Privacy Policy

1. Controller

Ferdous Nasri and Pascal Iversen Hasso Plattner Institute Prof.-Dr.-Helmert-Straße 2–3 14482 Potsdam Germany Email: pascal@auditowl.ai

The controller within the meaning of the General Data Protection Regulation (GDPR) is the provider named above and in the Imprint. You can reach us for all data protection matters at the email address given there.

2. Data we process

• Account data: your email address, name and, if you sign in with Google, the profile data Google provides to us (name, email address, profile picture). Your account is managed by our authentication provider Clerk.
• Materials: the manuscript (PDF) and code repository (uploaded archive or repository URL) you submit for an audit, and any instructions you enter. Materials may contain personal data, such as author names. Please do not upload any other personal data.
• Audit data: the audit results, the status and timing of each audit, the tier, which version of the Terms of Use you accepted and when.
• Communication data: the emails we send you about your audits (queued, ready, failed).
• Technical data: when you visit the website, our servers process your IP address, the time of the request, the requested page and browser information, which is necessary to deliver the website and protect it against attacks.

3. Purposes and legal bases

• Providing the Service, including your account, audits and audit emails, is necessary to perform our contract with you under the Terms of Use (Art. 6(1)(b) GDPR).
• Processing your Materials by AI service providers outside the EU, in particular Anthropic in the USA, is based on your explicit consent, which you give when starting an audit (Art. 6(1)(a) and Art. 49(1)(a) GDPR).
• Technical data is processed on the basis of our legitimate interest in operating a secure and reliable website (Art. 6(1)(f) GDPR).
• Keeping a record of your acceptance of the Terms of Use serves our legitimate interest in being able to prove it (Art. 6(1)(f) GDPR).

4. Recipients and processors

We pass personal data only to the following service providers, and only as far as necessary to provide the Service:

• Hetzner Online GmbH, Germany: hosting of the website, database and file storage. All of this is stored on servers in the EU.
• Clerk, Inc., USA: user accounts and sign-in.
• Resend, Inc., USA: sending of emails.
• Anthropic PBC, USA: AI analysis of your Materials to produce the audit results.
• Google Ireland Limited / Google LLC: only if you choose to sign in with Google.
• If you submit a repository URL, the repository is downloaded from its host (for example GitHub). No personal data about you is passed to the host in this process.

We do not sell your data and do not use it for advertising. We do not use your Materials to train AI models.

5. Transfers to the USA

Some of the recipients above are located in the USA. For Clerk and Resend, transfers take place on the basis of the EU Commission adequacy decision for the EU-US Data Privacy Framework where the recipient is certified under it, and otherwise on the basis of standard contractual clauses adopted by the EU Commission (Art. 46(2)(c) GDPR).

The transfer of your Materials to Anthropic is based on your explicit consent (Art. 49(1)(a) GDPR). Please note the risks: the USA may not offer a level of data protection equivalent to that in the EU, in particular US authorities may be able to access the data, and you may not be able to enforce your rights there effectively. You can withdraw your consent at any time with effect for the future by not starting further audits and deleting your existing ones.

6. Cookies

We only use cookies that are strictly necessary to provide the Service, namely the session cookies of our authentication provider Clerk that keep you signed in (§ 25(2) no. 2 TDDDG). We do not use analytics, tracking or advertising cookies, so no consent banner is required.

7. Storage period

• Account data is stored until you delete your account.
• Materials and audit results are stored until you delete them or your account. When you delete your account, all associated Materials and audits are deleted.
• Technical data in server logs is kept only as long as necessary for operation and security, and then deleted.
• Records of your acceptance of the Terms of Use are kept as long as claims arising from the contract can be asserted.

8. Your rights

You have the right to access your personal data (Art. 15 GDPR), to rectification (Art. 16), to erasure (Art. 17), to restriction of processing (Art. 18), to data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21). You may withdraw any consent at any time with effect for the future (Art. 7(3)). To exercise these rights, contact us at the email address in the Imprint.

You also have the right to lodge a complaint with a data protection supervisory authority, in particular the Berlin Commissioner for Data Protection and Freedom of Information (Berliner Beauftragte für Datenschutz und Informationsfreiheit).

9. Obligation to provide data

You are not obliged to provide personal data. Without an account and Materials, however, we cannot carry out audits for you.

10. Changes

We may update this Privacy Policy when the Service or the legal situation changes. The current version is always available on this page.