Privacy Policy

The controller responsible for processing your personal data within the meaning of the General Data Protection Regulation (GDPR) is:

xpand Deutschland GmbH
Ernst-Penzoldt-Weg 9
91080 Spardorf

Phone: +49 (0) 821 217000 80
Email: office@xpand.pro

You can find the full company details in the imprint.

We have appointed a data protection officer. You can reach them at:

Ricardo Wiedenbrüg
c/o xpand Deutschland GmbH
Ernst-Penzoldt-Weg 9
91080 Spardorf

Phone: +49 (0) 821 21700080
Email: datenschutz@xpand.pro

You can contact this address directly at any time — even without stating the reason for your enquiry.

This policy covers your use of the Leadership Impulse web application at lead.xpand.app and the emails we send you as part of this service.

It does not cover other websites operated by xpand Deutschland GmbH or third-party websites that we link to. If you follow a link in an impulse to a tool from the xpand toolbox, the privacy notice of that particular offering applies there.

We only process data that you provide to us yourself or that arises technically from operating the service. We do not buy in additional data and do not enrich your profile from external sources.

Access data:
- Your email address
- Your name (optional)
- Your role in the service (user or administrator)
- Your language and time zone
- One-time sign-in tokens and session identifiers, each stored only as a cryptographic hash value

Information from your leadership profile — all optional except the first item:
- Your current challenge as a leader (free text)
- Your development goal (free text)
- Leadership role, team size, leadership experience, industry
- Your self-assessment between specialist tasks and leadership
- Your preferred tone for the impulses

Information about your impulse series:
- The focus topics you have chosen
- Period, weekdays, rhythm, time of day and desired reading time

Generated content and delivery information:
- The impulses generated for you, including the series arc
- Delivery logs: recipient address, timestamp, success or error message, and the reference number from our email service provider

Consents:
- Time and version of your agreement to the terms of use
- Time and version of your consent to the AI-supported analysis, and any withdrawal of it

Details of a learning partnership:
- the name and email address of the person you name as your learning partner
- the time of the invitation as well as that person's agreement, refusal or stepping out

Sparring chat:
- Your questions and the assistant's answers, with timestamps, organised into conversations
- Your chat settings (response length, tone, mode and which sources are included)

Usage log of AI calls:
- for each call the purpose, model, tokens, cost and duration — for cost control, without any content

Access, sign-in and operation of the service — so that you can sign in without a password and use the service. Legal basis: performance of the contract for use under Art. 6(1)(b) GDPR.

AI-supported analysis of your profile information to create personal impulses — this is the core of the service and goes beyond mere administration of your data. Legal basis: your consent under Art. 6(1)(a) GDPR. You give this consent explicitly when setting up your profile and can withdraw it at any time with effect for the future.

Delivery of the impulses by email on the days and at the times you have chosen. Legal basis: Art. 6(1)(b) GDPR.

Delivery logs for troubleshooting and to prove delivery. Legal basis: our legitimate interest in a service that functions in a traceable way, under Art. 6(1)(f) GDPR.

Security of the service, in particular limiting sign-in attempts. Legal basis: Art. 6(1)(f) GDPR.

Documentation of your consents. Legal basis: our legal obligation to be able to demonstrate consent, under Art. 6(1)(c) in conjunction with Art. 7(1) GDPR.

Sparring chat — answering your questions on leadership topics, drawing on your profile, your most recent impulses and our knowledge base to the extent you allow this in the chat settings. Legal basis: your consent under Art. 6(1)(a) GDPR insofar as your profile information is included; otherwise Art. 6(1)(b) GDPR. The limit of 40 requests per hour serves the security of the service (Art. 6(1)(f) GDPR).

In the questionnaire, we ask you to describe your current challenge. This is exactly what makes the impulses accurate — and it is also the most personal information in the whole service. So we ask two things of you:

• Do not name other people, or describe them in a way that makes them identifiable. Describe situations and roles, not people.
• Do not provide any special categories of personal data within the meaning of Art. 9 GDPR — in particular no information about health, illness, therapy, religion, political opinions, trade union membership or sex life.

We do not ask for such information and do not need it. Should you provide it anyway, we process it solely on the basis of your explicit consent under Art. 9(2)(a) GDPR — and you can delete or overwrite it in your profile at any time.

Your profile information and the topics you have chosen are passed to an AI language model, which uses them to write a series arc and the individual impulses. Material from our editorially maintained knowledge base is also included; this knowledge base contains no personal data of users.

Three points matter to us:

• Processing takes place via the European endpoint of our AI service provider. Your information is processed within Europe.
• According to the provider, your information is not stored and is not used to train AI models. We likewise do not use your information to train our own models.
• No automated decision-making within the meaning of Art. 22 GDPR takes place. The impulses are editorial texts; they have no legal effect on you and do not similarly significantly affect you.

The generated impulses are created in advance and stored in our database, so that they can be delivered at the desired time and read again later in the archive.

The sparring chat uses the same process: your question, the conversation so far and — depending on your chat settings — your profile, your most recent impulses and matching sections of the knowledge base are passed to the AI language model. We store conversations and messages in our database so that you can continue them later; you can delete any conversation at any time.

For an impulse series you can name a person who receives every impulse of that series in copy — your learning partner. Whoever reads along can ask — intentions hold better when someone knows about them.

For us this person is a third party whose address we did not receive from them. Therefore:

• We store the name and email address you enter and write to this person once. That email tells them from whom we have their address and what we use it for (Art. 14 GDPR).
• An impulse only goes out in copy once the person has expressly agreed. The legal basis is their consent under Art. 6(1)(a) GDPR; delivery to you yourself remains based on Art. 6(1)(b) GDPR.
• Every copy names the partnership and carries a link with which the person can stop reading along immediately. You yourself can end the partnership in your series at any time.
• When the partnership ends — through refusal, stepping out, your ending it, or the end of the series — we delete the name and the address. If an invitation remains unanswered for 30 days, we delete it as well.
• Our delivery logs record which address a copy went to; the same period applies to them as to the other logs.

Please bear in mind: this person reads the complete impulse — it is tailored to your profile and allows conclusions about your details. So name only someone you wish to entrust with that. We do not pass on your free-text entries from the questionnaire.

Your data stays within xpand Deutschland GmbH and is only passed on to carefully selected service providers who act for us as processors under Art. 28 GDPR. We have the necessary data processing agreements in place with all of them.

• Vercel Inc., USA — operation and delivery of the web application; application execution in Frankfurt am Main
• Neon, LLC (Databricks, Inc.), USA — operation of the database in Frankfurt am Main
• Plus Five Five, Inc. (Resend), USA — sending of emails
• Eden AI SAS, France — access to the AI language model and to the embeddings, exclusively via the European endpoint; the gateway only forwards requests to model providers in European regions (currently Google Cloud, Vertex AI, EU region)

We do not sell your data and do not pass it on for advertising purposes. Data is only passed on to public authorities where we are legally obliged to do so.

If your access was set up through an approval granted by your employer, your employer does not receive any content from your profile or any impulses from us. We tell them neither what you have written nor which topics you have chosen.

Business customers can find the full list with legal details, processing locations and safeguards in Annex 3 of our data processing agreement.

Some of the service providers named above are based in the United States. Where personal data is transferred to a third country as a result, we base this transfer on the European Commission's Standard Contractual Clauses under Art. 46(2)(c) GDPR and — where the provider concerned is certified — on the adequacy decision for the EU-US Data Privacy Framework under Art. 45 GDPR.

The AI-supported processing of your profile information runs exclusively via the European endpoint of our AI service provider and is not affected by any transfer to a third country.

We only store your data for as long as necessary for the relevant purpose:

• Sign-in links: 15 minutes from the time requested, then invalid
• Invitation links: 14 days from being sent
• Sign-in sessions: 30 days from sign-in, immediately upon sign-out
• Language choice in the browser: up to one year
• Profile information, series and generated impulses: for as long as your access exists
• Delivery logs: 12 months from sending
• Records of consent and withdrawal: for as long as your access exists — they evidence our accountability obligation under Art. 7(1) GDPR and are deleted together with your access
• Details of a learning partnership: until it ends; unanswered invitations 30 days
• Sparring chat: conversations and messages until you delete them or your access ends

If you have your access deleted, we remove your profile, your series and your impulses. We cannot recall emails already sent to you — they remain in your inbox.

We only use technically necessary cookies. A consent banner is therefore not required; storage is permitted under Section 25(2) no. 2 TDDDG (German Telecommunications Digital Services Data Protection Act) because it is strictly necessary for the use you have expressly requested.

• li_session — keeps you signed in. Transmitted only over an encrypted connection, not readable by scripts, and expires after 30 days.
• NEXT_LOCALE — remembers your language choice so that you do not have to make it again on every visit. Expires after one year.

We do not use cookies for analytics, marketing or profiling purposes. No advertising networks, social media plug-ins or tracking services are integrated.

The fonts used are delivered from our own server. No connection to Google Fonts or any other external provider is established when the pages are loaded, and no IP address is transmitted to third parties.

When you access our pages, technical log data is generated at our hosting provider — for example IP address, timestamp, the address accessed and the amount of data transmitted. It serves the secure and trouble-free operation of the service and the defence against attacks. The legal basis is our legitimate interest under Art. 6(1)(f) GDPR. We do not combine these logs with your profile.

You have the following rights against us:

• Access to information about what data we process about you (Art. 15 GDPR)
• Rectification of inaccurate data (Art. 16 GDPR)
• Erasure of your data (Art. 17 GDPR)
• Restriction of processing (Art. 18 GDPR)
• Receipt of your data in a common format and transmission to another provider (Art. 20 GDPR)
• Objection to processing that we base on a legitimate interest (Art. 21 GDPR)

A message to datenschutz@xpand.pro is sufficient. We respond without delay, and at the latest within one month. You can also change or delete your profile information yourself at any time in the profile area.

You can withdraw your consent to the AI-supported analysis of your profile information at any time — in the profile area with a single click, without giving a reason and without any disadvantage to you.

After withdrawal, we no longer generate any new impulses for you. A series in progress is ended; impulses not yet created are cancelled. Impulses you have already received remain available in the archive until you request deletion of your access.

The withdrawal takes effect for the future. The lawfulness of processing carried out before the withdrawal remains unaffected.

If you believe that we have infringed data protection law in processing your data, you can lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The competent authority is the one for your habitual residence, your place of work, or the place of the alleged infringement.

Regardless of this, we would welcome you contacting our data protection officer first — this is usually the fastest way to resolve a concern.

You are under no statutory or contractual obligation to provide us with personal data. However, without an email address we cannot set up access for you, and without a description of your challenge we cannot create personal impulses. All other information in the questionnaire is optional; without it, the impulses will be less precisely tailored to you.

We update this privacy policy whenever the service or the legal position changes. You will always find the current version on this page; the version date is shown at the end.

If a change affects the scope of your consent, we will obtain your consent again before processing on the new basis.

This policy is provided in several languages. All language versions describe the same processing; in case of doubt about the interpretation of a technical term, we refer to the German version.