, email address, password (stored only as a bcrypt hash), role (organization owner, trainer, invited user), affiliation with organization, trainer and groups, permissions and minute quota, language, profile picture (stored encrypted) and time of registration.

Login

You log in with a code sent by email or with your username or email address and password. We send the login code via the web hosting service of Hetzner Online GmbH. In doing so, we store the code, email address, IP address, browser identifier (user agent) and time. We store failed login attempts with the email address or username, IP address and browser identifier in order to prevent misuse. After logging in you receive a login token that is valid for 180 days; logging out invalidates it for the respective device.

Devices and Technical Data

List of your logged-in devices (device type and name derived from the browser identifier, last activity, online status), the time of your last activity and the most recently used IP address, which is overwritten with every request. You and ImmBlend’s administrators can see the device list and the most recently used IP address; the time of your last activity can additionally be seen by your trainer and the organization owner (Section 16).

Purpose of processing:

  • Providing and managing your account
  • Authentication and protection against unauthorized access, for example by limiting code requests and failed attempts
  • Compliance with the agreed usage quotas

Legal basis: For organization users, the legal basis is determined by your organization (Section 3). For direct users Art. 6(1)(b) GDPR; for protection against misuse Art. 6(1)(f) GDPR.

Retention: Login codes are deleted after 24 hours (they are contained in the server log files for up to 14 days, Section 4), failed login attempts after 30 days. Account data, the device list and the last IP address are stored until the account or the organization is deleted.

8. Demo Mode

Role: ImmBlend is the controller.

In demo mode you can try the dialog trainer without a user account. We process the following data:

  • Microphone audio: Your speech is streamed live to Mistral AI for speech recognition and is not stored as an audio file. The resulting transcript is sent to Mistral AI to generate the AI’s response and convert it into speech. In demo mode we use Mistral AI exclusively.
  • Demo content: Conversation history, feedback and characters you create, stored under a randomly generated demo ID.
  • Usage limit: To prevent misuse, the number of demos per IP address is limited. For this purpose we store a pseudonymized hash value (HMAC) of your IP address, not the IP address itself.
  • Browser: Demo ID and a time-limited demo token in session storage (Section 20).

Please do not enter any confidential information or personal data of other people in the demo.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in offering prospective customers a demo and in preventing misuse).

Retention: Conversation histories, feedback and characters are deleted after 24 hours. The hash value remains stored so that the demo usage limit stays effective. The session storage entries are removed when you close the browser tab.

9. Presentation Trainer

Role: Processing on behalf of your organization; for direct users, ImmBlend is the controller.

Recording (Video and Audio)

Your presentation is recorded as video with sound and stored in encrypted form in Hetzner Object Storage. Uploaded slide decks (PDF) are also stored in encrypted form.

Speech Recognition

During the recording, your microphone audio (raw audio) is streamed live to Mistral AI and converted into text there. If your organization has enabled OpenAI for speech recognition, the audio is transferred to OpenAI depending on the setting (Section 18).

Speech Analysis

On our servers we calculate speech metrics from the recording, such as speaking rate (words per minute), pauses, filler words and pitch and volume curves. These values describe technical characteristics of your way of speaking. No emotion recognition based on your voice takes place.

Text Analysis

The transcript of every new recording is automatically sent to Mistral AI to determine the tone of the text (sentiment) and key phrases. The analysis is based on the text alone.

AI Feedback

At your request, the transcript and speech metrics are sent to Mistral AI to generate written feedback with scores.

Stored Results

The recording, transcript, metrics, scores and feedback are stored. Section 16 describes who can see this data. If you share a session in a chat, the participants of that chat see the video as well as scores, speech metrics (including pitch, volume and pause curves), filler words, tone, key phrases and an excerpt of the transcript. This information is stored as part of the message.

Purpose and legal basis: Carrying out presentation training. For organization users, the legal basis is determined by your organization (Section 3); for direct users Art. 6(1)(b) GDPR.

Retention: for the duration of the contract (Section 22).

10. Dialog Trainer

Role: Processing on behalf of your organization; for direct users, ImmBlend is the controller.

In the dialog trainer you practice conversations with AI-controlled conversation partners. The following data is processed:

Voice Input

Your microphone audio (raw audio) is streamed live to Mistral AI and converted into text, or to OpenAI if your organization has enabled this. The audio is not stored as a file; only the transcript is stored.

Conversation Simulation

The transcript is sent, together with the scenario, the description of the character or personality and your organization’s company knowledge, to the language model of Mistral AI, which generates the response. The response is converted into a synthetic voice using Mistral AI’s speech synthesis. For tasks and hints during the conversation, excerpts of the transcript are also evaluated by Mistral AI.

Feedback and Quiz

After the conversation, the transcript is sent to Mistral AI to generate feedback with scores. Mistral AI creates quiz questions from the topic knowledge, the company knowledge and your own previous conversation transcripts. Your answers and results are stored.

Conversation Partners

The images of the conversation partners come from a pre-generated pool of AI-generated images and do not depict real persons. The voices of the conversation partners are synthetically generated.

Stored Data

Conversation history (text of both sides), feedback, scores, task progress, quiz results and training time (recorded as learning time if the IDD function is enabled, Section 13).

Sharing in a Chat

If you share a dialog trainer session in a chat, the participants see the conversation history (up to 50 messages), scenario, personality, time, duration and the overall score. This information is stored as part of the message.

Purpose and legal basis: Carrying out conversation training. For organization users, the legal basis is determined by your organization (Section 3); for direct users Art. 6(1)(b) GDPR.

Retention: for the duration of the contract (Section 22).

11. Dictation

Role: Processing on behalf of your organization; for direct users, ImmBlend is the controller.

When creating scenarios (topics) and personalities (conversation types), you can dictate text using voice dictation. For this purpose your microphone audio is streamed live to Mistral AI and converted into text, or to OpenAI if your organization has enabled this. The audio is not stored; the recognized text becomes part of the content you create.

Legal basis: For organization users, the legal basis is determined by your organization (Section 3); for direct users Art. 6(1)(b) GDPR.

12. Scenarios, Knowledge Documents and Company Knowledge

Role: Processing on behalf of your organization; for direct users, ImmBlend is the controller.

Scenarios, Characters and Personalities

With the appropriate permission you can create your own scenarios (topics), characters (conversation partners) and personalities (conversation types), including from text or PDF files. PDF files are read on our servers; only the text is sent to Mistral AI to generate scenarios and characters. Knowledge documents for scenarios (PDF) are stored in encrypted form and are also deleted when the scenario or document is deleted.

Company Knowledge

The organization owner can store company knowledge, as text or from PDF files. The PDF files are read on our servers and are not stored; their text is sent to Mistral AI to create a summary from it. The company knowledge text is stored and included in the dialog trainer conversations and quiz questions of all members of the organization.

Organization Settings

Company name, contact details, logo, color scheme, IDD setting, the choice of speech recognition provider and whether the AI assistant is switched on (Section 14).

Please do not include personal data of customers or other persons in scenarios, knowledge documents or company knowledge.

Legal basis: For organization users, the legal basis is determined by your organization (Section 3); for direct users Art. 6(1)(b) GDPR.

Retention: until deleted by you or your organization, at the latest for the duration of the contract (Section 22).

13. IDD Learning Time and Certificates

Role: Processing on behalf of your organization; for direct users, ImmBlend is the controller.

If your organization has enabled the IDD function, we record the net learning time per training session (minutes, topic, type of further training). This supports your organization in documenting the further training obligation under the Insurance Distribution Directive (IDD).

Certificates can be issued for completed topics and years. They contain your name, the name of your organization, the topic or topics, where applicable the IDD category and the competence area, the learning time, the number of training sessions or topics, the quiz result (points achieved and possible) and the date of issue. For a topic certificate, a list of the individual training sessions with date, time and duration and, where available, conversation partner, personality and individual score is also stored; for an annual certificate, the learning time, the quiz result and the number of training sessions per topic.

Public verification: Every certificate has a verification link or QR code. Anyone who knows this link can retrieve all of the information listed above without logging in, including the list of training sessions with individual scores. Please share the link only with persons who are supposed to verify the certificate.

Legal basis: For organization users, the legal basis is determined by your organization (Section 3); for direct users Art. 6(1)(b) GDPR.

Retention: for the duration of the contract (Section 22).

14. Messaging and AI Assistant

Role: Processing on behalf of your organization; for direct users, ImmBlend is the controller.

The platform offers group and direct messages as well as a private AI chat. The following data is processed:

  • Messages: text, sender, time, replies to messages and shared training sessions
  • Media files: images (max. 5 MB) and voice messages (max. 10 MB), stored in encrypted form in Hetzner Object Storage and accessible only to the participants of the respective conversation
  • Read receipts: time at which a message was read
  • Real-time delivery: messages are delivered via an encrypted WebSocket connection (WSS)

Group members can see your name, your profile picture and your messages in the respective group. Direct messages are possible with members of shared groups, with your trainer and with the organization owner. There is currently no function for deleting individual messages; however, you can clear your private AI chat completely (see below).

Private AI chat:

  • In Messages you have your own private chat with the AI assistant. This applies to all members of an organization (organization owner, trainers, invited users) and to direct users. Nobody other than you takes part in this chat.
  • No command is needed: every text message you send there is sent to Mistral AI. As context, the last 10 messages of this chat are included, i.e. your own questions and the assistant’s answers; each message is truncated to 2,000 characters. No messages or names of other people from groups or direct messages are sent.
  • Only text messages are possible; images, voice messages and replies to individual messages are refused in the private AI chat.
  • A notice in the chat header makes clear that you are chatting with an AI and that answers can be wrong or outdated (Art. 50(1) AI Act).
  • You can clear the chat at any time using a button in the header; after you confirm, the messages are deleted permanently (for backups see Section 22).
  • If your user account is deleted, your private AI chat, its messages and your usage counters (see below) are deleted as well.

AI assistant in groups:

  • The assistant is only active if the trainer has switched it on for a group.
  • It only acts when a group member addresses it with a command (for example @ai). The request is then sent to Mistral AI.
  • With the commands @summary (German: @zusammenfassung), @todo (German: @aufgaben) and @quiz (German: @quizfrage), the last 30 text messages of the group, including the display names of their senders, are also sent to Mistral AI. In all cases, the request is truncated to 2,000 characters.
  • The assistant’s answer appears in the group and is visible to all members.

The following applies to the private AI chat and the group assistant:

  • Switching on and off: The organization owner can switch the AI assistant off for the whole organization in the settings; it is switched on by default. When it is switched off, neither the group assistant nor the private AI chat produces answers, and trainers cannot switch the assistant on for any group. For direct users, the assistant is available.
  • Daily limits: A daily limit applies per group and, for the private AI chat, a daily limit per person (by default 20 questions per day).
  • Usage counters: For each day and each person or group, we store the number of requests, the number of tokens processed by Mistral AI (input and output) and the number of web searches. These are counts only; the counters contain no message content.
  • State of knowledge: The assistant’s training knowledge may be outdated. With every request, its instructions contain today’s date and the rule not to invent circular numbers, sections of law, deadlines, interest rates or other figures, but to point out that information may have changed and to name the competent primary source (BaFin, EBA, EIOPA, Bundesbank, gesetze-im-internet.de).
  • Web search: The organization owner can switch on a web search in the settings; it is switched off by default. When it is on, the assistant can search the internet via Mistral AI for current information when needed, for general questions (@ki, @ai) and in the private AI chat, and lists the sources under its answer. It is instructed not to include personal data in search queries. Summaries, tasks and quiz questions from the group history never use the web search.
  • Recipient: Requests are sent exclusively to Mistral AI (Section 18).

Legal basis: For organization users, the legal basis is determined by your organization (Section 3); for direct users Art. 6(1)(b) GDPR.

Retention: for the duration of the contract (Section 22); you can clear the private AI chat yourself before then, and it is deleted together with your user account (see above).

15. Invitations, Registration Links and Usage Logs

Role: Processing on behalf of your organization; for direct users, ImmBlend is the controller.

Invitations and Groups

Invitation codes, group memberships and the sharing of scenarios, characters or personalities with other users.

Registration Links

Organizations can create registration links, optionally with a password and a restriction to certain email domains. When password-protected links are accessed and during registration, we store the IP address and time in order to prevent misuse such as password guessing.

Usage Logs

For minute quotas and billing we log usage per session (time, duration, module, language, topic; for presentations additionally word count, speaking rate and pauses). Trainers and organization owners can view these logs.

Legal basis: For organization users, the legal basis is determined by your organization (Section 3); for direct users Art. 6(1)(b) GDPR, for IP logging Art. 6(1)(f) GDPR (protection against misuse).

Retention: Usage logs and the IP addresses in the registration link logs are stored until the account or the organization is deleted (Section 22).

16. Who Can See Your Data?

Your trainer

Name, username, email address, time of registration, last activity, groups, permissions and minute quota; list of your presentation sessions with name, date, duration, overall score, speaking rate and filler words; list of your dialog trainer sessions with name, time, duration, number of messages, status and language; your usage logs.

The organization owner

Names, email addresses, last activity and usage logs of the trainers and their users. For users who registered via a registration link of the organization, the organization owner sees the same information as a trainer.

Visible only to you

Recordings, transcripts, AI feedback, dialog trainer conversation histories, your private AI chat, quiz answers and certificates, unless you share a session in a chat yourself or pass on a certificate link.

ImmBlend

Our administrators can see account data, role, last activity and the last IP address in the user management. As a processor, we process the data of organization users only on the instructions of the respective organization (Art. 29 GDPR).

As the controller, your organization can also require us to hand over or delete the data processed on its behalf.

17. AI Transparency, Profiling and Automated Decisions

Information on the use of AI (Art. 50 AI Act, Regulation (EU) 2024/1689):

  • In the dialog trainer you are talking to an AI system, not a human being.
  • In the private AI chat in Messages you are chatting with an AI system, not a human being; a notice in the chat header also points out that answers can be wrong or outdated.
  • The voices of the conversation partners are synthetically generated (speech synthesis by Mistral AI); the images of the conversation partners are AI-generated.
  • Transcripts, scores, feedback, quiz questions, answers of the AI assistant in Messages (groups and private AI chat) as well as generated scenarios, characters and company knowledge summaries are created automatically by AI.
  • AI results can be incorrect or incomplete. Please review them critically.

Profiling: The automated evaluation of your training sessions (scores, speaking rate, filler words, feedback) assesses aspects of your communication and may therefore constitute profiling within the meaning of Art. 4(4) GDPR. It serves training purposes only.

No automated decisions: ImmBlend does not make any decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you (Art. 22 GDPR). Scores are automated assessments for training purposes.

Trainers and organization owners can view the scores, metrics and sessions of their users (Section 16). Whether and how results are used within the organization is decided by your organization as the controller. It is responsible for complying with employee data protection rules (Section 26 BDSG) and, where applicable, the co-determination rights of the works council (Section 87(1) no. 6 of the German Works Constitution Act, BetrVG).

18. Recipients and Processors

The following service providers process personal data as our processors or sub-processors under Art. 28 GDPR:

Hetzner Online GmbH – Hosting, File Storage, Backups, Email Delivery

Industriestr. 25, 91710 Gunzenhausen, Germany. Servers in Falkenstein and Nuremberg, Object Storage in Falkenstein for all uploaded files and recordings, Storage Box for encrypted database backups, web hosting for sending login codes. Basis: data processing agreement.

Hetzner Privacy Policy

Mistral AI SAS – Speech Recognition, Language Model, Speech Synthesis

15 rue des Halles, 75001 Paris, France. Speech recognition (your microphone audio is streamed live), language model for conversation simulation, feedback, text analysis, quiz generation, generation of scenarios, characters and company knowledge as well as the AI assistant in Messages (groups and private AI chat), speech synthesis for the voices of the conversation partners. Basis: Mistral AI’s Data Processing Addendum.

Mistral AI Legal Information

OpenAI Ireland Ltd – Speech Recognition (only if your organization enables it)

1st Floor, The Liffey Trust Centre, 117-126 Sheriff Street Upper, Dublin 1, Ireland; processing is also carried out by OpenAI OpCo, LLC (USA). OpenAI is used exclusively for speech recognition and only if the organization owner selects “Mistral with OpenAI fallback” (Mistral AI first, OpenAI in the event of an outage; the last approximately 5 seconds of buffered audio are transmitted again) or “OpenAI only” in the organization settings. Your microphone audio and the transcript generated from it are transferred. By default and in demo mode, only Mistral AI is used. Basis: OpenAI’s Data Processing Addendum; for the transfer to the USA see Section 19.

OpenAI Policies

We also use Gcore for the name resolution (DNS) of our domain; Gcore is not a processor and does not process any platform content.

Within your organization, trainers, organization owners and group members receive data to the extent described in Section 16. We only disclose data to authorities where we are legally obliged to do so. We do not sell personal data and do not pass it on for advertising purposes.

19. Data Transfer to Third Countries

Hetzner and Mistral AI are companies based in the EU. We transfer your data to a country outside the EU or the EEA only if your organization has enabled OpenAI for speech recognition:

OpenAI (USA):

Your microphone audio and the transcript may be processed by OpenAI OpCo, LLC (USA). The transfer is safeguarded by the EU Standard Contractual Clauses in OpenAI’s Data Processing Addendum (Art. 46(2)(c) GDPR) and by the EU-US Data Privacy Framework (adequacy decision of the European Commission, Art. 45 GDPR).

Where our service providers themselves use sub-processors outside the EU, this takes place under their data processing agreements on the basis of appropriate safeguards pursuant to Art. 44 et seq. GDPR.

20. Storage of Information in Your Browser

We only store information in your browser that is technically necessary for the functions you use. The only exception is an empty browser database without any function (IndexedDB, see below). We do not use analytics or marketing cookies.

Cookies

ibki_consent stores your choice in the cookie notice (365 days). accessToken contains your login token (Secure, SameSite=Strict; cookie lifetime 90 days, token validity 180 days).

Local Storage

accessToken (login token until logout), ibki-theme and ibki-org-theme (display and your organization’s color scheme), preferredLoginMethod (preferred login method), sidebarMini, useBottomNav and adminSidebarExpanded (navigation), trainer_response_speed and trainer_barge_in (dialog trainer settings) as well as setup_company, setup_knowledge, setup_language and setup_has_logo (temporary draft in the setup wizard, removed once setup is completed).

Session Storage

demoToken and demoUgid for demo mode; they are removed when you close the browser tab.

IndexedDB

PresentationDB: An empty browser database may be created when you set up or start a presentation recording. It is created by a technical remnant in the program code, contains no data and has no function; it remains until deleted in the browser.

Details can be found in our Cookie Policy.

Legal basis: Section 25(2) no. 2 of the German Telecommunications Digital Services Data Protection Act (TDDDG) (storage and access are strictly necessary to provide the service you requested). The only exception is the empty database PresentationDB (see above). Further processing is governed by the legal basis of the respective function.

21. No Analytics or Tracking Tools

We do not use any analytics, tracking or advertising tools. Fonts and the PDF viewer are loaded from our own servers, so your browser does not connect to third-party providers for them.

Until 23 September 2026 we used the web analytics service Microsoft Clarity (Microsoft Corporation, USA) with your consent. The service has been disabled since then; no more data is transferred to Microsoft Clarity. You can delete Clarity cookies set earlier (for example _clck, _clsk) in your browser settings.

22. Retention and Deletion

Training Content

We store recordings, transcripts, scores and feedback, dialog trainer conversations, quiz results, learning time, certificates as well as messages and media files for the duration of the contract with your organization or of your user contract. There is currently no automatic deletion after fixed periods. You can clear your private AI chat yourself at any time (Section 14).

Deletion on Request

We delete individual accounts or data on request within 30 days. Deleting the account directly in the app is currently not possible: the “Delete account” button in the settings opens an email request to info@immblend.de. For organization users, deletion takes place on the instructions of, or in agreement with, the organization. If your organization removes an account in the app, training content, usage logs and the IP addresses in the registration link logs are currently not deleted automatically along with it; complete deletion takes place on request or after the end of the contract. Exceptions are the private AI chat with its messages and the per-person usage counters of the AI assistant: they are deleted together with the account (Section 14). If you delete a presentation session in the app, the associated video is currently not deleted along with it; we will delete it on request.

After the End of the Contract

After the end of the contract with an organization, we delete or return its data on the documented instructions of the organization, at the latest 90 days after the end of the contract.

Backups

The database is backed up every night; the backups are kept for 90 days. Deleted data may therefore remain in backups for up to 90 days. Since 14 September 2026 the backups have been encrypted; older, unencrypted backups are deleted once the 90 days have passed, the last one on 13 December 2026. Files in Object Storage are not additionally backed up. When we switched to file encryption on 18 September 2026, we created an unencrypted backup copy of the files uploaded up to that date; it is temporarily kept in a separate area of Hetzner Object Storage in Falkenstein and will be deleted once the switch has been completed.

Fixed Deletion Periods

  • Server log files: 14 days
  • Login codes: 24 hours (up to 14 days in the server log files)
  • Failed login attempts: 30 days
  • Conversation histories, feedback and characters in demo mode: 24 hours; the hash value used to limit demo usage remains stored

Until the Account or Organization Is Deleted

Account data, the device list, the last IP address, usage logs and the IP addresses in the registration link logs. If an account is removed in the app, usage logs and these IP addresses currently remain stored until they are deleted on request or after the end of the contract (see “Deletion on Request”).

Data from the Previous Platform Generation

Data from the previous version of the platform (2024 to November 2025) was migrated to the current database and is handled according to the same rules.

Statutory retention obligations, in particular for contract and billing records (Section 257 HGB, Section 147 AO), remain unaffected.

23. Data Security

We protect your data with technical and organizational measures pursuant to Art. 32 GDPR, including:

  • encrypted transmission via HTTPS or WSS with TLS 1.2 and 1.3; database connections exclusively with TLS 1.3
  • encryption of the database at rest
  • encryption of all uploaded files and recordings with AES-256-GCM before they are stored in Object Storage (since 18 September 2026; for the temporary unencrypted backup copy see Section 22)
  • encrypted database backups (since 14 September 2026; older unencrypted backups will be deleted by 13 December 2026 at the latest)
  • storage of passwords only as a bcrypt hash
  • role-based access rights
  • limits on code requests and failed attempts for code login as well as general request limits per IP address
  • server log files without training or message content, masked login tokens

24. Obligation to Provide Data

You are not legally obliged to provide personal data to ImmBlend. However, no user account can be created without account data, and the voice-based training functions cannot be used without access to your microphone. For organization users, whether you are obliged to use the platform depends on the requirements of your organization.

25. Minors

The platform is intended for people in a professional context. Use is only permitted from the age of 16. Whether apprentices under 18 use the platform is decided by the respective organization as the controller.

26. Your Rights

Under the GDPR you have the right to:

  • Access to your stored data (Art. 15 GDPR)
  • Rectification of inaccurate data (Art. 16 GDPR)
  • Erasure (Art. 17 GDPR)
  • Restriction of processing (Art. 18 GDPR)
  • Data portability (Art. 20 GDPR)
  • Object to processing (Art. 21 GDPR, see Section 27)
  • Withdraw consent given, with effect for the future (Art. 7(3) GDPR); the lawfulness of processing carried out until the withdrawal remains unaffected
  • Lodge a complaint with a data protection supervisory authority (Art. 77 GDPR)

Access and data export: There is currently no export function in the app. On request, we will provide your data within one month in a common, machine-readable format.

Members of an organization should address their requests to their organization or its data protection officer. We forward requests that reach us to the organization and support it in responding.

Contact: info@immblend.de. To protect your data, we may ask you to verify your identity.

Supervisory authority competent for ImmBlend:

Bayerisches Landesamt für Datenschutzaufsicht (BayLDA)
Promenade 18
91522 Ansbach, Germany
www.lda.bayern.de

You can also contact the supervisory authority of your place of residence or work.

27. Right to Object under Art. 21 GDPR

You have the right to object at any time, on grounds relating to your particular situation, to the processing of your personal data that is based on Art. 6(1)(f) GDPR (legitimate interests).

At ImmBlend this concerns in particular the server log files, protection against misuse during login and registration, the demo mode and communication with the contact persons of our customers. After an objection we will no longer process this data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defense of legal claims.

The objection can be made informally, most easily by email to info@immblend.de. As a member of an organization, please address your objection to processing on the platform to your organization. We do not process your data for direct marketing.

28. Changes to This Privacy Policy

We update this privacy policy when our data processing, the service providers we use or the legal situation change.

The version published on this website applies.

Last updated: September 2026 (Version 3.0)