As of: October 2026
Privacy Policy
We process personal data exclusively in accordance with the EU General Data Protection Regulation (GDPR) and the German Federal Data Protection Act (BDSG). This policy describes which data we process in the Engrane pilot, why, for how long – and your rights.
1. Controller
ENGRANE UG (haftungsbeschränkt) i.G., Seylerstrasse 5, 14109 Berlin, Germany, email: hello@engrane.de.
For any privacy question, contact us at hello@engrane.de.
2. Data we process
Application data: name, email, club/academy, city, country, coaching language, years of teaching, optional motivation, and timestamps of contact, Terms and Privacy consent.
Access data: email address and one-time codes for passwordless sign-in; session tokens.
Lesson data: audio recordings, photos/videos, marked moments, transcripts, coach notes and AI-generated drafts (summaries, player versions, training notes) – only with the player's explicit recording allowance.
Usage data: technical logs (e.g. timestamps, status codes) for security and error analysis, without advertising profiles.
3. Private inference – no cloud-vendor models
All AI processing (transcription, analysis, summarization) runs exclusively on our own EU servers using private open-weight models (private inference).
Audio, image, or content data is never transferred to third-party cloud models (e.g. OpenAI, Google, Anthropic, AWS Bedrock) and never used to train external models.
4. Hosting & processors
Hosting: Hetzner Online GmbH (servers in Germany/EU).
Email delivery: transactional email via Resend (EU region).
Data processing agreements pursuant to Art. 28 GDPR exist with all processors. Transfers to third countries only occur where adequate safeguards (e.g. EU Standard Contractual Clauses) apply.
5. Legal bases
Art. 6(1)(a) GDPR: consent (e.g. recording allowance, optional analytics).
Art. 6(1)(b) GDPR: contract and pre-contractual steps (application, access, service).
Art. 6(1)(f) GDPR: legitimate interest (security, abuse protection, error analysis).
Art. 6(1)(c) GDPR: legal obligations (e.g. retention duties).
6. Cookies & local storage
Necessary cookies and local storage are used for language, sign-in, security, and the stored cookie decision.
Optional product analytics – where deployed – only run after active consent, without advertising profiles and without sharing with ad networks.
7. Retention & deletion
Application data: up to 6 months after the application process ends, then deleted – unless statutory duties require longer retention.
Lesson data: until deleted by the coach, at the latest until the end of the pilot; deletion within 30 days of request.
Security logs: maximum 90 days.
8. Your rights
You have the right to access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20), objection (Art. 21), and withdrawal of consent with future effect.
Complaints can be filed with the supervisory authority: Berlin Commissioner for Data Protection and Freedom of Information, Alt-Moabit 59–61, 10555 Berlin, https://www.datenschutz-berlin.de.
9. Security & certification posture
We use transport encryption (TLS), access controls, encryption at rest, and backups.
Our architecture is designed for ISO 27001 and SOC 2 certifiability (policies, access model, logging). A completed certification audit does not yet exist; we will state it transparently once it does.
10. Changes
We update this policy when processing or law changes and mark each version with the date above.