Privacy Policy
Last updated: August 2026
This is a translation provided for convenience. In case of any discrepancy, the German version is the legally binding one.
1. Controller
kalebru GmbH
Gustav-Heinkel-Str. 55
76187 Karlsruhe
Germany
Email: hallo@kalebru.com
2. Overview of processing activities
We process personal data in connection with the provision of our SaaS service “HiWi+” for AI-assisted student advisory, exam management, faculty administration and content generation at higher education institutions, as well as in the context of our website. The following overview summarises the types of data processed, the purposes of processing and the persons concerned.
3. Legal bases
Personal data is processed on the basis of the following legal bases of the GDPR:
- Art. 6 (1) (a) GDPR — consent of the data subject
- Art. 6 (1) (b) GDPR — performance of a contract and pre-contractual measures
- Art. 6 (1) (f) GDPR — legitimate interests (e.g. security, operation, optimisation)
4. Data collected in the context of the website
4.1 Hosting and server logs
Our website is hosted by Mittwald CM Service GmbH & Co. KG (Königsberger Straße 4–6, 32339 Espelkamp, Germany). The servers are located exclusively in Germany. The website itself embeds no external services, fonts, tracking or analytics tools; all resources are delivered locally from our own server. When you visit, the hosting provider automatically records technical data in server log files:
- IP address (anonymised where applicable)
- Date and time of access
- Page / URL requested
- Browser type and version
- Operating system
- Referrer URL
Legal basis: Art. 6 (1) (f) GDPR (legitimate interest in the security and stability of the service). A data processing agreement pursuant to Art. 28 GDPR is in place with the hosting provider.
4.2 Getting in touch
If you contact us by email or telephone, the data you provide (name, email address, institution or company, message) is processed in order to handle your enquiry. Legal basis: Art. 6 (1) (b) GDPR (pre-contractual measures) or Art. 6 (1) (f) GDPR (legitimate interest in answering enquiries).
5. Data processing within the “HiWi+” SaaS service
5.1 User account and authentication
Using HiWi+ requires a user account, which is set up by kalebru GmbH. The following data is processed:
- Email address
- Name
- Password (stored encrypted using bcrypt)
- Role assignment and tenant assignment
Legal basis: Art. 6 (1) (b) GDPR (performance of a contract).
5.2 Document upload and text extraction (OCR)
Users can upload documents (e.g. PDFs) to HiWi+. These are processed server-side:
- Storage: documents are stored on servers in Germany (Hetzner).
- Text extraction (OCR): text content is extracted using external European services with data residency in Germany or the EU.
- The extracted text is stored only in our own database and used for further processing.
Legal basis: Art. 6 (1) (b) GDPR (performance of a contract).
5.3 AI-assisted processing and generation
HiWi+ uses artificial intelligence to analyse and generate content:
- Student advisory: AI-assisted chat for student advisory questions
- Exam management: automated analysis and administration of exam material
- Content generation: AI-generated teaching and information content
- Embeddings: vector representations are created for semantic search
Note on data processing by AI services
Data residency for text extraction: extraction and reading of document content (OCR) is performed via services with data residency in Europe.
Data processing in AI functions: processing may take place via AI services whose servers are located outside the European Union. In that case we ensure an adequate level of data protection through appropriate safeguards (e.g. EU standard contractual clauses pursuant to Art. 46 (2) (c) GDPR, the provider's data processing addendum).
No training on your data: the content you provide is not used for training purposes by the AI service providers we use. We use exclusively API access under which providers contractually undertake that submitted data will not be used to train their models.
Legal basis: Art. 6 (1) (b) GDPR (performance of a contract).
5.4 Usage data and cost tracking
To administer and bill the service, API usage data is recorded (provider, model, token count, estimated cost). This data is stored per tenant.
Legal basis: Art. 6 (1) (b) GDPR (performance of a contract) and Art. 6 (1) (f) GDPR (legitimate interest in billing).
6. Recipients and processors
We use the following third-party providers to deliver our services:
| Provider | Purpose | Data location |
|---|---|---|
| Mittwald CM Service GmbH & Co. KG (Espelkamp, Germany) | Hosting of this website | Germany |
| Hetzner Online GmbH (Gunzenhausen, Germany) | Server hosting, database and file storage for the HiWi+ SaaS service | Germany |
| Mistral AI (Paris, France) | Text extraction (OCR), analysis, generation | EU / Germany / France |
| OpenAI, Inc. (San Francisco, USA) | Content analysis, generation, embeddings | USA (safeguarded by EU standard contractual clauses / DPA) |
Agreements pursuant to Art. 28 GDPR have been concluded with all processors. The AI services (Mistral, OpenAI) are used exclusively within the HiWi+ SaaS service, not on this website.
7. Transfers to third countries
In the context of AI processing, personal data may be transferred to OpenAI, Inc. in the USA. The transfer takes place on the basis of EU standard contractual clauses (Art. 46 (2) (c) GDPR) together with OpenAI's data processing addendum, which contractually guarantees that customer data is not used for training purposes.
8. Retention periods
Personal data is stored only for as long as is necessary for the respective processing purposes:
- Account data: for the duration of the contractual relationship and beyond that in line with statutory retention periods.
- Uploaded documents and generated content: until deleted by the user or termination of the contractual relationship.
- Usage data: in line with commercial and tax law retention periods (up to 10 years).
- Server log files: as a rule a maximum of 30 days.
9. Rights of data subjects
Under the GDPR you have the following rights:
- Right of access (Art. 15 GDPR) — the right to information about the data stored about you
- Right to rectification (Art. 16 GDPR) — the right to have inaccurate data corrected
- Right to erasure (Art. 17 GDPR) — the right to have your data deleted
- Restriction of processing (Art. 18 GDPR)
- Data portability (Art. 20 GDPR) — the right to receive your data in a structured, machine-readable format
- Right to object (Art. 21 GDPR) — the right to object to processing
- Withdrawal of consent (Art. 7 (3) GDPR) — the right to withdraw consent given at any time
To exercise your rights, please contact: hallo@kalebru.com
10. Right to lodge a complaint with a supervisory authority
You have the right to lodge a complaint with a data protection supervisory authority. The competent authority is:
Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg
Lautenschlagerstraße 20
70173 Stuttgart, Germany
www.baden-württemberg.datenschutz.de
11. Cookies
Our website uses no cookies and no tracking. Should this change, we will update this privacy policy accordingly and, where necessary, implement a consent solution (cookie banner).
12. Changes to this privacy policy
We reserve the right to adapt this privacy policy in order to reflect changes in the legal situation or changes to the service or to data processing. The current version can always be found on this page.