Privacy Policy

At Shlau Personal, we take your privacy seriously. This Privacy Policy explains how we collect, use, store, and protect your personal data when you use our bookmark and knowledge management services at shlau.com. It applies to users in the European Economic Area (EEA) and worldwide. By using our services, you acknowledge that you have read this policy.

The data controller responsible for your personal data is: Cworc GmbH Hubertusweg 47 14552 Michendorf Germany For privacy-related matters, contact us at [email protected].

We collect the following categories of personal data: • Account data: email address, name, profile picture, authentication identifier (Clerk ID), and preferred language. • Content you save: URLs, notes, attachments, extracted text, keywords, categories, and search queries. • Voice input: short audio recordings sent via the search bar for transcription (processed transiently). • Voice assistant: text and voice messages exchanged with the optional ElevenLabs assistant widget. • Payment data: subscription status, plan details, and RevenueCat app user identifiers (payment card details are handled by RevenueCat and the App Store / Google Play / Web Billing processors). • Connected channels: platform link codes and connection status for messaging channels you choose to connect. • Public profile (optional): display name, handle, bio, email, phone, website, location, country, and avatar URL if you enable a public profile. • Technical data: error reports, performance metrics, and server logs (which may include IP addresses). • Consent preferences: your cookie and analytics choices stored locally in your browser.

We process your personal data for the following purposes and on the following legal bases under Article 6 GDPR: • Providing our services (account management, bookmark storage, search, subscriptions) — performance of a contract, Art. 6(1)(b). • AI-assisted organization (keyword suggestions, semantic search, description generation, audio transcription) — performance of a contract, Art. 6(1)(b). • Securing our platform and fixing errors (including Sentry error monitoring) — legitimate interest, Art. 6(1)(f). • Optional analytics and session replay (Google Analytics 4 and masked Sentry Replay) — your consent, Art. 6(1)(a); enabled only when you choose "Accept all" in the cookie banner. • Tax and billing record-keeping — legal obligation, Art. 6(1)(c). • Informing you about service updates — legitimate interest or contract, Art. 6(1)(f) or Art. 6(1)(b).

We use AI technologies to help you organize your saved content. OpenAI Whisper transcribes voice input from the search bar into text. Our backend services may automatically suggest keywords, generate profile descriptions, and power semantic search over your bookmarks. The optional ElevenLabs voice assistant processes your spoken or typed messages to provide interactive help. These processes support our service but do not produce legal or similarly significant effects about you without human involvement. You remain in control of your content and can review, edit, or delete it at any time.

We do not sell your personal data. We share data with the following categories of processors who help us operate our platform: • Clerk — authentication, session management, and OAuth sign-in (including Google). • RevenueCat — payment processing and subscription management (Web Billing, App Store, Google Play). • OpenAI — voice-to-text transcription. • ElevenLabs — optional voice assistant widget. • Sentry (EU region: ingest.de.sentry.io) — error monitoring and, with your consent, masked session replay. • Google Analytics 4 — optional product analytics (page views and selected events), only with your consent. • Vercel — application hosting. • Our backend microservices — storage and processing of bookmarks, profiles, and related content. • Yahoo Finance — stock symbol lookups for finance bookmarks (no personal data is sent). We may also disclose data when required by law or with your explicit consent.

Some of our processors are located outside the European Economic Area, primarily in the United States (including Clerk, OpenAI, RevenueCat, ElevenLabs, Google Analytics, and Sentry). When we transfer personal data outside the EEA, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses (SCCs) or equivalent mechanisms offered by our processors. Sentry processes data in the EU where possible. You may contact us at [email protected] for more information about the safeguards in place.

Certain features allow you to share content beyond your private account. If you enable a public profile, information such as your display name, bio, avatar, and selected bookmarks may be visible to anyone on the internet at your chosen profile URL. If you create a share link for an entry, the content of that entry becomes accessible to anyone with the link until the link expires or you revoke it. These features are entirely optional and require your deliberate action to activate.

We use cookies and similar technologies as follows: • Essential: Clerk session cookies required to keep you signed in, and local storage for theme preferences. • Analytics (optional): Google Analytics 4 (page views and selected product events) and Sentry Session Replay, enabled only after you click "Accept all" in our cookie consent banner. Replay recordings mask all text and block all media. Your consent choice is stored in local storage under the key shlau_cookie_consent_v1. You can change your preference at any time via "Cookie settings" in the footer. Essential cookies cannot be disabled while using the service. For optional analytics, you may also use your browser settings.

We implement appropriate technical and organizational measures to protect your personal data, including encryption in transit (HTTPS), secure authentication via Clerk, access controls, and error monitoring. No method of transmission or storage is completely secure; we continuously work to improve our safeguards.

We retain your personal data for as long as your account is active and as needed to provide our services. Voice recordings sent for transcription are processed transiently and not stored by us after transcription. After you request account deletion, we delete or anonymize your data within a reasonable period, except where retention is required for legal obligations (such as tax records) or legitimate interests (such as resolving disputes). Subscription records may be retained as required by applicable law.

Under the GDPR, you have the following rights regarding your personal data: • Right of access (Art. 15) — request a copy of your data. • Right to rectification (Art. 16) — correct inaccurate data. • Right to erasure (Art. 17) — request deletion of your data. • Right to restriction of processing (Art. 18). • Right to data portability (Art. 20) — receive your data in a structured format. • Right to object (Art. 21) — object to processing based on legitimate interests. • Right to withdraw consent (Art. 7) — withdraw consent at any time without affecting prior processing. To exercise any of these rights, email [email protected]. We will respond within 30 days. You may also withdraw analytics consent via the cookie settings in the footer.

If you believe we have not handled your personal data correctly, you have the right to lodge a complaint with a data protection supervisory authority. If you are in Germany, you may contact the data protection authority (Landesdatenschutzbehörde) of the federal state where you reside. A list of EU supervisory authorities is available at edpb.europa.eu.

Shlau Personal is not directed at children. We do not knowingly collect personal data from anyone under 16 years of age in Germany, or under 13 in other EU member states. If you believe a child has provided us with personal data, please contact [email protected] and we will delete it promptly.

We may update this Privacy Policy from time to time to reflect changes in our services or legal requirements. We will notify you of material changes via email or a prominent notice on our platform. The "Last updated" date at the top indicates when this policy was last revised. Continued use after changes constitutes acceptance of the updated policy.

For privacy-related questions, data subject requests, or concerns, please contact our privacy team at [email protected]