1. Controller
Daria Hacker
Selma-Lagerlöf-Str.4
13189 Berlin
Germany
Email: hallo@meinekapa.de
Last updated: 21 October 2026
[Add data protection officer details if appointed or required.]
2. Providing the website
The website is provided through Lovable. Using it involves processing technical connection and request data. The IP addresses, browser information, timestamps and other fields actually recorded by hosting and security services, and their retention periods, have not been fully verified.
[Add the hosting provider's legal entity, actual data fields, recipients, processing locations and deletion periods.]
Providing requested app functions may rely on Article 6(1)(b) GDPR where necessary for the user relationship. Security processing may rely on Article 6(1)(f), with the legitimate interest of operating a secure and reliable service. [Confirm these bases against the actual contractual and usage arrangements.]
3. Registration and sign-in
An account is not required to use suggestions. You can register and sign in with an email address and password or use Google sign-in.
Email sign-in processes your email address and authentication data. Your password is transmitted to the authentication service; it is not stored as a plaintext password in saved entries. Registration currently does not require email confirmation. You can request an email link to recover your password. Delivery is not guaranteed.
Google sign-in uses Google and Lovable's sign-in intermediary. Identity and session data required for sign-in are processed. The app subsequently uses your account identifier and email address. [Verify and add any additional Google data, legal entities, provider roles and contractual arrangements.]
The purposes are creating, providing and securing your account. Article 6(1)(b) GDPR applies where the processing is necessary for this purpose; supplementary security processing must be assessed separately.
Account data and saved entries are processed in Lovable Cloud. The account database used by this app is located in Frankfurt, Germany, in eu-central-1. This does not establish that all authentication data, logs, backups or other providers' data are processed exclusively there.
[Add the legal entities and subprocessors for account data, authentication and recovery emails.]
4. AI suggestions
Your submitted text, selected language and relevant method-library information are sent through Lovable to Claude by Anthropic to generate the suggestions you request. The app currently selects anthropic/claude-sonnet-5. Each time you choose “Another idea”, your original text is sent again together with the relevant category and identifiers of previously displayed techniques.
This happens without an account and whether or not you enable saved entries. Suggestions provide everyday coaching support, not diagnosis or therapy. The reviewed functions do not make solely automated decisions producing legal or similarly significant effects within Article 22 GDPR.
[Determine and document the legal basis for AI processing; assess whether Article 6(1)(b) fits the requested service or separate consent is necessary.]
Please do not enter medical or other sensitive personal details. This instruction does not prevent sensitive information from appearing in free text and being sent to AI services. [Assess the legal and technical handling of special categories of personal data under Article 9 GDPR.]
5. Voice input
If you choose optional voice input, your recording is sent through Lovable to OpenAI for conversion into text. The app calls openai/gpt-transcribe. The app does not save a permanent audio file in your account or database. The transcript appears in the input and may subsequently be sent to Claude like typed text and saved as an entry if saving is enabled.
Browser microphone permission is not automatically GDPR consent to all subsequent processing.
OpenAI's official API documentation lists “None” for both abuse-monitoring content retention and application-state retention for /v1/audio/transcriptions. The Lovable model catalog checked on 21 October 2026 also labels the transcription surface actually used as zero. These statements concern content at the transcription service, not all technical metadata, Lovable logs or the text subsequently sent to Claude. [Confirm the legal basis, provider roles, processing locations and any additional gateway/metadata retention.] Source: OpenAI API data controls.
6. Optional entries and pattern suggestions
Only when you are signed in and enable “Remember my entries to spot patterns” does the app privately save your text and selected technique identifiers together with your account identifier, entry identifier and creation time. App access and deletion are restricted to the corresponding account.
Up to ten earlier entries may then be sent to Claude for a new request to help identify patterns. Each earlier entry's text is limited to 1,000 characters.
Turning the switch off stops future entry saving and loading of earlier entries for that pattern function. It does not delete existing entries. They remain until you delete them or your account.
[Determine the legal basis for optional storage and further AI transmission; if relying on Article 6(1)(a) consent, document information, evidence and withdrawal.]
7. Browser storage
The app uses localStorage for:
- favorites, including saved suggestion text and techniques;
- progress and completed steps;
- your chosen language;
- the saved-entry preference;
- the sign-in session and authentication tokens used to keep you signed in.
Signing out removes the local sign-in session. Favorites, progress and preferences remain in the browser. Account deletion also leaves favorites and progress in that browser. You can remove local data by clearing this website's browser data. Not all local items disappear when you close the browser.
Within the Lovable editor, the session may also be synchronized with the preview environment; this concerns the editing preview rather than an additional public sign-in method.
[Assess necessity and legal bases for storing/accessing information on the device under Section 25 TDDDG and subsequent personal-data processing under GDPR; obtain prior consent where required. Separately verify hosting/sign-in cookies and any platform analytics actually used.]
8. Deletion and retention
“Delete all” removes saved account entries, not your account. “Account settings” → “Delete account” removes the account and its saved entries. The app then signs out on this device. This function was verified with a separate test account.
Deletion in the app does not confirm immediate or complete deletion of previously processed data held by AI providers, logs or backups. The following verified statements and limitations apply:
- Active account data and entries: The app has no automatic inactivity-deletion period. Account data remains in the active database until account deletion; entries remain until “Delete all” or account deletion. Disabling the memory feature does not remove existing entries.
- Cloud database backups: Lovable documents one database backup per day and retention of up to roughly 14 days of daily backups. Deleted data may remain in earlier backups until those snapshots leave the backup window. This is the published general backup policy, not verification of the current backup inventory or a guarantee covering every other copy. Source: Lovable Database.
- Claude / Anthropic: On 21 October 2026, Lovable labels the Messages surface used as
provider_retained, without a number of days. Anthropic publishes deletion of inputs and outputs within 30 days of receipt or generation for its standard API. Exceptions include different agreements, longer-retention features, policy enforcement and legal duties. For content automatically flagged as a policy violation, Anthropic states up to two years for inputs/outputs and up to seven years for safety classifications. These published standard rules are not a confirmed project-specific 30-day guarantee for calls mediated by Lovable. [Obtain written confirmation of the Anthropic contractual period and any model-specific rules applicable to the actual mediation service.] Source: Anthropic commercial retention. - OpenAI transcription: OpenAI documents no abuse-monitoring content retention and no persisted application state for
/v1/audio/transcriptions; the Lovable transcription surface used is labeledzero. This must not be confused with the general 30-day logging rules of other OpenAI endpoints and does not establish additional metadata or gateway-log retention. Source: OpenAI. - Google sign-in: Google does not publish a single period for all sign-in data. Retention depends on the data type, purpose and account settings. Deleting your MeineKapa account does not delete your Google account or automatically erase Google's data. Google's general deletion description refers to normally around two months for certain deletion processes and possible backup retention of up to six months, subject to exceptions; these are not universal deadlines for Google sign-in data. Source: Google retention.
- Local browser data: Favorites, progress and language preferences have no app-imposed automatic expiry. They remain until removed or this site's browser data is cleared; the saved-entry preference can be changed using the switch. Sign-in sessions are removed on sign-out; token expiry is not equivalent to erasure of all authentication data.
- Systems still requiring confirmation: [Add specific periods for hosting/error and authentication logs, recovery emails, mailbox data, additional gateway logs and other backups.] The public sources reviewed do not establish consistently applicable project-specific periods for these systems.
[Confirm applicable statutory retention duties and any different deletion procedures.]
9. Recipients and international transfers
Services involved include Lovable for hosting, account services and AI mediation, Anthropic for Claude, OpenAI for transcription, and Google if you choose Google sign-in. Lovable's public processing agreement identifies Lovable Labs AB, Regeringsgatan 25, 111 53 Stockholm, Sweden. The page describes inclusion of that agreement for Business and Enterprise plans; its actual applicability to this project still needs confirmation. The platform privacy policy does not replace this app's end-user privacy notice. Lovable DPA · Lovable Privacy.
[Add legal entities, processing agreements, independent-controller roles, subprocessors and actual processing locations.]
Potential processing or access outside the European Economic Area has not been fully verified. A German database location alone does not rule out international transfers.
[Add actual countries and transfers and, where applicable, valid adequacy decisions or appropriate safeguards under Articles 44 onward GDPR and how to obtain them. Do not assert unverified DPF certification or standard contractual clauses.]
10. Diagnostics, contact and newsletter
The app's own error reporting has been limited to sanitized error-type/status information; it is intended not to log private input, error messages, stacks or provider response bodies. This is not a statement about all hosting or AI-service logs. [Verify production telemetry, recipients and retention.]
If you email hallo@meinekapa.de, your email address, message and any other voluntarily supplied details are processed to respond. The basis may be Article 6(1)(b) for contract-related requests or Article 6(1)(f), with the legitimate interest of responding to other enquiries. [Add the mailbox provider, retention periods and actual legal basis.]
A contact form with automated email delivery is not currently configured. A Brevo newsletter is planned but not connected. Registering an account does not subscribe you to a newsletter. This notice will be updated with actual email and consent processes before those features are enabled.
11. Your rights
Subject to statutory conditions, you have rights of access, rectification, erasure, restriction, portability and objection. Where consent is the basis, you can withdraw it at any time for the future without affecting the lawfulness of earlier processing.
Objection: You can object to processing based on Article 6(1)(f) GDPR on grounds relating to your particular situation, subject to statutory conditions and exceptions.
Send requests to hallo@meinekapa.de. You can complain to a data protection supervisory authority, particularly where you live, work or where an alleged infringement occurred. In Berlin this is the Berliner Beauftragte für Datenschutz und Informationsfreiheit: https://www.datenschutz-berlin.de/.
Account data is necessary to provide an account; without it, you can still use suggestions without an account. The app cannot generate individualized suggestions without submitted or transcribed text. Voice input and saving entries are optional.