Privacy Policy
1. Controller and Contact
The controller within the meaning of the General Data Protection Regulation (GDPR) for the processing of personal data in connection with this website and the offerings “LYF – Lead Yourself First” (hereinafter “LYF”) and “Agentic Engineering” is:
Daniel Hauck, Friedhofstr. 21, 71577 Großerlach, Germany, Email: dh@hauck.io, Mobile: +49 176 23909862
No data protection officer has been appointed, as there is no legal requirement to do so (the number of people involved in data processing is below the statutory threshold of 20 persons, Section 38 of the German Federal Data Protection Act – BDSG). For data protection inquiries, please contact the email address above.
2. General Information on Data Processing
Personal data means any information relating to an identified or identifiable natural person. We generally process our users’ personal data only to the extent necessary to provide our website and our offerings, content, and services, or where another legal basis applies (consent, a legal obligation, or a legitimate interest).
3. Data Collected When Visiting the Website
When you access our website, our hosting provider automatically collects information transmitted by your browser to our server (server log files):
- page visited
- date and time of access
- amount of data transferred
- referring page (referrer URL)
- browser and operating system used
- IP address (possibly anonymized)
Processing is carried out under Art. 6(1)(f) GDPR, based on our legitimate interest in the stability and security of our website. The data is automatically deleted after 30 days, unless specific indications of unlawful use require further storage for evidentiary purposes.
Data transmission on our website is additionally protected using current SSL/TLS technology to secure your data as effectively as possible against unauthorized access. You can recognize an encrypted connection by the string “https://” in your browser’s address bar.
4. Hosting
Our website and the backend of the LYF app are hosted by:
Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany.
All data collected through the use of our website and the LYF app is stored and processed on Hetzner’s servers, located in Germany. We have concluded a data processing agreement (DPA) with Hetzner under Art. 28 GDPR. No transfer to a third country takes place as part of this hosting.
5. Data Transfers to Third Countries
Some of the service providers we use are based outside the EU/EEA or transfer data there, in particular to the United States. In these cases, we ensure an adequate level of data protection – either based on an adequacy decision of the European Commission (e.g., the EU-US Data Privacy Framework, Art. 45 GDPR) or on EU Standard Contractual Clauses (Art. 46 GDPR). Further details are provided below for each relevant service.
6. Cookies
Our website does not use any cookies that would require consent. The analytics software Matomo that we use (see Section 7) runs in a cookieless configuration. A cookie consent banner is therefore not required.
7. Web Analytics (Matomo)
We use the analytics software Matomo to statistically evaluate visitor behavior on our website. Matomo is self-hosted on our own servers at Hetzner (see Section 4). No cookies are set, and IP addresses are anonymized before storage (the last digits are masked), so that identification of individual users is not possible.
Processing is based on our legitimate interest (Art. 6(1)(f) GDPR) in the statistical evaluation of website usage to improve our offering. Data is not shared with third parties.
8. Contacting Us
If you contact us by email, we store your details (including your email address, name if provided, and the content of your message) to process your inquiry.
Our business email correspondence runs through Google (Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland, potentially involving Google LLC, USA). The legal basis is Art. 6(1)(b) GDPR (performance of a contract or pre-contractual measures) or Art. 6(1)(f) GDPR (legitimate interest in responding to inquiries). We have concluded a DPA with Google under Art. 28 GDPR; where applicable, data transfers to the USA take place under the EU-US Data Privacy Framework (see Section 5).
Your data will be deleted once it is no longer needed to process your inquiry, and no later than 6 months, unless further storage is required (e.g., in connection with an agreement that has been concluded).
9. Newsletter
If you subscribe to our newsletter, we use your email address to send you information about our offerings (LYF and Agentic Engineering) as well as new content on our website. The newsletter is directed at anyone interested, regardless of whether you are already a customer.
We use the double opt-in procedure: you will only receive the newsletter after you have expressly confirmed your subscription via a confirmation link. The legal basis is your consent (Art. 6(1)(a) GDPR). You may withdraw your consent at any time via the unsubscribe link in every newsletter email.
We use the service Brevo SAS, 8 rue de Londres, 75009 Paris, France, to send our newsletters. We have concluded a DPA with Brevo under Art. 28 GDPR. Brevo is based in the EU; to our knowledge, no transfer to third countries takes place.
10. LYF: User Account and App Usage
10.1 Registration
When you book the LYF program or Membership, we create a user account for you. In doing so, we process your name and email address. The legal basis is Art. 6(1)(b) GDPR (performance of a contract).
10.2 Daily App Usage
In the app, you record the completion status of the four daily prompts each day (done/not done). This status is visible to your coach. The specific content (e.g., what you journaled) is not automatically shared with the coach or an AI feature – only if you actively choose to share a specific entry.
The legal basis is Art. 6(1)(b) GDPR (performance of a contract). For entries you voluntarily share, that act of sharing also constitutes your consent to processing for that purpose.
10.3 AI-Assisted Feedback (Claude via OpenRouter)
If you share an entry for AI-assisted feedback, its content is forwarded to the Claude language model, which we access through the routing service OpenRouter, Inc., USA. OpenRouter technically forwards the request to the AI provider (Anthropic) and returns the response.
Data transfers to the USA are carried out, where possible, on the basis of appropriate safeguards (EU Standard Contractual Clauses, Art. 46 GDPR) or an adequacy decision. The legal basis for this processing is your consent (Art. 6(1)(a) GDPR), which you give by actively sharing the relevant entry, and which you can withhold for future entries at any time simply by not sharing them.
10.4 Confidentiality and Support Access
The Provider and the coaches acting on its behalf treat all personal information disclosed in the course of coaching as confidential (see also Section 10 of our Terms). For support, maintenance, or troubleshooting purposes, we may temporarily access your user account; the legal basis is Art. 6(1)(f) GDPR (legitimate interest in functioning support).
10.5 Retention Period
Your data is stored for the duration of your 90-day Program or your Membership. After the Program or Membership ends, app access and the data stored there are deleted 30 days after the agreement ends, unless statutory retention obligations require otherwise.
11. LYF: Health-Related Information
During the introductory call or by email, you may voluntarily tell us whether you have an acute mental health condition, are currently experiencing a crisis, or are undergoing ongoing psychotherapeutic treatment (see Section 9 of our Terms). This constitutes health data and therefore a special category of personal data within the meaning of Art. 9 GDPR.
Providing this information is voluntary. If you share such information with us, we treat this as your express consent to processing it for the purpose of assessing whether the Program is suitable for you (Art. 9(2)(a) GDPR). This information is used exclusively for that purpose, is not shared with third parties, and is deleted once no longer needed for it, at the latest upon expiry of the period described in Section 10.5. You may withdraw your consent at any time with effect for the future.
12. LYF: Waitlist
If no course place is currently available, you may add yourself to our waitlist, without obligation. For this purpose, we process your name and email address in a dedicated database hosted by our provider Hetzner (see Section 4).
The purpose is to notify you once a course place becomes available again. The legal basis is Art. 6(1)(b) GDPR (pre-contractual measures taken at your request) or Art. 6(1)(f) GDPR (legitimate interest in an orderly waitlist). Being on the waitlist does not entitle you to a place.
Your data is deleted once you register for a course, or at the latest 12 months after the last notification, if you have not responded to it.
13. LYF: Appointment Scheduling
For scheduling the introductory call and other appointments, we use the following scheduling services, depending on availability:
Google Calendar
Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland. We process your name, email address, and, where provided, phone number to schedule the appointment. The legal basis is Art. 6(1)(b) GDPR (performance of a contract) or Art. 6(1)(f) GDPR (legitimate interest in efficient appointment management). Data is deleted after the appointment takes place. We have concluded a DPA with Google under Art. 28 GDPR; data transfers to the USA take place under the EU-US Data Privacy Framework (see Section 5).
Fantastical
Flexibits, Inc., 223 Wall Street #238, Huntington, NY 11743, USA.
We process your name, email address, and, where provided, phone number to schedule the appointment. The legal basis is Art. 6(1)(b) GDPR (performance of a contract) or Art. 6(1)(f) GDPR (legitimate interest in efficient appointment management). Data is deleted after the appointment takes place.
We have concluded a DPA with Flexibits under Art. 28 GDPR; data transfers to the USA take place on the basis of EU Standard Contractual Clauses.
14. LYF: Payment Processing
For payment processing, we use the payment provider Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland. We process the data required for payment processing (including name, payment data, transaction data). The legal basis is Art. 6(1)(b) GDPR (performance of a contract). We have concluded a DPA with Stripe under Art. 28 GDPR. Further information: https://stripe.com/privacy
15. Agentic Engineering: Inquiries and Proposals
If you submit an inquiry regarding our Agentic Engineering workshops through our website or by email, we process the data you provide (company name and address, contact person’s name, email address, phone number) to prepare a proposal and carry out the engagement. Communication takes place through the channels described in Section 8.
For internal documentation, proposal preparation, and management of client data, we also use the following services:
Google Docs
Google Ireland Limited / Google LLC (see Section 8 – same data processing agreement and transfer basis). We use Google Docs for internal documentation of inquiries and to prepare proposals.
Notion
Notion Labs, Inc., 2300 Harrison Street, San Francisco, CA 94110, USA. We use Notion for internal documentation of client inquiries and proposals.
We have concluded a DPA with Notion under Art. 28 GDPR; data transfers to the USA take place on the basis of EU Standard Contractual Clauses.
Lexware Office
Haufe-Lexware GmbH & Co. KG, Munzinger Straße 9, 79111 Freiburg, Germany. We use Lexware Office to manage client data and for invoicing.
We have concluded a DPA with Lexware Office under Art. 28 GDPR; data transfers to the USA take place on the basis of EU Standard Contractual Clauses.
The legal basis for the processing described above is Art. 6(1)(b) GDPR (pre-contractual measures or performance of a contract). Data is deleted once it is no longer required to process the inquiry or to carry out an engagement that has been concluded, taking into account statutory retention obligations (in particular Sections 147 of the German Fiscal Code (AO) and 257 of the German Commercial Code (HGB): 10 years for tax- and commercial-law-relevant records).
16. Your Rights as a Data Subject
Under the GDPR, you have the following rights:
- Right of access under Art. 15 GDPR
- Right to rectification under Art. 16 GDPR
- Right to erasure under Art. 17 GDPR
- Right to restriction of processing under Art. 18 GDPR
- Right to data portability under Art. 20 GDPR
- Right to object to processing under Art. 21 GDPR
- Right to withdraw consent under Art. 7(3) GDPR
- Right to lodge a complaint with a supervisory authority under Art. 77 GDPR
To exercise these rights, an informal message to the contact address given in Section 1 is sufficient.
Right to object: Where we process your data based on a balancing of interests (Art. 6(1)(f) GDPR), you may object to that processing for reasons arising from your particular situation. We will then no longer process the data, unless we can demonstrate compelling legitimate grounds that override your interests, or the processing serves to assert, exercise, or defend legal claims.
17. Retention Period, Generally
Unless a more specific retention period is stated elsewhere in this policy, we store personal data only for as long as necessary for the relevant processing purpose, or for as long as statutory retention periods apply (in particular commercial- and tax-law retention obligations of up to 10 years, Sections 147 AO and 257 HGB).
Last updated: 08/2026