Privacy Policy

1. Controller

Axel Hoehnke Consulting
Axel Hoehnke · Fritz-Reuter-Straße 36 · 22926 Ahrensburg, Germany
Email: axel@axelhoehnke.com

2. Data processed and purposes

• Account and contact data used by Clerk to authenticate users and provide account access.
• Campaign, persona-panel, source, and result data used to provide the requested research service.
• Google Drive and Google Docs data only when a user initiates an import or export.
• Technical, security, session, IP, network, browser, and device data needed to operate, protect, troubleshoot, and understand use of the service.
• Communication and contractual data used for support and business administration.

Custom analytics events record fixed navigation categories, language preferences, booking-link clicks, and research workflow actions. Names, email addresses, account identifiers, prompts, and research responses are not included in custom event properties.

Homepage entry clicks record only a fixed destination category (workshop, campaigns, or reference case) and the public website language (English or German). These clicks do not confirm workshop bookings or research success. Health data and free-form text are not included in these event properties.

3. Legal bases

Processing is based on Art. 6(1)(b) GDPR for performance of a contract or pre-contractual measures, Art. 6(1)(c) GDPR for legal obligations, and Art. 6(1)(f) GDPR for legitimate interests including secure operation, abuse prevention, service analytics, support, and the establishment or defence of legal claims.

4. Service providers and recipients

Data is shared only as necessary to provide the service or fulfil a legal obligation. The service currently uses:

• Clerk for authentication and account sessions.
• Airtable for operational user, campaign, and research records. The account reference stored there is a pseudonymous alias derived from the Clerk user ID.
• Google Drive and Google Docs for user-requested imports and exports. Imported document text is returned to the browser and is not separately persisted unless the user includes it in campaign data; exported reports are stored in the connected Google account.
• OpenRouter through Replit AI Integrations for routing campaign prompts to a downstream AI model provider. The provider receives the prompt and synthetic persona context needed to generate a response. Provider identities remain confidential in product outputs; new research runs use one model.
• Replit for application hosting, technical infrastructure, request and security data, and Publishing Analytics. When analytics is enabled, Replit uses IP traffic, network, browser, and device data to provide approximate visitor, geography, browser, and device metrics. No separate advertising service or controller-operated analytics script is used.

Some providers or their subprocessors may process data outside the EU/EEA. Where required, these transfers take place under an adequacy decision, standard contractual clauses, or another safeguard permitted by Articles 44 et seq. GDPR.

5. Processing on behalf of clients

Where personal data is processed on a client's behalf, a data processing agreement pursuant to Art. 28 GDPR will be concluded where required.

6. Cookies and similar storage

The service uses only storage necessary to provide requested functionality: Clerk authentication and session technologies, and a sidebar_state preference cookie that remembers whether the navigation sidebar is open for seven days. There are no advertising cookies or separate controller-operated analytics cookies. Replit processes publishing analytics as described above when that platform setting is enabled.

The public website stores your English/German language preference in your browser’s local storage so it is remembered on later visits.

7. Retention and deletion

Account, campaign, research, technical, and security data is retained only for as long as required for the relevant purpose, contractual relationship, secure operation, or statutory retention period. Signed-in users can delete individual campaigns or use the account-deletion action in the service. Account deletion removes the user's operational Airtable user, campaign, study, response, and bias-tag records, then deletes the Clerk account and revokes its active sessions. If deletion is interrupted, the service reports that it was incomplete and allows the signed-in user to retry safely. Records that must be retained for legal obligations, such as tax-relevant documents or commercial correspondence, are maintained separately from these operational research records and remain only for the applicable retention period. Tax-relevant documents may be retained for 10 years and commercial correspondence for 6 years. Provider-side copies and logs are deleted according to the applicable provider retention schedules.

8. Your rights

You may have rights of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20), and objection (Art. 21 GDPR). Send requests to axel@axelhoehnke.com.

9. Right to complain

Competent supervisory authority: Unabhängiges Landeszentrum für Datenschutz Schleswig-Holstein (ULD), Holstenstraße 98, 24103 Kiel · mail@datenschutzzentrum.de · www.datenschutzzentrum.de

10. Data security

Appropriate technical and organisational measures are used pursuant to Art. 32 GDPR, including encrypted transmission, authenticated access, access controls, secure storage, and regular review of security measures.

11. Changes

This Privacy Policy may be updated when the service or legal requirements change. Version: 14 September 2026.