Privacy

1. Controller

The controller for this site is:

[FULL NAME]
Commaton
[STREET AND NUMBER]
69120 Heidelberg
Germany
Email: contact@commaton.com

We have not appointed a Data Protection Officer.

2. What we process and why

We keep data collection to a minimum. We do not use analytics, advertising, tracking pixels, or third-party web fonts. The specific processing activities are described below: account login (section 3), the homepage globe (section 4), server logs (section 5), and — if you take part in one of our research interviews — AI-conducted voice interviews (section 6).

3. Account login (email address)

If you sign in, we process the email address you enter to send you a one-time magic link and to authenticate your session. Login is restricted to existing accounts; we do not create new accounts from the login form.

• Purpose: authenticating you and maintaining your logged-in session.
• Legal basis: performance of a contract or pre-contractual measures (Art. 6(1)(b) GDPR), or our legitimate interest in securing access (Art. 6(1)(f) GDPR).
• Processors: Supabase, used as our authentication backend on an EU-hosted project (Paris, France); and Resend, used to deliver the login email (delivery infrastructure located in the EU, Ireland).
• Retention: for the lifetime of your account; session cookies expire on logout or when the session times out.

Providing your email is required to log in. If you do not provide it, you cannot access the logged-in areas of the site, but you can still use the public pages.

4. Location of the homepage globe

On the homepage, we derive an approximate location (latitude, longitude, and city) from your IP address to centre the globe near you. This is done on our server for that request only: the location is not stored on your device and not kept afterwards, and is not used to identify you, profile you, or track you across sites.

• Purpose: displaying the homepage globe centred on your approximate location.
• Legal basis: our legitimate interest in providing this site feature (Art. 6(1)(f) GDPR).
• Retention:none — the location is computed transiently per request and not stored.

5. Server logs

When you access the site, our hosting provider automatically processes connection data such as your IP address, the requested page, and timestamps, in order to deliver the site and to keep it secure and operational.

• Legal basis: our legitimate interest in the secure and reliable operation of the site (Art. 6(1)(f) GDPR).
• Processor: Vercel Inc., our hosting and edge provider.
• Retention: retained by our hosting provider for the period needed for operation and security.

6. AI-conducted voice interviews

If you take part in one of our research interviews, we process the audio recording of the conversation and its written transcript. The interview is conducted by an automated AI interviewer; no other person takes part in the conversation. Because the interview covers your life experiences and personal views, the recording and transcript may contain special categories of personal data within the meaning of Art. 9 GDPR — for example information about your health, political opinions, religious or philosophical beliefs, or racial or ethnic origin — to the extent you choose to share it.

• Purpose: conducting and analysing the research interview and building the resulting research dataset. [CONFIRM whether the dataset is shared with third-party researchers, and whether it is anonymised first.]
• Legal basis: your consent (Art. 6(1)(a) GDPR) and, for any special-category data contained in your answers, your explicit consent (Art. 9(2)(a) GDPR). You give this consent on the interview page before the recording begins, and you can withdraw it at any time with future effect (see section 10).
• Voluntary: participation is entirely voluntary. You may decline to answer any question and may end the interview at any time using the control on screen.
• Processors:ElevenLabs (speech-to-text, the interviewer’s synthesised voice, and processing/recording of the conversation audio); Anthropic (the Claude AI model that conducts the interview and receives the conversation text to ask follow-up questions); Supabase (storage of the recording and transcript on our EU-hosted project, Paris, France); and Vercel Inc. (hosting and delivery of the interview page). ElevenLabs and Anthropic are US-based companies (see section 9).
• Retention: we keep interview recordings and transcripts for as long as they are needed for the research, which may be indefinitely. This long-term storage for scientific research purposes relies on Art. 5(1)(e) in conjunction with Art. 89(1) GDPR together with appropriate safeguards. You can withdraw your consent or request erasure at any time (see section 10).
• Automated processing: the interview is conducted by an AI, but it does not make any decision about you that produces legal or similarly significant effects within the meaning of Art. 22 GDPR.

7. Cookies

We use only one cookie, which is strictly necessary. We set no analytics, advertising, or other non-essential cookies, so the site needs no consent banner.

8. Recipients and processors

We share personal data only with service providers acting as processors on our behalf under a data processing agreement:

• Supabase— authentication and account storage, and storage of interview recordings and transcripts, hosted in the EU (Paris, France).
• Vercel Inc.— hosting, edge delivery, and IP-based geolocation.
• Resend— delivery of the login (magic-link) email; delivery infrastructure located in the EU (Ireland).
• ElevenLabs— for research interviews: speech-to-text, the interviewer’s synthesised voice, and processing/recording of the conversation audio (US-based company).
• Anthropic— for research interviews: the Claude AI model that conducts the interview (US-based company).

9. International data transfers

Account and authentication data is stored within the EU, and the login email is delivered through infrastructure located in the EU (Ireland). Some of our processors are companies based in the United States — Vercel Inc. (hosting and edge geolocation) and Resend (email delivery) — so operating the site may involve transfers of personal data (such as your IP address or email address) to the USA. In addition, if you take part in a research interview, your interview audio and transcript are processed by ElevenLabs and Anthropic, both US-based companies, which may involve transfers of personal data — including special-category data — to the USA. Such transfers are safeguarded by the EU Standard Contractual Clauses and/or the EU–US Data Privacy Framework, providing an adequate level of protection under Art. 46 GDPR.

10. Your rights

Under the GDPR, you have the right to:

• access your personal data (Art. 15);
• have inaccurate data rectified (Art. 16);
• have your data erased (Art. 17);
• restrict processing (Art. 18);
• data portability (Art. 20);
• object to processing based on legitimate interest (Art. 21); and
• withdraw any consent at any time, with future effect (Art. 7(3)).

To exercise any of these rights, contact us at contact@commaton.com.

11. Right to lodge a complaint

You have the right to lodge a complaint with a data protection supervisory authority, in particular in the EU member state of your residence, place of work, or the place of the alleged infringement. The authority competent for us is the State Commissioner for Data Protection and Freedom of Information of Baden-Württemberg (Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg, LfDI).

12. Automated decision-making

We do not use automated decision-making or profiling within the meaning of Art. 22 GDPR.

13. Changes to this policy

We may update this policy to reflect changes to the site or to legal requirements. The current version is always available on this page.