Privacy Policy

This policy explains what personal data DenkenLabs collects, why, how it is stored and shared, and the choices you have. It covers this website and the denken-labs app, through which you can connect a Google account to Carol, the assistant on our Carolverse platform.

• Who we are
• This website
• Connecting a Google account
• How we use Google user data
• AI processing
• Storage and security
• Sharing
• Keeping and deleting data
• Google API Limited Use
• Your rights
• Children
• Changes and contact

1. Who we are

DenkenLabs ("we", "us") is based in Frankfurt am Main, Germany, and is the controller of the personal data described here. DenkenLabs is being registered as a company; until registration is complete, Ninad Joshi is responsible for it.

Privacy questions and requests: [email protected].

2. This website

• Hosting. The site is served by Cloudflare. Like any web server, Cloudflare processes your IP address and basic request details to deliver the page and protect it from abuse.
• No cookies or tracking. The site sets no cookies of its own and uses no analytics or advertising trackers.
• Contact form. If you send us a message, the name, email address, company, subject and message you enter are delivered to our inbox through FormSubmit (formsubmit.co). We use them only to reply to you and to follow up on your enquiry.

3. Connecting a Google account

Carol can work with a Google account only after its owner connects it through the denken-labs app, on Google's own consent screen. Each connection is made for one stated purpose, is kept separately from every other connection, and is never used for another purpose or another person. Carol may request the following permissions:

Connections are offered for three purposes:

• Your profile with Carol (read email only). If you choose to connect your mailbox, Carol reads it to learn facts about you that help her serve you, such as your name and contact details. Every fact she records notes where and when it was found; nothing is guessed or invented.
• Our company's receipts (read email only). Our own administrator's work mailbox is read once a day to find receipts for the company's subscriptions and purchases, which are recorded in our accounts.
• Our team's own mail and calendar (read email, draft email, read calendar events). A member of our team can connect their own work account to see their mail and meetings, receive reminders and get draft replies. A connection is kept only if the account that consented is that team member's own work address, and only that person can use it.

4. How we use Google user data

We use data obtained through Google APIs only to provide or improve the feature you connected it for, as described above. Specifically, we do not:

• sell Google user data, or use or transfer it for advertising, retargeting or interest-based ads;
• use it to determine creditworthiness or for lending;
• use it to develop, improve or train generalised AI or machine-learning models;
• let anyone read it except as described in section 7.

5. AI processing

Some features, such as preparing a draft reply, use an AI language model. To do this, the relevant content is sent to the model provider (currently Anthropic) solely to produce the result, under business terms that do not allow the provider to train its models on that content. We only use providers whose terms prohibit such training, and we never use Google user data to train AI models, ours or anyone else's.

6. Storage and security

• Carol runs on our own server hosted by Microsoft Azure in Germany (Frankfurt region).
• The access granted by Google is stored as a token in a folder kept for the person who granted it, which only Carol's own service account can open. No team member's account can read another person's connection.
• Data travels between Google, our server and our providers only over encrypted connections (HTTPS/TLS), and the server's disks are encrypted at rest.
• Our team signs in to the server with a password plus a one-time code from an authenticator app, and every sign-in is recorded.

7. Sharing

We do not sell personal data. We share it only:

• with the service providers named in this policy (Cloudflare, FormSubmit, Microsoft Azure, Anthropic), and only as needed to provide the service;
• when you ask us to, or with your consent;
• when required by law, or to protect the security of our users and systems.

No person at DenkenLabs reads your Google user data, except: with your explicit consent for specific messages; where necessary for security, such as investigating abuse; or to comply with the law. A team member's own mail and calendar are read by that team member.

8. Keeping and deleting data

• We keep Google user data only for as long as the connection serves its purpose.
• You can disconnect at any time at myaccount.google.com/permissions. From that moment Carol can no longer read your account.
• Email [email protected] and we will delete the stored access and the information derived from your account within 30 days, unless the law requires us to keep it.
• Contact-form messages are kept as long as needed to handle your enquiry and any resulting relationship.

9. Google API Services User Data Policy

10. Your rights

Under the EU General Data Protection Regulation you can ask us for access to your personal data, and to correct it, delete it, restrict or object to its use, or receive it in a portable format. Where we rely on your consent, such as for a Google account connection, you can withdraw it at any time; this does not affect what was done before. We rely on your consent for Google connections, on our legitimate interest in running a secure website, and on handling your enquiry for the contact form.

To exercise a right, email [email protected]. You can also complain to a data-protection authority; ours is the Hessian Commissioner for Data Protection and Freedom of Information (HBDI).

11. Children

Our services are not directed at children under 16, and we do not knowingly collect their personal data.

12. Changes and contact

If we change how we use personal data, we will update this page and its effective date, and we will ask for your consent again before using Google user data in a new way. Questions: [email protected].