Privacy at SELIM

Controller

What data we process and for what purposes

• Account: your email address or the identifier of your Google sign-in, an internal account identifier and, if you set one up, your passkey. You use these to sign in, and your content belongs to your account.
• Conversations and learning content: your messages, attached files, SELIM's responses and saved learning content. So that SELIM can respond to you and you can continue working on earlier topics.
• Usage and operation: usage data for your allowance; technical connection and log data for operating, troubleshooting and protecting the service.
• Contact: if you write to us, your contact details and your message, in order to handle your request.

Legal bases: Account, learning functions and requests concerning your account: Art. 6(1)(b) GDPR. Operation and protection of the service and other requests: Art. 6(1)(f) GDPR. Our legitimate interest is a secure, functioning service and replying to your message.

Very personal information: If you share something very personal of your own accord, for example about health, religious beliefs or sexuality, SELIM processes it and remembers it only with your explicit consent, which you give before the first conversation: Art. 9(2)(a) and Art. 6(1)(a) GDPR.

You need the information for your sign-in method in order to use it. Without it, this sign-in method does not work. What you share or attach beyond that is your own decision.

Who receives data

• Hetzner Online GmbH: servers and website.
• netcup GmbH: contact mailbox.
• OpenAI Ireland Ltd.: AI responses. Receives your request and the conversation context needed for it.
• Resend (Plus Five Five, Inc.): sending the sign-in emails. Receives the recipient address, subject and email content.
• Google Ireland Limited: contact emails are forwarded to a Google mailbox.

Transfers outside the EU

OpenAI and Google may process data outside the European Economic Area. Resend stores data in the USA. For OpenAI and Resend, the standard contractual clauses in the respective data processing agreements apply. You can obtain a copy via kontakt@heyselim.de.

Google LLC is certified under the EU-US Data Privacy Framework; the adequacy decision of the European Commission applies to this (Art. 45 GDPR).

How long data is stored

• Account, conversations, learning content: until you delete them, reset SELIM or delete your account.
• Backups: Deleted data may remain in backup copies at Hetzner and netcup for up to seven days.
• OpenAI: up to 30 days, longer only where required by law or to protect against harm.
• Resend: 30 days, backup copies seven days.

• Usage data: as long as your account exists. After a reset, the amounts and times of the last 40 days remain, without content.

• Technical server logs: no more than 7 days.
• Contact emails: until your request has been dealt with and the email is no longer needed; we then delete it at netcup and Google.

Your rights

You have the right of access and the rights to rectification, erasure, restriction of processing and data portability. You can lodge a complaint with a data protection supervisory authority.

Withdraw consent: You can withdraw your consent at any time in Settings. SELIM then deletes your conversations and saved learning content; your account remains. What happened before the withdrawal remains lawful.

Objection: Where we process data on the basis of legitimate interests, you can object at any time on grounds relating to your particular situation.