Privacy policy

Last updated: 27 September 2026 [[ZU PRÜFEN: update the date on publication]]

Speeches are personal. This policy explains which personal data we process when you use RedeStudio (redestudio.de), for what purpose, on which legal basis, for how long, and which rights you have (Art. 13 GDPR).

1. Controller

Alexander Seipel
Jeseniova 2829/20
13000 Praha
Tschechien
Email: hallo@redestudio.de

We have not appointed a data protection officer because there is no legal obligation to do so. [[ZU PRÜFEN: confirm the obligation to appoint one (Art. 37 GDPR, § 38 BDSG)]]

2. The key points

• RedeStudio runs on servers in Germany. We store the texts of your speeches encrypted.
• For the drafts, an AI language model from OpenAI processes your input. OpenAI does not use it for training and keeps it only for a limited time to detect abuse (see 6.3).
• We use no tracking cookies and no advertising. Our audience measurement works without cookies.
• Speeches are deleted automatically, by default 30 days after the occasion. You can delete them yourself at any time.
• We do not sell data and only share it with the service providers listed below, as far as necessary to run the service.

3. Hosting and server logs

RedeStudio is operated by Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany, in data centres in Germany. We have a data processing agreement with Hetzner.

When you visit our pages, our web server processes technically necessary data: IP address, date and time, requested address, referrer, browser and operating system. This serves the secure and stable operation of the website (Art. 6(1)(f) GDPR). We delete server logs after 14 days. [[ZU PRÜFEN: align the retention of server logs with the server configuration]]

4. Cookies and similar technologies

We only use technically necessary storage in your browser:

• a session cookie ("__Secure-redestudio.session_token", 30 days, extended when you use the site) that links your speeches to your browser, even without an account, and keeps you signed in after you sign in. It is only set when you first save something (for example, start a speech) or sign in;
• an entry in your browser's local storage once you have exported a speech, so that we ask you for feedback only once.

These cookies are strictly necessary for the service you request (§ 25(2) no. 2 TDDDG). The legal basis for the related processing is Art. 6(1)(b) GDPR. We set no tracking or advertising cookies, which is why there is no cookie banner.

5. Audience measurement without cookies (Umami)

To understand which pages are used, we use Umami. Umami runs on our own server in Germany, sets no cookies and creates no profiles. It records page views, referrers, UTM parameters, browser, operating system, device type and country. Your IP address is not stored. The legal basis is our legitimate interest in privacy-friendly audience measurement (Art. 6(1)(f) GDPR). [[ZU PRÜFEN: confirm the assessment under § 25 TDDDG]]

In addition, we store anonymous usage events in our own database, such as “story map created” or “speech exported”, with occasion, language and plan, but without any content of your speeches. This helps us improve the product (Art. 6(1)(f) GDPR). [[ZU PRÜFEN: define the retention period for usage events]]

6. Using RedeStudio

6.1 Which data we process

When you create a speech, we process the information you provide: occasion, your role, names of the people involved, date, answers to the guided questions, your notes, wishes and topics to avoid, texts you add for your style profile, the story map and the drafts. We store this content encrypted at application level (AES-256-GCM), so it is not in plain text even in database backups.

The legal basis is the performance of our contract with you (Art. 6(1)(b) GDPR). You can use RedeStudio without an account; we then link your speeches to you via the session cookie.

6.2 Data about other people

Speeches are about other people. Please only enter information about third parties that you are allowed to use for this purpose, and remove names from added style samples that are not needed. Some information may be specially protected, for example health or religion in a eulogy. We only process it because and to the extent that you enter it for your speech. [[ZU PRÜFEN: legal basis for special categories (Art. 9 GDPR) and the role of RedeStudio for private users]]

If you write speeches professionally, we process your clients’ data on your behalf. For this, we conclude a data processing agreement with you.

6.3 AI processing

For the story map, style profile, drafts and rewrites, we send the necessary content to OpenAI Ireland Ltd., 1st Floor, The Liffey Trust Centre, 117–126 Sheriff Street Upper, Dublin 1, D01 YC43, Ireland. Processing may also take place at OpenAI, L.L.C. in the USA. OpenAI keeps requests and responses for up to 30 days to detect abuse and deletes them afterwards, unless it is legally required to keep them longer. Your content is not used to train models. We have a data processing agreement with OpenAI.

[[ZU PRÜFEN: check the retention period at OpenAI against its current terms; check the transfer to OpenAI, L.L.C. (USA) and other sub-processors in third countries and its basis (adequacy decision or standard contractual clauses), and name it here]]

In our own logs, we only store technical data for each AI request, such as the type of request, model, number of tokens, duration and errors, plus a hash of the IP address (see 6.5), never the content.

6.4 Account and sign-in

If you want to save your speeches, you sign in with your email address. We send you a sign-in link; there is no password. We store your email address, your chosen language and the time of confirmation (Art. 6(1)(b) GDPR).

6.5 Protection against abuse

To prevent anyone from using the AI features on a massive or automated scale, we limit the number of requests, including per IP address. For this, we do not store your IP address itself with each AI request, only a hash of it created with a secret key (HMAC). We delete these hashes after 7 days. The legal basis is our legitimate interest in secure and affordable operation (Art. 6(1)(f) GDPR). [[ZU PRÜFEN: align the 7-day deletion period with the implementation]]

7. Payments

We process payments via the payment service provider Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland. Stripe processes your email address, payment details, billing address and, if applicable, your VAT ID, creates the invoices and receipts, and manages your Pro subscription. We do not receive card details; we only store purchase and subscription data such as amount, status, period and the Stripe identifiers. Stripe is itself responsible for certain processing, for example for fraud prevention and to meet its own legal obligations. Data may also be transferred to Stripe, Inc. in the USA, which is certified under the EU-US Data Privacy Framework. [[ZU PRÜFEN: confirm the allocation of roles and third-country transfers at Stripe]]

The legal basis is the performance of the contract (Art. 6(1)(b) GDPR) and compliance with statutory retention obligations (Art. 6(1)(c) GDPR): we keep invoices and accounting records for the legally required period, even if you delete your account. When you buy, we also store your consent to the immediate start of performance with a timestamp.

8. Emails

We send sign-in links, confirmations, information about your contract and reminders before a speech is deleted automatically via the email service provider Sendinblue SAS (Brevo), 106 boulevard Haussmann, 75008 Paris, France, under a data processing agreement (Art. 6(1)(b) GDPR). We do not send marketing newsletters. [[ZU PRÜFEN: enter the SMTP provider actually used]]

9. Waitlist and feedback

If you join a waitlist, for example for the live interview assistant or the audio upload, we store your email address, the feature you are interested in and your language, so we can let you know when it is available (consent, Art. 6(1)(a) GDPR). You are added without a separate confirmation email (no double opt-in). [[ZU PRÜFEN: proof of consent without double opt-in]] You can withdraw your consent at any time; on request by email to hallo@redestudio.de, we delete your entry immediately. Otherwise, we delete it once we have informed you. [[ZU PRÜFEN: retention period of the waitlist]]

After the first export of a speech, we ask you, voluntarily, for a rating (1 to 5), roughly how many minutes RedeStudio saved you, and an optional comment. We store this linked to your account or session and the speech, and use it to improve the product (Art. 6(1)(f) GDPR). Please do not include any content of your speech in the comment. Feedback is deleted with your account. [[ZU PRÜFEN: retention period for feedback]]

10. Error analysis

To detect errors, we may use Sentry (Functional Software, Inc.) with data storage in the EU. Technical information about the error is transmitted, such as browser, operating system and the affected page. The content of your speeches and form entries is removed beforehand (Art. 6(1)(f) GDPR). [[ZU PRÜFEN: only include this section if Sentry is active; check third-country transfers]]

11. Retention and deletion

• Without an account and without a purchase: we delete all data 14 days after your last activity.
• Without an account but with a purchase: we keep your data for 12 months after your last activity, so you can still reach your speech via the link in the purchase confirmation.
• Individual speeches: every speech is deleted automatically, by default 30 days after the occasion or, if no date is given, 12 months after the last edit. You can change this per speech (off, 30 or 90 days after the occasion) or delete the speech yourself at any time. However, a speech is never deleted automatically earlier than 14 days after its last edit, even if the occasion was longer ago.
• Reminder before deletion: if you have an account, we send you a reminder by email 7 days before a speech is deleted automatically, so you can export it or change the period.
• AI logs: hashes of IP addresses used to prevent abuse are deleted after 7 days (see 6.5).
• Account: you can delete your account at any time. This deletes all speeches and style profiles.
• Invoice and payment data are kept for as long as statutory retention obligations require. [[ZU PRÜFEN: enter the retention periods under the applicable tax and commercial law]]
• Backups: database backups are encrypted and overwritten after 35 days at the latest. Deleted data also disappears from the backups by then. [[ZU PRÜFEN: align with the backup rotation]]

12. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21). You can withdraw consent at any time with effect for the future (Art. 7(3)). Simply write to us at hallo@redestudio.de.

You can also lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), in particular in the member state where you live or work. The authority responsible for us is: [[ZU PRÜFEN: enter the competent supervisory authority at the controller’s place of business]]

13. No automated decisions

We do not make decisions based solely on automated processing that have legal effects on you (Art. 22 GDPR). RedeStudio’s drafts are suggestions; you decide how to use them.

14. Changes

We update this policy when RedeStudio or the law changes. The version published here applies.