Privacy policy

Last updated: 8 October 2026

This policy explains how Innofully GmbH processes personal data on the IdeaHone website, in the early-access list and in the IdeaHone application. It follows Articles 13 and 14 of the General Data Protection Regulation (GDPR).

1. Who is responsible

Innofully GmbH, Vogesenstraße 4, 13129 Berlin, Germany. Managing director: Adalberto Pérez Salas.

Contact for data protection: privacy (at) innofully.com

Data protection officer: dpo (at) innofully.com, or by post to the address above

2. Our role

  • Website, early-access list and user accounts: we decide how and why this data is processed, so we are the controller.
  • Content of workshops and sessions: organisations use IdeaHone for their own workshops. The organisation decides who takes part and what is recorded, so it is the controller of that content and we process it on its behalf (Art. 28 GDPR, data processing agreement). If you took part in a session, the organisation that ran it is your first point of contact. We support it in answering your request.

3. Visiting the website

  • Server logs: when you open a page, our host stores your IP address, date and time, the requested address, the referring page and your browser's user agent. We need this to deliver the site and to detect attacks. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in a secure and working website). The logs are deleted after [7] days.
  • No advertising: we use no advertising and no social media plugins. Fonts and design files are served from our own server, nothing is loaded from Google Fonts.
  • Web analytics, only with your consent: on the public pages (start page, legal pages, sign-in) we use Google Analytics 4 by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, if you click "Accept" in the cookie banner. It stores cookies (_ga, _ga_<ID>, up to 13 months) and sends Google your device and browser details, a shortened IP address, the pages you view, where you came from and actions such as opening or sending the early-access form. Google may process this data in the USA (EU-US Data Privacy Framework, see section 12). Google signals and advertising features are switched off. We keep analytics data for 14 months. Inside the app (boards, sessions, participant and share links) nothing is measured. Legal basis: your consent, Art. 6(1)(a) GDPR and § 25(1) TDDDG. You can withdraw it at any time under "Cookie settings" at the bottom of the page; the cookies are then deleted. If your browser sends the Global Privacy Control signal, we treat this as a refusal.
  • Storage in your browser: see section 13.

4. Early-access list

  • Data: email address, and optionally your name, company and planned use, plus your language, the time of the request and your IP address.
  • Purpose: to contact you personally about early access to IdeaHone. We do not send newsletters and do not pass your address on.
  • Legal basis: your consent, Art. 6(1)(a) GDPR. You can withdraw it at any time by email to privacy (at) innofully.com; we then delete your entry. The IP address is used to block automated mass sign-ups, Art. 6(1)(f) GDPR.
  • Internal notice: each new request is sent by email to our administrators.
  • Retention: until you withdraw, at the latest 12 months after your request. The IP address is removed after 30 days.

5. User accounts

  • Data: name, email address, password (stored only as a secure hash), language, role, organisation membership, sign-in times and the IP address of security-relevant actions.
  • Purpose and legal basis: providing the service you or your organisation signed up for, Art. 6(1)(b) GDPR. Protection against misuse (failed sign-ins, rate limits, security log), Art. 6(1)(f) GDPR.
  • Session cookie: after sign-in we set one cookie that keeps you signed in. It is strictly necessary and is removed when you sign out or after a period of inactivity.

6. Workshops and sessions

  • Data: what is said while someone has pressed "Start listening", as text (transcript), the cards, summaries, scores and decisions derived from it, the names and optionally the organisation of participants, who said what and how long each person spoke, and documents the organisation adds as background.
  • Audio: raw audio is not stored. It is turned into text and discarded.
  • Who decides: the organisation running the session (see section 2). It must inform participants before it starts listening; IdeaHone asks the facilitator to confirm this before the first recording of each session.
  • Retention: as long as the organisation keeps the session. Organisations can set an automatic deletion period for transcripts and can delete sessions, spaces or their whole organisation at any time.

7. Taking part through a participant link

  • Data: the name and optional organisation you enter, an optional voice profile (section 8), the cards you add on the board, and your IP address.
  • Purpose: to show you in the session, to credit your contributions to you and to protect the link from misuse.
  • Legal basis: processing on behalf of the organisation running the session (section 2). The IP address is kept for one day for rate limiting.
  • In your browser: your name and a technical key are kept in the browser tab (sessionStorage) so you can add cards without joining again. They are gone when you close the tab.

8. Voice profiles (biometric data)

  • What: optionally, IdeaHone computes a voice profile from about 10 seconds of reading. It is a set of numbers that describes your voice; it does not contain a recording. It is used only to recognise who is speaking in sessions of your organisation.
  • Legal basis: your explicit consent, Art. 9(2)(a) GDPR. Without it, no profile is stored.
  • While listening: to tell speakers apart, the browser of the person running the session computes such numbers for every spoken line and compares them with the stored profiles. For people without a profile, these numbers stay in that browser's memory for the session only and are not stored.
  • Withdrawal: you can withdraw your consent at any time, in your profile or through the organisation or privacy (at) innofully.com. The profile is then deleted. Withdrawal does not affect processing that took place before.

9. Speech recognition

The organisation chooses one of two engines. Local transcription is the default.

  • Chrome speech recognition: the audio is sent from the browser to Google's speech service (Google LLC, USA, or its affiliates) and comes back as text. Google processes it under its own terms; we have no access to it. Transfer to the USA: see section 12.
  • Local transcription (Whisper): the audio is converted to text inside the browser. No audio leaves the device.

10. AI features

  • What is sent: to create cards, summaries and pre-scores, excerpts of the transcript, board content and background documents are sent to the AI provider the organisation has chosen. Depending on the setting this is OpenRouter Inc. (USA), which forwards the request to the selected model provider, Anthropic PBC (USA) or OpenAI (USA). With the "local model" setting, no text leaves the browser.
  • Use: we choose providers and settings under which content is not used to train models, where the provider offers this.
  • Legal basis: processing on behalf of the organisation (section 2).
  • No automated decisions: AI suggestions and scores are proposals. People decide; there is no decision based solely on automated processing within the meaning of Art. 22 GDPR.

11. Other service providers

  • Hosting: STRATO GmbH, Pascalstraße 10, 10587 Berlin, Germany, with a data processing agreement. Our servers are located in Germany.
  • Email: service emails (invitations, password reset, notices) are sent through the mail server of our host STRATO GmbH.
  • Code and model files: for voice recognition, local transcription and the local AI model, the browser loads program libraries and model files from jsDelivr (cdn.jsdelivr.net) and Hugging Face (huggingface.co, Hugging Face Inc., USA). These providers see your IP address and browser details. Legal basis: Art. 6(1)(f) GDPR (providing these functions without running our own download servers for large files).

12. Transfers outside the EU

Some providers in sections 3 and 9 to 11 are based in the USA or transfer data there. Transfers rely on the EU-US Data Privacy Framework where the provider is certified, and otherwise on the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR). You can request a copy of the safeguards at privacy (at) innofully.com.

13. Storage in your browser

  • Session cookie after sign-in (section 5).
  • Local storage: your language, light or dark mode, the chosen speech engine and the focus view of the board.
  • Session storage: the participant key from section 7.
  • Your cookie choice (accepted or rejected, with the date), so we do not ask again.

These entries only provide functions you asked for and are strictly necessary within the meaning of § 25(2) no. 2 TDDDG. Analytics cookies are only set with your consent (section 3). We set no advertising cookies.

14. How long we keep data

  • Server logs: [7] days.
  • Google Analytics data: 14 months; cookies up to 13 months.
  • Rate-limit records (IP address): 1 day.
  • Security log: the IP address is removed after 12 months.
  • Accounts: until the account or organisation is deleted.
  • Session content: as set by the organisation (section 6).
  • Voice profiles: until consent is withdrawn or the person is deleted.
  • Early-access list: section 4.
  • Backups: up to [30] days, then overwritten.

Longer retention only applies where the law requires it (for example tax rules for invoices).

15. Your rights

You have the right to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to withdraw consent at any time with effect for the future (Art. 7(3)).

Right to object (Art. 21 GDPR): where we process data on the basis of legitimate interests (Art. 6(1)(f)), you can object at any time for reasons arising from your particular situation. We then stop unless we can show compelling legitimate grounds.

Send requests to privacy (at) innofully.com. For session content, we forward requests to the organisation responsible.

You also have the right to lodge a complaint with a supervisory authority, for example the authority responsible for us: Berliner Beauftragte für Datenschutz und Informationsfreiheit, Alt-Moabit 59-61, 10555 Berlin.

16. Do you have to provide data?

Using the website requires none. An account needs a name and an email address. Joining a session needs a name. A voice profile is always optional.

17. Children

IdeaHone is a tool for organisations and is not aimed at children. If you are under 16, please do not create a voice profile.

18. Changes

We update this policy when the service or the law changes. The current version is always available on this page, with its date at the top.