Privacy Policy

Last updated: 11 October 2026

1. Controller

The controller within the meaning of the EU General Data Protection Regulation (GDPR) and other data-protection provisions is:

Maximilian Gürke
Oberdorf 31
99947 Bad Langensalza
Germany
Email: contact@baldur.studio

2. Scope

This privacy policy applies to the website at https://baldur.studio and the application at https://app.baldur.studio (together “Baldur Studio”).

3. What Baldur Studio does with your inputs

You enter advertising copy, headlines, calls to action and audience details. These inputs are transmitted to a language model that uses them to generate the reactions of synthetic persona agents. Do not transmit third-party personal data and no confidential information in the ad-copy fields - they are transferred to the model provider for processing (see section 5).

4. Hosting

The website and the application are hosted at:

Unesty
Geschwister-Scholl-Platz 5
09648 Mittweida
Germany

The servers are located in Frankfurt am Main, Germany. Unless otherwise stated, user data is processed in Germany or in the European Economic Area.

5. Application infrastructure and processors

The application uses the following services. Where they act as processors within the meaning of Art. 28 GDPR, processing takes place on the basis of data-processing agreements and, where necessary, appropriate safeguards for third-country transfers:

Supabase (database, authentication, storage) - project infrastructure in the EU.
Cloudflare (DNS, CDN, protection against attacks). Requests technically travel through Cloudflare’s network before they reach our server.
PostHog EU (PostHog Inc., Cloud Region Frankfurt, Germany) - Privacy-friendly product analytics and session recording. Processing takes place strictly within the EU (Frankfurt am Main) and relies on your explicit consent (Art. 6 para. 1 lit a GDPR, § 25 para. 1 TDDDG). All IP addresses are discarded at collection, URLs are scrubbed of credentials, and sensitive ad copy/prompts in the workbench are fully masked.
Language-model providers. The generation of persona reactions runs through model endpoints from Google and Microsoft Azure. In the process, the advertising copy you enter as well as the used persona profiles are transmitted. Processing outside the EU (in particular in the USA) is possible; it relies on the European Commission’s standard contractual clauses or the EU-US Data Privacy Framework, insofar as the respective provider is certified.

Disclosure: A payment processing service is currently not set up. As soon as paid plans are offered, this section will be extended to include the payment service provider before activation.

6. Data processed when visiting the website

When you visit the website, your browser automatically transmits information to the server. The following data may be temporarily stored in server log files: IP address of the requesting device; date and time of access; name and URL of the requested file; referrer URL; browser and operating system; name of your access provider.

Processing takes place on the basis of Art. 6 para. 1 lit f GDPR (legitimate interest in a secure, stable and optimized operation of the website). This data is not merged with other data sources for profiling purposes.

7. Account, simulations and contact

When you create an account or save simulations, we process account data (email address, authentication IDs), usage and credit data as well as the advertising copy and audience details you transmit, in order to provide the service (Art. 6 para. 1 lit b GDPR).

When you contact us by email, we process the data you transmit (email address, possibly name, message content) to handle your request (Art. 6 para. 1 lit b or lit f GDPR; where consent is required, Art. 6 para. 1 lit a GDPR). You may revoke consent you have given at any time with effect for the future.

Baldur Studio uses no third-party advertising cookies and sells no user data to brokers or marketing networks.

Technically necessary storage (§ 25 para. 2 TDDDG): The application sets strictly necessary cookies and local storage entries for authentication, session integrity and user preferences (such as the light/dark theme and your consent choice). These are required to operate the service and do not require consent.

Product analytics and session recording (§ 25 para. 1 TDDDG, Art. 6 para. 1 lit a GDPR): If you grant explicit consent via our privacy banner, we use PostHog EU to collect interaction events (such as section views, button clicks and scroll depth) and session recordings to identify interface bugs and improve simulation flows. You can grant, decline or revoke your consent at any time via the banner or by clearing your browser settings.

9. Retention period

Server logs are only kept as long as is necessary for security and operation, and are then deleted or anonymized. Account, simulation and analysis data is stored for the duration of the contractual relationship and deleted or anonymized after account closure, unless statutory retention obligations oppose this (e.g. commercial and tax retention under the AO and related provisions). Contact emails are kept until the request is resolved and for a short grace period, unless longer retention is required.

10. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16 GDPR), erasure (Art. 17 GDPR), restriction of processing (Art. 18 GDPR), data portability (Art. 20 GDPR) and objection to processing based on legitimate interests (Art. 21 GDPR). Where processing is based on consent, you may revoke it at any time (Art. 7 para. 3 GDPR).

You also have the right to complain to a supervisory authority (Art. 77 GDPR). For Thuringia this is the Thuringian State Commissioner for Data Protection and Freedom of Information.

11. Security

Baldur Studio uses TLS/SSL encryption during transmission. You can recognize an encrypted connection by the “https://” in the browser’s address bar.

12. No automated decisions with legal effect

Baldur Studio makes no automated decisions that produce legal effects concerning you or similarly significantly affect you within the meaning of Art. 22 GDPR. Simulation results are decision aids; you remain responsible for your own decisions.