Privacy Policy

Last updated: 12.10.2026

1. Introduction
This privacy policy explains what personal data we collect when you visit our website debiaslab.com or use our platform app.debiaslab.com (the “Platform”), how we use it, and the rights you have under the General Data Protection Regulation (GDPR), the German Federal Data Protection Act (BDSG) and the German Telecommunications Digital Services Data Protection Act (TDDDG).
Debias is a brand of Dr. Nina Weber, Einzelunternehmen, based in Berlin, Germany. Our full contact details are in the imprint.
We have written this policy to be readable. If anything is unclear, please contact us at contact@debiaslab.com and we will explain.

2. Controller
The controller responsible for processing your personal data on debiaslab.com and app.debiaslab.com is:
Dr. Nina Weber, Einzelunternehmen, trading as Debias
Lepsiusstr. 14
12163 Berlin
Germany
E-Mail: contact@debiaslab.com

3. Data we collect
We only collect data that you provide voluntarily, plus the technical data necessary to deliver and secure the website.
3.1 Server log data
When you visit the website, our hosting provider (IONOS SE, Germany) automatically collects technical information for security and operational reasons. This typically includes:
• IP address (in shortened form where possible)
• Date and time of the request
• Pages requested
• HTTP status code and amount of data transferred
• Referring URL (the page you came from)
• Browser type and operating system
This data is necessary to deliver the website and protect against abuse. It is not combined with other data to identify individual visitors.
3.2 Contacting us by email
If you contact us by email, we process your email address, your name (if provided) and the content of your message. We use this data only to reply to your enquiry and, if relevant, to discuss a possible collaboration.
3.3 Newsletter signup data
If you subscribe to our newsletter, we collect:
• Your email address
• Your consent to receive the newsletter (recorded with timestamp)
• Your confirmation of the subscription via the link in the confirmation email (recorded with timestamp)
We use a double opt-in process: after you sign up, you receive an email with a confirmation link. Your subscription only becomes active once you click that link. This ensures that nobody can sign up someone else’s email address.
The newsletter is sent about once a month and contains practical guides on customer research and the psychology of buying decisions, best practices for Debias, product news and subscriber-only discounts.
You can unsubscribe at any time using the link at the bottom of every newsletter, or by contacting us.
3.4 Cookies and similar technologies
The website uses cookies and similar technologies. The Platform only uses technically necessary storage technologies, in particular to keep you signed in (§ 25(2) no. 2 TDDDG). You can review and manage your cookie preferences via our cookie consent banner (powered by CookieYes) at any time by clicking the “cookie settings” link in the footer.
We distinguish between:
• Strictly necessary cookies, which are required for the website to function (for example, to remember your cookie preferences or to protect the newsletter signup against spam). These are set without consent under § 25(2) no. 2 TDDDG.
• Optional cookies (analytics), which are only set after you give explicit consent through the cookie banner (§ 25(1) TDDDG).
A full list of cookies in use, including their purpose and retention period, is available inside the cookie banner.
3.5 Platform account
If you create an account on the Platform, we process:
• Your name and email address
• Your password (stored only in encrypted form)
• If you sign in with Google: the name, email address and profile picture that Google sends us after your approval
• Information about your workspace (e.g. name, website domain, business model, offering) and invited members (name, email address, role)
• A log of activities in the workspace (e.g. who started a study or bought credits)
• Technically necessary sign-in data (session token in your browser)
We use this data to provide the Platform, manage your account and send you emails required for using it (e.g. email address confirmation, password reset, order confirmations).
3.6 Orders, payments and invoices
If you order a study or Analyser scans, we process the order data (service, price, time), your billing details (name or company, address, VAT ID if applicable) and information on the payment status. The Platform passes your full payment details (e.g. card number or IBAN) directly to our payment provider Stripe; we only receive limited information (e.g. card type and the last four digits).
3.7 Uploaded content and study results
For studies and scans, we process the content you upload or provide (e.g. screenshots, URLs, images, texts, product descriptions), your study settings (e.g. goals, target audience criteria) and the results. This content usually contains no personal data; please do not upload personal data of third parties that is not necessary for the study.
Your content is shown to the participants of the study. Participants do not learn your name or contact details. Conversely, you only receive analysed, anonymised results from us and no data that identifies individual participants.
As agreed in our Platform Terms, we also use content, study data and results in anonymised form for benchmarks, for developing and training the Analyser and for aggregated reports. This anonymised data no longer contains personal data.
How we process participants’ data is described in our separate privacy notice for participants.

4. How we use your data and the legal basis
We process your data only for the purposes set out below. Each purpose is supported by a legal basis under Art. 6(1) GDPR.
• Delivering and securing the website (server logs): Art. 6(1)(f) GDPR – legitimate interest in operating a working, secure website.
• Responding to email enquiries: Art. 6(1)(f) GDPR – legitimate interest in responding to enquiries; and Art. 6(1)(b) GDPR where the enquiry relates to a potential contract.
• Sending the newsletter: Art. 6(1)(a) GDPR – your consent.
• Protecting the newsletter signup against spam and bots (reCAPTCHA): Art. 6(1)(f) GDPR – legitimate interest in protecting the website against abuse.
• Booking a free demo (Calendly): Art. 6(1)(b) GDPR – steps taken at your request prior to entering a contract.
• Providing the Platform, managing your account and workspace: Art. 6(1)(b) GDPR – contract for the use of the Platform.
• Processing orders, payments and refunds: Art. 6(1)(b) GDPR – performance of contract.
• Running studies and Analyser scans with your content: Art. 6(1)(b) GDPR – performance of contract.
• Anonymising content, study data and results for benchmarks, model training and reports: Art. 6(1)(f) GDPR – legitimate interest in developing our services.
• Sign-in with Google: Art. 6(1)(b) GDPR – performance of contract (at your request).
• Preventing misuse and securing the Platform (e.g. activity log): Art. 6(1)(f) GDPR – legitimate interest in a secure platform.
• Analytics (where consent is given): Art. 6(1)(a) GDPR – your consent via the cookie banner.
• Managing and documenting your cookie consent (CookieYes): Art. 6(1)(c) GDPR in conjunction with Art. 7(1) GDPR – legal obligation to demonstrate consent.
• Complying with legal obligations (e.g. invoicing, tax records): Art. 6(1)(c) GDPR – legal obligation.

5. Third-party processors and recipients
To operate the website we use the following service providers. Each one processes data on our behalf under a Data Processing Agreement (DPA) where applicable.
5.1 IONOS SE (Germany) – hosting
The website is hosted by IONOS SE, Elgendorfer Str. 57, 56410 Montabaur, Germany. IONOS processes server log data described in section 3.1.
Privacy policy: https://www.ionos.de/terms-gtc/datenschutzerklaerung/
5.2 Brevo (France) – newsletter delivery
Newsletter signups are processed by Brevo (Sendinblue SAS, 17 rue Salneuve, 75017 Paris, France). Brevo sends the confirmation email and the newsletter.
Legal basis: Art. 6(1)(a) GDPR (your consent at signup).
Data transferred: email address, consent and confirmation timestamps, technical data needed to deliver the email (e.g. opens and clicks).
Privacy policy: https://www.brevo.com/legal/privacypolicy/
5.3 Calendly (USA) – demo booking
When you click a “Book a free demo” link, you are taken to a separate booking page operated by Calendly (Calendly LLC, United States). Calendly processes whatever booking information you choose to provide there. We receive the booking confirmation and any details you submit during booking.
Legal basis: Art. 6(1)(b) GDPR (steps taken at your request prior to entering a contract) and Art. 6(1)(f) GDPR (legitimate interest in scheduling calls efficiently).
This involves a transfer of data to the United States. Calendly LLC is certified under the EU-US Data Privacy Framework.
Privacy policy: https://calendly.com/legal/privacy-notice
5.4 Google (Ireland/USA) – fonts, reCAPTCHA, sign-in, analytics
Operator: Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland, and Google LLC, USA.
The website uses the following Google services:
• Google Fonts (Playfair Display, Inter, DM Serif Display and DM Sans) are loaded from Google’s content delivery network on the website and (Inter) on the Platform. When the fonts load, your IP address is transferred to Google.
Legal basis: Art. 6(1)(f) GDPR (legitimate interest in presenting our content with consistent typography).
• Google reCAPTCHA (invisible version) protects our newsletter forms against spam and automated signups. reCAPTCHA loads when you open a page and evaluates information such as your IP address, browser and device information and your interaction with the page to distinguish humans from bots. reCAPTCHA may set cookies in the process.
Legal basis: Art. 6(1)(f) GDPR (legitimate interest in protecting the website against abuse).
• Sign-in with Google on the Platform (Google Sign-In): if you sign in with your Google account, Google sends us your name, email address and profile picture after your approval. Google learns that you are signing in to Debias.
Legal basis: Art. 6(1)(b) GDPR (performance of contract at your request).
• Google Analytics 4, integrated via the WordPress plugin Google Site Kit. We use Google Consent Mode: the Google tag script loads when you open a page, which technically transfers your IP address to Google. However, analytics data is only collected and analytics cookies are only set after you consent via the cookie banner. Google Analytics 4 does not store IP addresses.
Legal basis: Art. 6(1)(a) GDPR and § 25(1) TDDDG (your consent).
Transfers to the USA are safeguarded by the EU-US Data Privacy Framework, under which Google LLC is certified, and by EU Standard Contractual Clauses.
Privacy policy: https://policies.google.com/privacy
5.5 CookieYes (United Kingdom) – consent management
Our cookie banner is provided by CookieYes (CookieYes Limited, 3 Warren Yard, Warren Park, Wolverton Mill, Milton Keynes, MK12 5NW, United Kingdom). CookieYes stores your cookie preferences in a cookie in your browser and logs your consent (consent ID, time, selected categories) so that we can demonstrate consent as required.
Legal basis: Art. 6(1)(c) GDPR in conjunction with Art. 7(1) GDPR (demonstrating consent).
The European Commission has issued an adequacy decision for the United Kingdom.
Privacy policy: https://www.cookieyes.com/privacy-policy/
5.6 Lovable (USA/Sweden) – operating the Platform
The Platform is built and hosted with Lovable. Our contracting party and processor is Lovable Labs Incorporated, 1 Lincoln St, Boston, MA 02111, USA; its EU contact is Lovable Labs Sweden AB, Regeringsgatan 25, 111 53 Stockholm, Sweden. Lovable stores account, workspace, order and study data as well as your uploaded content in a database in the EU (Ireland region) and sends the Platform’s emails (e.g. email address confirmation, password reset). Lovable uses sub-processors for this, in particular Supabase (database and authentication, EU), Google Cloud Platform (applications and infrastructure, Netherlands) and Amazon Web Services (storage and email delivery, including the United Kingdom). The current list is available at https://trust.lovable.dev.
Legal basis: Art. 6(1)(b) GDPR (performance of contract).
As Lovable Labs Incorporated is based in the USA and is not certified under the EU-US Data Privacy Framework, we rely on EU Standard Contractual Clauses, which form part of the data processing agreement with Lovable.
Privacy policy: https://lovable.dev/privacy
5.7 Stripe (Ireland) – payments and invoices
Payments on the Platform are processed by Stripe (Stripe Payments Europe, Limited, Dublin, Ireland). Stripe also creates the invoices and calculates VAT. Stripe processes your payment details (e.g. card details, IBAN), your billing details, the amount and technical data for fraud prevention (e.g. IP address, device information).
Stripe is an independent controller for fraud prevention and for complying with its own legal obligations (e.g. anti-money laundering).
Legal basis: Art. 6(1)(b) GDPR (performance of contract) and Art. 6(1)(c) GDPR (legal obligations).
Data may be transferred to Stripe, LLC (formerly Stripe, Inc.) in the USA; Stripe, LLC is certified under the EU-US Data Privacy Framework.
Privacy policy: https://stripe.com/privacy
5.8 No sale or unrelated use of data
We do not sell, rent, or trade your personal data. We share data only with the processors listed above, only for the purposes described, and only to the extent necessary to deliver the website and our services.

6. International data transfers
Some of the service providers above are based outside the European Economic Area (EEA), in particular in the United States and the United Kingdom. Whenever data is transferred outside the EEA, we rely on legal safeguards under Chapter V of the GDPR, including:
• adequacy decisions of the European Commission (the EU-US Data Privacy Framework for certified US companies; the adequacy decision for the United Kingdom), and
• in addition, EU Standard Contractual Clauses (SCCs) approved by the European Commission.
You can request more information about the specific safeguards in place by contacting us at contact@debiaslab.com.

7. Data retention
We keep personal data only for as long as we need it for the purpose it was collected, or for as long as we are legally required to.
• Server logs: 7 days, then automatically deleted.
• Email enquiries: For the duration of the conversation, plus a reasonable period afterwards (typically up to 12 months); emails that count as business correspondence (e.g. about orders) 6 years, as required under § 147 AO.
• Newsletter data: Until you unsubscribe or request deletion; we keep proof of your consent for as long as needed to defend against possible claims.
• Account and workspace data: Until your account is deleted.
• Uploaded content and study results: Until your account is deleted; anonymised data (section 3.7) indefinitely.
• Workspace activity log: Until the workspace is deleted.
• Cookie consent: The consent cookie is deleted after 1 year.
• Invoices and accounting vouchers: 8 years, as required under § 147 AO.
• Other tax-relevant records (e.g. books, annual accounts): 10 years, as required under § 147 AO.
When data is no longer needed, we delete or anonymise it.

8. Your rights under GDPR
You have the following rights regarding your personal data. Many of these can be exercised by emailing us at contact@debiaslab.com. We will respond within one month, in line with Art. 12(3) GDPR. We may need to verify your identity before disclosing personal data.
• Right of access (Art. 15 GDPR): you can ask what personal data we hold about you.
• Right to rectification (Art. 16): you can ask us to correct inaccurate or incomplete data.
• Right to erasure (Art. 17), the “right to be forgotten”: you can ask us to delete data we no longer need or that we hold without a valid legal basis. Note that we may have to keep some data to meet legal obligations (e.g. tax records).
• Right to restrict processing (Art. 18): you can ask us to pause processing in specific circumstances (e.g. while we verify a correction).
• Right to data portability (Art. 20): you can ask for a copy of data you provided to us in a structured, machine-readable format.
• Right to object (Art. 21): where we process data based on legitimate interest, you can object and we will stop unless we have compelling grounds that override your rights.
• Right to withdraw consent (Art. 7(3)): where processing is based on consent, you can withdraw it at any time, for cookies via the “cookie settings” link in the footer, for the newsletter via the unsubscribe link. Withdrawal does not affect the lawfulness of processing before withdrawal.
• Right to lodge a complaint (Art. 77): you can complain to a supervisory authority. The competent authority for us is the Berliner Beauftragte für Datenschutz und Informationsfreiheit (BlnBDI), https://www.datenschutz-berlin.de.

9. Data breach notification
In the event of a personal data breach that poses a risk to your rights and freedoms, we will notify the competent supervisory authority within 72 hours under Art. 33 GDPR. If the breach is likely to result in a high risk to your rights, we will also inform affected individuals directly under Art. 34 GDPR.

10. Children’s privacy
The website and the Platform are aimed at adults and are not directed at children under 16. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us at contact@debiaslab.com and we will delete it.

11. Changes to this policy
We update this policy when the website, the services we use or the legal requirements change. The “Last updated” date at the top reflects the most recent change. The version published at the time of your visit applies.

12. Contact
For privacy questions or to exercise your rights, please contact us:
Dr. Nina Weber, Einzelunternehmen, trading as Debias
Lepsiusstr. 14
12163 Berlin
Germany
E-Mail: contact@debiaslab.com
The supervisory authority for data protection complaints is:
Berliner Beauftragte für Datenschutz und Informationsfreiheit
Alt-Moabit 59–61, 10555 Berlin
https://www.datenschutz-berlin.de