Privacy policy

1. Controller

CoTraX GmbH, Breite Straße 27, 40213 Düsseldorf, Germany, represented by its managing director Sara Fanselau.

Email: [email protected]
Phone: +49 (0) 170 99 47 316

2. What data the application processes

Depending on the features you use, we process:

• technical connection and security data, such as IP address, time, browser/app information and server logs,
• sign-in and account information, where access is protected by the platform sign-in,
• training configurations (including an optionally stored training focus), product knowledge, website URLs and uploaded text or PDF content,
• pasted conversation transcripts and the training assessments produced from them,
• when the reporting function is used — in the app as well as on this website: the reported AI content, the reason for the report, an optional comment, the origin (web, iOS or Android) and the time,
• saved conversation partners: the person invented by the AI (name, role, background, way of speaking, typical objections), the situation it grew out of, a title you gave it yourself and the chosen voice — so that the same person can be called again in the app and on the web,
• training histories and settings stored locally on the device.

Please do not enter special categories of personal data, trade secrets or information about third parties where this is not necessary for the training and not legally covered.

3. Purposes and legal bases

We process data in order to provide the service, to build sales scenarios, to assess pasted conversation transcripts, to prevent misuse and to ensure technical security. Depending on the use, the legal bases are Art. 6(1)(b) GDPR (contract or pre-contractual measures) and Art. 6(1)(f) GDPR (secure and economical operation). For the voluntary spoken conversations — the role play and the preliminary talk in which you describe your situation — Art. 6(1)(a) GDPR applies in addition: you give your consent by starting them and allowing microphone access (section 5). Without such a conversation no microphone processing takes place.

4. Hosting, delivery and access protection

The web application and the interface run on a server operated for us by CLUSTER ONE GmbH, Grüner Winkel 21, 41065 Mönchengladbach, as a processor under Art. 28 GDPR. Hardware, network connection and data centre are provided by STRATO AG, Otto-Ostrowski-Straße 7, 10249 Berlin, Germany; the location is Berlin. A data processing agreement under Art. 28 GDPR obliges STRATO to access the data only on our instructions. Delivery goes through the network of Cloudflare (Cloudflare Germany GmbH, Rosental 7, 80331 München, as the contracting party for the EU; parent company Cloudflare, Inc., USA), which acts as a reverse proxy and protects against attacks. In doing so, IP address, time, requested address, browser identification and technical status data are processed.

To protect against misuse we limit the number of requests per IP address – and, when a sign-in link is requested, additionally per email address – and for that purpose store the address together with a counter in our database. Most counters run for ten minutes; for the trial conversation without an account and its feedback, where offered, we count per IP address for 24 hours. We delete these entries automatically, at the latest 25 hours after the respective counting window began. In addition the server issues a short-lived access token bound to the IP address (valid for one hour), which is kept in the browser only for the current session and in the app only in memory. The legal basis is Art. 6(1)(f) GDPR (provision and security of the service).

Bot protection (Cloudflare Turnstile). To stop automated clients from sending sign-in links or burning AI minutes, we use Cloudflare Turnstile. Your browser loads a script from challenges.cloudflare.com; Cloudflare processes your IP address, details about your browser and device and signals about your behaviour on the page, and returns a short-lived token that our server verifies. The check runs invisibly and only shows a box to tick when it is unsure. Turnstile sets no cookies for recognising you across websites and is not used for advertising. It is triggered when you request a sign-in link or start an AI function. The legal basis is Art. 6(1)(f) GDPR (protection against automated misuse and the costs it causes).

Further information: Cloudflare privacy policy.

5. AI processing by OpenAI

For offer analysis, scenario preparation and the assessment of a conversation transcript, the inputs needed for this are transmitted to the OpenAI API. The responsible contracting party for customers in the EEA is OpenAI Ireland Limited, 1st Floor, The Liffey Trust Centre, 117‑126 Sheriff Street Upper, Dublin 1, D01 YC43, Ireland.

Spoken conversations (voluntary). If you start a role play under “Speak live now” or a preliminary talk under “Talk it through with the coach”, your browser asks for access to your microphone. A direct WebRTC connection is established between your device and OpenAI; in the process your microphone signal and your IP address are transmitted to OpenAI and processed there for the duration of the conversation. We set up the connection — we send the instructions for it from our server — and do not receive the other side’s audio ourselves. In the app the same applies to every spoken conversation. So that your own sentences also appear in the transcript, your device additionally sends short pieces of your microphone signal (about five seconds each) to our server, which passes them on to OpenAI’s transcription and returns only the text to you – on this website during the role play, in the app in every spoken conversation: role play, 90-second drill, trial conversation and preliminary talk with the coach. We store neither the pieces nor the text; it appears in your history only together with your feedback. In the preliminary talk with the coach, this website writes down only what the coach says, the app also what you say; that text reaches our server only when you have a scenario built from it.

Trial conversation without an account. On the home page, in the app and via links from courses of the demo academy a predefined conversation can be held without signing in. No user account is created, and we store neither the conversation nor its transcript. For the duration of the conversation the same is processed as described above — microphone signal and IP address at OpenAI, and in the app also the audio pieces for the transcript. If you then get your feedback, the transcript goes to our server and from there to OpenAI; even then we do not store it. In addition we store your IP address in the form described in section 4 (24-hour counting window), in order to limit the number of trial conversations per caller; without that limit the offer could not be free of charge. The legal basis for the conversation is your consent (Art. 6(1)(a) GDPR), for the limit our legitimate interest in protection against misuse and cost (Art. 6(1)(f) GDPR).

We make no audio recording. We make no audio recording, neither on your device nor on our server. What is written down as text during the conversation stays in your browser or in the app; it reaches our server only when you get your feedback or have a scenario built from the preliminary talk. The legal basis is your consent (Art. 6(1)(a) GDPR), which you give by starting the conversation and allowing microphone access; you can withdraw it at any time by hanging up.

The live conversation is one of two routes. Instead you can take the scenario to ChatGPT or Claude and hold it there in your own account — then no voice connection is established here. Section 8 describes what is transmitted in that case.

We send Responses requests with store: false set. According to OpenAI, API content is by default not used to train the models. Security and abuse logs can, under the API data controls applicable at the time, generally be retained for up to 30 days, unless different data controls have been agreed.

The legal basis is Art. 6(1)(b) GDPR. The basis for the processing on our behalf and for any transfers to third countries is the OpenAI data processing agreement and the standard contractual clauses it provides for.

6. Product knowledge, files and external websites

Uploaded PDFs and text files are read out on the server and handed to the AI for the requested analysis. Files are not kept by the application as permanent file storage. When a product URL you have given is fetched, the operator of the target website necessarily receives a server request including IP address and user agent. Only fetch websites whose use is permitted for this purpose.

7. Local storage on the device

Training history, saved conversations and temporary session settings are kept in the local storage of the browser or the app. This data generally stays on the device used until it is deleted in the application or through the browser/app data. If you are signed in, saved conversations and your offers are additionally stored in your account (section 11) so that you see them on other devices; deleting them in the application removes them there as well. With every AI assessment, your current contribution, the last ten conversation contributions, the structured offer fields (product, price, benefit, target customers, conversation goal, evidence, needs questions, objections) and an extract of up to 3,000 characters of your product knowledge are transmitted to our server and then to OpenAI.

8. Handover to ChatGPT or Claude

Only when you choose the corresponding button do we put the generated prompt into your clipboard and open the page of the chosen provider. Nothing is transmitted from us: only when you paste the text there does it reach ChatGPT (OpenAI) or Claude (Anthropic). The prompt contains the invented conversation partner and the scenario data you entered (industry, role and, where the module provides for it, the product name).

Important: this processing takes place in your own account with the respective provider. There is no data processing agreement with us for it and no joint controllership; the provider’s terms alone apply – including the question of whether it uses the content to improve its models. That differs from our own use of the OpenAI interface (section 5). The handover is optional.

9. Assessment of conversations held elsewhere

If you have held a conversation at ChatGPT or Claude, you can paste the transcript here and have it assessed. The pasted text is then transmitted to OpenAI together with the offer fields of your scenario (as described in section 5) and the result is stored in your account under “Trainings” – marked as held elsewhere. The legal basis is Art. 6(1)(b) and (f) GDPR; this entry is deleted along with your account.

Please do not paste personal data of third parties. You are responsible for the content you transmit.

10. Reporting AI content

In the app and on this website, AI replies and training assessments can be reported immediately. We process the selected content, the reason for the report, an optional comment, the platform and the time, in order to examine safety problems, inappropriate content and errors. Reports are stored in our database, used only for security, fault fixing and improvement of the service, and deleted at the latest 90 days after the examination is closed.

11. Account, sign-in and history

A free account is needed for the AI features. We store your email address, the time of your sign-ins, sessions per device (browser or device identification as free text, times), the trainings stored in the account (configuration without product knowledge, transcript, assessments, duration), your saved offers and daily usage counters, on which the quotas depend where they apply. We also count how often you have started a course exercise whose counterpart changes – only this number per exercise, so that a different person answers each time, in turn. Reminders in the app are local notifications that the app schedules itself on the device: time and weekly goal stay there, there is no push token for them, and neither we nor a push service receive any data for them. An offer contains the fields you enter yourself – industry, product, price, benefit, target customers, conversation goal, evidence, needs questions, expected objections, URL and source name – and, unlike the trainings, your product knowledge as well. We store offers so that the same offer is available in the app and on the web; you can delete each one individually and at any time. Sign-in links are valid for 15 minutes, work once and are stored only as a hash. The session sits in the browser in an HttpOnly cookie (sct_session, 90 days rolling) or in the app in the device’s keychain. The legal basis is Art. 6(1)(b) GDPR.

The sign-in link is sent by an SMTP mail server that CLUSTER ONE GmbH operates for us. Under “Konto” you can export all account data as JSON (Art. 15 GDPR) and delete your account (Art. 17 GDPR); the deletion permanently removes sessions, trainings and counters.

11a. Signing in with CoTraX Academy and courses in the app

From version 1.9.0 of the app, you no longer sign in with a sign-in link but with your CoTraX Academy account – one sign-in for the courses and the exercises. At present, only testers receive this version of the app; on this website, the sign-in link remains. You sign in in a sign-in window provided by the operating system, at the Academy’s sign-in service (Keycloak, operated by CoTraX GmbH); we see neither your password nor your sign-in details. Accounts are created by the Academy; there is no self-registration. With every request, the app sends us an access key (access token) issued by the Academy. Our server checks it against the Academy’s public keys, which it fetches from the Academy; no personal data goes to the Academy in the process. The token contains the identifier of your Academy account, your name, your email address and your organisation. Of this, we store only the identifier of your Academy account and the sign-in service that issued it, together with the time of the first and the most recent sign-in – this is how your account with us belongs to your sign-in. We do not store your name, email address or organisation; the email address only goes back to the app so that it can show who is signed in. On your first sign-in, a new account is created with us, even if you already have one with a sign-in link: the two remain separate, and we do not link them via the email address. The link between them is included in the data export and is deleted together with your account with us; your Academy account is not affected. “Sign out” revokes the access keys with the Academy and deletes them from the device. CoTraX GmbH is responsible both for the sign-in service and for your account with us (section 1). The legal basis is Art. 6(1)(b) GDPR.

Under “Academy”, the app shows the courses of CoTraX Academy. Using the Academy’s access keys, which it stores in the device keychain, it fetches courses, content, videos and your profile (name, email address, language) directly from the Academy. The Academy is the responsibility of CoTraX GmbH. Your learning progress – completed units and the point where a video stopped – goes from the device to the Academy and is stored there in your Academy account. None of this passes through our server; we receive neither courses nor progress. In the process, the Academy learns your IP address. Processing by the Academy is governed by its privacy notice, which you confirm there on first access. If you start an exercise from a course, this policy applies to the conversation (sections 5 and 11). When you delete your account with us, the app revokes the access keys with the Academy and deletes them from the device.

13. Retention period

We store personal data only for as long as it is necessary for the respective purpose or for legal obligations. Locally stored training data remains until the user deletes it. Account data remains until the account is deleted; expired sessions and sign-in links are removed after one day at the latest, usage counters after 90 days, the start counter of a course exercise 90 days after your last start of that exercise. Counters for request limiting, together with the IP or email address, are deleted at the latest 25 hours after their counting window began (section 4), content reports deleted at the latest 90 days after they have been handled. For data held by processors, the contractual deletion and retention rules of the respective services apply.

14. Automated assessments

AI-generated scores and hints serve the training alone. They can be inaccurate and have no legal or similarly significant effect. No automated decision within the meaning of Art. 22 GDPR takes place.

15. Your rights

Subject to the statutory conditions, data subjects have in particular rights to information, rectification, erasure, restriction of processing, data portability and objection. Consent can be withdrawn with effect for the future. There is also a right to lodge a complaint with a data protection supervisory authority, in particular at the place of habitual residence, place of work or place of the alleged infringement.

16. Security and updates

We use appropriate technical and organisational measures to protect data. This policy is adjusted when features, service providers or legal requirements change.