This policy explains which personal data dcyphr.® GmbH (“we”) processes when you use dcyphr.® ID — your account, the apps (including Events, Matchmaking, Academy, Games, prompt tools, Focus) and the event area with tickets and check-in. It follows the structure of the privacy policy on dcyphr.ai; our websites dcyphr.ai, dcyphr.io and aicon26.com have their own policy there.
Registered at the Amtsgericht Mannheim under HRB 748843, VAT ID DE355754143. The contact for data protection is the managing director, reachable at the email address above. No data protection officer has been appointed because the legal requirements (Art. 37 GDPR, § 38 BDSG) are currently not met.
Account, platform operation, own events of dcyphr.® and AICon: we are the controller.
Events and organisations of other organisers: other organisers and organisations may use dcyphr.® ID for their own events, teams and content. For the data they collect there (e.g. attendee lists, invitations, programme, staff or team data) they are the controllers; we process it on their behalf under Art. 28 GDPR. A template data processing agreement is available. The organiser of an event is named on the event page.
| Data | Purpose | Legal basis | Retention |
|---|---|---|---|
| Name, handle, email address, password (hash only), optional profile picture, chosen language and appearance | Create an account, sign in, assign people in apps and events | lit. b, additionally lit. f | until the account is deleted |
| Sign-in with Google (only if set up and chosen by you): email address and name confirmed by Google | Sign-in without a separate password | lit. b | until the account is deleted |
| Second factor (optional or where required): one-time code by email or SMS, for SMS your mobile number; “remember device” flag | Account protection | lit. b and lit. f (Art. 32 GDPR) | codes a few minutes; mobile number until you remove it; “remember device” 30 days |
| Confirmation and reset tokens (hashed), time of last sign-in, failed attempts with IP address | Confirm email, reset password, protect against password guessing | lit. b and lit. f | 24 hours or 1 hour; counters expire after 15 minutes to 1 hour |
| Events: registration for programme items, ticket (name, ticket type, QR code), check-in scans with time, messages in the event chat | Participation, check-in, programme, exchange | lit. b; event chat on your use (lit. b/f) | as long as the event exists; afterwards according to the organiser’s rules or statutory periods |
| Matchmaking: your profile (details you provide), search criteria, your swipe decisions, contact requests and matches | Bring attendees together | lit. a — only if you make yourself visible for an event; can be switched off at any time | until you end visibility or delete the account |
| Messages and contacts between accounts, invitations | Communication within the platform | lit. b and lit. f | until deleted by you or the participants |
| Academy, games, Focus, prompt tools: learning progress, results and leaderboards (with your display name, if you take part), certificates, prompts and inputs you save | Learning, competition, storing your work | lit. b; leaderboards lit. f | until deleted by you or the account is deleted |
| Organisation and team functions (roles, invitations, projects and tasks, apps enabled in an organisation, e.g. HR apps): content entered by your organisation | Collaboration within the organisation | depends on the organisation; we act as processor (see section 2) | as determined by the organisation |
| Operating statistics: time, app, requested path, response code, duration, referrer; a daily changing, non-reversible hash to count unique visitors. No IP address is stored. | Operation, troubleshooting, load | lit. f | raw data at most 35 days |
| Hoster server logs (IP address, time, address, browser identifier) | Operation, attack defence | lit. f | as set by the hoster, usually a few days |
| Requests by email or phone | Answering them | lit. b or lit. f | until resolved, at most three years |
| Invoice and contract data (where paid services exist) | Billing, accounting | lit. b and lit. c | 6 or 10 years (§ 257 HGB, § 147 AO) |
Technically necessary and without consent (§ 25(2) no. 2 TDDDG): the session identifier pcsid (ends at the latest when you close the browser), pctrust
(only if you choose “remember this device” in two-factor sign-in; 30 days), pck (your last chosen account in multi-account mode; 180 days) and pclang
(your language choice; one year). They are only sent over HTTPS, cannot be read by scripts and contain no content.
Your browser also stores settings in local storage (e.g. chosen programme view, Academy appearance, best scores in games, dismissed notices). These values do not leave your device; you can delete them at any time in your browser settings.
If we have set up analytics or marketing services and require consent, a cookie banner appears. We remember your choice in the cookie dc_consent (one year). Without your
consent none of these services is loaded. To change your choice, delete this cookie in your browser settings; the banner will then appear again.
The platform can include the following services if we set them up: Google Tag Manager and Google Analytics 4 (Google Ireland Ltd., Dublin), Hotjar (Hotjar Ltd., Malta), Meta Pixel (Meta Platforms Ireland Ltd., Dublin), TikTok Pixel (TikTok Technology Ltd., Dublin), X Pixel (Twitter International Unlimited Company, Dublin) and Ahrefs Analytics (Ahrefs Pte. Ltd., Singapore). They serve to measure reach and the success of our offers and campaigns. They load only with your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG); without consent there is no connection to these providers. Hotjar masks input in form fields by default. The providers may transfer data to the USA and other third countries (see section 10) and link it to their own accounts; details are in their privacy notices. We tell you on request which services are currently active.
In matchmaking and attendee views you are visible only if you have set it up for the respective event. Your agenda is not open by default. We do not pass attendee lists to third parties; exhibitors and sponsors receive contact data only if you expressly agree at the stand (e.g. by badge scan). Name and company may appear on the name badge. For speakers and contacts at exhibitors we process name, role, company, short bio and photo to publish the programme.
At events of dcyphr.® and AICon, photo, video and audio recordings are made and used for documentation, reporting, media library, promotion of future events, social media and press releases (legitimate interest, Art. 6(1)(f) GDPR, §§ 22, 23 KUG). We point this out at check-in, on tickets and by signage. If you do not want to be recognisably depicted, tell us at check-in (you will receive a marker); afterwards you can object at any time at contact@dcyphr.ai. Talks are recorded and published only with the speakers’ consent.
Where service providers outside the EU/EEA are used, we ensure an adequate level of protection through an adequacy decision (e.g. EU-US Data Privacy Framework for certified US providers), EU standard contractual clauses (Art. 46(2)(c) GDPR) or, in individual cases, your explicit consent (Art. 49(1)(a) GDPR). We provide a copy of the safeguards on request. The platform itself is hosted in Germany.
We do not make automated decisions with legal effect (Art. 22 GDPR). Suggestions in matchmaking are hints based on your own details and search criteria; you decide whether to contact someone. Where you interact with an AI system, we label it (Art. 50 AI Regulation (EU) 2024/1689).
Anyone who knows a personal link (e.g. invitation or sharing link) can retrieve content with it without signing in. Do not pass such links on; where the platform offers it, “Create new link” makes the old one invalid immediately. Uploaded files are stored outside the publicly accessible area and delivered only to authorised, signed-in people. Name, handle and profile picture are visible to members of shared teams, organisations and events.
You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests, at any time against direct marketing (Art. 21 GDPR). You can withdraw consent with effect for the future (Art. 7(3)). An email to contact@dcyphr.ai is enough. You can change many details yourself in your profile and take your data with you using the export functions of the apps.
You can lodge a complaint with a supervisory authority. The authority responsible for us is the State Commissioner for Data Protection and Freedom of Information Baden-Württemberg, Lautenschlagerstraße 20, 70173 Stuttgart.
On request we delete your account including name, email address, handle, profile picture and your personal settings. Contributions and entries that belong to the shared work of a team, organisation or event (e.g. created tasks, programme items) may remain; on request we remove your name there. Statutory retention duties remain unaffected.
Without name, email address and password (or Google sign-in) no account can be created; without an account the apps cannot be used. All other details, including profile picture and matchmaking profile, are voluntary.
The platform is delivered only over TLS (HTTPS); passwords are stored only as hashes. We apply technical and organisational measures under Art. 32 GDPR and keep them up to date. We review this policy at least annually and adapt it when processing or the law changes; the version published here applies.