Privacy notice

Who processes your data

onthewall® GmbH, Solmsstrasse 35, 10961 Berlin, Germany, is the controller for the project site and the test application. For privacy enquiries, email info@onthewall.de. Further contact details are in the legal notice.

Visiting the website

To deliver a page to your browser, the web server processes the IP address of the connection, the requested address and technical information about the browser. For chat, account and feedback functions, the application counts requests per connection address in one-minute windows. This helps prevent overload and abuse. We rely on our legitimate interest in operating a reliable and secure service under Article 6(1)(f) GDPR.

Carepie serves its own fonts, images and scripts. We do not use Google services, including externally hosted Google Fonts, Google Analytics, Google Ads or Google Tag Manager. We do not use cookies for advertising or audience measurement. If you choose a language on the site or in the studio, your browser saves the choice under carepie.language in local storage for future visits. You can change the language or remove the entry by clearing the site’s data in your browser.

STRATO GmbH manages our domain and DNS. When you access carepie.de through the STRATO web server, it processes connection and request data and forwards the request to Railway. Railway Corporation serves the project pages and their assets and hosts the studio and its PostgreSQL database in the selected region of Amsterdam, Netherlands. When you open the studio or submit feedback, your browser connects directly to studio.carepie.de. Railway may process connection and operational data on its network. Selecting this region does not guarantee that every processing activity, including support, takes place in the EEA. See Railway’s privacy policy and data processing terms.

Chat before registration

When you start a conversation, we store your messages, the replies, the draft concept and its approval status in our database. You can do this without an account. The app identifies your draft using a random identifier in the carepie.draft cookie, which expires after seven days. If no one has registered for the conversation within seven days of the last edit, the daily clean-up removes the draft. When you register, the server links your confirmed conversation to your new account. Article 6(1)(b) GDPR is the legal basis for the planning you request.

When data is sent to OpenAI

Before you send an input, the app shows which planner is active. In local mode, the Carepie server alone processes the input. When OpenAI is active, the server sends the conversation so far and any existing draft concept to the OpenAI API for the initial draft and follow-up questions. For a later workspace change, it sends the change request, the last eight rounds of the development conversation and the current description of the areas and fields. The Carepie server runs field filters and examines existing values for the data preview. It does not automatically send the sample values shown there to OpenAI. When a workspace owner requests a permissions suggestion, Carepie sends the task description the owner entered and the names and keys of the workspace areas. Stored table rows, account and invitation email addresses, and feedback are excluded from the automatically supplied context. Text that you enter yourself is sent with the request. Use fictional examples and leave out real people’s names, health data, access credentials and trade secrets.

If you request an AI mapping suggestion during a CSV import, the active OpenAI planner receives the headers and column positions of the unmapped columns together with the names, keys and types of the visible destination fields. The Carepie server processes the data rows. When you ask AI to create a calculation, OpenAI receives your description of the calculation and the input names. Carepie processes the numeric test cases, your expected values and any numbers you later enter to run the calculation. Headers, field names and requests can also contain confidential information. Use fictional examples there as well.

If you ask AI to suggest dashboard metrics, OpenAI receives your request and the names and keys of areas and numeric fields. Carepie calculates counts, sums and averages in the workspace database. Previewing, viewing and approving these metrics requires no model call.

This processing serves your planning request under Article 6(1)(b) GDPR. OpenAI identifies OpenAI Ireland Ltd. as the contracting party for customers in the European Economic Area. Carepie sets store: false so that OpenAI does not store the response for later retrieval. OpenAI also describes abuse monitoring logs that may contain inputs and responses. Its standard retention period is up to 30 days. Legal requirements or specific security concerns may require longer retention. According to OpenAI, training on API content is disabled by default. OpenAI on API data and retention

Data may be processed outside the European Economic Area, particularly in the United States. Depending on the recipient, OpenAI cites an adequacy decision or the European Commission’s standard contractual clauses as the basis for such transfers. You can ask us for details of the safeguards that apply to a transfer and for a copy of them. OpenAI on international data transfers

Account, email and workspace

To create an account, we need the name you provide, your email address and a password. We store the password hash, confirmation status and session information needed to sign you in, among other details. Your browser receives a session cookie. When you register or reset your password, your browser keeps your email address in the tab’s session storage for the confirmation screen. Technically necessary cookies and access to stored information are covered by section 25(2), point 2 of the German TDDDG.

For account emails sent from studio@carepie.de, we use STRATO GmbH, Berlin. STRATO receives your email address, the subject and the message with its invitation, confirmation or reset link for delivery. In local development without email delivery, the message stays in the local test outbox. In the workspace, we store your role and membership, the records you enter, model versions and the development conversation, including approval decisions. This processing is necessary for the account and workspace functions you request under Article 6(1)(b) GDPR.

For a CSV preview, the server processes the file contents and your field mapping. Once you approve the import, it saves the confirmed data in the mapped fields. The uploaded file itself is not retained. To record your approval and detect repeat submissions, Carepie keeps technical verification values, the account, the area, the imported row count, the version and the time in the workspace. When you export an area, your browser receives a CSV containing the fields your account can see in the selected area.

For a calculation, Carepie stores the name, request, input names, test cases and results, formula, and the generated executable version with its verification value and origin in the workspace. Approvals and rollbacks are logged. Members can run an approved calculation using numbers they enter themselves. Runtime inputs and results are not stored.

When a workspace owner invites you, that person provides your email address and the intended area permissions. We use these details to send the invitation and link it to your confirmed account. The invitation names the workspace and is valid for seven days. The first clean-up after expiry deletes the invitation entry, including the email address, intended permissions and link verification value, from the Carepie database. Once an invitation has been accepted, membership and assigned rights are kept until removed from the workspace. A technically necessary cookie remembers the selected workspace.

To trace changes and approvals, we log in the workspace which account performed which action on which object and when. We rely on our legitimate interest in data security and traceability under Article 6(1)(f) GDPR. We need the account and workspace contents for as long as you use the service. You can ask us to delete them. After use ends, data may be kept only for as long as a statutory obligation or the establishment or defence of specific claims requires.

When you connect a test mailbox

As the workspace owner, you can connect a test mailbox containing fictional correspondence. Carepie checks IMAP access with your provider and retrieves your inbox even while the studio is closed. You can also enable SMTP sending. Carepie encrypts the stored credentials. If Google or Microsoft sign-in is enabled, Carepie redirects you to that provider. The provider receives the mailbox address you entered and displays the requested permissions. Carepie encrypts the provider credential it stores for future access. You can also revoke authorization in your provider account.

In your workspace we store the sender or recipient, the reply address when available, the subject, time, technical message identifiers and a text preview. For outgoing messages we store your text and the sending status. Attachments stay with your mail provider. When you select Send, Carepie submits your message to your outgoing mail server for delivery to the address shown. The mailbox supplies no content to the AI planner.

Disconnecting stops retrieval and deletes the connection credentials and message copies from the active Carepie database. Originals at your provider and messages already delivered are unaffected. The audit log keeps the time, account, action and technical object reference. Copies may remain in database backups until those backups are deleted. For erasure requests, contact info@onthewall.de.

Feedback and contact

You can use the feedback form without an account. We store the selected type of feedback, your message, the time of receipt and, if you want a reply, the email address you voluntarily provide in our PostgreSQL database. The project team uses your feedback to investigate errors, review suggestions or reply to you. We do not publish feedback or send it to OpenAI. We delete form submissions no later than 90 days after receipt. We rely on our legitimate interest in improving Carepie and responding to your feedback under Article 6(1)(f) GDPR.

If you write to us directly by email, we process the sender address and message to handle your enquiry. Article 6(1)(b) GDPR applies to contract-related enquiries. For other enquiries, we rely on our legitimate interest in responding under Article 6(1)(f) GDPR. We retain correspondence for as long as handling the enquiry or statutory retention obligations require.

Your rights

Subject to the legal conditions, you can request access to your data, rectification, erasure, restriction of processing or data portability.

Your right to object applies where processing is based on our legitimate interest. You can object on grounds relating to your particular situation. To exercise this right, email info@onthewall.de.

You can also complain to a data protection supervisory authority, in particular where you live, where you work or where you believe an infringement occurred. The supervisory authority for our registered office is the Berlin Commissioner for Data Protection and Freedom of Information.

Last updated 11 November 2026.