Privacy Policy

Introduction

At Sleak, protecting the confidentiality, integrity and availability of your data is our highest priority. With this Privacy Policy, we inform you about the nature, scope and purposes of the processing of personal data in connection with the use of our website (sleak.ai), the Sleak platform (app.sleak.ai) and our social media presence, to the extent we are the controller for such processing.

If you have any questions about data protection, you can contact us at any time at privacy@sleak.ai.

The German version controls; the English translation is for information only.

1. Controller, Contact and Data Protection Officer

The controller within the meaning of the GDPR for the processing described in this Privacy Policy is:

Sleak GmbH (“Sleak” or “we”), c/o Mindspace, Rosental 7, 80331 Munich, Germany

Email: support@sleak.ai; data protection inquiries: privacy@sleak.ai

We have appointed an external data protection officer:

Kertos GmbH, Brienner Str. 41, 80333 Munich, Germany, email: dsb@kertos.io

2. What Data We Collect and Why

a. Visiting Our Website (sleak.ai)

When you visit our website, our servers automatically process certain technical data (server log files) to establish a connection and ensure convenient use:

• IP address of the accessing device
• date and time of access
• URL accessed and, where applicable, the URL from which access occurred (referrer)
• device, browser and operating system information
• amount of data transferred and HTTP status code
• error messages or session-specific information, where applicable

The purpose is to operate, secure, stabilize and further develop the website and to detect and prevent attacks. The legal basis is our legitimate interest in the uninterrupted provision of the website (Art. 6(1)(f) GDPR). Server log files are deleted at regular intervals.

b. Registration for the Sleak Platform (app.sleak.ai)

To use the Sleak platform (including during the free trial), a user account is required. In this context we process:

• first and last name
• email address
• mobile or phone number
• company name and job title, where applicable
• profile picture, where applicable (voluntary)
• date and time of registration and IP address
• authentication data when using single sign-on (e.g. Microsoft Entra ID, Google Workspace), where applicable
• for paid subscriptions: address and payment data and additional data provided during registration

The purpose is to provide and manage your user account, to authenticate users and to detect and prevent misuse. The legal basis is performance of the contract (Art. 6(1)(b) GDPR) and our legitimate interest in preventing misuse (Art. 6(1)(f) GDPR). We delete your user account upon request or no later than 30 days after termination of the contractual relationship, unless statutory retention obligations apply.

c. Contact Inquiries and Support

When you contact us through one of our communication or support channels (e.g. email, contact form or chat), we process the contact and communication data you provide (name, contact details, company and job title where applicable, and the content of your message) to respond to your inquiry. The legal basis is performance of the contract or pre-contractual measures (Art. 6(1)(b) GDPR) and our legitimate interest in responding to inquiries (Art. 6(1)(f) GDPR). We delete this data after the statutory retention periods for business communications. Following support inquiries, we may send short, voluntary satisfaction surveys for quality assurance (Art. 6(1)(f) GDPR); you can object at any time at support@sleak.ai.

d. Billing and Payment

Payment processing is handled by the payment service provider Stripe (stripe.com/privacy). We therefore do not store payment data such as credit card or account numbers ourselves. For billing we store:

• company name and address data
• first and last name of the contact person
• contact details for invoice delivery
• the subscription ID assigned by Stripe
• information on booking history and invoices
• information on payment status

The legal basis is performance of the contract (Art. 6(1)(b) GDPR). We delete this data after the statutory commercial and tax retention periods, typically after 10 years.

e. Email Communications and Newsletter

Newsletter: If you subscribe to our newsletter, we process first and last name, email address and the date, time and IP address of the subscription. The legal basis is your consent (Art. 6(1)(a) GDPR). You can object at any time via the opt-out link or at support@sleak.ai; we retain the consent record for up to two years after you unsubscribe.

Product updates for existing users: As a registered user, we may use your email address to inform you about new products and features unless you have objected (Art. 6(1)(f) GDPR in conjunction with Section 7(3) of the German Unfair Competition Act (UWG)). You can object at any time free of charge.

Administrative notices: We inform administrators about technical changes to their workspace relevant to its operation (e.g. interfaces, security updates) based on our legitimate interest (Art. 6(1)(f) GDPR). We delete this data once the underlying workspace is deleted.

f. Participation in Phone and Video Calls or Webinars

When you speak with us by phone or participate in a digital meeting (e.g. video call, webinar), we process your contact and communication data to communicate with you. Where you have consented, we may record content or have it analysed by transcription tools. The legal basis is performance of the contract or pre-contractual measures (Art. 6(1)(b) GDPR) and our legitimate interest in business communications (Art. 6(1)(f) GDPR); for recordings, your consent (Art. 6(1)(a) GDPR). We delete recordings once their purpose has been fulfilled.

g. Use of the Sleak Platform (app.sleak.ai)

When you use the Sleak platform as a user within a workspace (e.g. for trainings, coaching, simulations or assessments), Sleak processes your data solely as a processor. The controller is the organization providing you with the workspace (typically your employer, not Sleak); the basis is the data processing agreement between Sleak and that organization. The same applies where you participate in an assessment as an external applicant: the inviting organization is the controller.

Your content (e.g. inputs, voice recordings, transcripts and assessments) is processed by us exclusively to provide the contracted services and not for our own purposes. Your data is not used to train AI models. Retention and deletion are governed by the data processing agreement and the instructions of the responsible organization.

Independently of content data, we collect anonymized telemetry and aggregated usage data as a controller (e.g. access and load times, error messages, aggregated usage frequencies) to detect errors early, ensure operations and further develop the platform.

h. Social Media Presence

We maintain a presence on social media platforms (in particular LinkedIn). When you contact us there (e.g. by direct message), we process your contact and communication data to communicate with you. The legal basis is performance of the contract or pre-contractual measures (Art. 6(1)(b) GDPR) and our legitimate interest in public corporate communications (Art. 6(1)(f) GDPR). The platform operators provide us with aggregated statistics (insights), for which we are jointly responsible with the operator; we use these exclusively in aggregated, non-personal form. For all other processing by the platforms, the respective operator is responsible (e.g. LinkedIn: linkedin.com/legal/privacy-policy).

i. Job Applications at Sleak

When you apply for a position with us, we process the data you submit as part of your application (e.g. contact details, application documents and information about your background, qualifications and availability). The purpose is to conduct the application process. The legal basis is pre-contractual measures (Art. 6(1)(b) GDPR in conjunction with Section 26(1) of the German Federal Data Protection Act (BDSG)). If no employment relationship is established, we delete your documents six months after the end of the process; the legal basis for this retention is our legitimate interest in defending legal claims (Art. 6(1)(f) GDPR).

3. How We Process Data

a. Security

We employ comprehensive technical and organizational measures to protect your data, including encryption of data at rest and in transit, regular security audits and strict access controls. A detailed description can be found in our Trust Center (trust.sleak.ai).

b. Processors and Third Parties

We engage carefully selected service providers who process personal data on our behalf under a data processing agreement and may not use it for their own purposes. The sub-processors used in the Sleak platform can be found in our list in the Trust Center (trust.sleak.ai) and in Appendix 2 of the DPA. For our own processing, we use service providers in particular in the following areas:

• cloud and infrastructure providers (e.g. Microsoft)
• email and communication services (e.g. Google) and video and webinar platforms
• payment providers (e.g. Stripe) and accounting and tax tools
• error tracking, ticketing and support
• product and usage analytics (e.g. PostHog)
• security, compliance and fraud checks
• sales and CRM systems
• service providers for newsletter delivery
• applicant tracking software

To protect our legal and economic interests, we work with external advisors (e.g. lawyers, tax advisors) who are bound by confidentiality. In the context of a merger, acquisition or sale, data may be shared with the acquirer and its advisors to the extent necessary and subject to confidentiality. Otherwise, we only disclose data where required by law, court order or governmental decision.

c. International Data Transfers

As a general rule, we process personal data on servers within the European Union. In exceptional cases, data may be transferred to third countries, but only where appropriate safeguards under the GDPR are in place, in particular an adequacy decision of the European Commission, the EU-U.S. Data Privacy Framework or EU Standard Contractual Clauses. You can obtain a copy of the safeguards used at privacy@sleak.ai.

4. Cookies and Similar Technologies

We use cookies and comparable technologies on our website. Technically necessary cookies are required to operate the website and cannot be disabled (Art. 6(1)(f) GDPR in conjunction with Section 25(2) of the German Telecommunications-Telemedia Data Protection Act (TDDDG)). Optional cookies, for example to analyse usage behaviour (e.g. PostHog), are used only with your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time with effect for the future via the “Cookies” link in the footer. You can also manage or delete cookies via your browser settings.

5. Automated Decision-Making and Profiling

Sleak does not make automated individual decisions within the meaning of Art. 22 GDPR that produce legal effects concerning you or similarly significantly affect you. AI-assisted assessments on the platform serve as one factor among several; the decision is always made by a qualified person at the responsible organization, who also ensures human review. We do not create personality profiles. Where we use automated checks to prevent misuse and fraud, you can request human review at privacy@sleak.ai.

6. Your Rights as a Data Subject

When we process your personal data, you have the following rights under the GDPR, which you may exercise at any time:

• Access to whether and which data we process about you, for what purpose, for how long and to whom we may disclose it.
• Rectification of inaccurate or incomplete data.
• Erasure of your data, provided no statutory retention obligations apply.
• Restriction of processing.
• Data portability in a structured, machine-readable format.
• Objection to processing based on our legitimate interests (Art. 6(1)(f) GDPR).
• Withdrawal of consent given, with effect for the future (Art. 6(1)(a) GDPR).
• Human review where we make an automated decision in an individual case.
• Complaint to a supervisory authority. The authority responsible for us is the Bavarian State Office for Data Protection Supervision (BayLDA), Promenade 18, 91522 Ansbach, Germany (poststelle@lda.bayern.de). You may also contact the authority in your country of residence or work.

To exercise your rights, a message to privacy@sleak.ai is sufficient.

7. Changes to This Privacy Policy

We update this Privacy Policy when our services, the legal requirements or our processing practices change.