Privacy Policy

The controller for the processing of personal data on this website is:

These pages introduce the programme “The Inner Jungle”, let you write to us, let you take the Bottleneck Check (section 12), let you request free resources and sign up to our newsletters (section 13). They also link to a Proton Calendar booking page for a free Clarity Call (section 4); the booking itself happens there, not here. Nothing else happens here.

In particular, there are no user accounts, no chat and no AI processing on this website, and no data is sent to Anthropic (Claude) or OpenAI from it. All of that belongs to the platform, and the German policy linked at the top describes it.

The contact form lets you write to us. We process only what you enter yourself: your name, your email address and the text of your message. All three are required — without a name and an address we cannot reply, and without a message there is nothing to reply to.

• –The legal basis is Art. 6 Abs. 1 lit. b DSGVO where your enquiry is aimed at a contract with us, and otherwise Art. 6 Abs. 1 lit. f DSGVO: our legitimate interest in answering a message addressed to us. We do not ask for your consent and do not need it — consent would not be freely given here, because without processing your details there would be no answer (Art. 7 Abs. 4 DSGVO).
• –Your message is not stored, it is sent: it reaches us as an email at [email protected], and you receive a confirmation at the address you gave, with your message repeated in it.
• –In our contact records we do keep the fact that you wrote: your name, split into a first and a last name, your email address, the time, that the enquiry came through this form, and that you are therefore recorded as an enquirer. Where those records live is set out in section 6.
• –Not there: the text of your message. The path into those records has no field for it — it is not that we leave it out, it is that it cannot get through. It travels as an email through our sending provider Resend (section 5) instead, and sits in its log files for up to 30 days. After that it remains an email in our inbox for as long as we need it — see below.
• –Alongside that we may add working notes: a few keywords, one short note on the next step with a date, and short factual notes about a contact — the kind (email, phone call, meeting, other), the time and, where needed, what mattered about it, such as an agreed next step or the outcome of a conversation. Where we enter it by hand, the name of your company or organisation may be recorded as well. If one of these details is corrected later, we keep what it said before, what it says now, when it changed and where the change came from. They exist to organise the contact. They are not an assessment of you and not a rating. You receive them with your access request under Art. 15 DSGVO.
• –Why we keep those notes, and on what basis: to run a contact properly — to know what was discussed and what comes next, rather than forgetting it or asking twice. While an enquiry or a contract is live, the basis is Art. 6 Abs. 1 lit. b DSGVO; otherwise it is our legitimate interest under Art. 6 Abs. 1 lit. f DSGVO, and you can object at any time (Art. 21 DSGVO) with a short message to [email protected]. We record only what is necessary, and factually. Health data and other special category data under Art. 9 DSGVO, details about other people that we do not need, and judgements about you as a person do not belong in these fields. That is a binding internal rule for the person writing — not a technical barrier the field itself could impose.
• –We also record which automatic email was sent to you and when — a confirmation, a reminder, a newsletter — whether it went out successfully, and the sending provider’s technical reference for it. The subject line and the content of the email are not stored.
• –We use the service Resend for those two emails (see section 5). There are no other recipients.
• –How long your message stays with us afterwards is set out in section 9: for as long as the exchange lasts, and beyond that only while we still need it. We delete it earlier on request — a short message to [email protected] is enough.
• –Before you can send it, there is a bot check, and the number of requests per hour is limited. Both are described in section 8.
• –Please do not send us health data or other special category data under Art. 9 DSGVO through this form. Unlike the free-text fields elsewhere in this project, this field goes through the email service, and once transferred it sits in the sending provider’s log files for up to 30 days.

For the free introductory conversation (“Clarity Call”), we link to a booking page provided by Proton Calendar. The booking page is not embedded: as long as you do not click the booking button, nothing is loaded from Proton Calendar, nothing is stored on your device and nothing on your device is accessed.

If you click the button, you leave this site. To make the booking, you provide your name and email address there. Those details, the time you choose and other data Proton Calendar collects when you open the page and make the booking are processed there; Proton explains this in its own privacy policy. The booking details then reach us so the conversation can take place. The legal basis for that is Art. 6 Abs. 1 lit. b DSGVO.

We use the service Resend (Resend Inc., San Francisco, USA) to send our emails, as a processor under Art. 28 DSGVO. On this website that covers the two emails of the contact form: your message on its way to us, and your confirmation. Since the Bottleneck Check (section 12), it also covers the email with your result and our notification of your answers, and since the newsletter (section 13), the emails you receive as a subscriber.

• –Transferred are your name, your email address and the text of your message — it is the message.
• –For the Bottleneck Check, your email address, your first name if you gave one, your answers, your result and your open answer are transferred.
• –For the newsletter, your email address, your first name if you gave one and the content of each email are transferred. The list of subscribers is not kept at Resend but in our contact records, and whether you open an email or click a link in it is not tracked.
• –Resend keeps sent emails in log files for a maximum of 30 days.
• –For every automatic email we record in our contact records what kind of email was sent to you and when, whether it went out successfully, and the technical sending reference Resend returns to us. The subject line and the content are not stored there (section 3).
• –Resend Inc. is based in the USA; the transfer is safeguarded by the EU Standard Contractual Clauses (SCC, Art. 46 DSGVO). You can request a copy of the clauses at any time at [email protected]; it is free of charge.

Resend privacy policy: resend.com/legal/privacy-policy

This website runs on a rented server at netcup GmbH. The server is located in Nuremberg, Germany, so the processing takes place within the EU and no third-country transfer arises from the hosting. netcup provides the machine and can technically access it, and therefore acts as a processor under Art. 28 DSGVO; a data processing agreement is in place. All connections are TLS-encrypted.

What is rented is the hardware, not the operation: the application, the databases and the reverse proxy in front of them are run by the controller or by internally authorised persons. netcup does not analyse the content.

Two databases: One carries the platform — accounts, conversations, everything written inside the programme. The other carries only the contact records described in sections 3, 12 and 13. It has its own credentials and technically cannot read the platform’s tables. If you only ever used the contact form, the second one is the only place your address appears.

The split runs between content and contact details, not between people: if you take part in the programme, there is a contact record for you as well — your address, your name, your customer relationship and the record of emails sent to you. What is not in it is what you write inside the programme.

Server log files: The reverse proxy in front of the site logs server access. Technical connection data is recorded — IP address, date and time, the address requested, and browser and device details. These logs serve security, stability and error analysis (legal basis: Art. 6 Abs. 1 lit. f DSGVO) and are deleted automatically after 14 days at the latest. Because the proxy is ours, that is our retention period, not the provider’s.

Backups: Both databases are backed up automatically every day, each on its own. Backups stay on the same server in Nuremberg — they go to no other service — and are replaced by the newest backup after 7 days. Encrypting the backup files is planned but not yet implemented.

Cloudflare in front of the server: Before your request reaches our server, it passes through Cloudflare’s network (Cloudflare, Inc., San Francisco, USA). Cloudflare accepts the connection, decrypts it and passes it on to us encrypted. This protects the site against overload and attacks. Cloudflare acts as a processor under Art. 28 DSGVO in doing so.

• –What is processed: your IP address, the address requested, and browser and device details — the same technical connection data that also appears in our own logs.
• –This applies to every request to this site, including this privacy policy — not just the contact form. The bot check in front of that form is a separate, additional processing operation; it is described in section 8.
• –Cloudflare Inc. is based in the USA; for any access from there, the EU Standard Contractual Clauses (SCC, Art. 46 DSGVO) apply. You can request a copy of the clauses at any time at [email protected]; it is free of charge.
• –Nothing is stored additionally on our side from this processing; at Cloudflare, for as long as it is necessary there to operate and secure the network and to prevent abuse — the details are set out in Cloudflare’s privacy policy, linked below this list.
• –Legal basis: Art. 6 Abs. 1 lit. f DSGVO (legitimate interest in delivering the site securely, reliably and without interruption).

Cloudflare privacy policy: cloudflare.com/privacypolicy

This website sets no cookies. There is no tracking, no analytics service, no social media embedding and no advertising networks. That is also why you see no cookie banner here.

On resource pages we count visits per resource, day and source. The count holds no IP address, cookie or device identifier (section 13).

On the Bottleneck Check page we also count how far the check is used: page opened, started, which step was reached, email step, result shown and click on the intro call. The count holds one number per day, language, entry point (website or event) and version of the check. It holds no IP address, cookie, device identifier or answers, and we cannot link a step to a person (section 12).

The platform behind it sets exactly one, and only once you sign in: a technically necessary authentication cookie. It is described in the German policy linked at the top.

Fonts are served from our own server, not by an external provider — so loading the page creates no connection to Google Fonts.

Your language choice is not stored either: it lives in the page address (/de or /en), not in a cookie.

So the forms on this website — the contact form, the Bottleneck Check, the newsletter sign-up and the resource request — cannot be submitted en masse, and so the visit count on resource pages cannot be driven up, we count the attempts per sender. Your IP address is used for this:

• –Stored is only the current count, no history. Once the time window has passed, counting starts again from zero.
• –The entry is deleted at the latest with the daily cleanup — around 25 hours after the attempt at the very longest.
• –There is no evaluation: the address is not linked to anything, not analysed and not passed on.
• –Legal basis: Art. 6 Abs. 1 lit. f DSGVO (legitimate interest in protection against misuse).
• –The contact form deliberately has no hidden field for telling humans and bots apart: it has three fields, all required, and an invisible fourth would be the place where a password manager swallows a real message.

Cloudflare Turnstile: In front of these forms there is also a check that tells humans and automated programs apart. Without it, the forms could be used to send email en masse in our name. We use Turnstile by Cloudflare (Cloudflare, Inc., San Francisco, USA) for this; for that check Cloudflare acts as our processor under Art. 28 DSGVO. This is the second place Cloudflare is involved — the first is the delivery of the site itself, described in section 6. This section is only about the check in front of the forms.

• –Only once you start filling in the form does your browser fetch the check element from challenges.cloudflare.com. If you only read the page, no connection there is made. Cloudflare then processes your IP address as well as technical details about your browser and device, and assesses how the page is being used, in order to tell humans and bots apart.
• –This connection is made only on pages with one of these forms, and only once you start filling one in. The home page carries the newsletter sign-up at its end; reading it without touching that form makes no connection. This privacy policy, the legal notice and the terms do not embed the check.
• –No cookie is set. The only Turnstile mode for which Cloudflare would set one (pre-clearance) is explicitly switched off here.
• –As it runs, the check reads technical properties of your device, and § 25 TDDDG covers that access even without a cookie. We do not ask for consent to it because the check is necessary for you to be able to send the form (§ 25 Abs. 2 Nr. 2 TDDDG) — and that is exactly why it loads with your first entry rather than while you are reading the page.
• –When you send the form, all we pass on to Cloudflare is the result of the check — a random string that can be redeemed once. Neither your name nor your email address nor the text of your message is transferred, and we do not additionally pass on your IP address.
• –If you would rather reach us without this check: the email address and the phone number in the legal notice and in section 1 do not embed it.
• –Cloudflare Inc. is based in the USA; for any access from there, the EU Standard Contractual Clauses (SCC, Art. 46 DSGVO) apply. You can request a copy of the clauses at any time at [email protected]; it is free of charge.
• –Cloudflare evaluates the same signals for its own purposes as well — to improve its own bot detection. For that, by its own account, Cloudflare is a controller in its own right and relies on its legitimate interest; for our check it remains a processor. Set out in the Turnstile Privacy Addendum.
• –Legal basis: Art. 6 Abs. 1 lit. f DSGVO (legitimate interest in these forms not being usable to send email en masse).

Cloudflare privacy policy: cloudflare.com/privacypolicy · Turnstile Privacy Addendum: cloudflare.com/turnstile-privacy-policy

What is kept once you take part in the programme — account data, reflection data, the periods after an account is deleted — is set out in the German policy linked at the top.

You have the right at any time to:

• –Access (Art. 15 DSGVO) – what data about you is stored
• –Rectification (Art. 16 DSGVO) – correction of inaccurate data
• –Erasure (Art. 17 DSGVO) – deletion of your data
• –Restriction (Art. 18 DSGVO) – restriction of processing
• –Data portability (Art. 20 DSGVO)
• –Objection (Art. 21 DSGVO) – objection to the processing
• –Withdrawal of consent (Art. 7 Abs. 3 DSGVO) – at any time, with effect for the future

For any request, please write to: [email protected]

You also have the right to lodge a complaint with a data protection authority. In Germany this is the Data Protection Commissioner of your federal state.

Our offer is aimed exclusively at adults. People under 18 cannot take part in the programme. We do not knowingly collect personal data from minors.

With the Bottleneck Check at /en/bottleneck-check and /de/bottleneck-check you can find out in a few minutes where recurring friction arises in your work right now. The following is processed:

• –How the result comes about: from your answers, according to fixed rules that are the same for everyone. There is no AI evaluation and nothing is sent to Anthropic or OpenAI. The result is an orientation, not an assessment of you as a person.
• –The legal basis for the evaluation and for the email with your result is Art. 6 Abs. 1 lit. b DSGVO: you asked for both. Keeping your answers, your open answer and your result afterwards is based on Art. 6 Abs. 1 lit. f DSGVO: our legitimate interest in knowing them if we talk later, for example in a Clarity Call or an AI Discovery Call. You can object to this at any time (Art. 21 DSGVO), and we will delete them. A short message to [email protected] or a reply to the email with your result is enough.
• –No consent for the check, and no newsletter without a separate sign-up. We do not ask for consent for the check; it would not be freely given, because without processing your answers there would be no result (Art. 7 Abs. 4 DSGVO). The check does not sign you up to any newsletter, and the email with your result contains no advertising. On the result page you can additionally and separately sign up to the newsletter: with a checkbox of its own that is not pre-ticked, and a confirmation by email like any other sign-up (section 13).
• –Where it is kept: in our contact records (section 6), separate from the platform. We create a contact entry with your email address there or add to an existing one, without a second entry for the same address. Unlike the contact form, your open answer is stored there as well, because it is the reason for keeping the check; your first name is stored there as it is on any other route.
• –Emails: you receive your result by email, and we receive a notification with your answers at [email protected]. Both go through Resend (section 5).
• –On your device: while you fill in the check, your answers are kept in your browser’s session storage (sessionStorage), so that reloading on a phone costs you nothing. It is not a cookie, it is not transmitted, and your browser deletes it when you close the tab. Your email address and first name are not kept there. The basis is § 25 Abs. 2 Nr. 2 TDDDG: the storage is strictly necessary for the check you are filling in.
• –Retention: for as long as the relationship recorded in the contact records lasts; earlier on request or after your objection (section 9).
• –Before you send it, there is the same bot check as for the contact form, and the number of requests is limited (section 8).
• –Please do not enter health data or other special category data under Art. 9 DSGVO in the open field. It is stored and sent to us by email in the notification.

On pages under /en/resources/… and /de/resources/… you can request guides, prompts, checklists, workflows and templates. We store your email address, your first name if given, which resource you requested and when, where the visit came from (for example LinkedIn) and, if your browser sends it, the domain of the page you came from. The link to the resource is stored only as an irreversible fingerprint. You get access immediately on the page and by email (sent via Resend, section 5). Legal basis for providing the resource: Art. 6 Abs. 1 lit. b DSGVO. We keep the request for 24 months after your last one, based on our legitimate interest in maintaining contacts and understanding which content is useful (Art. 6 Abs. 1 lit. f DSGVO); you can object at any time, most simply by replying to the access email, and we will delete it.

When one of these pages is opened, we increase a counter per resource, day and source. The counter holds no IP address, no cookie and no device identifier, and we cannot link a visit to a person. Our legal basis is our legitimate interest in seeing which content and channels are useful (Art. 6 Abs. 1 lit. f DSGVO). The limit on visits per IP address that keeps the counter honest is the one described in section 8.

Separately, you can sign up for the “AI Tools & Workflows” newsletter in the same form: useful AI tools, workflows, automation ideas, practical guides and relevant AI news. You get the resource either way. It is a separate newsletter alongside “Build From Within”, with its own consent (Art. 6 Abs. 1 lit. a DSGVO), double opt-in and unsubscribe link; the record of consent and the periods follow the rules below.

With “Build From Within” we send thoughts, tools and experiments on building a business from the inside out. You can sign up on the home page, at /en/newsletter and /de/newsletter, and after the Bottleneck Check. The following is processed:

• –The legal basis is your consent (Art. 6 Abs. 1 lit. a DSGVO). It is voluntary and not tied to anything else: neither the contact form nor the Bottleneck Check, an application or a contract signs you up to the newsletter.
• –Double opt-in: after you send the form, you receive an email with a confirmation link. Only once you confirm through it are you subscribed. The email contains nothing but that request. The link is valid for 7 days; if you do not confirm, we will not write to you, and the request is deleted after 30 days. After confirming, you receive a short welcome email.
• –You can unsubscribe at any time, without giving reasons and with effect for the future (Art. 7 Abs. 3 DSGVO): via the link in every newsletter email, via the unsubscribe function of your email program, or with a short message to [email protected]. Unsubscribing only affects the newsletter; anything else you requested or agreed with us is not affected.
• –No tracking: we do not measure whether you open an email or click a link in it, and we build no profile of you from the newsletter. All we count is how many sign-ups, confirmations and unsubscriptions there are.
• –Where it is kept: in our contact records (section 6), separate from the platform. If there is already a contact entry for your address, for example from the Bottleneck Check, it is added to rather than duplicated. The list of subscribers is not kept at a newsletter service.
• –Sending: the emails go through Resend (section 5). Your email address, your first name if you gave one and the content of each email are transferred.
• –Retention: for as long as you are subscribed. After you unsubscribe, we keep the record that and when you consented and withdrew for three years. We need it to be able to show that an email to you was lawful (Art. 7 Abs. 1 DSGVO), and three years is the standard limitation period (§ 195 BGB); the legal basis for keeping it is Art. 6 Abs. 1 lit. f DSGVO. After that it is deleted. A request that is never confirmed is deleted after 30 days (section 9).
• –Before you send it, there is the same bot check as for the contact form, and the number of requests is limited (section 8). In addition, at most one confirmation email is sent to the same address every 15 minutes.

We reserve the right to adapt this privacy policy where necessary. The current version is always available at this address.

Last change: 6 October 2026. Changed: section 4 names Proton Calendar instead of Cal.com as the booking service and describes the details entered on its booking page. Booking remains a link, not an embedded calendar. It now names only the Clarity Call that is offered.

Before that: 26 September 2026. Added: section 13 is now called “Newsletters and resources” and describes the resources you can request on this website and the separate “AI Tools & Workflows” newsletter, together with a row in section 9 and the resource request in section 8. Changed: section 7 no longer says there is no analysis of usage behaviour; it now names the visit count on resource pages, which holds no personal data. Section 2 mentions the resources.

Before that: 21 September 2026. Changed: section 4 names Cal.com instead of Calendly as the booking service and covers the AI Discovery Call alongside the Clarity Call. Booking remains a link, not an embedded calendar. Sections 2 and 12 mention the AI Discovery Call as well.

Before that: 17 September 2026. Corrected: section 3 said that your name from the contact form was not kept in our contact records. That stopped being true on 15 September 2026; it is kept, and the section now says so. Also corrected: section 3 promised that working notes were “not a record of a conversation” — since the same day they can contain short factual notes about one, and the section now describes that. Unchanged: the text of your message is not stored in our database, and we do not rate you. Added: the purpose, legal basis, right to object and data minimisation for those notes in section 3, the record of sent emails in sections 3 and 5, the note on what the two databases separate in section 6, and the corresponding rows in section 9.

Before that: 15 September 2026. Section 12 on the Bottleneck Check and section 13 on the newsletter “Build From Within” were new; sections 2, 5, 6, 7, 8 and 9 were extended accordingly. This policy covers the public website and, unlike the German policy, not the platform — the box at the top says which policy applies where.