Privacy Policy

The controller responsible for processing your personal data within the meaning of the General Data Protection Regulation (GDPR) is:

xpand Deutschland GmbH
Ernst-Penzoldt-Weg 9
91080 Spardorf

Phone: +49 (0) 821 217000 80
Email: office@xpand.pro

You can find the full company details in the imprint.

We have appointed a data protection officer. You can reach them at:

Ricardo Wiedenbrüg
c/o xpand Deutschland GmbH
Ernst-Penzoldt-Weg 9
91080 Spardorf

Phone: +49 (0) 821 21700080
Email: datenschutz@xpand.pro

You can contact this address directly at any time — even without stating the reason for your enquiry.

This policy covers your use of the Leadership Impulse web application at lead.xpand.app and the emails we send you as part of this service.

It does not cover other websites operated by xpand Deutschland GmbH or third-party websites that we link to. If you follow a link in an impulse to a tool from the xpand toolbox, the privacy notice of that particular offering applies there.

We only process data that you provide to us yourself or that arises technically from operating the service. We do not buy in additional data and do not enrich your profile from external sources.

Access data:
- Your email address
- Your name (optional)
- Your role in the service (user or administrator)
- Your language and time zone
- One-time sign-in tokens and session identifiers, each stored only as a cryptographic hash value

Information from your leadership profile — all optional except the first item:
- Your current challenge as a leader (free text)
- Your development goal (free text)
- Leadership role, team size, leadership experience, industry
- Your self-assessment between specialist tasks and leadership
- Your preferred tone for the impulses

Information about your impulse series:
- The focus topics you have chosen
- Period, weekdays, rhythm, time of day and desired reading time

Generated content and delivery information:
- The impulses generated for you, including the series arc
- Delivery logs: recipient address, timestamp, success or error message, and the reference number from our email service provider

Consents:
- Time and version of your agreement to the terms of use
- Time and version of your consent to the AI-supported analysis, and any withdrawal of it

Access, sign-in and operation of the service — so that you can sign in without a password and use the service. Legal basis: performance of the contract for use under Art. 6(1)(b) GDPR.

AI-supported analysis of your profile information to create personal impulses — this is the core of the service and goes beyond mere administration of your data. Legal basis: your consent under Art. 6(1)(a) GDPR. You give this consent explicitly when setting up your profile and can withdraw it at any time with effect for the future.

Delivery of the impulses by email on the days and at the times you have chosen. Legal basis: Art. 6(1)(b) GDPR.

Delivery logs for troubleshooting and to prove delivery. Legal basis: our legitimate interest in a service that functions in a traceable way, under Art. 6(1)(f) GDPR.

Security of the service, in particular limiting sign-in attempts. Legal basis: Art. 6(1)(f) GDPR.

Documentation of your consents. Legal basis: our legal obligation to be able to demonstrate consent, under Art. 6(1)(c) in conjunction with Art. 7(1) GDPR.

In the questionnaire, we ask you to describe your current challenge. This is exactly what makes the impulses accurate — and it is also the most personal information in the whole service. So we ask two things of you:

• Do not name other people, or describe them in a way that makes them identifiable. Describe situations and roles, not people.
• Do not provide any special categories of personal data within the meaning of Art. 9 GDPR — in particular no information about health, illness, therapy, religion, political opinions, trade union membership or sex life.

We do not ask for such information and do not need it. Should you provide it anyway, we process it solely on the basis of your explicit consent under Art. 9(2)(a) GDPR — and you can delete or overwrite it in your profile at any time.

Your profile information and the topics you have chosen are passed to an AI language model, which uses them to write a series arc and the individual impulses. Material from our editorially maintained knowledge base is also included; this knowledge base contains no personal data of users.

Three points matter to us:

• Processing takes place via the European endpoint of our AI service provider. Your information is processed within Europe.
• According to the provider, your information is not stored and is not used to train AI models. We likewise do not use your information to train our own models.
• No automated decision-making within the meaning of Art. 22 GDPR takes place. The impulses are editorial texts; they have no legal effect on you and do not similarly significantly affect you.

The generated impulses are created in advance and stored in our database, so that they can be delivered at the desired time and read again later in the archive.

Your data stays within xpand Deutschland GmbH and is only passed on to carefully selected service providers who act for us as processors under Art. 28 GDPR. We have the necessary data processing agreements in place with all of them.

• Vercel Inc., USA — operation and delivery of the web application
• Neon Inc., USA — operation of the database
• Resend, Inc., USA — sending of emails
• Eden AI SAS, France — access to the AI language model and to the embeddings; processing exclusively via the European endpoint

We do not sell your data and do not pass it on for advertising purposes. Data is only passed on to public authorities where we are legally obliged to do so.

If your access was set up through an approval granted by your employer, your employer does not receive any content from your profile or any impulses from us. We tell them neither what you have written nor which topics you have chosen.

Some of the service providers named above are based in the United States. Where personal data is transferred to a third country as a result, we base this transfer on the European Commission's Standard Contractual Clauses under Art. 46(2)(c) GDPR and — where the provider concerned is certified — on the adequacy decision for the EU-US Data Privacy Framework under Art. 45 GDPR.

The AI-supported processing of your profile information runs exclusively via the European endpoint of our AI service provider and is not affected by any transfer to a third country.

We only store your data for as long as necessary for the relevant purpose:

• Sign-in links: 15 minutes from the time requested, then invalid
• Invitation links: 14 days from being sent
• Sign-in sessions: 30 days from sign-in, immediately upon sign-out
• Language choice in the browser: up to one year
• Profile information, series and generated impulses: for as long as your access exists
• Delivery logs: 12 months from sending
• Records of consent and withdrawal: for as long as your access exists — they evidence our accountability obligation under Art. 7(1) GDPR and are deleted together with your access

If you have your access deleted, we remove your profile, your series and your impulses. We cannot recall emails already sent to you — they remain in your inbox.

We only use technically necessary cookies. A consent banner is therefore not required; storage is permitted under Section 25(2) no. 2 TDDDG (German Telecommunications Digital Services Data Protection Act) because it is strictly necessary for the use you have expressly requested.

• li_session — keeps you signed in. Transmitted only over an encrypted connection, not readable by scripts, and expires after 30 days.
• NEXT_LOCALE — remembers your language choice so that you do not have to make it again on every visit. Expires after one year.

We do not use cookies for analytics, marketing or profiling purposes. No advertising networks, social media plug-ins or tracking services are integrated.

The fonts used are delivered from our own server. No connection to Google Fonts or any other external provider is established when the pages are loaded, and no IP address is transmitted to third parties.

When you access our pages, technical log data is generated at our hosting provider — for example IP address, timestamp, the address accessed and the amount of data transmitted. It serves the secure and trouble-free operation of the service and the defence against attacks. The legal basis is our legitimate interest under Art. 6(1)(f) GDPR. We do not combine these logs with your profile.

You have the following rights against us:

• Access to information about what data we process about you (Art. 15 GDPR)
• Rectification of inaccurate data (Art. 16 GDPR)
• Erasure of your data (Art. 17 GDPR)
• Restriction of processing (Art. 18 GDPR)
• Receipt of your data in a common format and transmission to another provider (Art. 20 GDPR)
• Objection to processing that we base on a legitimate interest (Art. 21 GDPR)

A message to datenschutz@xpand.pro is sufficient. We respond without delay, and at the latest within one month. You can also change or delete your profile information yourself at any time in the profile area.

You can withdraw your consent to the AI-supported analysis of your profile information at any time — in the profile area with a single click, without giving a reason and without any disadvantage to you.

After withdrawal, we no longer generate any new impulses for you. A series in progress is ended; impulses not yet created are cancelled. Impulses you have already received remain available in the archive until you request deletion of your access.

The withdrawal takes effect for the future. The lawfulness of processing carried out before the withdrawal remains unaffected.

If you believe that we have infringed data protection law in processing your data, you can lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The competent authority is the one for your habitual residence, your place of work, or the place of the alleged infringement.

Regardless of this, we would welcome you contacting our data protection officer first — this is usually the fastest way to resolve a concern.

You are under no statutory or contractual obligation to provide us with personal data. However, without an email address we cannot set up access for you, and without a description of your challenge we cannot create personal impulses. All other information in the questionnaire is optional; without it, the impulses will be less precisely tailored to you.

We update this privacy policy whenever the service or the legal position changes. You will always find the current version on this page; the version date is shown at the end.

If a change affects the scope of your consent, we will obtain your consent again before processing on the new basis.

This policy is provided in several languages. All language versions describe the same processing; in case of doubt about the interpretation of a technical term, we refer to the German version.