Privacy Policy

This privacy policy explains how personal data is processed when you visit and use the public Emina website at emina-app.de.

This first part applies to the public Emina website, including both the German and English versions. Separate privacy information for the Emina mobile app is provided in the following section, “Privacy information for the Emina app.”

The controller responsible for data processing on this website is:

Simon von Rüden

c/o The Delta Campus

Donaustraße 44

12043 Berlin

Germany

Email: simon.von.rueden@emina-app.de

No data protection officer has been appointed.

Emina is a public landing page for a digital product that is still in development. The website is used to provide information about Emina, add interested people to a waitlist, provide contact options, and offer voluntary introductory calls.

When you visit the website, technically necessary data is processed so the website can be displayed, operated securely, and kept stable.

This may include in particular:

• IP address
• date and time of access
• visited pages
• browser and device information
• technical connection and log data

Processing takes place to provide, secure, and stabilize the website.

The legal basis is Article 6(1)(f) GDPR. Our legitimate interest lies in the secure and reliable operation of the website. Where information is technically necessary to be stored in or read from the browser, this is additionally based on Section 25(2) TDDDG.

The website is hosted via Vercel. Wherever possible, we use an EU-related configuration. Because Vercel operates globally available infrastructure, processing outside the EU/EEA cannot be ruled out completely.

Technical hosting and log data is stored only as long as necessary for operation, security, and error analysis.

We use a consent banner on the website. It allows you to decide whether you want to consent to extended analytics and marketing tracking.

The website distinguishes in particular between:

• required technologies
• analytics
• marketing

Your selection is stored in local browser storage so we can respect your choice on future visits.

The legal basis for storing your selection is Article 6(1)(f) GDPR. Our legitimate interest is to implement your privacy choice. Where storage is technically necessary, it additionally takes place on the basis of Section 25(2) TDDDG.

You can change your selection at any time via the “Cookie settings” link in the footer.

We use PostHog to understand how the website is used and to improve the landing page.

Without your consent, PostHog is not initialized in your browser. If you submit the waitlist form, we send a pseudonymous conversion event to PostHog from our server regardless of your analytics consent. No person profile is created, and your email address is not sent to PostHog.

If you consent to analytics, more extensive usage data may be processed, in particular:

• page views
• clicks and interactions
• language setting
• browser and device information
• referrer and URL data
• pseudonymous analytics identifiers

The legal basis for this limited server-side conversion measurement is Article 6(1)(f) GDPR. Our legitimate interest is to verify waitlist signups technically and evaluate the effectiveness of the website.

The legal basis for extended analytics is your consent under Article 6(1)(a) GDPR. Where cookies or similar technologies are used for this purpose, processing also takes place on the basis of your consent under Section 25(1) TDDDG.

You can withdraw your consent at any time via the cookie settings. The withdrawal applies for the future.

We do not use session replay and do not record individual sessions. Clicks on crisis or support resources are not tracked.

Analytics data is stored for a maximum of 12 months.

If you consent to marketing, we use Meta Pixel and the Meta Conversions API to measure Meta ad performance and build advertising audiences.

This may include page views, referrer and URL data, pseudonymous browser and click identifiers, and, for waitlist signups, a hashed email address.

The Meta Conversions API is used only for confirmed waitlist signups if your marketing consent was present when the form was submitted.

The legal basis is your consent under Article 6(1)(a) GDPR. Where cookies or similar technologies are used, processing also takes place on the basis of your consent under Section 25(1) TDDDG.

You can withdraw your consent at any time via the cookie settings. The withdrawal applies for the future.

We use Sentry to identify and fix technical errors and stability issues on the website.

This may involve processing technical error data, browser and device information, timestamps, visited pages, and technical context information in particular.

Sentry is not used for marketing or user profiling. Session replay and performance tracking are disabled.

The legal basis is Article 6(1)(f) GDPR. Our legitimate interest lies in the secure and stable operation of the website as well as in identifying and fixing technical issues.

Sentry is used independently of your analytics consent because it serves the technical security and stability of the website.

Error data is stored only as long as necessary for error analysis and stability, usually for 30 to 90 days.

A Tally form is embedded on the landing page. You can use it to join the waitlist and take a short product-related survey.

The form is embedded directly. When the form loads, your browser connects to Tally. Technical data such as IP address, browser and device information, and the time of access may be processed.

When you submit the form, we process in particular:

• your email address
• your answers to single-choice and multiple-choice questions
• technical transmission data

The form does not ask for your name. If you select ‘Other’ for certain questions, an optional free-text field may appear. The form is not intended to collect health data, diagnoses, information about mental distress, or crisis information. Please do not enter this type of information in the optional free-text fields either.

Processing takes place for the following purposes:

• adding you to the waitlist
• analyzing the survey for product validation
• contacting you in connection with Emina
• improving the landing page and product concept

The legal basis is your consent under Article 6(1)(a) GDPR.

You can withdraw your consent at any time with effect for the future, for example by email to simon.von.rueden@emina-app.de.

The data collected via Tally is also stored in Notion so the waitlist and survey can be managed operationally. Only Simon von Rüden has access to it.

Waitlist and survey data is stored until the landing page or beta validation is complete, but for no longer than 12 months unless you request deletion earlier or withdraw your consent.

A Calendly booking module may be embedded on the contact page and the thank-you page. You can voluntarily book a conversation through Calendly.

Calendly is embedded directly. When the booking module loads, your browser connects to Calendly. Technical data such as IP address, browser and device information, and the time of access may be processed. Calendly may also use cookies or similar technologies.

When you book an appointment, Calendly processes in particular:

• name
• email address
• selected appointment
• time zone
• optional information in the free-text field
• technical booking data

The optional free-text field is intended only for organizational questions relating to the appointment. Please do not share diagnoses, health data, information about mental distress, or crisis information there.

The legal basis is Article 6(1)(b) GDPR insofar as processing is necessary to organize a conversation you requested. In all other respects, processing takes place on the basis of Article 6(1)(f) GDPR. Our legitimate interest lies in the simple organization of conversations.

Calendly is connected to Google Calendar so appointments can be managed.

Appointment and calendar data is generally stored for up to 6 months after the appointment unless further communication follows or legal reasons require longer retention.

If you contact us by email, we process the data you send to us.

This may include in particular:

• your email address
• your name, if you provide it
• the content of your message
• technical email metadata
• the time of communication

The website does not provide its own contact form. Messages are sent via your own email client or email provider.

We use Google Workspace for email communication.

The legal basis is Article 6(1)(f) GDPR. Our legitimate interest lies in processing your request. If your request concerns a potential collaboration, beta participation, or other pre-contractual communication, Article 6(1)(b) GDPR may also apply.

Contact emails are stored until your request has been fully processed and then for a maximum of 12 months, unless statutory retention obligations apply or longer retention is required in the individual case.

The contact page may contain links to external crisis and support resources, in particular TelefonSeelsorge and 116117.

Clicks on these crisis and support resources are not tracked by us.

If you click an external link, you leave our website. The respective providers are responsible for further data processing on the linked websites.

Emina is not an emergency or crisis service and does not replace medical, psychotherapeutic, or crisis-related support.

Our website uses required technologies to provide the website and store your cookie or consent decision.

If you consent to analytics or marketing, cookies or similar technologies may be used to store pseudonymous analytics, browser, or click identifiers.

Embedded services such as Tally and Calendly may also use cookies or similar technologies when their content is loaded.

Where consent is required, processing takes place on the basis of Article 6(1)(a) GDPR and Section 25(1) TDDDG. Technically necessary storage takes place on the basis of Section 25(2) TDDDG.

As part of operating this website, personal data may be processed by the following service providers:

• Vercel – hosting and technical delivery
• PostHog – website analytics
• Meta – marketing tracking and conversion measurement
• Sentry – error and stability monitoring
• Tally – waitlist and survey form
• Notion – operational management of the waitlist and survey
• Calendly – appointment booking
• Google Workspace / Google Calendar – email and calendar management

Data is only shared to the extent necessary to provide the website and its functions, if you have consented, if there is a legal obligation, or if another legal basis permits it.

We do not sell personal data.

Where possible, we choose providers and settings with an EU focus. Nevertheless, for some service providers processing of personal data outside the EU or EEA cannot be ruled out.

Where personal data is transferred to third countries, this is done on the basis of appropriate safeguards, in particular adequacy decisions of the European Commission, EU standard contractual clauses, or comparable data protection agreements.

The website is not designed to collect special categories of personal data within the meaning of Article 9 GDPR. In particular, we do not ask for diagnoses, health data, information about mental distress, or crisis information through the website.

Please do not share health data, diagnoses, or acute crisis information via the waitlist form, Calendly, or email.

If you nevertheless provide such information to us unsolicited, we will only process it to the extent necessary for handling, deletion, or compliance with legal obligations.

We store personal data only as long as necessary for the respective purposes or as required by statutory retention obligations.

The following criteria apply in particular:

If you request deletion or withdraw consent, we will delete the affected data without undue delay unless statutory retention obligations or other legitimate reasons prevent this.

Providing personal data is generally voluntary.

Only technically necessary data is processed for visiting the website.

Providing an email address is required to be added to the waitlist. Without an email address, we cannot add you to the waitlist or contact you in connection with Emina.

For booking an appointment via Calendly, your name and email address are required. Without this information, an appointment cannot be booked.

Consent to extended analytics and marketing is voluntary. You can also use the website if you reject these optional purposes.

We take appropriate technical and organizational measures to protect personal data.

These include in particular encrypted transmission, access restrictions, privacy-preserving configurations, and limiting access to authorized persons.

At present, only Simon von Rüden has access to waitlist, contact, and booking data.

Under the GDPR, you have the following rights in particular:

• right of access
• right to rectification
• right to erasure
• right to restriction of processing
• right to data portability
• right to object to processing based on legitimate interests
• right to withdraw consent with effect for the future
• right to lodge a complaint with a data protection supervisory authority

You can exercise your rights by email at simon.von.rueden@emina-app.de.

If you withdraw consent, the lawfulness of processing carried out before the withdrawal remains unaffected.

You have the right to lodge a complaint with a data protection supervisory authority if you believe that the processing of your personal data violates data protection law.

In particular, you can contact the supervisory authority at your place of residence or the authority responsible for us.

We may update this privacy policy if the website, the services used, or the legal requirements change.

The current version is always available on this website.

This second part explains how personal data is processed when you use the Emina mobile app. It applies independently of the privacy information for the public website above.

The controller responsible for data processing in the Emina app is:

Simon von Rüden

c/o The Delta Campus

Donaustraße 44

12043 Berlin

Germany

Email: simon.von.rueden@emina-app.de

No data protection officer has been appointed.

Depending on the features you use, Emina processes the following data in particular:

• Account and sign-in data, in particular your email address, technical account identifier, and authentication data
• Profile and onboarding data, such as language settings and voluntary information about you or your use of the app
• Content you create, in particular chat messages, mood entries, journal entries, and history
• AI and memory data, in particular replies, summaries, relevant memories, embeddings, and other data derived from your content
• Consent records, including the version, status, and time of your consent or withdrawal
• Technical operational data, in particular timestamps, request identifiers, error codes, and device, network, and security metadata; logs do not contain raw chat or journal content
• Deletion and recovery metadata, which enables secure account deletion and reconciliation after a backup is restored

Emina does not use advertising trackers and does not sell personal data.

We process account, product, and content data to provide the app features you request. The legal basis is Article 6(1)(b) GDPR.

Your input and relevant context are processed by AI, and memories are created, only with your consent under Article 6(1)(a) GDPR. Where content may include health data or other special categories of personal data, processing additionally relies on your explicit consent under Article 9(2)(a) GDPR.

We process technical operational and security data under Article 6(1)(f) GDPR. Our legitimate interest lies in operating the app securely, reliably, and resistant to misuse. Legal obligations may require processing under Article 6(1)(c) GDPR.

The app stores required data in encrypted form on your iOS device. Data is transmitted over encrypted TLS connections, and the app additionally verifies the public keys used by the production connection. Protecting your device, Apple ID, and device passcode remains important as well.

Product data is stored in encrypted form in the AWS Frankfurt region (eu-central-1). We use Amazon Web Services (AWS) for authentication, networking, application servers, databases, key management, monitoring, and backups. AWS processes this data as our processor.

AI requests are processed through Amazon Bedrock. Your input, relevant previous content, and AI output may be processed in approved AWS regions within the European Union. Product data remains stored in Frankfurt. Model invocation logging is disabled. Inputs and outputs are not used to train the underlying foundation models.

To create relevant AI replies and memories, Emina may send your current input, relevant conversation and profile data, and existing memories to Amazon Bedrock. Summaries, embeddings, and memories may be derived from content and stored in your account.

This processing starts only after you accept the current privacy policy and terms and explicitly consent to AI processing, memory processing, and processing by external processors.

Recipients of app data include Amazon Web Services EMEA SARL and the AWS entities involved in providing infrastructure, authentication, storage, backups, and AI processing. Data is shared only where necessary for the app, where you have consented, or where a legal obligation applies.

The app does not send product content to advertising, analytics, or marketing services.

Operational recovery and audit evidence contains only required metadata and no raw chat or journal content. The encrypted backups themselves contain the product data required for recovery and are subject to the 14-day period above.

You can withdraw AI consent at any time under “Privacy & Security” in the app, with effect for the future. Emina will then start no new AI processing; processing already in progress may finish. Queued AI work is stopped.

Content you created and content previously derived from it remains stored. To delete that data as well, use account deletion. You may consent again later to re-enable future AI features. Withdrawal does not affect the lawfulness of processing carried out beforehand.

Subject to the GDPR, you have rights including access, rectification, erasure, restriction of processing, data portability, objection to processing based on legitimate interests, and withdrawal of consent.

You can exercise your rights by emailing simon.von.rueden@emina-app.de. You also have the right to lodge a complaint with a data protection supervisory authority, in particular at your place of residence or with the authority responsible for us.

Emina does not make decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you.

We use appropriate technical and organizational safeguards, including encryption, access restrictions, separate production and recovery environments, multi-factor authentication, and monitored recovery procedures.

We update this privacy policy when the app, the services used, or legal requirements change. The current version is always available on this page.