Privacy Policy

xpand Deutschland GmbH, Ernst-Penzoldt-Weg 9, 91080 Spardorf, Germany. Represented by its managing directors Jürgen Kast and Ricardo Wiedenbrüg. Dortmund local court, HRB 14698.

Phone +49 (0) 821 217000 80, email office@xpand.pro. Contact for data protection questions: office@xpand.pro. Responsible for the content of Pauls Tools: Paul Donders (p.donders@xpand.one); technical implementation: Christian Freitag (c.freitag@xpand.one).

Your email address (for sign-in and sending the daily impulses).

Your scan answers and the scores derived from them.

Your answers to the deepening questions and your chat messages.

Plan and profile settings (time, weekdays, time zone).

Optional feedback you send us.

Technical access data (e.g. IP address, timestamp) that arises server-side on access.

Providing the service incl. the reflection, 30-day plan and chat (performance of a contract, Art. 6(1)(b) GDPR).

Consent to the AI evaluation: before the scan begins, we ask for your consent to process your answers for the AI-supported evaluation and to transmit them to our AI providers in the EU (Art. 6(1)(a) GDPR). Processing by those providers takes place via their EU endpoints.

Sign-in via magic link (performance of a contract).

Security and abuse prevention, e.g. rate limiting (legitimate interest, Art. 6(1)(f) GDPR).

Improving the service based on voluntary feedback (consent, Art. 6(1)(a) GDPR).

Hosting: Vercel Inc. (USA). Delivery and processing take place in the EU region Frankfurt am Main.

Database: Neon Inc. (USA). The database runs in Frankfurt am Main (EU).

The data stored in your profile therefore resides in the EU (Frankfurt).

AI text features (evaluation, impulses, chat, knowledge search): Eden AI (France, EU). We use their EU endpoint exclusively, which only exposes providers with European infrastructure. Your inputs and the answers are processed in the EU and are not stored by Eden AI; they are not used to train AI models.

Speech output (read-aloud) and transcription: Mistral AI (France, EU). Here too we use the EU endpoint exclusively; processing takes place in the EU.

Payments: Stripe Payments Europe, Ltd. (Ireland, EU) and Stripe, Inc. (USA). When you take out a subscription, Stripe processes your payment and billing data under its own responsibility. Payment details (e.g. card numbers) never reach our servers. Standard contractual clauses are in place for transfers to the USA.

Images: Unsplash (USA). When article images load, your browser connects directly to Unsplash, which transmits your IP address to Unsplash (USA).

Email delivery: Hostinger (EU).

The data-protection agreements required by law are in place with all processors.

We use strictly necessary cookies only: pt_session (sign-in, httpOnly, up to 60 days) and pt_auth (a hint about your sign-in status for the navigation).

Your browser's local storage holds your scan progress, a cache of your reflection, and the cookie-notice acknowledgement.

There is no tracking. We do not use analytics, advertising or third-party tracking cookies.

Profile data is stored until you delete your profile. Magic-link tokens are valid for at most 45 minutes and single-use. Technical server logs are kept only briefly.

You have the right to access, rectification, erasure, restriction of processing, data portability and objection. You can fully delete your profile yourself at any time in your account.

You also have the right to lodge a complaint with a data-protection supervisory authority.

There is no automated decision-making with legal effect; the AI reflection is supportive and does not replace professional advice.

For access, deletion or other privacy requests: p.donders@xpand.one.