Data protection · Datenschutz

Privacy Policy

Effective date: [date of publication] · Version 1.0 · Your Digital Innovation GmbH

1. Who We Are

Your Digital Innovation GmbH ("YDI", "we", "us", "our") is the data controller responsible for the processing of personal data in connection with the ReachYourGoal.AI app (the "Service"), including its Free, Pro, B2B and City Editions.

Contact:

Your Digital Innovation GmbH
Radnitzkygasse 25, 1100 Vienna, Austria
Managing Director: Jürgen Gutmayer
Email: jg@yourdigitalinnovation.com
Data Protection Officer (if appointed): jg@yourdigitalinnovation.com

If you are a Member of a B2B or City workspace, your employer, municipality or other organization (the "Organization") acts as the data controller for its internal purposes, and YDI acts as processor on its behalf. That relationship is governed by a Data Processing Agreement ("DPA").

2. Scope of This Policy

This Privacy Policy applies to personal data we collect when you use ReachYourGoal.AI across all Editions and channels (mobile apps, web app, websites, support). It applies worldwide, with additional local rules where required.

3. Personal Data We Collect

3.1 Data You Provide

Account data: name, email, password (hashed), profile picture, preferences.
Content data: course progress (Day 1 to 30 completion), check-question answers, streaks, community posts and comments, buddy interactions, Community Credit balance and earning history, tool ratings, favorites and notes you create in the App.
Payment data: billing address, VAT number, invoice details for the one-time purchase of the 30-day training program (€ 19 App Store / discounted per-seat pricing for Business and City Editions) as well as any optional Community Credit packages. Full card details are handled by our payment processors.
Communications: messages you send to support, feedback and survey responses.

3.2 Data We Collect Automatically

Usage data: screens viewed, actions taken, day-in-program, streak status, features used.
Device data: device model, operating system, language, time zone, app version, crash logs, IP address.
Diagnostics: performance and error data, aggregate reliability metrics.

3.3 Data from Third Parties

Sign-in providers: if you use Apple / Google / SSO to log in.
Organization Admins: for B2B and City Editions, your Organization may provide your name, email and role to provision your Account.

3.4 Special Categories

ReachYourGoal.AI is not intended for the collection of special categories of personal data (health, religion, political opinions, etc.). Please do not enter such data into your community posts, notes or inputs.

4. How We Use Your Data

We use personal data for the following purposes:

4.1 Providing the Service

creating and managing your Account and Edition;
delivering the 30-day curriculum, evaluating check-question answers, tracking progress and streaks, providing tool ratings and community features (with Credit-based participation);
processing your inputs through AI models where the curriculum interacts with third-party AI tools (e.g., to demonstrate prompts, evaluate answers).

4.2 Payments and Billing

handling one-time purchases of the 30-day training program, per-seat B2B and City license fees, optional Community Credit packages, invoices, taxes and cashback/buddy rewards;
preventing fraud and abuse of promotional programs.

4.3 Communication

sending transactional messages (verifications, receipts, service notices);
with your consent or where permitted by law, sending product updates or marketing.

4.4 Safety, Security and Compliance

securing our systems, detecting fraud and abuse;
complying with legal obligations, responding to lawful requests.

4.5 Improvement, Analytics, AI

understanding aggregated usage patterns to improve the Service;
training and evaluating internal quality models on aggregated and de-identified data. We do not use your Content to train third-party foundation models unless you have given us explicit, informed consent.

4.6 B2B / City Programs

providing Organization Admins with dashboards, analytics and administrative controls in accordance with the DPA.
For B2B: enabling employers to set and track work-related learning goals and KPIs, within the boundaries of applicable employment and works-council law.
For City: enabling municipalities to onboard citizens into KI-training programs, with anonymized aggregate reporting for public-administration purposes.

5. Legal Bases for Processing

Where the GDPR (or an equivalent law such as UK GDPR, Swiss FADP) applies, our legal bases are:

Performance of a contract (Art. 6 (1) (b) GDPR): to provide the Service, deliver your one-time-purchased training program, and administer any B2B / City license or Community Credit balance.
Consent (Art. 6 (1) (a) GDPR): for optional features (e.g., non-essential cookies, marketing, sensitive data where required).
Legitimate interests (Art. 6 (1) (f) GDPR): to secure the Service, prevent fraud, improve product quality, and communicate with existing customers. You may object at any time.
Legal obligation (Art. 6 (1) (c) GDPR): to comply with tax, accounting, consumer-protection and law-enforcement duties.

For B2B/City Members, YDI acts as processor. The Organization is responsible for identifying its own legal basis and informing its Members.

6. How We Share Data

We share personal data with:

6.1 Sub-processors

Trusted service providers acting on our behalf under contract, including:

Cloud infrastructure: for hosting the Service (in the EU where possible).
AI providers: including Anthropic (Claude) and other model providers for AI features. Prompts and outputs may be transmitted to these providers to generate responses. Providers are contractually restricted from using your data to train their models.
Payment processors: for handling subscriptions and payouts.
Email and messaging providers: for transactional and, with consent, marketing messages.
Analytics and error-tracking providers: in a privacy-preserving configuration.

An up-to-date list of sub-processors is available on request at jg@yourdigitalinnovation.com.

6.2 Organization Admins (B2B / City)

If you use a B2B or City Edition, your Organization Admin may see your account, activity within the Organization workspace, and goal completion. Personal notes marked as private remain private to you.

6.3 Legal Requests

We may disclose data where required by law, court order or lawful request. We will push back on overbroad requests and inform you where legally permitted.

6.4 Business Transfers

If YDI is involved in a merger, acquisition or sale of assets, personal data may be transferred to the successor subject to this Policy.

7. International Data Transfers

ReachYourGoal.AI is a worldwide service. Personal data may be transferred to, and processed in, countries outside your jurisdiction, including outside the EEA. When we transfer personal data outside the EEA, we rely on appropriate safeguards, including:

Adequacy decisions of the European Commission;
Standard Contractual Clauses (SCCs) approved by the European Commission;
Supplementary technical, contractual and organizational measures where necessary.

8. Data Retention

We retain personal data only as long as necessary for the purposes described:

Account data: for the life of your Account and up to 6 months after deletion to handle disputes.
Content and progress data (including Community Credit balance and certificates): for the life of your Account; you can delete individual entries at any time. Certificates are retained also as documentation under Art. 4 EU AI Act (KI-Kompetenz) unless you specifically request deletion.
Invoices and tax records: for the legal retention period (typically 7-10 years, depending on jurisdiction).
Support communications: for up to 3 years.
Aggregated / de-identified analytics: may be retained without a time limit as it is no longer personal data.

For B2B/City workspaces, retention periods are governed by the Organization's instructions and the DPA.

9. Security

We apply technical and organizational measures appropriate to the risk, including encryption in transit, encryption at rest for sensitive fields, hashed credentials, access controls, logging, backups and regular reviews. Despite our efforts, no system is 100% secure. Please help us keep your Account safe by using strong credentials and enabling multi-factor authentication where offered.

10. Your Rights

Depending on your jurisdiction, you have the following rights regarding your personal data:

10.1 Under the GDPR / UK GDPR / Swiss FADP

Right of access to your data;
Right to rectification of inaccurate data;
Right to erasure ("right to be forgotten");
Right to restriction of processing;
Right to data portability;
Right to object to processing based on legitimate interests or direct marketing;
Right to withdraw consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal;
Right to lodge a complaint with a supervisory authority (e.g., the Austrian Data Protection Authority, https://www.dsb.gv.at).

10.2 Under U.S. Laws (CCPA / CPRA and similar)

California residents and residents of other U.S. states with equivalent laws have rights to know, delete, correct and receive a copy of personal data, and to opt out of the "sale" or "sharing" of personal information. We do not sell personal information as defined by these laws.

10.3 Under Other Laws

Users in Brazil (LGPD), Canada (PIPEDA), Japan (APPI), South Korea (PIPA), Australia (Privacy Act) and other jurisdictions may have equivalent or additional rights. We honour these rights where they apply.

10.4 Exercising Your Rights

You can manage most data directly in the App (e.g., "Export your data, Download as JSON", "Sign out", account deletion). For other requests contact jg@yourdigitalinnovation.com. We may need to verify your identity before processing a request. We respond within the time frames required by applicable law (typically 30 days under the GDPR, extendable by 60 days for complex requests).

11. Children

The Service is not directed to children under 16. We do not knowingly collect data from children under 16 without verified parental consent. If we learn that we have collected such data, we will delete it. Parents or guardians who believe their child has provided us with personal data may contact jg@yourdigitalinnovation.com.

12. Cookies, SDKs and Similar Technologies

We use cookies, local storage and mobile SDKs to operate the Service, remember your preferences, understand aggregated usage and support security. Non-essential cookies and tracking technologies are only set with your consent (via our cookie banner where applicable). You can withdraw consent at any time in the App or your browser settings.

13. Automated Decision-Making

ReachYourGoal.AI shows curriculum content and evaluates check-question answers automatically. These evaluations are for learning feedback and certification purposes. Certificate data serves as documentation under Art. 4 EU AI Act. They are advisory in nature and do not produce legal or similarly significant effects on you without meaningful human involvement. We do not use automated decision-making within the meaning of Art. 22 GDPR that produces legal effects without your explicit consent or contract-necessary use.

14. AI-Tool Interactions

ReachYourGoal.AI teaches you how to use third-party AI tools (ChatGPT, Claude, Perplexity, and others). When you engage with these tools from within the App, your prompts may be processed by the respective third-party providers under their own privacy policies. We link out clearly and mark affiliate links. Your account and progress data remain on our EU-hosted servers. You can control whether to keep, delete or export voice recordings and transcripts in your Account settings. Where required by law, we ask for your consent before processing voice data.

15. Third-Party Links and Services

The Service may reference or link to third-party sites, apps and integrations (e.g., calendar providers, sign-in providers, AI tool listings). Those are governed by their own privacy policies. We are not responsible for their practices.

16. Data Breach Notification

In case of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the competent supervisory authority within 72 hours where feasible, and inform affected Users without undue delay where the breach is likely to result in a high risk, in accordance with Art. 33 and 34 GDPR and equivalent laws.

17. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you through the App or by email at least fourteen (14) days before they take effect. The "Effective Date" at the top reflects the latest version. Prior versions are archived and available on request.

18. Contact

Questions about this Policy or your personal data?

Your Digital Innovation GmbH

Radnitzkygasse 25, 1100 Vienna, Austria

Email: jg@yourdigitalinnovation.com

Data Protection Officer (if appointed): jg@yourdigitalinnovation.com

EU Representative under Art. 27 GDPR (if applicable): [Name and address of representative]

UK Representative under UK GDPR (if applicable): [Name and address of representative]