Effective date: September 10, 2026

1. Who is responsible for your data
LERNZONE GmbH is the controller of the personal data processed in Kata Dojo AI (“Denise”, “the App”).

LERNZONE GmbH,

Finkenweg 13,

73035 Göppingen,

Germany.

 

Amtsgericht Ulm,

HRB 732140.

Managing Director: Tilo Schwarz.

Email support@lernzone.com,

telephone +49 7161 1589690.

We have not appointed a Data Protection Officer, as we are not required to. Privacy questions go to support@lernzone.com.

2. What we collect

•  Account information — your name and email address

• What you write and receive — the content of your coaching conversations, and any files you upload.

• Usage and device data — IP address, device and browser information, which features you use, performance metrics and logs.

• Subscription status — whether your account is trialing, active or cancelled. We never see or store your card details.

 

Please do not enter sensitive or confidential information. Denise is designed for your own working situations, not for health information, information about identifiable third parties, or material your employer or institution treats as confidential. We do not ask for it and we do not need it. Because you type freely, we cannot prevent it technically — this is a request, not a filter.

3. Why we process it, and on what legal basis

• Providing the App, your account and your coaching conversations — performance of a contract, Art. 6(1)(b) GDPR.

• Support, troubleshooting and service messages — performance of a contract, Art. 6(1)(b).

• Keeping the service secure and preventing abuse — legitimate interests, Art. 6(1)(f).

• Improving Denise — reviewing feedback to refine how the coach responds, and looking at which features get used — legitimate interests, Art. 6(1)(f).

• Marketing email — your consent, Art. 6(1)(a), which you can withdraw at any time.

• Invoicing and statutory record-keeping — legal obligation, Art. 6(1)(c).

 

4. Who can see your conversations
Instructors, managers and client administrators cannot read your conversations. This is by design: the App provides no interface through which a third party can open what you have written.

A small number of LERNZONE administrators can access account data and conversation content where running or supporting the service requires it — for example, investigating a fault you have reported. Access is limited to named individuals, each bound in writing by a confidentiality agreement and a data processing agreement.
 

5. AI processing
Denise generates its responses using large language models from OpenAI, called only from our servers.

Your content is not used to train AI models. We use OpenAI under business terms that exclude training on our data, and model improvement is switched off on our account.

Denise gives coaching feedback. It makes no automated decision that produces legal or similarly significant effects for you. Where Denise is used in a course, grading and assessment decisions are made by faculty, not by the App.
 

6. Who else processes your data
We use the following providers, each under a data processing agreement:

 

• Google Ireland Limited / Google LLC — hosting, authentication, database, file storage and backend functions (Firebase and Google Cloud).

• OpenAI Ireland Ltd. — generating coaching responses.

• Stripe Payments Europe, Limited — subscriptions and payments. Card details are entered on Stripe's own pages and never reach us.

• MailerLite Limited — email to users.

We do not sell your personal data, and we do not share it for anyone else's marketing.
 

7. Where your data is held
LERNZONE is established in Germany. Our production systems run in United States regions of Google Cloud, and content is sent to OpenAI for processing.

Transfers outside the EEA are covered by the European Commission's Standard Contractual Clauses (Decision 2021/914) or by the equivalent safeguards each provider maintains. You can ask us for details of the safeguards that apply.

For users in Quebec: your personal information is stored and processed outside Quebec, in the United States and the European Union, under the safeguards described above.

8. How long we keep it

• Account information and conversation content — for as long as your account is open, and for 30 days after you ask us to delete it or close your account

• Uploaded files in chat — deleted shortly after they are processed.

• Usage and log data — kept for a limited period for security and troubleshooting.

• Invoices and billing records — kept for the periods German commercial and tax law require, which are longer than the above.

​

9. How we protect it
Denise runs on Google Cloud, which provides the physical, network and infrastructure security of the environment. On top of that: encryption in transit and at rest, authentication through Firebase, server-side access rules that default to denying everything not explicitly permitted, administrative access limited to named individuals, and uploads restricted by size and file type.

No system is perfectly secure, and we do not claim otherwise.
 

10. Your rights
You can ask us to give you a copy of your data, correct it, delete it, restrict how we use it, provide it in a portable format, or stop processing based on legitimate interests. Where we rely on your consent, you can withdraw it at any time without affecting what we did before.

Write to support@lernzone.com. We will respond within one month.

You can also complain to a data protection authority. Ours is:
 

Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg,

Lautenschlagerstraße 20,

70173 Stuttgart,

Germany.

 

You can also complain to the authority where you live; in Quebec that is the Commission d'accès à l'information du Québec.
 

11. Cookies and local storage
We do not use analytics, advertising or tracking cookies in the App.
The App stores a small amount of information in your own browser so that it works: your sign-in session, and settings such as your language. This stays on your device, is not read by anyone else, and is cleared when you sign out or clear your browser data.
When you subscribe, you are taken to Stripe's own checkout pages. Stripe sets its own cookies there for payment security and fraud prevention, under Stripe's privacy policy.

We do record which features of Denise are used, so we can see what helps people and what does not. That information is stored in our own database against your account, not in cookies, and is covered by section 3.

12. Children
Kata Dojo AI is intended for adults. You must be at least 18 to create an account.

13. Changes
We may update this policy. If a change materially affects you we will tell you in the App or by email, and we will update the date at the top.