Privacy Policy

This is a convenience translation. The German version is legally binding.

As of: 15 July 2026

1. Data Controller

The controller responsible for data processing under the General Data Protection Regulation (GDPR), other national data protection laws of the EU member states, and other data protection-related provisions is:

ESTAYA Beyond GmbH
Moritzstr. 13
09212 Limbach-Oberfrohna
Germany

E-mail: hello@sip.coach
Further details about the provider can be found in our Imprint.

2. General Information on Data Processing

We process personal data of our users only to the extent necessary to provide a functioning website, our content, and our services. The processing of personal data generally only takes place after obtaining the consent of the data subject, or on another legal basis permitted by law. Where consent is obtained for the processing of personal data, Art. 6(1)(a) GDPR serves as the legal basis. Where processing is necessary for the performance of a contract, Art. 6(1)(b) GDPR serves as the legal basis. Where processing is necessary to comply with a legal obligation, Art. 6(1)(c) GDPR serves as the legal basis. Where processing is necessary to protect a legitimate interest of ours or of a third party, and where the interests, fundamental rights, and freedoms of the data subject do not override that interest, Art. 6(1)(f) GDPR serves as the legal basis.

3. Provision of the Website and Creation of Log Files

Each time this website is accessed, our system automatically collects data and information from the accessing computer system (server log files). This includes, among other things: IP address, date and time of the request, content of the request (specific page accessed), access status/HTTP status code, amount of data transferred, the website from which the request originated (referrer), as well as the browser, operating system, and language of the accessing system.

This data is processed solely to ensure trouble-free operation of the website, to detect abuse, and to safeguard IT security, and is not merged with other data sources. The legal basis is our legitimate interest in the security and stability of our systems (Art. 6(1)(f) GDPR).

This website is hosted in Germany on our own infrastructure. Accordingly, server log data is not transferred to third-party providers outside the EU.

4. Cookies and Matomo web analytics on this website

This section covers the marketing website (sip.coach). The training platform (app.sip.coach) follows a different model without a banner; it is summarized in section 6 and described in more detail in the separate privacy notices within the app.

This website uses technically necessary cookies to provide basic functionality. Consent is not required for these (Art. 6(1)(f) GDPR).

In addition (only after your explicit consent via our cookie consent banner), we use Matomo, self-hosted web analytics software. Matomo runs exclusively on our own infrastructure in Germany; there is no disclosure to third parties and no transfer to countries outside the European Union. On this website, Matomo sets no cookies.

The legal basis for the use of Matomo is your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG). Without your consent, Matomo is not loaded and no usage-statistics data is collected.

You may withdraw your consent at any time with future effect: Change cookie settings. For a complete overview of the cookies we use, their purpose, and their retention period, see our Cookie Policy.

5. Contact by E-mail

If you contact us by e-mail (e.g. to hello@sip.coach), the data you provide (including your e-mail address, and where applicable your name and phone number, as well as the content of your message) will be stored by us in order to process your inquiry. This data is deleted once processing of your request is complete, provided no statutory retention obligations apply.

The legal basis is Art. 6(1)(b) GDPR, where your inquiry relates to the initiation or performance of a contract; otherwise Art. 6(1)(f) GDPR (legitimate interest in responding to inquiries).

6. Registration and Use of the sip.coach App

Using the sip.coach training platform (app.sip.coach) requires registration. The personal data processed during registration and subsequent use (including account data, training and conversation data, and scoring results) is described in detail in the separate privacy notices within the app, which govern the respective usage relationship.

In summary: data is stored in the EU / Germany. For account management and authentication, we use a self-hosted instance of the Keycloak software: login credentials and identity information therefore never leave our own infrastructure, which is operated within the EU. The legal basis is the performance of the usage contract (Art. 6(1)(b) GDPR) and, for team and enterprise accounts, a separately concluded Data Processing Agreement (DPA) with the respective employer as the data controller for its employees' data.

Within the app, we additionally use technically necessary cookies for sign-in and sessions. For usage statistics, we use the same self-hosted Matomo instance there as on this website, but without the banner described in section 4: Matomo runs on our own servers in Germany and sets no cookies in the app either. You can turn off usage statistics in your account settings at any time; it is on by default. Further details are in the privacy notices within the app.

7. Payment Processing via Stripe

To process paid orders, we use the payment service provider Stripe (Stripe Payments Europe, Limited, 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland, and affiliated companies, "Stripe"). As part of the checkout process, we transmit the data required for payment processing (including name, payment details, billing address, and amount) to Stripe.

The legal basis is Art. 6(1)(b) GDPR (performance of the contract). This may involve a transfer of data to Stripe group companies outside the EU. For details on that processing and the safeguards applied, see Stripe's privacy policy: stripe.com/privacy.

8. Invoicing and Accounting

To fulfill our commercial and tax law obligations and for invoicing purposes, we use the ERP system Odoo. This involves processing contract, invoice, and payment data, which is retained for the periods required by law.

The legal basis is Art. 6(1)(c) GDPR in conjunction with statutory commercial and tax retention obligations (in particular § 147 of the German Fiscal Code (AO) and § 257 of the German Commercial Code (HGB)).

9. Voice Recordings in Live Sparring and the Objection Dialogue

On our website you can speak a conversation with an AI persona instead of typing it (live sparring on the home page and at /sparring/). We access your microphone only with your explicit permission; without it, text input remains fully available. You can withdraw that permission in your browser at any time.

The purpose of the processing is to convert your recording into text (transcription) and to speak the reply aloud. The legal basis is your consent under Art. 6(1)(a) GDPR. Consent is voluntary and can be withdrawn at any time with effect for the future.

The recipients are the speech-AI processors listed in section 10, namely the provider that converts speech into text and the provider that generates the spoken reply. The audio data is processed in memory only, is never written to disk, and is discarded immediately after the conversion. Only the text is stored; neither the recording nor the transcript is written to our log files.

10. Recipients and Processors

Within our company, access to your data is granted only to those units that need it to fulfill our contractual and legal obligations. To provide our services, we engage carefully selected service providers as processors (Art. 28 GDPR), including for hosting, payment processing (Stripe) and accounting (Odoo). Web analytics (Matomo, only after consent) runs on our own infrastructure and is not an external processor. In addition, two speech-AI providers are involved: one for converting speech into text (transcription) and one for generating the spoken reply (text to speech), both only after your consent under section 9. We have entered into corresponding agreements with all processors that ensure a level of protection consistent with the GDPR.

11. Data Transfers to Third Countries

Personal data is transferred to countries outside the European Union / European Economic Area ("third countries") only where necessary for the purposes described in this policy, in particular in connection with payment processing via Stripe and individual speech-AI steps (transcription and spoken output) after consent. Our web analytics (Matomo) runs exclusively on our own infrastructure in Germany; it involves no transfer to third countries. For the other cases, we ensure an adequate level of data protection through appropriate safeguards, in particular EU Standard Contractual Clauses issued by the European Commission and/or certification of the recipients under the EU-US Data Privacy Framework.

12. Retention Period

Unless a more specific retention period is stated in this policy, we process and retain personal data only for as long as necessary to achieve the respective processing purpose. Where statutory retention obligations apply (such as commercial and tax law retention periods of up to ten years for invoices and accounting records), we retain the affected data for the duration of those obligations; processing for other purposes generally does not take place during that period.

13. Your Rights as a Data Subject

Under the GDPR, you have the following rights with respect to your personal data:

  • Right of access (Art. 15 GDPR)
  • Right to rectification (Art. 16 GDPR)
  • Right to erasure (Art. 17 GDPR)
  • Right to restriction of processing (Art. 18 GDPR)
  • Right to data portability (Art. 20 GDPR)
  • Right to object to processing based on Art. 6(1)(f) GDPR (Art. 21 GDPR)
  • Right to withdraw consent given, with future effect (Art. 7(3) GDPR)

To exercise these rights, an informal message to hello@sip.coach is sufficient. App users can also access data export and account deletion directly in their account settings.

14. Right to Lodge a Complaint with a Supervisory Authority

Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a data protection supervisory authority, in particular in the member state of your habitual residence, place of work, or the place of the alleged infringement. The authority responsible for our company's registered office is:

Die Sächsische Datenschutz- und Transparenzbeauftragte
(Saxon State Commissioner for Data Protection)
Devrientstraße 1
01067 Dresden, Germany
Phone: +49 351 85471-101
E-mail: saechsdsb@slt.sachsen.de
Web: www.datenschutz.sachsen.de

15. No Automated Decision-Making

We do not use solely automated decision-making within the meaning of Art. 22 GDPR that produces legal effects concerning you or similarly significantly affects you. The AI-powered scoring within the app evaluates the quality of simulated training sessions and serves exclusively your personal development; no automated decisions with legal effect on you are made on this basis.

16. Currency and Amendment of this Privacy Policy

This privacy policy is currently in effect and dated 2 October 2026. As we develop our website and services further, or due to changes in legal or regulatory requirements, it may become necessary to amend this privacy policy. The current version is always available at this address.

This privacy policy is under ongoing legal review and will be updated accordingly.