Privacy Policy

This English version is provided for convenience. The German version is legally binding.

1. Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) is:

umtech Systemberatungen GmbH
An der Stadtmauer 4
72516 Scheer
Germany
Represented by its Managing Director, Hubert Baumann
Telephone: +49 7572 7694650
Email: baumann@toubot.de

Where another controller or joint controllership exists for individual functions, this is explained for the respective function.

2. General Information

This Privacy Policy provides information about the processing of personal data when using toubot.eu, a TouBot account, the question catalogue, the game profiles, the games, the game chat and the associated general functions. Personal data is any information relating to an identified or identifiable natural person.

Which data is actually processed depends on whether TouBot is only visited, an account is used, an answer sheet or game profile is saved, a shared game room is used or a purchase is made. For optional later story and AI use, supplementary function-specific privacy information applies. It is displayed before any data is collected for this purpose or transmitted to an AI provider.

3. Provision of the Website and Server Logs

When TouBot is accessed, technically necessary connection data is processed. This may include the IP address, date and time, the address requested, the amount of data transferred, referrer, browser, operating system, device information and response status.

The purposes are delivery of the website, stability, error analysis, defence against attacks and abuse, and evidence of system security. The legal basis is Art. 6(1)(f) GDPR. The legitimate interest lies in the secure and functional operation of the service. Where data is required for the performance of a contract, Art. 6(1)(b) GDPR also applies.

Recipients may be hosting, network, storage and security service providers. Our servers are operated in Germany. Log data is stored only for as long as necessary for security and error analysis.

Counting page views without cookies

To see how often individual pages of our service are visited, we count the visits per page and day. We do not set any cookies for this, do not store any information on your device and do not read any from it. IP addresses are not stored for this count. Only the number of visits per page and day is stored; no conclusions about individual visitors can be drawn from it. To filter out automatic requests, for example by search engines, the browser identifier is checked when the page is requested and is not stored.

If you arrive via a link from one of our advertisements, the address contains an identifier of the advertisement. We also count this identifier per page and day without linking it to you, your account or an order.

The legal basis is our legitimate interest in designing our service according to demand and in assessing the success of our advertising (Art. 6(1)(f) GDPR).

4. Registration, User Account and Login

During registration and account use, the following in particular may be processed:

• username, email address and encrypted or hashed password verifier;
• language, invitation code, account and plan status;
• voluntary profile, address and mobile phone details;
• login times, security events and technical session data;
• for passkeys/WebAuthn: credential ID, public key, counter, device type, transport types and a freely chosen device name;
• settings, activations, credit allowances and usage history.

Processing takes place to set up, secure and manage the account and to provide contractual functions on the basis of Art. 6(1)(b) GDPR. Security logs are additionally processed on the basis of Art. 6(1)(f) GDPR.

5. Question Catalogue, Answer Sheets and Game Profiles

TouBot processes the questions, answers, names and profile details selected or entered by the user insofar as this is necessary for the question catalogue, encrypted answer sheets or a game profile created by the user.

Processing takes place to perform the service requested by the user in accordance with Art. 6(1)(b) GDPR. If inputs contain personal data of third parties, the user is responsible for ensuring that a suitable legal basis and any required information or consent exist.

5.1 Encrypted Answer Sheets

Answer sheets that a user saves in their TouBot account are encrypted in the browser with AES-GCM-256. Through the answer sheet interfaces, TouBot accepts only data recognised as a valid encrypted answer sheet. This also applies to earlier versions of an answer sheet stored on the server. The server therefore holds only the encrypted content and the metadata required for account assignment, display, size checks, version management and deletion. A neutral name should be used to label an answer sheet.

Local browser drafts and downloaded files remain under the user’s control. Saving an answer sheet does not trigger any AI processing or any transmission of its content to an AI provider. If TouBot later offers a story or AI function, the user can deliberately select an answer sheet for it. Before decryption for this purpose and before transmission, the supplementary privacy information on the specific function and the recipients actually used is provided.

5.2 Unencrypted Game Profiles and Profile Games

For the TouBot profile games, the user can create a separate game profile from selected answers. For each bot it contains only the chosen name, six rounded trait values – patience, willingness to take risks, action, caution, persistence and spontaneity – and the number of answers taken into account in the calculation. Individual questions, answers and free texts are not transferred to the game profile.

A game profile saved in the TouBot account is stored on the server unencrypted and assigned to the respective user account. Through the application it can be retrieved only by the logged-in account holder; the operator’s technically necessary access and administration capabilities remain unaffected. The user can also download a game profile and store or pass it on at their own responsibility.

The browser games offered as TouBot profile games do not use generative AI and do not transmit game profiles or game histories to external AI providers. The computer opponent’s moves are determined by game and decision logic. This applies differently only if a new function is expressly identified as AI-assisted; separate information on the related data processing is provided before it is used.

6. Optional Later Story and AI Functions

Story and AI functions are not part of the games plan and are not activated automatically by saving an answer sheet or game profile. If TouBot later offers such functions as a separate plan or individual order, the user decides expressly which content is used for them.

Before ordering, and again in good time before the first transmission to an external AI provider, the user receives the special terms and privacy information for story and AI functions. These describe in particular the data processed, purposes, legal bases, providers actually used, recipients, transfers to third countries, retention periods, credit rules and consequences of publication. If the purpose changes materially or a provider relevant to the processing is added, information is provided again before the new processing.

The general information in this Privacy Policy applies in addition. The separate privacy information is not consent. Consent is obtained separately only where the specific processing requires such a legal basis, for example for optional promotional use of specific content or, where applicable, for particularly sensitive data.

7. Storage and Provision of General Account Content

Account content such as encrypted answer sheets, unencrypted game profiles, settings and purchase assignments is stored in the databases and object storage configured for TouBot. Non-public content is made available only to authorised users and technically necessary service providers. For texts and media of a later story or AI function, the special privacy information provided there applies in addition.

8. Contact, Support and Chatbot

When you contact us by email, form or support function, the contact details provided, the message text, related order data and technical processing notes are processed.

If the enquiry relates to a contract or pre-contractual measures, Art. 6(1)(b) GDPR is the legal basis. Otherwise, processing takes place on the basis of Art. 6(1)(f) GDPR; the legitimate interest lies in handling and documenting enquiries.

When an AI chatbot is used, inputs, answers, session identifier and, where applicable, the user account are stored and transmitted to the configured language model provider in order to answer. The chatbot must be identified as an AI system. Users should not enter unnecessary personal or confidential data there.

8.1 Shared Game Rooms and End-to-End Encrypted Game Chat

Invited participants can use an approved game room without their own TouBot account and without their own games plan. Before access, TouBot processes a join request with the chosen display name, a pseudonymous device identifier, the approval status and the associated timestamps. The owner of the game URL can accept or reject the request and revoke an approval granted. After approval, participants can play together and exchange text and voice messages. To establish the connection, TouBot processes the assignment to the game room and the technical connection details of the devices, including IP addresses. For billing, TouBot processes the start and end of the periods during which at least two devices have the game open, the number of devices connected and the credits charged.

Moves and text and voice messages are transmitted over a WebRTC connection between the participants’ browsers. This connection is always encrypted (DTLS). The browsers involved negotiate the key anew for each connection; TouBot does not receive it. TouBot therefore cannot read the content and does not store it on its servers. Newly approved participants do not receive messages sent before their approval. The chat history is stored unencrypted in the browser storage of each device involved so that it is retained after reloading. The browser keeps the data of each website separate; other websites cannot read this storage. However, anyone using the device with the same browser can read the history. Each participant can delete the history on their device in the game room; deletion takes effect only on their own device. The owner of the game URL can also delete the history on all devices currently connected. On shared devices, a private browser window is recommended: the history is deleted there when the window is closed. Display names and the approval, connection and billing data referred to in paragraph 1 are not end-to-end encrypted. Recipients can store or pass on content outside TouBot.

With a direct connection, the other participants’ devices technically receive the IP address of your device and vice versa. The other participants of the game room are therefore also recipients of this information. If no direct connection is possible, a TouBot TURN server relays the encrypted data without being able to read it. The TURN server processes the participants’ IP addresses, a pseudonymous device identifier, the time and duration of the connection and the amount of data transferred. This information is stored in its log and deleted after seven days.

A TouBot server arranges the connection over a WebSocket connection; no message content passes through it. So that a game can continue after a lost connection or a reload, it stores the game setup: the seats with the display names of the players and profiles, the assignment of devices to seats and seat changes. It does not store moves between several devices; if only one device plays against profiles, it also stores that device's moves. This information is deleted seven days after the last change.

The processing serves to provide and secure the game room set up by the owner of the game URL, including chat, and the time-based credit billing. The legal basis is Art. 6(1)(b) GDPR insofar as the processing is necessary for the performance of the contract. For invited participants, Art. 6(1)(b) GDPR also applies: before joining, they are referred to the Terms of Service, and joining concludes a free user contract. In the alternative, the legal basis is Art. 6(1)(f) GDPR; the legitimate interest is providing the shared game to which they were invited. The TURN server log is based on Art. 6(1)(f) GDPR; the legitimate interest is secure and trouble-free operation and the investigation of failed or abusive connections. Storing the chat history in the browser storage is strictly necessary for the service requested by the user (Section 25(2) no. 2 of the German Telecommunications Digital Services Data Protection Act, TDDDG).

Message content is not stored on TouBot servers. The chat history in the browser is retained until the participant deletes it in the game room or via the browser data. Connection details for establishing and relaying the connection are removed when the connection ends or during technical clean-up; the TURN server log after seven days and the game setup seven days after the last change. The approval status with display name, pseudonymous device identifier and time of approval remains until the owner revokes the approval, renews the game URL or the associated user account is deleted. Billing data may be stored beyond this insofar as necessary for account management, prevention of abuse or compliance with statutory documentation obligations.

9. Purchases, Credits, Invoices and Mollie

When an order is placed, TouBot processes in particular the user account, product or plan, amount, currency, status, time of purchase, email address and – where required for the invoice or contract – name, address and VAT ID.

For payment processing, the necessary data is transmitted to Mollie B.V., Keizersgracht 313, 1016 EE Amsterdam, Netherlands. Payment instrument data is generally processed by Mollie and the payment institutions involved. The legal basis is Art. 6(1)(b) GDPR; accounting and tax data required by law is stored in accordance with Art. 6(1)(c) GDPR. Information from Mollie: https://www.mollie.com/en/privacy.

10. Sending Emails and Recipients

For registration, security, order processing and other requested notifications, TouBot processes the email address, content, delivery status and error logs. Any later sending of stories or AI content is processed exclusively within the optional offering and described in its supplementary privacy information.

The legal basis is Art. 6(1)(b) GDPR. For voluntary notifications or advertising, Art. 6(1)(a) GDPR applies. Technical delivery logs may be based on Art. 6(1)(f) GDPR. Users may enter recipients only if they are entitled to use the address and send the content.

Emails are sent via the configured hosting or SMTP service provider. The provider used and the storage location are recorded in the internal processing documentation.

11. Optional Delivery via Telegram

A connection to Telegram is not part of the general game and account functions. If it is offered later for a story or AI plan, the supplementary privacy information provided with the offering applies. Data is transmitted only when the user initiates the connection or delivery themselves.

Telegram processes data under its own terms and, where applicable, outside the European Economic Area. Information: https://telegram.org/privacy. Users must be entitled to use the target chat or channel and to publish the content.

12. Optional YouTube Connection and Video Upload

A connection to YouTube is not part of the general game and account functions. If it is offered later for a story or AI plan, the supplementary privacy information provided with the offering applies. Data is transmitted only when the user connects their account or initiates an upload themselves.

Processing takes place at the user’s request to perform the function in accordance with Art. 6(1)(b) GDPR. The connection can be disconnected and the authorisation additionally revoked in the Google account. Google/YouTube processes the transmitted data under its own terms: Google Privacy Policy and YouTube Terms of Service.

With embedded YouTube videos, the IP address, device and usage data may be transmitted to Google/YouTube. Embeddings and cookies that are not technically necessary may be activated only after consent in accordance with Section 25(1) TDDDG and Art. 6(1)(a) GDPR.

13. Push Notifications

If users activate browser push messages, the push endpoint, public keys, browser information and notification settings are processed. Processing is based on consent in accordance with Art. 6(1)(a) GDPR. Consent can be withdrawn in the browser or TouBot settings. Depending on the browser, its push service and platform provider are technically involved.

14. Newsletter and Other Advertising

Newsletters or promotional emails are sent only with corresponding consent. The email address, time of subscription and confirmation, and delivery and unsubscription information are processed. The legal basis is Art. 6(1)(a) GDPR. After unsubscription, a minimal suppression list may be stored on the basis of Art. 6(1)(f) GDPR to prevent further mailings.

15. Cookies, Local Storage and Consent Management

TouBot uses cookies and local browser storage. These include in particular:

• necessary session, login, security and CSRF cookies;
• the cookie `cookie_consent` to store the consent selection;
• local settings for language, display, text size or colour scheme;
• in the game room, the chat history, the display name and a pseudonymous device identifier (see Section 8.1);
• after consent, marketing and measurement data, in particular for Google Ads.

Technically necessary access to the end device takes place in accordance with Section 25(2) TDDDG. Subsequent processing is based, depending on the purpose, on Art. 6(1)(b) or (f) GDPR. Cookies or comparable technologies that are not necessary are activated only after consent in accordance with Section 25(1) TDDDG and Art. 6(1)(a) GDPR.

The selection can be changed at any time via the cookie settings. Data already stored in the browser can also be deleted there.

16. Google Ads and Campaign Attribution

TouBot uses Google Ads to measure registrations or purchases if marketing consent has been given. Cookie and device identifiers, IP address, pages visited, times and events may be transmitted to Google. TouBot may also assign campaign parameters such as GCLID, GBRAID, WBRAID, UTM source, campaign, ad or device parameters to the user account, provided valid consent has been given.

After marketing consent has been given, TouBot also measures internally, without storing the IP address or user agent, which pages are visited within a campaign visit and how long each page is actively visible. The sequence of pages is assigned to a random campaign visit identifier and ends after 30 minutes without activity. URL query parameters are not stored. The processing serves to evaluate and optimise our own campaigns and is based on consent in accordance with Art. 6(1)(a) GDPR; it can be withdrawn at any time with effect for the future via the cookie settings.

The legal bases are Section 25(1) TDDDG and Art. 6(1)(a) GDPR. Consent can be withdrawn at any time via the cookie settings. Information from Google: https://policies.google.com/privacy.

17. External Resources and Bot Protection

Depending on the page, TouBot loads program and design files via jsDelivr and uses ALTCHA for bot protection. When external resources are retrieved, the respective CDN provider technically receives in particular the IP address, time, requested file, referrer and browser and device information. ALTCHA challenges serve to prevent automated registrations and requests.

The security check itself is based on Art. 6(1)(f) GDPR. Where external resources are not technically necessary or store information on the end device, prior consent is required. Which resources are delivered locally and which via third parties is checked technically on a regular basis.

18. Reporting System for Illegal Content

For reports of allegedly illegal or terrorist content, TouBot processes the contact, content and justification data provided by the reporting person as well as processing and decision information. The legal basis is Art. 6(1)(c) GDPR in conjunction with the applicable legal obligations, in particular Regulation (EU) 2022/2065 and, where applicable, Regulation (EU) 2021/784. Where there is no legal obligation, Art. 6(1)(f) GDPR may cover the handling of legal and security-related reports.

19. Categories of Recipients

Personal data may be transmitted – in each case only to the extent necessary – to the following categories:

• hosting, database, storage, CDN, security and email service providers;
• for a separately activated story or AI function, the providers of text, image, audio, video and upscaling models named in its supplementary privacy information;
• payment service providers, banks and tax and invoicing service providers;
• YouTube/Google, Telegram and browser push services where their use is activated;
• recipients, group members and the public where sharing is initiated by the user;
• authorities, courts or other bodies where there is a legal obligation;
• professional advisers and technical support providers where necessary and subject to confidentiality obligations.

A current list of the processors actually used in production should be kept in addition and updated in the event of material changes.

20. Transfers to Third Countries

Some AI, platform, analytics or infrastructure providers may process data in countries outside the EU and the European Economic Area, in particular in the USA. A transfer takes place only if the requirements of Art. 44 et seq. GDPR are met, for example on the basis of an adequacy decision for the specific recipient, appropriate standard contractual clauses and additional safeguards, or a statutory exception.

The mere existence of the EU-US Data Privacy Framework is not sufficient; what matters, among other things, is whether the specific recipient is effectively certified. The transfer basis of each provider used in production must be checked before use and regularly thereafter.

21. Retention Period

TouBot does not store data for longer than necessary for the respective purpose. The following criteria are particularly relevant:

Data category	Intended period or criterion
Account and profile data	Until the account is deleted or the contract ends, thereafter only where required by law or for legal defence
Encrypted answer sheets and unencrypted game profiles	Until deleted by the user or until the account is deleted, unless there is a retention obligation
Data of a later story or AI function	In accordance with the supplementary privacy information provided with the respective offering
Server and security logs	Only for as long as necessary for the respective purpose; longer storage only in the event of security incidents or legal proceedings
Shared game rooms	Message content is not stored on the server; chat history in the browser until deleted by the participant; connection details until the connection ends; TURN server log seven days; game setup seven days after the last change; approval status and billing data in accordance with Section 8.1
Payment, invoice and tax data	In accordance with the applicable commercial and tax retention periods
OAuth and connection tokens	Until disconnection, revocation or account deletion; backups according to the technical deletion cycle
Records of consent	For the duration of use and thereafter for the duration of possible evidence and limitation periods

Deleted data may remain in backups until the end of a documented backup cycle and is no longer used productively there.

22. Security

TouBot uses appropriate technical and organisational measures to protect data against loss, alteration and unauthorised access. These include in particular encrypted transmission, access restrictions, separate storage areas, hashed passwords and – for YouTube – encrypted refresh tokens. No internet-based service can guarantee absolute security.

23. Automated Decisions

Automatic credit calculations, abuse detection and technical job control serve to provide and secure the service. According to the reviewed status, no decisions based solely on automated processing are made that produce legal effects concerning users or similarly significantly affect them. Should this change, the information and safeguards required under Art. 22 GDPR will be provided.

24. Data of Children and Young People

TouBot is not specifically aimed at children. Minors may use third parties’ personal data, images or voices only with the necessary consents.

25. Rights of Data Subjects

Subject to the statutory requirements, data subjects have in particular the right to:

• access in accordance with Art. 15 GDPR;
• rectification in accordance with Art. 16 GDPR;
• erasure in accordance with Art. 17 GDPR;
• restriction of processing in accordance with Art. 18 GDPR;
• data portability in accordance with Art. 20 GDPR;
• object in accordance with Art. 21 GDPR;
• withdraw consent with effect for the future in accordance with Art. 7(3) GDPR;
• lodge a complaint with a data protection supervisory authority in accordance with Art. 77 GDPR.

TouBot provides an export function for account content. Further requests can be sent to baumann@toubot.de. Suitable proof of identity may be requested to prevent unauthorised disclosure.

Right to Object

Where processing is based on Art. 6(1)(f) GDPR, you may object at any time on grounds relating to your particular situation. In the case of direct marketing, you may object at any time without giving any particular reason.

26. Competent Supervisory Authority

A complaint may in particular be addressed to:

Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg, Heilbronner Straße 35, 70191 Stuttgart, Germany. Website: https://www.baden-wuerttemberg.datenschutz.de/

Data subjects may also contact another supervisory authority competent under Art. 77 GDPR.

27. Changes to This Privacy Policy

This Privacy Policy is updated when functions, providers or the legal situation change. The current version is published on TouBot. In the event of material changes requiring renewed consent, this will be obtained separately.

Version: 23 October 2026