'%3e%3cpath%20d='M32.5229%2031.0009C41.919%2025.7808%2041.919%2018.4727%2032.5229%209.07666C23.1268%2018.4727%2023.1268%2025.7808%2032.5229%2031.0009Z'%20fill='%23FF016E'/%3e%3cpath%20d='M39.1289%2036.9649C48.3476%2042.4922%2054.6766%2038.8381%2058.1158%2026.0028C45.2805%2022.5636%2038.9516%2026.2177%2039.1289%2036.9649Z'%20fill='%23FB5809'/%3e%3cpath%20d='M25.5668%2036.9649C25.7442%2026.2176%2019.4152%2022.5636%206.57993%2026.0028C10.0191%2038.8381%2016.3481%2042.4921%2025.5668%2036.9649Z'%20fill='%233A86FF'/%3e%3c/g%3e%3cdefs%3e%3cclipPath%20id='clip0_145_278'%3e%3crect%20width='58.6957'%20height='30.8606'%20fill='white'%20transform='translate(3%209.07666)'/%3e%3c/clipPath%3e%3c/defs%3e%3c/svg%3e)
Controller
STRUCT Tech UG (haftungsbeschränkt) Löffelstraße 22–24 70597 Stuttgart Germany
Access to the service
When you visit the website, the delivery systems process the IP address, time, requested resources and browser information as needed for delivery and operation. This supports the service and detection of faults and abuse. The legal basis is Article 6(1)(b) GDPR for delivering the service and Article 6(1)(f) GDPR for our interest in secure and stable operation.
Protection against automated abuse (Cloudflare Turnstile)
When abuse protection is enabled, registration, login, password reset and creation of a new meeting load Cloudflare Turnstile. Your browser connects to challenges.cloudflare.com and transmits connection and browser data to Cloudflare for the security check. Our API sends the short-lived verification token to Cloudflare for validation. We do not send your email, password, meeting title, participant names or media with this verification request, and do not store or log the Turnstile token. This protection is separate from optional diagnostics and product analytics. Existing calls, reconnections and device changes do not trigger a new check. The legal basis is our legitimate interest in protecting the service against automated abuse (Article 6(1)(f) GDPR). Cloudflare processes data under its Turnstile Privacy Addendum.
Hosting and meeting infrastructure
We run the website, API, LiveKit, TURN and storage on infrastructure of the hosting provider Hetzner. The object storage for recordings is located in Nuremberg, Germany. Hetzner processes the technical connection and operational data required for this on our behalf. Sentry, Stripe, Cloudflare and Mailjet are separate recipients described in their own sections.
Meetings and communication
Meetings process display names, meeting identifiers, permissions and technical connection data. Enabled camera, microphone, screen sharing and chat transmit content to other participants through the meeting infrastructure. Delivery is based on the agreed service or the organising entity's legal basis. End-to-end encryption is in development and not yet available for production meetings, so the infrastructure can process media server-side.
Recordings
Where recording is enabled for a STRUCT Call meeting, the host can start an MP4 recording of audio, video and shared screens after all current participants explicitly agree. The recording is stored in private object storage and is deleted automatically after everyone leaves and a short download period ends. The host must still provide the required information and legal basis. In sessions opened through KI Praxis, KI Praxis controls recording separately. Transcription is not available in STRUCT Call meetings, and no external transcription or AI provider is used.
Storage in your browser
The app stores language, appearance, device preferences, display names and scheduled meetings in your browser. Host access and meeting titles are kept partly in session storage and alongside scheduled meetings in local storage. People with access to your browser profile may access these data. Clearing website data removes local entries but does not automatically revoke server access. The Cookie Policy describes the storage areas in more detail.
Account and sign-in
For an account we process your email address, an optional display name, your password in hashed form, confirmation and sign-in times, and the meetings and schedules you create. Sign-in runs on a Supabase instance that we operate ourselves. After signing in, two HttpOnly cookies keep you signed in (access token; refresh token for 30 days); signing out deletes them. The legal basis is the performance of the user relationship (Article 6(1)(b) GDPR). To delete your account, contact contact@ki-praxis.app; data we must keep by law is retained until the statutory period ends.
Email delivery (Mailjet)
We send account confirmation and password reset emails through Mailjet (Mailjet SAS, Paris, France, part of the Sinch group), which acts on our behalf. Mailjet receives your email address, the content of the message including your personal single-use link, and technical delivery data. Links in these emails may be routed through Mailjet addresses, and Mailjet may record delivery and retrieval events, for example that the email was opened or the link was clicked. We do not use these events for advertising or profiling. The legal basis is performance of the user relationship (Article 6(1)(b) GDPR). A data processing agreement under Article 28 GDPR governs Mailjet's processing.
Feature notifications (Mailjet)
On the home page you can ask to be told when the planned add-ons are available. We then send one confirmation email through Mailjet (see above); only after you click the link in it is your email address added to a separate Mailjet contact list for this purpose (double opt-in). Confirmation emails are sent without open or click tracking. We use the list only to inform you about new features, not for a general newsletter, and it is independent of the interest survey and of any account. The legal basis is your consent (Article 6(1)(a) GDPR), which you can withdraw at any time with effect for the future, through the unsubscribe link in each email or by message to us. After withdrawal we keep the address marked as unsubscribed so that it is not added again without a new confirmation. Unconfirmed requests are not stored on a list; the confirmation link expires after 72 hours.
Paid packages and payment
Before a paid booking we ask for your business name (for self-employed people, your own name) and your confirmation of business use and of the accepted version of the Terms of Service. We store these details with your account, the time and the booking attempt as evidence of the contract; we do not store your IP address or browser details for this. Payment is handled by Stripe: you enter your billing address, payment method and, optionally, a VAT ID directly at Stripe. We receive the customer and subscription status from Stripe, not your full card details. We pass Stripe your email address and internal reference numbers, not your business name. The legal basis is the performance of the contract and steps prior to it (Article 6(1)(b) GDPR) and statutory accounting and tax duties (Article 6(1)(c) GDPR). Stripe also processes data outside the EU.
Referral programme
If you sign up through a referral link, we store the referral code with your account. When you later pay for a package, we calculate the referrer's commission from the payment data. The referrer does not receive your name, email address or meeting data from us. The legal basis is our legitimate interest in settling referrals (Article 6(1)(f) GDPR).
Sessions via KI Praxis
If you join a session through a link from KI Praxis, our API forwards the requests about that session (the link token and the data you submit, such as your display name) to the KI Praxis service, which manages the session and access to it. We do not forward your IP address or cookies. The meeting itself then runs on STRUCT Call as described above. For the session data, KI Praxis's own privacy notice also applies.
Beta diagnostics
For technical errors, connection states and timings in the app we use Sentry, provided by Functional Software, Inc. d/b/a Sentry (United States). The app limits and filters event data, but technical metadata may still relate to individuals. These diagnostics only run with your consent (Article 6(1)(a) GDPR and, where applicable, Section 25(1) TDDDG); without a decision or after a refusal nothing is sent from your browser. You can withdraw consent at any time with effect for the future. Transmission is disabled on these information pages.
Server error reports and beta feedback
Where configured, our API reports technical errors and performance data of its own operation to Sentry. These reports are independent of the diagnostics choice in your browser. Request headers, cookies, request bodies, query parameters and user details are excluded, and access credentials are filtered. The legal basis is our legitimate interest in detecting and fixing faults (Article 6(1)(f) GDPR). If you send beta feedback, your text and ratings are transmitted to Sentry; this is your own choice when you press send (Article 6(1)(f) GDPR). Only with diagnostics consent does the feedback also include the call's quality category and a reference to a related error report.
Interest survey for planned add-ons
On the home page you can say whether a planned add-on interests you. A click sends only the feature, your answer and the answer it replaces to our API, which counts it as an aggregate metric in Sentry (see server diagnostics) and replies only once Sentry has accepted it. No email address, account, IP address, name or other identifier is sent to Sentry, and no technical diagnostics of your browser are started. Your request to our API is processed like any request (abuse protection in memory). Your answers are stored in your browser (localStorage) so you can see and change them; deleting the site data removes them. The legal basis is our legitimate interest in planning the product according to demand (Article 6(1)(f) GDPR); taking part is voluntary.
Product Analytics (optional)
Product Analytics is a separate, first-party measurement of product steps and is not the Sentry diagnostics. It is off by default and only applies to a signed-in account that expressly allowed it, at signup or later in cookie settings; the legal basis is that consent (Article 6(1)(a) GDPR), which you can withdraw at any time. Only if the operator has switched collection on does an event consist of a server timestamp, the event name from a fixed list and two pseudonymous codes (HMAC) derived from your account with a secret server-side key. The codes are still personal data for us. Events do not contain meeting or room identifiers, affiliate links, names, email or IP addresses, URLs, messages, media, transcripts, keys or tokens. Events are stored in the operator's Supabase database and deleted automatically after 90 days. Withdrawal stops future events and deletes your stored events. Paid conversion and commissions are determined from the billing and affiliate records, not from these events.
Fonts
Manrope is delivered from our own website (SIL Open Font License 1.1); your browser does not connect to Google Fonts for it. The program files and segmentation model for background blur (MediaPipe, Apache License 2.0) are also served from our website and only load when you switch on blur.
Contact and support
If you contact us, we process your contact details and message to handle your request. Depending on the request, this is based on pre-contract steps or contract performance under Article 6(1)(b) GDPR, or our legitimate interest in responding under Article 6(1)(f). Send only information necessary for the request and avoid unnecessary meeting content or access credentials.
Purposes, legal bases and recipients
The meeting service and accounts rely on performance of the user relationship or contract under Article 6(1)(b) GDPR. Technical operations, error reports and abuse prevention rely on our legitimate interests under Article 6(1)(f). Optional diagnostics and Product Analytics rely on your consent under Article 6(1)(a). Statutory accounting and tax duties rely on Article 6(1)(c). In business meetings, the organising entity determines the legal basis for its content.
Retention and deletion
Local preferences remain until removed by you, the browser or the app; session storage normally ends with the browser session. On the server, meeting titles are deleted automatically after 180 days and Product Analytics events after 90 days. If a STRUCT Call meeting is recorded, its recording is deleted after everyone leaves and the configured short download period ends; temporary storage or service failures can delay deletion, which is retried. Account data is kept until the account is deleted; records of accepted terms and payment data are kept as long as needed as evidence of the contract and for statutory accounting and tax periods. Server-side deletion does not erase recordings downloaded by participants.
Data region and international access
Sentry, Stripe, Cloudflare and Mailjet (as part of the Sinch group) are companies with seats or group companies outside the EU and may process data in third countries, in particular the United States. Where this happens, the safeguards provided under Articles 44 et seq. GDPR apply, such as an adequacy decision or standard contractual clauses. We make no promise that all data remains exclusively in Germany.
Your rights
Subject to the statutory conditions, you have rights of access, correction, erasure, restriction and portability, and you can withdraw consent with effect for the future. Joining a meeting may not be possible without necessary connection or access data. Send requests to contact@ki-praxis.app. You may also complain to a competent data protection authority, in particular where you live, work or believe an infringement occurred.
Right to object
Where we process data on the basis of legitimate interests (Article 6(1)(f) GDPR), you have the right to object at any time on grounds relating to your particular situation (Article 21 GDPR). Send your objection to contact@ki-praxis.app.
Automated decisions
We do not implement automated decisions about individuals with legal or similarly significant effects. Product Analytics is described separately in this notice. Any future processing with significant effects would require a separate assessment and an updated notice before it is used.
Contact
Telephone: +49 172 628 9359
contact@ki-praxis.app