Privacy Policy

Version: 31 August 2026

This is an English translation for your convenience. Only the German version is legally binding; in the event of any discrepancy between the two versions, the German version prevails.

1. Controller

DigitalWinners GmbH, Hauptstraße 30, 83109 Großkarolinenfeld, Germany, e-mail hello@digitalwinners.net. Further details in the Imprint.

2. Overview of the data processed

Account data: name, e-mail address, encrypted password, plan/subscription status.
Usage content: your inputs in the AI coaches (chats, OKR/KPI drafts) and the generated answers, together with your histories.
Technical data: server log files (IP address, time, resource accessed, user agent) for provision and security.
Payment data: processed by the app stores or payment service providers; we receive only the subscription/payment status, no complete card details.

3. Hosting

The App is operated at Hostinger; the server location is Frankfurt am Main, Germany. When it is accessed, technically necessary data (server logs) is processed. The legal basis is our legitimate interest in secure, stable operation (Art. 6 (1) (f) GDPR). A data processing agreement pursuant to Art. 28 GDPR is in place with the provider; it forms part of Hostinger's terms of service as a Data Processing Addendum and incorporates the EU Standard Contractual Clauses for transfers outside the EEA.

Our contracting party Hostinger International Limited is based in Cyprus and subject to European law. Hostinger is not a US cloud provider and, according to publicly available company information, has no US parent company. In particular, there is therefore no CLOUD Act risk arising from belonging to a US group.

4. Registration and account

You create an account in order to use the App. Account data is processed for the performance of the contract (Art. 6 (1) (b) GDPR). Without this data, use is not possible.

5. AI processing (OpenAI)

In order to provide the coaching functions, your inputs are transmitted to the interface of OpenAI and processed there in order to generate answers. This may involve a transfer to the USA. The legal basis is performance of the contract (Art. 6 (1) (b) GDPR). Please do not enter any particularly sensitive personal data into the coaches.

5a. Anonymised AI processing (anymize, Companion Secure only)

In the Companion Secure plan, text input to the OKR Goal Assistant is not sent directly to OpenAI. It first goes to anymize (anymize GmbH, Schauenburgerstr. 116, 24118 Kiel, Germany), where personal details are replaced before any further processing; the language model used (Mistral) is accessed through anymize and only receives the anonymised version. The answer is then de-anonymised. The legal basis is performance of the contract (Art. 6(1)(b) GDPR). A data processing agreement pursuant to Art. 28 GDPR is in place with anymize. Dictation, photo upload and phone camera are not covered and continue to run via OpenAI (section 5).

6. Personalised book PDF (pdfRest)

With a subscription you receive the book as a personalised PDF. To create it, we transmit the book file together with your first and last name and your e-mail address to the service pdfRest (Datalogics, Inc., USA). Name and e-mail are added to the document as a watermark to protect it against unauthorised distribution; the file is then encrypted. This may involve a transfer to the USA. The legal basis is performance of the contract (Art. 6 (1) (b) GDPR). The finished file is stored on our server and can only be retrieved by you.

7. Payment processing

Paid subscriptions are processed via the Apple App Store, Google Play or a web payment service provider and, where applicable, RevenueCat (subscription management). The respective providers process the payment data under their own responsibility. The legal basis is performance of the contract (Art. 6 (1) (b) GDPR).

8. Local storage

In order for the App to function, we store technically necessary data (e.g. login token, language setting) in the local storage of your device/browser. No third-party tracking or marketing cookies are set.

9. Storage period

We store personal data only for as long as is necessary for the stated purposes or as long as statutory retention obligations exist. Account data is removed once the account is deleted, unless retention obligations prevent this.

10. Your rights

You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection (Art. 21 GDPR). An e-mail to hello@digitalwinners.net is sufficient to exercise them.

11. Right to lodge a complaint

You have the right to lodge a complaint with a data protection supervisory authority, in particular in the member state of your habitual residence or of the place of the alleged infringement.

12. Changes

We adapt this Privacy Policy when the processing or the legal situation changes. The version published here at any given time applies.