Privacy policy

This policy tells you what data the website dunel.ai and the dunel app process, on the iPhone and in the browser: for what purpose, on what legal basis, who receives it, how long it is kept and what rights you have. It is available in German, English, Spanish, French, Portuguese and Italian. The German version is authoritative.

In short

• dunel is a personal assistant with AI. Everything you give dunel is saved word for word, with Supabase in Frankfurt am Main, Germany.
• So that dunel can answer you, write notes and add events, the content needed for this goes to OpenAI, including to the USA. For search in your content, text goes to Google Cloud. Both happen only with your consent, which the app asks for before you first use it.
• We don’t sell data, show no ads and don’t track you. This website sets no cookies.
• You can export everything at any time, original files included, and delete your account with everything in it.
• dunel is for people aged 18 and over.

1 Who is responsible

The controller under the General Data Protection Regulation (GDPR) is:

Referred to below as “we”. For all questions about data protection and to exercise your rights, you can reach us at hello@dunel.ai.

2 This website

2.1 When you visit

When you open dunel.ai, your browser sends technically necessary information to our host: your IP address, date and time, the address requested, the page you came from, and an identifier of your browser and operating system. This creates access logs. They are used to deliver the site and protect it against attacks. We don’t build profiles from them or combine them with other data.

The host is Vercel Inc., 440 N Barranca Avenue #4133, Covina, CA 91723, USA. Vercel delivers this website and dunel in the browser. We can view the access logs in our Vercel account for one day. According to its privacy notice, Vercel itself deletes or anonymises them once it no longer needs them for operation and security; Vercel does not state a fixed period there. On the transfer to the USA, see section 9.

The legal basis is our legitimate interest in a secure, working website (Art. 6(1)(f) GDPR).

2.2 No cookies, no tracking

This website sets no cookies and stores nothing on your device. There are no analytics or advertising services, no tracking pixels and no embedded content from other providers. Fonts, images and videos come from our own host. That is why there is no cookie banner either.

2.3 Taking you into the app

One exception, for reading only: if you are signed in to dunel in this browser, the home page checks on opening whether your sign-in is stored here and still valid, and then takes you straight into the app. It only reads that one entry, which the app created when you signed in. It stores nothing, changes nothing and sends nothing. This also applies to a sign-in that has not been renewed for up to 30 days; the app renews it when it opens. This check is strictly necessary so that you reach dunel, which you use yourself, without a detour (§ 25(2) no. 2 TDDDG).

2.4 Links to other providers

Links to other providers, such as the App Store, are plain links. Only when you tap one do you reach that provider, and its privacy notice applies there.

2.5 When you write to us

If you email us, we process your address and your message to reply. If it concerns the app or your account, the legal basis is the user agreement (Art. 6(1)(b) GDPR), otherwise our legitimate interest in answering enquiries (Art. 6(1)(f) GDPR). Our mailbox is hosted by STRATO GmbH in Berlin. We delete your message once the matter is settled, unless a law requires us to keep it.

3 The dunel app

3.1 Account and sign in

You cannot use dunel without an account. You sign in with Apple, with Google, with an email address and password, or with a code sent by email. For this we store your email address, an identifier for your account, when you created it and when you last signed in, and, with Apple or Google, the identifier that provider gives us for this. We use your email address for signing in and for notices about the agreement, for example when the terms of use or the service change. We do not send you advertising.

• Apple: dunel only asks for your email address. If you use “Hide My Email”, we only receive a forwarding address from Apple.
• Google: when you sign in, Google also sends your name and a link to your profile picture. The sign-in service stores both with your account; dunel does not use them.
• Password: we store it only as a check value, never in plain text.
• Code by email: the email contains only the code.

Sending the emails. Emails with a code (for signing in, for confirming your address when you create an account, for changing your address and as a security check when you change your password) are sent for us by the email service Resend of Plus Five Five, Inc., 2261 Market Street #5039, San Francisco, CA 94114, USA. For this, Resend receives your email address and the email including the code, and records when it was sent and whether it was delivered, with the technical details of delivery, such as the reply of the receiving mail server. The emails are sent from a data centre in Ireland and stored at Resend in the USA (section 9). Resend deletes this information after 30 days. Whether you open an email or tap a link in it is not recorded. Other emails, such as replies and notices about the agreement, we write to you from our mailbox at STRATO (section 2.5).

If you sign in with Apple or Google, that provider learns that you are signing in to dunel. The provider is responsible for this itself, and its privacy notice applies.

To protect your account, the sign-in service keeps your sessions and a sign-in log: when, from which IP address and with which browser or device you sign in.

The legal basis for the account and the emails with a code is the user agreement (Art. 6(1)(b) GDPR); for sessions and the sign-in log, it is our legitimate interest in secure accounts (Art. 6(1)(f) GDPR).

3.2 What you give dunel

dunel saves everything you give it, word for word and with date and time: what you write, voice messages together with the recording, photos, screenshots and files, what you share from other apps, and chats you bring along. dunel also saves where a message came from (for example from the app, from sharing or from the widget), the time zone of your account and the language of a text. From your content, dunel creates notes, events, tasks, deadlines and lists and answers you. New versions replace old ones; nothing is overwritten. Earlier versions of a note and the history of an event or a task are also kept until you delete them.

Storage is with Supabase in an Amazon Web Services data centre in Frankfurt am Main. Original files are kept first on your iPhone or in your browser and then there as well. The database separates every account from all others, and only you can reach your content with your sign in.

The legal basis is the user agreement (Art. 6(1)(b) GDPR); for highly personal information, additionally your explicit consent (Art. 9(2)(a) GDPR, section 3.8).

3.3 Voice messages, photos and files

Your iPhone turns voice messages into text itself, using on-device speech recognition. The recording is kept as the original so that you can listen to it. The recording never goes to OpenAI or Google, only the text. Text in photos and screenshots is also recognised by your iPhone.

dunel saves photos and files unchanged as originals. If your iPhone stores additional details in a photo, such as the time it was taken, the device or the location, they remain in the file. dunel does not remove them.

When you send or share an image or a PDF, the app tells you as you send or share it that OpenAI’s AI will analyse the attachment. By sending or sharing it, you allow this for that attachment. For this, an image goes to OpenAI as a reduced copy (HEIC too). For a PDF with a text layer, only its text goes there, and the pages themselves only if the AI needs them for your question; a PDF without a text layer goes as a file (up to 8 MB). Other formats only go as recognised text. The original file stays stored with you unchanged. The legal basis is your consent (Art. 6(1)(a) GDPR).

3.4 Answers, notes and events with AI from OpenAI

So that dunel understands you, answers you, writes notes and adds events, tasks and lists, we send the content needed for this to OpenAI: your message, relevant excerpts from what you gave dunel earlier, relevant notes, how you want to be served (such as “always keep your answers short”), the current conversation, time and time zone, and what the AI looks up for the answer (section 3.5). Some of this happens later in the background, even when the app is closed: notes on messages that dunel did not answer in the chat, the analysis of chats you bring along and the organising of your memory. OpenAI does not receive your email address or your sign-in details.

For customers in the European Economic Area, the contracting party is OpenAI Ireland Limited in Dublin. Processing runs on OpenAI’s worldwide service, so also outside the EU, in particular in the USA (section 9).

We do not let OpenAI store our requests for later retrieval, and by default OpenAI does not use them for training. So that answers come faster, OpenAI may cache parts of a request for up to 30 minutes. To protect against abuse, OpenAI may keep requests for up to 30 days, longer only if a law or a court requires it. We have no commitment that nothing at all is kept.

The legal basis is your consent (Art. 6(1)(a) GDPR); for highly personal information, your explicit consent (Art. 9(2)(a) GDPR). More on this in section 4.

3.5 What the AI looks up for an answer

For an answer, the AI often looks things up itself: in your content and notes, in events, tasks and lists, in the conversation so far, with your permission in your iPhone calendar (section 3.10) or on the internet (section 3.6). dunel saves what it looks up and what it finds together with the answer. This makes it possible to trace how an answer came about and what dunel added along the way. This also applies to events from your iPhone calendar that the AI checked. You don’t see these details in the chat, but they are in your export. They remain until you delete the chat or your account.

The legal basis is the user agreement (Art. 6(1)(b) GDPR); for calendar data, your permission (Art. 6(1)(a) GDPR).

3.6 Looking things up on the internet

If you ask about something in the world, such as opening hours, the weather, prices or news, dunel looks it up on the internet. For this, a separate request sends only a short search query of at most 200 characters to OpenAI’s web search, never your notes or your conversation. The AI phrases the search query from your question. The app does not let email addresses, phone or account numbers through. The AI is told to leave out names and other personal details. This cannot be ruled out entirely, because what you name in your question yourself, such as a place, can end up in the search query. dunel shows the sources. dunel saves the search query and the sources with the answer (section 3.5).

The legal basis is your consent (Art. 6(1)(a) GDPR).

3.7 Search in your content with Google Cloud

So that dunel finds the right things in your content, even when you use different words, Google Cloud calculates series of numbers for search (so-called embeddings) from text passages, from the title and summary of your notes and from search queries. We store the series of numbers for your content and notes in Frankfurt alongside the text they come from. For this, only that text goes to Google Cloud EMEA Limited in Dublin, without your email address or sign-in details. We use Google Cloud’s EU region. Google gives no assurance for this service that processing takes place only there (section 9).

The legal basis is your consent (Art. 6(1)(a) GDPR); for highly personal information, your explicit consent (Art. 9(2)(a) GDPR).

3.8 Highly personal information

If you tell dunel, for example, about your health or your genetic make-up, your religion or beliefs, your political opinions, membership of a trade union, your ethnic origin, your sex life or your sexual orientation, these are specially protected data (Art. 9(1) GDPR). dunel saves and processes them like everything else, including with OpenAI and Google as described above, and only for your own answers, notes and reminders. You give your explicit consent to this when you start the app (Art. 9(2)(a) GDPR, section 4).

3.9 Information about other people

In dunel you also talk about other people, family, friends or colleagues, and dunel keeps notes about them. This also applies to what you wrote about others in chats you bring along. We save and process this information like the rest of your content, only for you and for nothing else, including with OpenAI and Google as described above. dunel does not match it against other accounts.

The legal basis towards these people is the legitimate interest in offering you an assistant for your own life, which includes other people (Art. 6(1)(f) GDPR). We don’t know these people and can’t reach them, so we don’t inform them individually (Art. 14(5)(b) GDPR). Anyone who believes their data is in dunel can contact us. Please only tell dunel about others what you need for your everyday life, and be careful with the health and similarly personal matters of other people.

3.10 Calendar, reminders and notifications

Reading your calendar. If you turn on “Read iPhone calendar” in your profile under Calendar and allow it in iOS, dunel shows your iPhone events in planning, only on this device. They don’t go to us or to the AI.

Calendar in the chat. If you also turn on “Use in chat”, the app sends the titles, times, places and calendar names of your iPhone events from seven days back to 61 days ahead with every message, at most 300 events, so that dunel knows them too when planning. They are only saved and sent to OpenAI if the AI checks your calendar for an answer; section 3.5 then applies. The permission applies to your account on this device, and you can turn it off there again at any time. The legal basis is your consent (Art. 6(1)(a) GDPR).

Adding to your calendar. If you set it up this way, dunel adds events and reminders to Apple Calendar or Apple Reminders, in a calendar of its own. These entries are stored by Apple on your device and, if you sync calendars via iCloud, there as well; Apple’s privacy notice applies to this. We only store which entry belongs to which event. If you delete your account on another device or revoke dunel’s access to the calendar in iOS, these entries may remain. You then delete them in the Calendar app.

Notifications. The app schedules reminders on your iPhone as notifications. A notification shows the title that dunel gives the item and a fixed sentence, never your own words. The title can still reveal what it is about. Whether notifications can be read on a locked iPhone is up to your iOS settings (Notifications, Show Previews). Today, reminders do not run through a server. If that is added, we will update this policy beforehand.

The legal basis for adding entries and reminding you is the user agreement (Art. 6(1)(b) GDPR).

3.11 Chats from ChatGPT and Claude

You can bring along exports from ChatGPT and Claude. You select the export file, and dunel saves the original files unchanged so that you can get them back in full. Your own messages are taken over, the newest 10,000 per import. What the other AI answered there, dunel reads as context. The analysis runs in the background with OpenAI’s AI, and search with Google Cloud, as described above.

The original files contain everything in your export, including conversations that dunel does not take over. They remain saved until you delete your account, even if you delete chats in dunel.

The legal basis for saving is the user agreement (Art. 6(1)(b) GDPR), for highly personal information additionally your explicit consent, and for the analysis your consent (Art. 6(1)(a), Art. 9(2)(a) GDPR).

3.12 What is stored on your iPhone

So that dunel works without a connection too, your iPhone holds your sign-in, messages that haven’t reached us yet, the originals of your voice recordings, photos and files, and the scheduled reminders. Originals on your iPhone are included in your iCloud or computer backup if you back up your iPhone that way.

Face ID, the widget, the lock screen, the Action button and sharing from other apps run through iOS on your iPhone. With Face ID for the app lock, dunel receives no biometric data; iOS only reports whether unlocking worked.

The app’s error log keeps the last 50 entries, only on your iPhone and without your messages. It only reaches us if you email it yourself, and you see the whole text beforehand. dunel uses no services from other providers for analytics or crash reports.

A check value in case your account is deleted. When you use the app on your iPhone with your account, it stores a random value for your account there that only this device knows, and sends it to us once. We store only a check value of it with your account, from which the value cannot be recovered. If your account is deleted, including on another device or 30 days after a withdrawal (section 4), this check value remains for another 400 days, without any link to you, your account or your content. If you open dunel on this iPhone afterwards, it asks with its value, learns that the account has been deleted and cleans up there: messages that had not yet reached us, originals, drafts and scheduled reminders. Anyone who does not know the value learns nothing, not even whether an account exists. So that no one can ask in bulk, we count these requests per minute, using a check value of the IP address instead of the address itself. We delete this counter every day. In the browser there is no such value. The legal basis is the user agreement while your account exists (Art. 6(1)(b) GDPR), and afterwards our legitimate interest in nothing from your account remaining on your devices after a deletion (Art. 6(1)(f) GDPR).

The legal basis is the user agreement (Art. 6(1)(b) GDPR); for the error log you send us, our legitimate interest in fixing errors (Art. 6(1)(f) GDPR).

3.13 dunel in the browser

At dunel.ai/app/ you can also use dunel in the browser, with the same account. For this, the app stores what it needs to work in your browser: your sign-in in the browser’s local storage, messages that haven’t reached us yet and the state of your chats in a browser database (“dunel-lokal”), originals of your photos and files, exports and the error log in a second one (“dunel-dateien”), and a few settings of this browser, such as whether the sidebar is closed. Even before you sign in, this browser remembers two markers without content: whether you have seen the short introduction and, for this tab only, that the welcome has already played; if you come from a page in another language, that language too. This is strictly necessary for the service you have expressly asked for (§ 25(2) no. 2 TDDDG). dunel sets no cookies there either.

When you sign out, dunel clears this browser: your sign-in, unsent messages, originals, exports and the log are deleted. All that remains is a note that you signed out, after an account deletion a note about that, and three settings without content. On a shared or someone else’s computer, it is therefore best to sign out when you are done. A browser may also delete this data on its own, for example after a long time without a visit; whatever has already reached us stays.

In the browser, dunel does not record voice messages, send reminders or read a calendar. The legal basis is the user agreement (Art. 6(1)(b) GDPR).

3.14 Subscriptions and purchases through Apple

You buy subscriptions in the iPhone app, from Apple (Apple Distribution International Ltd., Cork, Ireland), from the day on which we offer subscriptions (§ 1(5) of the terms of use). Apple processes your payment data for this as a separate controller, and Apple’s privacy notice applies. We do not receive your payment data.

Before the purchase. Before Apple’s purchase sheet opens, the app shows you a sheet with what the subscription includes and the notice that dunel is an AI and may not always be available. If you tap “Agree, continue to Apple”, we store with your account when you confirmed this and in which version and language the text was. For the purchase, the app gives Apple the random identifier of your dunel account, no email address and no name. Apple attaches it to the purchase so that we can assign the purchase to your account.

What we store about your subscription. For each purchase, Apple sends details that Apple signs. From these we store with your account: the identifier of the purchase at Apple, which subscription you bought and which one you are switching to next, whether it is a test purchase, until when the paid period and a trial run, whether the subscription renews, whether Apple could not collect a payment and until when your tier therefore still applies, and whether and when Apple refunded a purchase to you. We also record every status that Apple reports as a history, with the type and time of the report. We do not store the price and country, which are also in Apple’s details. We use this to unlock your tier, count your quotas and show you in the app when your subscription ends, renews or has a payment outstanding.

Reports from Apple. If something changes about your subscription, for example a renewal, a cancellation, a payment problem or a refund, Apple sends a signed report directly to our server. So that no report gets lost, we also ask Apple once a day for the status of subscriptions that end soon and for the reports of the last two days; in doing so we give Apple at most the identifier of the purchase. We do not store reports that do not belong to an existing account, for example after a deletion. We only count them per day, without an identifier and without reference to any person.

On your iPhone the app only remembers whether you have already seen the trial offer and the announcement of subscriptions. If a trial is running that will renew, it reminds you on the second day of the trial, the last day on which you can safely cancel in time, with a notification that is scheduled only on your iPhone (section 3.10).

How long. We store the details of your subscription, their history and your confirmations before purchase until you delete your account. They are in your export (section 5.1) and go with the account. Deleting your account does not end a subscription with Apple; cancel it with Apple. Apple keeps what it stores about your purchase itself according to its privacy notice.

The legal basis is the user agreement (Art. 6(1)(b) GDPR). We also store the confirmation before purchase so that we can prove that you agreed to it; that is our legitimate interest (Art. 6(1)(f) GDPR).

3.15 Operation, security and limits

For operation, we record per account when the AI computed for what, what it cost and whether a step worked, without your content. This lets us detect errors and abuse and limit costs, for example with a daily limit per account. If an account reaches such a limit, we record that too. From the day on which we offer subscriptions, we also count this way how much of your quotas you have used, and note messages that dunel does not answer because of a limit. Our platform also logs technical access to its servers: time, the function called and IP address.

The legal basis is our legitimate interest in secure, affordable operation without abuse (Art. 6(1)(f) GDPR); counting quotas is part of the user agreement (Art. 6(1)(b) GDPR).

4 Your consent

Before you use dunel for the first time, the app shows you a page. By tapping “Agree” there, you accept the terms of use and consent to dunel processing your content with OpenAI and Google as described in sections 3.3 to 3.7 and 3.11, explicitly including highly personal information (section 3.8). We store when you agreed to which version and in which language the text was shown, and every withdrawal. You will find this history in your export.

For two things, dunel asks additionally and separately: when you send or share an image or PDF (section 3.3) and for the calendar in the chat (section 3.10).

Withdrawal. You can withdraw your consent at any time in your profile under Privacy, as easily as you gave it. The withdrawal applies to the future; what happened until then remains lawful. After that, nothing more from you goes to OpenAI or Google. Without this processing, dunel cannot work: the app then takes you back to the consent page. From there you can sign out or, via “Manage data”, export everything and delete your account. From then on, we keep what is already saved for only 30 more days, so that you can export it or consent again. If you don’t consent again within those 30 days, we delete your account with everything in it, in the same way as deleting it in the app (section 5.2); the app tells you the date. If you want it gone right away, delete your account. If you consent again in time, dunel carries on where it left off.

If what dunel passes your content on for, or to whom, changes, we will ask you again.

5 Take everything with you, delete everything

5.1 Export

In your profile under “Take everything with you” you can export everything at any time, in every tier: your messages with original files, notes with all earlier versions, answers with what the AI looked up for them, events, tasks, lists and their history, your settings, the history of your consent, your subscription with its history and your confirmations before purchase, and your own usage. The export is a machine-readable file that you can take to other services (Art. 20 GDPR).

Not included in the export is information that only the sign-in service keeps, such as which provider you sign in with, what Google sends along and your sessions. What Resend records about sending your emails is not included either (section 3.1). If you would like full information under Art. 15 GDPR, write to us at hello@dunel.ai.

5.2 Deleting

In the app you can delete:

• a chat (except the main chat): its messages with original files, the answers in it, answers in other chats that quote from it, and the events and tasks that come from this chat, including the entries dunel wrote to your iPhone calendar for them. Notes remain; they only lose their sources from this chat. The app shows you beforehand how much goes with it.
• a note: ask dunel in the chat.
• a list with its items.
• your whole account with everything that belongs to it: content, files, notes, answers, events, settings and sign-in details.

You cannot delete individual messages or the main chat in the app. Write to us at hello@dunel.ai, and we will delete them for you.

In our records, anything deleted is gone immediately. A few things take longer or remain:

• Backups at Supabase are overwritten within 8 days. If we restore a backup, we then delete again what you had deleted.
• OpenAI may keep requests in logs for abuse protection for up to 30 days (section 3.4).
• Emails with a code and what Resend records about sending them stay with Resend for up to 30 days (section 3.1).
• A file you opened shortly before may still be reachable through the delivery network for about a minute.
• The platform’s technical logs, including the sign-in log, expire after 7 days.
• A deletion record without content remains (section 6).
• A check value of your iPhone remains for 400 days, without any link to you, so that your iPhone can clean up after the deletion (section 3.12).
• Entries in your iPhone calendar may remain if you delete your account on another device or have revoked dunel’s access (section 3.10).
• The original files of chats you brought along only go with the account (section 3.11).

6 How long we keep data

• Account and content (messages, files, notes with earlier versions, answers with what the AI looked up, events, tasks, lists, settings): until you delete them or your account.
• After you withdraw your consent: your account with everything that belongs to it, for 30 more days. If you don’t consent again by then, we delete it (section 4).
• Sign-in details (email address, identifier at Apple or Google and what the provider sends along): until you delete your account.
• Sessions (time, IP address, browser or device): until they end or you delete your account.
• Sign-in log and the platform’s technical logs: 7 days.
• Emails with a code at Resend (address, content including the code, time, delivery): 30 days (section 3.1).
• History of your consent: until you delete your account.
• Operating data per account (when the AI computed for what, costs, whether a step worked): until you delete your account. General run logs without reference to an account we keep for 30 days, logs of the schedules for 14 days. Daily cost totals across all accounts, without reference to a person, remain permanently.
• Subscription and purchases through Apple (details of the subscription, their history, your confirmations before purchase): until you delete your account (section 3.14). We only count reports from Apple without an existing account per day, without reference to any person.
• Deletion record: so that your other devices also learn that your account has been deleted and can clean up, we keep the deletion request with your account identifier for up to 30 days, without content. After that, only a check value of the identifier with the time and the number of deleted entries remains, without time limit, as proof of the deletion. Such a check value also remains for deleted chats. We keep a copy of these check values outside the platform for up to 60 days so that, after restoring a backup, we can delete again what you had deleted.
• Check value of your iPhone after a deletion: 400 days, without any link to you, your account or your content (section 3.12). We delete the counter of requests with a check value of the IP address every day.
• Backups: up to 8 days after deletion.
• Access logs of the website: viewable for us for one day, at Vercel according to its periods (section 2.1).
• Emails to us: until the matter is settled, longer only if a law requires it.

7 Legal bases at a glance

Our legitimate interest is stated in each place where we rely on it.

8 Who receives data

We don’t sell data and don’t pass it on for advertising. These providers process data on our behalf and only on our instructions (Art. 28 GDPR):

The following are controllers in their own right, so not acting on our behalf:

We only pass data to authorities if a law obliges us to.

9 Transfers outside the EU

Some recipients are based outside the EU or may process data there:

• OpenAI processes through its worldwide service, in particular in the USA. The basis is the European Commission’s standard contractual clauses (Art. 46(2)(c) GDPR) in our contract with OpenAI.
• Supabase: the contracting party is Supabase Pte. Ltd. in Singapore. Your data is stored in Frankfurt, but Supabase may also access it from outside the EU for operation and support. The basis is the standard contractual clauses in our contract with Supabase.
• Google Cloud: we use the EU region. If processing outside the EU nevertheless takes place, the standard contractual clauses in our contract with Google apply.
• Vercel is based in the USA and, according to its own statement, is certified under the EU-US Data Privacy Framework. For this, the European Commission’s adequacy decision of 10 July 2023 applies (Art. 45 GDPR), and in addition the standard contractual clauses in our contract with Vercel.
• Resend (Plus Five Five, Inc.) is based in the USA and stores the data there; the emails are sent from Ireland. According to its own statement, Resend is certified under the EU-US Data Privacy Framework. For this, the European Commission’s adequacy decision of 10 July 2023 applies (Art. 45 GDPR), and in addition the standard contractual clauses in our contract with Resend.

Whether a company is certified is shown in the Data Privacy Framework list. We will send you a copy of the standard contractual clauses on request.

10 AI, profiling and automated decisions

In the app, an AI answers you. It produces answers, summaries, notes and the titles of events and tasks, and they can be wrong. When dunel quotes you, it is always your own saved words: the app cuts them from your content; the AI does not write them. You see what dunel adds straight away and can change or discard it.

dunel writes notes about you and remembers how you want to be served. This is an evaluation of personal aspects (profiling, Art. 4(4) GDPR). It serves only your own answers. You see it in the Brain in the folder You and in your profile under “Your way”. You withdraw preferences there; you change or delete notes by telling dunel in the chat. It is not used for advertising or any other purpose.

There is no automated decision that has legal effects on you or similarly significantly affects you (Art. 22 GDPR).

11 Security

All connections between your device, our services and the providers are encrypted. The database separates every account from all others. Original files are kept in non-public storage and can only be reached through addresses that expire after a short time. In the app you can turn on a lock with Face ID.

12 Your rights

You have the right to

• access to your data (Art. 15 GDPR),
• rectification (Art. 16 GDPR),
• erasure (Art. 17 GDPR),
• restriction of processing (Art. 18 GDPR),
• data portability (Art. 20 GDPR),
• object (Art. 21 GDPR, more on this below),
• withdraw a consent with effect for the future (Art. 7(3) GDPR).

Much of this works directly in the app: export everything, change notes, change or discard events, delete chats, notes, lists or the whole account, withdraw consent in your profile. dunel does not change what you wrote afterwards; if something in it is wrong, we delete it at your request. For everything else, write to us at hello@dunel.ai. We answer within one month.

You can also lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), for example in your country or with the one responsible for us: Der Landesbeauftragte für den Datenschutz Niedersachsen (the State Commissioner for Data Protection of Lower Saxony), Prinzenstraße 5, 30159 Hannover, Germany, lfd.niedersachsen.de/beschwerde.

Your right to object

If we process data on the basis of our legitimate interest (Art. 6(1)(f) GDPR), you can object at any time on grounds relating to your particular situation. This concerns the purposes listed with “legitimate interest” in section 7. To object, write to hello@dunel.ai. We will then no longer process this data, unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or we need it to establish, exercise or defend legal claims.

13 Do you have to provide data?

You don’t have to provide anything for this website. For the app, we need an email address or a sign-in through Apple or Google; otherwise there is no account. Without consent to processing with OpenAI and Google, you cannot use dunel, because without it dunel can neither answer nor write notes. The app asks for it before you first use it.

14 Minimum age

dunel is for people aged 18 and over. When you give your consent before first use, you confirm that you are at least 18. If we learn that an account belongs to a younger person, we delete it.

15 Changes

If dunel changes, we will update this policy. The version with the date shown at the top applies. If a change requires your consent, we will ask you again in the app.

Contact

Julian Ivanov, dunel, Am Birkenhain 51A, 49811 Lingen (Ems), Germany, hello@dunel.ai