Privacy policy — omul

Last modified: 18 September 2026

1 General information

Protecting your personal data matters to us. This policy tells you which data we process, why, on what legal basis, for how long, and who else gets to see it. The terms used are to be read as defined in Article 4 of the General Data Protection Regulation (Regulation (EU) 2016/679, "GDPR" — the European data protection law).

You can save or print this policy using your browser's "Print" or "Save page as" commands.

1.1 What this policy covers

This policy distinguishes throughout between two offerings, because they process different amounts of data and because for part of them we are not the controller (item 2):

1.1.1 the website at omul.app — our information and marketing offering, and

1.1.2 the application at omul.app/app/ — the software we host, in which presentations are built and voted on live. It also includes the joining and presenting paths at the root of the same host, for example omul.app/join/123456.

Since 7 September 2026 the two sit on the same host: they are kept apart by path, not by address. Everything the website and the application store in your browser (items 4.2 and 5.10) therefore lives in one store, which your browser keeps under omul.app, and is deleted together. And if you are signed in to an account, your browser sends the application's session cookie when you open the marketing pages as well.

The application has two roles, and they are treated separately here:

1.1.3 the presenting person ("presenter"), who may create an account, builds presentations and runs the session, and

1.1.4 the participant, who joins with a six-digit code, needs no account, provides no e-mail address and sets no password.

Not covered is the self-hosted variant: anyone who installs the "omul" software on their own infrastructure is solely responsible for the processing that happens there. We receive no data in that case and are not a recipient within the meaning of Article 13 (1) (e) GDPR. See item 2.4.

1.2 Controller

The controller within the meaning of Article 4 (7) GDPR — within the allocation described in item 2 — is:

Binary Please UG (haftungsbeschränkt)
c/o Factory Works GmbH
Rheinsberger Straße 76/77
10115 Berlin
Germany
E-mail: hallo@omul.app

Represented by its managing directors, who are named in the legal disclosure.

1.3 Data protection officer

We are not obliged to appoint a data protection officer and have not appointed one. Please direct privacy matters to the contact details in item 1.2.

1.4 Privacy enquiries

Please direct all enquiries about the processing of your personal data, and the exercise of the rights listed in item 9, to the contact details in item 1.2. We will answer without undue delay and at the latest within one month of receipt (Article 12 (3) GDPR).

2 Who is responsible for what

The most important statement in this policy comes first, because it determines whom you have to approach.

2.1 The website omul.app

We are the controller for processing that occurs when you visit the website. See item 4.

2.2 Account and operational data of the application

We are the controller for the data that arises in providing the application itself — your account, your sign-in, the server log files, protection against abusive use, and the sending of our transactional e-mails. See items 5.1 to 5.4, 5.10 and 5.11.

2.3 Presentation content and participants' answers

For the content of a presentation and for everything participants enter into it — answers, free text, questions, chat messages and, where applicable, names — the presenting person or their organisation is the controller. They decide which questions are asked, whether names are requested, how long results are kept and when they are deleted.

In that respect we are a processor under Article 28 GDPR. We process this data solely on the presenting person's instructions, do not use it for our own purposes, do not enrich it, build no profiles from it and do not advertise with it.

This has a practical consequence for participants: if you want to know which of your entries are stored where, or if you want them deleted, please turn to the person or organisation running the session. If you nevertheless approach us, we will forward your request there without undue delay and support them in answering it.

Organisations that need a data processing agreement can obtain one from us on request to hallo@omul.app. It carries the technical and organisational measures, the list of sub-processors and the deletion concept as annexes.

2.4 Self-hosted instances

If you run omul yourself, you process alone and on your own responsibility. We take no part in that processing, receive no data and are not a processor. This policy does not apply to such instances; their operator must provide a privacy policy of their own.

3 General notes on processing

3.1 Categories of data processed

We process master and contact data (for example the name and e-mail address of an account), content data (for example presentation titles, slide content, answers, free text, chat and Q&A contributions), usage data (for example the time of a request) and meta and communication data (for example IP address, browser and device information).

3.2 Categories of data subjects

Those affected are visitors to the website, presenters with and without an account, members of workspaces, participants in sessions, and third parties whose data participants enter into free-text answers.

3.3 Legal bases

We process personal data only on a legal basis, named individually in each section below. The possible bases are: your consent (Article 6 (1) sentence 1 (a), Article 7 GDPR), performance of a contract or pre-contractual measures (Article 6 (1) sentence 1 (b) GDPR), compliance with a legal obligation (Article 6 (1) sentence 1 (c) GDPR) and our legitimate interests (Article 6 (1) sentence 1 (f) GDPR).

The fact that the application is currently free of charge changes nothing here: a contract of use without payment is still a contract within the meaning of Article 6 (1) sentence 1 (b) GDPR.

For storing information on your terminal equipment and accessing information already stored there, Section 25 of the German Telecommunications and Digital Services Data Protection Act (TDDDG — the German statute implementing the European rules on cookies, which has continued the former TTDSG under a new name since 14 May 2024) takes precedence. Under it, such storage or access is permitted only if you have consented (Section 25 (1) TDDDG) or if it is strictly necessary for us to provide a service you have expressly requested (Section 25 (2) no. 2 TDDDG). A legitimate interest is not sufficient here.

3.4 Encrypted transmission and technical safeguards

All data you enter on the website and in the application and send to us is transmitted in encrypted form according to the state of the art (TLS for every connection, including the persistent connection over which results update live). Beyond that we protect our systems against destruction, unauthorised access, alteration and unauthorised disclosure by technical and organisational measures (Article 32 GDPR). On the availability of the data — Article 32 (1) (c) GDPR — the position is set out in item 8, including what we do not do at present.

3.5 Whether you have to provide data

Providing your data is neither required by law nor by contract. Without the data needed to perform the contract — for an account, a valid e-mail address and a password — we cannot, however, keep an account for you (Article 13 (2) (e) GDPR). You can take part in a session without giving any information about yourself at all, unless the presenting person expressly asks for a name.

3.6 No automated decision-making

Automated decision-making, including profiling, within the meaning of Article 22 (1) and (4) GDPR does not take place.

4 The website omul.app

4.1 Hosting and server log files

The website is a static site: files generated in advance, with no database of its own and no server-side application logic. The one place it talks to the application is the live poll on the home page and the demo page (item 4.7).

We host it ourselves. There is no third-party website builder, no third-party content management system, no content delivery network and no other service provider that serves the pages for us. The files sit on a server we operate and are delivered by an entry server we also operate — the same one that sits in front of the application (item 5.1).

Both servers are rented from one provider:

Hetzner Online GmbH, Industriestraße 25, 91710 Gunzenhausen, Germany; the data centres are located in Falkenstein (Vogtland), Germany.

Hetzner's service consists of providing infrastructure, computing capacity, storage and network connectivity. Hetzner is our processor under Article 28 GDPR in that respect, and the only recipient involved at all when a page is merely requested.

On each request the entry server records in server log files: the IP address of the requesting device, the date and time of the request, the name of the file requested or the path asked for, the status message, the volume of data transferred, your browser's statement about its operating system and program (user agent) and — where your browser sends it — the address of the previously visited page. The legal basis is our legitimate interest in the technical provision, stability and security of our offering (Article 6 (1) sentence 1 (f) GDPR).

These log files are deleted automatically after 90 days. The period is set centrally on all our servers and enforced by machine; it applies to the website and the application alike. If longer retention is required to investigate a specific security incident, we preserve the entries concerned separately and delete them once it has been finally resolved. The data is not combined with other sources and is not evaluated for marketing purposes.

4.2 Cookies and local storage

This website sets no cookies. It embeds no fonts, no maps, no videos and no analytics or advertising scripts from third-party servers; all fonts and images are served from our own server.

The website places exactly one entry in your browser's local storage, and even that only once you trigger it:

That entry is strictly necessary to provide the service you have expressly requested — remembering your display setting; the legal basis is therefore Section 25 (2) no. 2 TDDDG, and no consent is required for it. It holds nothing but one of the three words system, light or dark, serves no recognition purpose and is transmitted to nobody.

That is why there is no cookie banner on this website: there is nothing for you to consent to in advance.

The website and the application share one host (item 1.1), and therefore also the store your browser keeps under omul.app. Two things follow. First: if you are signed in to an account, your browser sends the application's session cookie (item 5.10) when you open these pages too — it was set by the application, not by the website, and it is read only there. Second: if you delete the website data for omul.app in your browser, you remove all entries of both offerings at once; note the point made in item 5.10 when you do.

4.3 Audience measurement

There is no audience measurement, no web analytics and no advertising tracking on this website. In particular we do not use: Google Analytics, Google Ads and conversion tracking, Google Tag Manager, Google Fonts embedded dynamically, Google reCAPTCHA, the Facebook pixel, LinkedIn Insights or the X advertising pixel.

There is no tool on this website that counts your visit, recognises you or traces your path across the pages. Should we change that in future, we will amend this policy first.

4.4 Booking a demonstration

On some pages we link to a booking form provided by HubSpot Meetings (meetings.hubspot.com). The link is an ordinary text link: as long as you do not click it, no data is transmitted to HubSpot. Only after the click do you leave our website; from then on the provider's privacy notices apply. The data you enter there — usually name, e-mail address, company and the desired appointment — reaches us so that we can hold the appointment. The legal basis is the performance of pre-contractual measures at your request (Article 6 (1) sentence 1 (b) GDPR).

Our contracting entity is HubSpot Germany GmbH, Am Postbahnhof 17, 10243 Berlin, Germany. HubSpot is our processor under Article 28 GDPR in this respect.

Our HubSpot account sits in HubSpot's EU data centre, which HubSpot states it operates in Germany. That is where your details are stored and processed. A connection to the United States of America nevertheless exists: HubSpot, Inc., Two Canal Park, Cambridge, MA 02141, USA is an affiliate and a sub-processor, and on HubSpot's own account processing may in a limited number of cases also take place outside the chosen data centre location — for instance in customer support, in handling security incidents, and for analytics and usage data about the service itself. On third-country transfers see item 7. Further information: https://legal.hubspot.com/privacy-policy and the sub-processor list at https://legal.hubspot.com/sub-processors-page.

4.5 Waiting list

On the pricing page you can put yourself on a waiting list for the paid plans that are not yet available. Technically this happens through a mailto: link: your own e-mail program opens a prepared message to hallo@omul.app, which you send yourself. There is no form, no background transmission and no storage before you have sent the message. We then process your e-mail address and your details in order to tell you when the plans launch. The legal basis is the performance of pre-contractual measures at your request (Article 6 (1) sentence 1 (b) GDPR).

On retention we deliberately give no fixed period here but the criterion (Article 13 (2) (a) GDPR): your message stays as an e-mail in our mailbox for as long as it is necessary for the purpose named. We delete it once that purpose has fallen away — that is, when the plans have launched and you have been notified, when you object to further storage, or when you ask us to delete it. Removing a single e-mail from the mailbox is possible for us at any time; a message to the address in item 1.2 is enough.

4.6 Contacting us

If you write to us by e-mail, we process the data you provide in order to answer your enquiry. The legal basis is Article 6 (1) sentence 1 (b) GDPR where your enquiry aims at concluding or performing a contract, and otherwise our legitimate interest in answering enquiries (Article 6 (1) sentence 1 (f) GDPR).

Here too we give the criterion rather than a fixed period: your message stays in our mailbox for as long as it is necessary to deal with the matter or to keep it traceable, and we delete it as soon as that is no longer so. We keep it longer only where a statutory retention obligation requires it — six years for commercial letters under Section 257 (1), (4) of the German Commercial Code (HGB), ten years for accounting records under Section 147 (1), (3) of the German Fiscal Code (AO). You can object to the storage or ask us to delete it at any time (items 9.3 and 9.8); we then delete it unless such an obligation stands in the way.

4.7 The live poll on the home page and the demo page

The home page and the page /demo show a real poll from the application (item 5) — not a mock-up. As soon as one of these pages has loaded, your browser asks the application at omul.app/api/ for this one poll and its current count. For as long as the page is visible, it then keeps a WebSocket connection to the application (omul.app/ws) open, over which the application reports each new vote live; if that connection cannot be made, your browser asks for the count again at regular intervals instead. This produces the application's server log files (item 5.1). The website sends the requests to omul.app/api/ without cookies: an application session cookie (item 1.1) is not transmitted, even if you are signed in.

Over the WebSocket connection the website sends only which poll it follows as a participant — no vote and nothing about you. When the connection is opened, your browser sends the cookies it holds for omul.app of its own accord, and this cannot be switched off; if you are signed in to the application, its session cookie is among them. The application does not evaluate these cookies on this connection: it reads neither a cookie nor a session there and attributes the connection to no account.

If you click an answer, you cast a vote in this poll. What is stored is the option you chose, the time, and a random participant identifier, as with any participation (items 5.7 and 5.8). Unlike what item 5.7 describes, the website does not keep this identifier in local storage: it exists only for as long as the page is open. If you reload the page and vote again, that counts as a further participation. The poll's count is public — everyone who has it open sees the same numbers, but not who voted how.

We run this poll ourselves. For the votes in it we are therefore the controller, not a processor as in item 2.3. The legal basis is our legitimate interest in demonstrating the product on the website in real operation (Article 6 (1) sentence 1 (f) GDPR). The votes stay stored until we reset or delete the poll.

5 The application at omul.app/app/

5.1 Hosting and server log files

The application runs on servers of Hetzner Online GmbH, Industriestraße 25, 91710 Gunzenhausen, Germany; the data centre is located in Falkenstein (Vogtland), Germany. The hosting services cover infrastructure, computing capacity, storage and network connectivity. The legal basis is our legitimate interest in the economical and secure operation of the application (Article 6 (1) sentence 1 (f) GDPR); Hetzner is our processor under Article 28 GDPR in that respect.

In front of the application, on the same machine, sits an entry server (Caddy) that terminates the encrypted connection and forwards requests. It keeps access logs, and they are the same ones item 4.1 describes for the website: IP address, time, path requested, status message, volume of data transferred, user agent and, where sent, referer. They too are deleted automatically after 90 days.

In its own database the application stores an IP address in exactly one place: if you sign in to an account, it records against your sign-in session the IP address and the browser identification (user agent) the session was started with. That entry belongs to the session: it is deleted when you sign out and when you delete your account; a session expires after at most seven days, and an expired entry is removed the next time your browser presents it.

Beyond that the application stores no IP addresses. In particular no answer, no chat message, no question and no reaction is attributed to an IP address, and taking part in a session produces no such entry at all — it needs no account and therefore no sign-in session. For limiting abusive use the server evaluates IP addresses solely in memory; see item 5.11.

5.2 Creating an account and signing in

To tie presentations permanently to an account you can register. In doing so we process your e-mail address, a name of your choosing and your password. We never store the password in clear text, only as a cryptographic hash — a value from which the password cannot be recovered.

The legal basis is performance of the contract of use, or pre-contractual measures (Article 6 (1) sentence 1 (b) GDPR).

After registration we send you an e-mail to confirm your address. Confirmation is not a condition of access: you can use the application immediately and in full. You can change your e-mail address later; for safety we then send one message to the old address and one to the new one.

You can delete your account yourself at any time without contacting us. Deletion requires you to enter your password and takes effect immediately.

Deleting your account does not today delete your presentations with it. It removes your account, your sign-in sessions and your access keys. The presentations that ran under your account remain, with everything submitted into them — and after the account is deleted nobody can reach them any more, not even us, because access hung on precisely the account you have just deleted.

So delete your presentations first and your account afterwards. Deleting a presentation reliably removes everything that belongs to it (item 8). If you want the contributions to an already orphaned presentation deleted, write to us at hallo@omul.app and we will delete them server-side.

5.3 Transactional e-mails

To send the messages named in item 5.2 — address confirmation, password reset, confirmation of an address change — we use a sending service provider:

Brevo GmbH, Köpenicker Straße 126, 10179 Berlin, Germany (Amtsgericht Berlin-Charlottenburg, HRB 133191)

Brevo is our processor under Article 28 GDPR in this respect. Only your e-mail address, your name and the content of the message concerned are transmitted. Participant data, presentation content and answers are never transmitted to the sending service provider. There is no measurement of success — no evaluation of whether and when you opened a message or clicked a link. We send no newsletter from the application.

On Brevo's own account it processes on servers in France, Germany and Belgium, that is, inside the European Union. Where Brevo in turn uses sub-processors outside the EU, Brevo bases those transfers on an adequacy decision or on standard contractual clauses; see item 7.

The legal basis is performance of the contract of use (Article 6 (1) sentence 1 (b) GDPR).

5.4 Personal access keys

Signed-in users can generate personal access keys (API keys) in order to address the application from their own programs. For that we store the key in secured form, the time it was created and its association with your account. The legal basis is performance of the contract of use (Article 6 (1) sentence 1 (b) GDPR).

5.5 Presentations without an account

You can also create a presentation without an account. You then receive a random edit token, which is stored solely in your browser's local storage. On the server we keep only a cryptographic hash of it; we do not know the token itself and cannot restore it. No master data about you arises.

Anyone who loses that token can no longer edit or delete their presentation. There is no recovery route, because there is no account against which we could verify you.

5.6 Workspaces, collaborators and comments

Signed-in users can join together in a workspace, edit presentations collaboratively and write comments on individual slides. We then process the association of your account with the workspace and the presentation, the role you hold there, and the content of your comments together with the account that wrote them. Slide comments are visible only to the editing accounts; they are loaded on no participant-facing surface at all. The legal basis is performance of the contract of use (Article 6 (1) sentence 1 (b) GDPR).

5.7 Taking part in a session

Taking part requires no account, no e-mail address, no password and no app. You enter a six-digit code or scan a QR code and you are in the room.

So that your device recognises its own answers — for instance to avoid counting a vote you have already cast twice, and to mark your own chat messages for you — your browser generates a random participation identifier and stores it in local storage. That identifier carries no link to your name, your e-mail address or an account. It is pseudonymous: for us it cannot be attributed to a specific person (Article 11 GDPR). You can remove it at any time by deleting the website data for omul.app in your browser.

Please note: pseudonymous is not anonymous. The identifier links all your contributions within a session to each other, and anyone who watched you in the room or knows your turn of phrase may draw conclusions from that. If the presenting person additionally asks for a name (item 5.8), the contributions are attributed to a person in any case.

5.8 Answers, names, questions and chat

Within a session we process the following — as a processor for the presenting person, see item 2.3:

Free-text fields can contain personal data — yours and other people's — if you enter such data. What is asked is decided by the presenting person; what you answer is decided by you. Do not enter anything into a free-text field that you would not want to show the whole room: results are displayed on a shared screen, and free text appears there verbatim.

The participation identifier attached to a chat message does not leave our server; in the chat each person sees only which lines are their own.

The legal basis is determined by the presenting person as controller; for us as processor the basis is the agreement under Article 28 GDPR.

5.9 Sharing and exporting results

The presenting person can mint a results link that opens a read-only view of the results without the person opening it needing an account. The link can be revoked at any time; after revocation it no longer works. On the server we store only a cryptographic hash of it. The link shows results, but no editing rights, no preview, no presenter notes and no answer key for a running quiz question.

The presenting person can also download the results as a spreadsheet or as a PDF file. If names were collected, they appear in those files. What happens to a downloaded file is outside our sphere of influence; the presenting person is responsible for it.

5.10 Storage on your device

The application stores the following on your device:

All of these entries are strictly necessary for us to provide the service you have expressly requested; the legal basis is therefore Section 25 (2) no. 2 TDDDG, and no consent is required for them. There are no cookies for analytics, advertising or recognition purposes in the application, and therefore no cookie banner.

The sign-in session cookie applies to the whole of the host omul.app and is therefore sent when you open the marketing pages as well (items 1.1 and 4.2). It is read only by the application; the website does not read it and does not need it.

You can delete these entries at any time by removing the website data for omul.app in your browser. That also removes the entry from item 4.2. Note item 5.5 when you do: losing the edit tokens means losing access to presentations created without an account.

5.11 Protection against abusive use

Because presentations can be created and answers submitted without anyone signing in, we limit how often the same origin may do so in a short period. To that end the server evaluates the IP address of the request — for IPv6 not the full address but only its leading part (a so-called /64 prefix). That evaluation happens solely in the memory of the running process; the IP address is not stored in the database and is not linked to other data. If a limit is exceeded, the server answers with an error message and a hint as to when a new attempt is possible.

The legal basis is our legitimate interest in protecting the service against automated mass access, against filling up storage, and against manipulation of voting results (Article 6 (1) sentence 1 (f) GDPR).

One note for context: this limit is flood protection, not an assurance of "one vote per person". In a lecture hall hundreds of people share the same network address; the limits are therefore deliberately set so that a full room does not reach them in normal operation.

5.12 Third-party content embedded by a presenting person

A presentation may contain slides whose content is loaded from a third-party server. When your device displays such a slide, your browser makes a direct connection to that third-party server, which necessarily receives your IP address as well as technical details about your browser and device. We have no influence over that processing and do not forward the data ourselves.

The possibilities are:

5.12.1 Images and video files that the presenting person embeds by internet address. Whichever server holds the file receives the connection.

5.12.2 Videos from YouTube and Vimeo. We embed YouTube videos through the address youtube-nocookie.com, that is, through the variant Google itself describes as more privacy-friendly, in which no cookies for advertising purposes are meant to be set on a mere page view. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Vimeo videos are embedded through player.vimeo.com; the provider is Vimeo.com, Inc., 330 West 34th Street, 5th Floor, New York, NY 10001, USA.

5.12.3 Embedded presentations and whiteboards — a PowerPoint file through Microsoft's viewer, OneDrive or SharePoint (Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland), a Google Slides deck (Google Ireland Limited, address as above) or a Miro board (Miro / RealtimeBoard Inc., 201 Spear Street, San Francisco, CA 94105, USA). No other provider is possible: the application accepts addresses of these three services only and rejects every other one.

The presenting person, not we, is responsible for the embedding: they decide whether such a slide appears in their presentation. They are therefore also obliged to inform you about it and to justify the processing. We merely provide the technical capability; the legal basis for that is our legitimate interest in functioning presentation software (Article 6 (1) sentence 1 (f) GDPR).

If a session contains no such slides, none of these connections occurs. The application itself loads nothing from third-party servers.

5.13 Drafting a presentation from a text prompt

The software contains an optional feature that can produce a draft presentation from a short text prompt. On omul.app that feature is not switched on. No processing takes place in this respect and no language-model provider receives any data. Should we switch it on in future, we will amend this policy first and add the model provider to the list of sub-processors.

5.14 Operations and administration surface

The application contains an administration surface for operations. By default it is open to nobody; it is available only to the accounts the operator expressly names. Actions on that surface are recorded in an append-only log, so that it remains traceable who did what and when. What is recorded is the time, the kind of action, the e-mail address of the operating account and a short description — no IP address. The log is appended to continuously and is not deleted automatically today. The legal basis is our legitimate interest in traceable and secure operations (Article 6 (1) sentence 1 (f) GDPR).

5.15 No audience measurement in the application

We use no analytics, tracking or marketing tools in the application. There is no third-party tool of any kind on participants' devices.

6 Recipients at a glance

The website has no host of its own. We serve it ourselves, from servers we rent from Hetzner; no further third party is involved (item 4.1).

Beyond that we pass on data where we are legally obliged to do so. We do not pass data on for advertising purposes, do not sell data and do not pass data to credit reference agencies.

The providers named in item 5.12 are not on this list: your device connects to them directly when the presenting person has embedded a corresponding slide; we transmit nothing to them.

7 Processing in third countries

A third country is any country outside the European Union (EU) and the European Economic Area (EEA). For core operations there is no transfer to a third country: the website, the application, the database and the server log files sit on servers in Germany, and the e-mail dispatch under item 5.3 stays inside the European Union.

A third-country connection arises in one place: the appointment booking under item 4.4, because HubSpot, Inc., established in the United States of America, can as an affiliate access the account. Indirectly, our sending service provider under item 5.3 in turn uses individual sub-processors outside the EU.

In both cases we observe Articles 44 et seq. GDPR. Such transfers are based primarily on an adequacy decision of the European Commission under Article 45 GDPR and, in addition, on the standard data protection clauses adopted by the European Commission under Article 46 (2) (c) GDPR (Implementing Decision (EU) 2021/914).

For transfers to the United States of America, adequacy decision (EU) 2023/1795 on the EU-US Data Privacy Framework has been in force since 10 July 2023. It applies to companies that have certified under that framework; on HubSpot's own contractual documentation HubSpot, Inc. is certified under it, and HubSpot's data processing agreement additionally incorporates the standard data protection clauses. For every US service provider we check whether such a certification exists, and we keep standard data protection clauses as a fallback.

As at this policy, the adequacy decision is in force. The General Court of the European Union dismissed an action against it by judgment of 3 September 2025, Case T-553/23 (Latombe); an appeal is pending before the Court of Justice of the European Union under C-703/25 P and was undecided on 18 September 2026. If the decision falls, the standard data protection clauses continue to carry the transfer.

8 Retention and deletion

We store personal data only for as long as is necessary to achieve the purpose stated in each case.

Deleting a presentation means deleting it completely. When a presentation is deleted, every answer, every upvote on an open answer, every Q&A question with its upvotes, every chat message and every name collected that belongs to it is deleted with it. Nothing orphaned is left of the presentation.

That does not hold for deleting an account today — it leaves the presentations standing. The order that resolves this is in item 5.2: delete the presentations first, then the account.

Backups. For the application's data we currently keep no backups off the machine it runs on. A deletion is therefore final: there is no backup generation from which deleted data could later reappear, and nothing extends the periods given above. If the machine is lost, however, the data is lost. Once we have a backup concept in place we will change this paragraph and state the retention period of the backup generations here.

9 Your rights as a data subject

Please note item 2.3 first: if your rights concern answers, chat messages, questions or names from a session, the presenting person is your point of contact, not us.

9.1 Access

You have the right to obtain, free of charge and at any time, information about the data stored about you and a copy of that data (Article 15 GDPR).

9.2 Rectification

You have the right to have inaccurate data rectified and incomplete data completed (Article 16 GDPR).

9.3 Erasure

You have the right to erasure of your data (Article 17 GDPR). You can delete your account and your presentations yourself inside the application; mind the order set out in item 5.2. If something is left afterwards — because a presentation was orphaned by an account deletion, for instance — a message to hallo@omul.app is enough and we will delete it server-side. Erasure is not possible where we must continue to store the data to perform the contract or on account of statutory retention obligations; in that case we restrict the processing.

9.4 Restriction of processing

You have the right to request restriction of the processing of your data (Article 18 GDPR).

9.5 Data portability

You have the right to receive the data you provided in a structured, commonly used and machine-readable format and to transmit it, or have it transmitted, to another controller (Article 20 GDPR).

9.6 Withdrawal of consent

You have the right to withdraw consent at any time with effect for the future (Article 7 (3) GDPR). The lawfulness of processing carried out before withdrawal remains unaffected.

9.7 Limit in the case of pseudonymous participation data

The participation identifier in item 5.7 cannot be attributed by us to a specific person. Under Article 11 (2) GDPR we are therefore not obliged to maintain or acquire additional information solely in order to comply with a request for access or erasure. We can only comply with such a request if you supply the information needed to make the attribution — usually your participation identifier, which you will find in your browser under the entry omul-participant-id.

9.8 Right to object

You have the right, on grounds relating to your particular situation, to object at any time to the processing of personal data concerning you which is based on Article 6 (1) sentence 1 (e) or (f) GDPR (Article 21 (1) GDPR). If you object, we will no longer process your personal data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims.

Where your personal data is processed for direct marketing purposes, you have the right to object at any time to such processing (Article 21 (2) GDPR).

No particular form is required; the objection can be sent to the contact details in item 1.2.

The second paragraph bites in one place with us: if you put yourself on the waiting list under item 4.5, the message with which we tell you that the paid plans have launched is advertising for our own offering. A word to the address in item 1.2 is enough and we will not write to you again. We send no newsletter, and we do not pass your data on for third parties' advertising (item 6).

9.9 Exercising these rights

An informal message to the contact details in item 1.2 is sufficient to exercise these rights.

10 Complaint to a supervisory authority

Without prejudice to any other remedy, you have the right to lodge a complaint with a data protection supervisory authority (Article 77 GDPR), in particular in the Member State of your residence, place of work or the place of the alleged infringement. The authority competent for us is:

Berliner Beauftragte für Datenschutz und Informationsfreiheit
Alt-Moabit 59–61 (entrance Alt-Moabit 60)
10555 Berlin, Germany
Telephone: +49 30 13889-0
Fax: +49 30 2155050
E-mail: mailbox@datenschutz-berlin.de
Web: https://www.datenschutz-berlin.de/

11 Status of this policy

This privacy policy carries the date given in its header. As the offering develops, or as legal or regulatory requirements change, it may become necessary to amend it. The current version can always be retrieved and printed at https://omul.app/en/privacy.