Privacy Notice

As of August 2026 · GDPR Art. 13/14 · The German version is the authoritative text.

1. Controller

Schübeler Consulting
Johann Jörgen Schübeler
Am Kreuzberg 10, 37688 Beverungen, Germany
Email: info@schuebeler-consulting.de

2. Data we process

• Account data: email address and the workspace name you choose. Legal basis: Art. 6(1)(b) GDPR (contract).
• Memories: the texts you upload or store through the interface. Held in an indexed database in a German data centre (Nuremberg). Legal basis: Art. 6(1)(b) GDPR.
• Your own AI keys: if you store provider keys, they are encrypted with a key specific to your workspace. Only your workspace can use them, and they are not kept in plain text on our servers.
• Access log: sign-in times, plan changes, retrievals and uploads, with the access used. Legal basis: Art. 6(1)(f) GDPR (security of processing).

3. Processors

• Hetzner Online GmbH, Gunzenhausen — server hosting in Nuremberg, Germany. Data processing agreement under Art. 28 GDPR in place.
• Stripe Payments Europe Ltd., Dublin — payment handling for paid plans.
• ALL-INKL.COM (Neue Medien Münnich), Friedersdorf, Germany — sending of sign-in links and billing notices.

4. AI providers (your own keys)

You may optionally store your own provider keys (Anthropic, OpenAI, Google, Mistral, local models). Inference requests then go from our server directly to the provider you chose. We recommend using a provider outside the EU only if you have your own data processing agreement with them.

Third-country note: choosing a provider outside the EU/EEA means inference transfers data to a third country. You initiate and are responsible for that transfer through your choice of provider; the legal basis for it (for example EU standard contractual clauses or an adequacy decision) has to exist between you and that provider. Schübeler Consulting does not cover this transfer with its own standard contractual clauses. If you use EU providers or local models only, content does not leave the EU through knowmind.

Indexing stays local: the vector indexing of your memories (embeddings) happens inside our server environment in Germany. No content is sent to external providers for indexing.

5. Connectors to your own systems

You can set up a connector through which a system you operate — Jira, for example — hands content to knowmind. knowmind retrieves nothing: it holds no credentials for your system and only receives what you have it send. Which events those are is decided in your system.

What that involves: the content itself plus whatever your system includes — for Jira that means issue key, summary, description, resolution and the names of the people involved, such as assignees or comment authors. These are stored like any other memory in your workspace, processed in Germany and not passed to third parties.

Your responsibility: since you decide which events your system sends, you also decide which personal data is handed over. Before setting a connector up, check whether the people concerned — employees or customers whose names appear in issues — may be included, and whether your works council has to be involved. We process this data solely on your instructions under Art. 28 GDPR.

6. Use through the ChatGPT app

If you use knowmind through the app directory of ChatGPT, OpenAI operates that surface. In that setting OpenAI and Schübeler Consulting are separate controllers: your conversation with ChatGPT is governed by OpenAI's terms and privacy notice, what you store in knowmind is governed by this notice. There is no data processing agreement between us and OpenAI, because neither of us processes on behalf of the other.

Practically this means: what our app returns to ChatGPT — the memories you retrieve — passes through OpenAI's systems and is subject to their developer terms, under which OpenAI may use app responses. Your stored content itself stays in Germany. If that separation matters to you, use knowmind through a client where you control the model, or through your own provider key.

7. Your rights

You have the right to:

• access (Art. 15 GDPR)
• rectification (Art. 16)
• erasure (Art. 17)
• restriction of processing (Art. 18)
• data portability (Art. 20)
• objection (Art. 21)

You do not have to ask us for most of these: you can export your data yourself at any time and delete your workspace yourself. How that works. For anything else, write to info@schuebeler-consulting.de. You also have the right to lodge a complaint with a supervisory authority.

8. Cookies

Only what the service needs to work: a session cookie after sign-in and a cookie for your language choice. No tracking, no advertising cookies, no consent banner — because there is nothing to consent to.

9. Retention

Memories stay until you delete them or your workspace. After the contract ends, data remains available for 30 days and is then irreversibly deleted. Access log entries are kept according to your plan — one month on Private, three on Pro, twelve on Team, twenty-four on Business, five years on Enterprise — and deleted automatically afterwards. Invoices are kept as long as tax law requires.

10. Personal data breaches

If we become aware of a breach — unauthorised access, loss or accidental disclosure — we follow a fixed procedure: analyse, contain, document, and assess the risk to the people affected.

• Where we are the controller for the data concerned (account, payment or email data) and the breach is likely to result in a risk to rights and freedoms, we notify the competent supervisory authority without undue delay, where feasible within 72 hours (Art. 33 GDPR). Where the risk is likely to be high, we inform the people affected without undue delay and in plain language (Art. 34 GDPR).
• For the content you process in knowmind as a business customer, you are normally the controller and we are your processor. In that case we do not notify the authority ourselves; we inform you without undue delay and within 48 hours at the latest, with the information available on nature, consequences and countermeasures, so that you can meet your own obligations under Art. 33 and 34 GDPR. The data processing agreement sets out the details.