Privacy Policy

Version: 31 August 2026

This is an English translation for your convenience. Only the German version is legally binding; in the event of any discrepancy between the two versions, the German version prevails.

1. Controller

DigitalWinners GmbH, Hauptstraße 30, 83109 Großkarolinenfeld, Germany, e-mail hello@digitalwinners.net. Further details in the Imprint.

2. Overview of the data processed

Account data: name, e-mail address, encrypted password, plan/subscription status.
Usage content: your inputs in the AI coaches (chats, OKR/KPI drafts) and the generated answers, together with your histories.
Technical data: server log files (IP address, time, resource accessed, user agent) for provision and security.
Sign-in events: for each sign-in, the time, IP address, browser/device (user agent) and a device identifier – for account security and to protect against unauthorised sharing of the personal (named user) account.
Payment data: processed by the app stores or payment service providers; we receive only the subscription/payment status, no complete card details.

3. Hosting

The App is operated at Hostinger; the server location is Frankfurt am Main, Germany. When it is accessed, technically necessary data (server logs) is processed. The legal basis is our legitimate interest in secure, stable operation (Art. 6 (1) (f) GDPR). A data processing agreement pursuant to Art. 28 GDPR is in place with the provider; it forms part of Hostinger's terms of service as a Data Processing Addendum and incorporates the EU Standard Contractual Clauses for transfers outside the EEA.

Our contracting party Hostinger International Limited is based in Cyprus and subject to European law. Hostinger is not a US cloud provider and, according to publicly available company information, has no US parent company. In particular, there is therefore no CLOUD Act risk arising from belonging to a US group.

3a. Sign-in events and protection against account sharing

Your account is personal (named user; see the Terms of Use). To ensure account security and to detect and prevent the inadmissible shared use of an account by several people, we log the time, the IP address, the browser or device (user agent) and a device identifier for each sign-in. When your account signs in from a new device for the first time, we send you a notification e-mail so that you can detect unauthorised access. The legal basis is our legitimate interest in secure operation and in protecting the personal account against unauthorised use (Art. 6 (1) (f) GDPR). These sign-in events are deleted as soon as they are no longer required for this purpose, and no later than after 90 days. You may object to the processing under Art. 21 GDPR; we will then examine whether compelling legitimate grounds prevail.

4. Registration and account

You create an account in order to use the App. Account data is processed for the performance of the contract (Art. 6 (1) (b) GDPR). Without this data, use is not possible.

5. AI processing (OpenAI)

In order to provide the coaching functions, your inputs are transmitted to the interface of OpenAI and processed there in order to generate answers. This may involve a transfer to the USA. The legal basis is performance of the contract (Art. 6 (1) (b) GDPR). Please do not enter any particularly sensitive personal data into the coaches.

5a. Anonymised AI processing (anymize, Companion Secure only)

In the Companion Secure plan, text input to the OKR Goal Assistant is not sent directly to OpenAI. It first goes to anymize (anymize GmbH, Schauenburgerstr. 116, 24118 Kiel, Germany), where personal details are replaced before any further processing; the language model used (Mistral) is accessed through anymize and only receives the anonymised version. The answer is then de-anonymised. The legal basis is performance of the contract (Art. 6(1)(b) GDPR). A data processing agreement pursuant to Art. 28 GDPR is in place with anymize. Dictation, photo upload and phone camera are not covered and continue to run via OpenAI (section 5).

6. Personalised book PDF (pdfRest)

With a subscription you receive the book as a personalised PDF. To create it, we transmit the book file together with your first and last name and your e-mail address to the service pdfRest (Datalogics, Inc., USA). Name and e-mail are added to the document as a watermark to protect it against unauthorised distribution; the file is then encrypted. This may involve a transfer to the USA. The legal basis is performance of the contract (Art. 6 (1) (b) GDPR). The finished file is stored on our server and can only be retrieved by you.

7. Payment processing

Paid subscriptions are processed via the Apple App Store, Google Play or a web payment service provider and, where applicable, RevenueCat (subscription management). The respective providers process the payment data under their own responsibility. The legal basis is performance of the contract (Art. 6 (1) (b) GDPR).

8. Local storage

In order for the App to function, we store technically necessary data (e.g. login token, language setting and a device identifier used to recognise your device at sign-in) in the local storage of your device/browser. No data is required to operate the service and does not depend on consent. Any cookies or similar technologies beyond that are only used with your consent – see section 8a.

8a. Consent, cookies and Google Tag Manager

On this website and in the web app we use Google Tag Manager, a service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Tag Manager administers scripts (tags) and does not itself set cookies for analytics purposes; your IP address is, however, transmitted to Google when it loads.

Consent is obtained through the consent management platform Cookiebot operated by Usercentrics A/S, Havnegade 39, 1058 Copenhagen, Denmark. Cookiebot stores your decision in a cookie (CookieConsent) and passes it on to Tag Manager. Tags that require consent only run once you have agreed; without your consent they remain blocked.

The legal basis for storing and reading information on your device is Section 25 (1) TDDDG and, for the subsequent processing, Art. 6 (1) (a) GDPR (consent). Technically necessary storage takes place under Section 25 (2) no. 2 TDDDG without consent.

You can change or withdraw your decision at any time with effect for the future – via the Cookie settings link in the footer of every page.

The following automatically updated overview shows which cookies are set, for what purpose and how long they are stored:

9. Storage period

We store personal data only for as long as is necessary for the stated purposes or as long as statutory retention obligations exist. Account data is removed once the account is deleted, unless retention obligations prevent this.

10. Your rights

You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection (Art. 21 GDPR). An e-mail to hello@digitalwinners.net is sufficient to exercise them.

11. Right to lodge a complaint

You have the right to lodge a complaint with a data protection supervisory authority, in particular in the member state of your habitual residence or of the place of the alleged infringement.

12. Changes

We adapt this Privacy Policy when the processing or the legal situation changes. The version published here at any given time applies.