Privacy Policy

1. Introduction

This privacy policy explains how we — Brumm Labs GbR — process personal data when you use the app.casthub.one platform ("CastHubOne"). We process your data exclusively in compliance with the General Data Protection Regulation (GDPR), the German Federal Data Protection Act (BDSG) and other applicable provisions. CastHubOne is a B2B SaaS offering: use typically takes place on behalf of an organization that has invited you as a user. The legally binding version of this policy is the German one.

2. Data Controller

The controller responsible for the processing of personal data within the meaning of Art. 4 (7) GDPR is:

Further information is available in our legal notice.

3. Data Protection Officer

We are currently not legally required to appoint a data protection officer. For data protection inquiries, please contact us using the details listed in Section 2.

4. Data We Process

We process only the data necessary to operate the platform and provide our services:

4.1 Account and Profile Data

• Email address
• First and last name
• Profile image (optional, from OAuth provider or upload)
• Language and theme preference
• Role (owner, success_manager, admin, user)
• Organization membership and group memberships
• Account creation and last-update timestamps

4.2 Learning and Activity Data

• Per-podcast listening progress (in seconds)
• Quiz attempts, answers and scores
• Quiz status (not started, in progress, completed)
• Completion timestamps

4.3 Content You Provide

• Uploaded audio files and file metadata
• Comments and feedback
• Learning Experience Requests (LXR) and related materials

4.4 Technical Data

• IP address (for rate limiting and security)
• User-Agent (browser, operating system)
• Server logs (method, path, status, duration)
• Error and audit logs
• Session tokens and JWTs (via our auth provider Clerk)

4.5 Notifications

• Notification records (type, title, message, link)
• Read status and context

5. Legal Bases

We process personal data on the following legal bases:

• Art. 6 (1)(b) GDPR (performance of a contract) — for providing the platform and all features you use as part of a contract with your organization.
• Art. 6 (1)(f) GDPR (legitimate interest) — for hosting, security, rate limiting, anonymized reach measurement and error analysis.
• Art. 6 (1)(c) GDPR (legal obligation) — for compliance with statutory retention and disclosure requirements.
• Art. 6 (1)(a) GDPR (consent) — where you have expressly granted your consent (e.g. for optional notifications).

6. Service Providers

We use carefully selected service providers to operate the platform. We have concluded data processing agreements (DPAs) pursuant to Art. 28 GDPR with all providers. For transfers to third countries (in particular the USA), EU Standard Contractual Clauses (SCC) are in place unless an adequacy decision applies.

7. Retention

We store your data only as long as necessary for the processing purpose. Account and learning data are stored for the duration of your platform use; after termination they are deleted or anonymized within 90 days, unless statutory retention obligations apply. Server and audit logs are typically retained for 30 days. Orphaned uploaded files ("orphan blobs") are automatically deleted after 24 hours.

8. Your Rights

You have the following rights regarding personal data concerning you:

• Right of access (Art. 15 GDPR)
• Right to rectification (Art. 16 GDPR)
• Right to erasure ("right to be forgotten", Art. 17 GDPR)
• Right to restriction of processing (Art. 18 GDPR)
• Right to data portability (Art. 20 GDPR)
• Right to object (Art. 21 GDPR)
• Right to withdraw consent (Art. 7 (3) GDPR) — the lawfulness of processing carried out before withdrawal remains unaffected.

An informal message to hallo@brummlabs.de is sufficient to exercise your rights.

8.1 Right to Complain to a Supervisory Authority

You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is:

9. Security

We use technical and organizational measures to protect your data from unauthorized access, loss and manipulation. Data is transmitted encrypted (TLS 1.2 or higher). Passwords are stored hashed at industry standard by our auth provider Clerk; we ourselves do not store any passwords.

10. Automated Decisions and Profiling

Automated decision-making within the meaning of Art. 22 GDPR or profiling with legal effect does not take place.