Data Processing Agreement

Processor: Lukas Buck, Dorfstraße 11, 72660 Beuren, Germany ("SixSentences_", "we"), the operator of the Service described in the Privacy Policy.

Controller: the customer, meaning the person or organization that owns the workspace and decides which content is uploaded to it and why ("you"). For personal data contained in workspace content, you are the controller within the meaning of Art. 4 No. 7 GDPR and we process it exclusively on your behalf. Our own processing as controller (accounts, waitlist, billing, website, and metadata about which features of the Service are used) is described in the Privacy Policy and is not subject to this DPA.

Subject matter is the provision of the SixSentences_ research workspace: hosting and storage of customer content, text extraction from uploaded documents and photos, transcription and analysis of interview audio, hosting of surveys and collection of their responses, AI assisted search, screening, writing and figure generation, and export functions. Processing takes place solely to provide these features to you. The DPA runs for as long as your account exists and ends with its deletion.

Types of data: content of uploaded documents, photos of sources and research data files; interview audio recordings and transcripts; survey responses including optional participant labels; reviewer comments; names and contact details contained in any of the above. The concrete content is determined by you. If your research collects special categories of personal data (Art. 9 GDPR), you are responsible for a valid legal basis; we process such content as stored data without evaluating it for our own purposes.

Categories of data subjects: interview participants, survey respondents, persons mentioned in uploaded materials, authors of works, reviewers and collaborators you invite, and other persons whose data appears in your content.

We process workspace content only on your documented instructions (Art. 28 (3) (a) GDPR). Your instructions are: this DPA, your use and configuration of the Service's features, and, for AI processing, the model you select per request, which determines the provider that receives the request text. Additional instructions can be given in text form to hello@sixsentences.com. We inform you without undue delay if, in our opinion, an instruction infringes the GDPR or other applicable data protection law; we may suspend such an instruction until it is confirmed or changed.

We do not use workspace content for our own purposes. In particular, we do not use it to train models and we do not reserve any right to do so.

Only persons bound to confidentiality process workspace content. The Service is operated by its owner; should employees or contractors be added, they will be committed to confidentiality in writing before any access (Art. 28 (3) (b) GDPR). We access workspace content only where technically unavoidable for operation, legally required, or explicitly requested by you, for example in a support case.

Taking into account the state of the art and the nature of the processing, we implement in particular the following technical and organizational measures:

• Hosting in data centers in Germany operated by Hetzner Online GmbH under an Art. 28 data processing agreement.
• Transport encryption (TLS) for all connections.
• Passwords stored only as salted PBKDF2 hashes; API tokens stored only as SHA-256 hashes.
• Workspace isolation at the application layer; every request is scoped to the authenticated workspace.
• Administrative functions require an interactive authenticated session; access to production systems follows the least privilege principle.
• Encrypted backups on a short rotation cycle; deleted content falls out of the rotation automatically.
• Short lived server logs, typically no longer than 14 days.
• Self serve deletion and export functions, so you can honor data subject requests without our involvement.

We may update these measures as the state of the art evolves, as long as the level of protection does not fall below the level agreed here.

You grant a general written authorization (Art. 28 (2) GDPR) for the following sub-processors engaged in processing workspace content:

• Hetzner Online GmbH, Gunzenhausen, Germany: hosting of the Service and all stored content.
• IONOS SE, Montabaur, Germany: SMTP transport for transactional email, for example review invitations sent from a workspace.
• Google (Google Ireland Ltd. / Google LLC, USA): Gemini models for figure generation, transcription of audio and photos, and the live voice interviewer. US transfers are covered by the EU-US Data Privacy Framework with EU standard contractual clauses as fallback. Content is not used to train Google's models under the EEA terms of the Gemini API.
• OpenRouter, Inc., USA: AI gateway that routes model requests to the model you select, currently including DeepSeek (People's Republic of China) and MiniMax (Singapore). Transfers rest on EU standard contractual clauses. OpenRouter does not use inputs or outputs for training and does not store prompt content by default.

AI sub-processors only receive the text, image or audio needed for the specific request you trigger, never your account data. We announce intended additions or replacements at least 30 days in advance by updating the Privacy Policy and this page and, for active customers, by email. If you object on justified data protection grounds and no solution is found, you may terminate the affected processing by stopping use of the affected feature or by deleting the workspace; there is no lock in.

Sub-processors are bound by contracts imposing data protection obligations essentially equivalent to this DPA (Art. 28 (4) GDPR).

We assist you, insofar as possible and taking into account the nature of the processing, in fulfilling data subject rights (Art. 12 to 23 GDPR) and your duties under Art. 32 to 36 GDPR. In practice the Service is built for self service: content can be inspected, exported and permanently deleted by you at any time. Requests from data subjects that reach us directly are forwarded to you without undue delay; we do not respond on your behalf.

We notify you without undue delay after becoming aware of a personal data breach affecting your content, providing the information required by Art. 33 (3) GDPR as it becomes available.

You can export your content through the Service's export functions at any time. Deleting content, a chat, a study or the whole account permanently removes the data; backups age out of the short rotation cycle automatically. After the end of the agreement, no copy is retained beyond that cycle unless Union or Member State law requires storage.

We make available the information necessary to demonstrate compliance with Art. 28 GDPR, in the first instance through this DPA, the Privacy Policy and written answers to your questions. Audits, including inspections, are possible with at least 30 days notice, during business hours, at your cost, no more than once per calendar year, unless a supervisory authority requires one or a personal data breach has occurred. Audit results concerning our systems are confidential.

Workspace content is stored exclusively in Germany. Transfers to third countries occur only through the AI sub-processors listed in section 7, on the safeguards named there (Art. 44 ff. GDPR), and only when you use the respective feature. Copies of the standard contractual clauses can be requested from the respective provider or from us.

• You ensure a valid legal basis for the personal data you upload or collect through the Service, including Art. 9 GDPR where special categories are involved.
• You inform the persons concerned (Art. 13 and 14 GDPR). For interviews and surveys hosted on the Service, the join and survey pages display the disclosures you configure; keeping them accurate is your responsibility.
• For recorded conversations you obtain consent before the recording starts (§ 201 of the German Criminal Code). The live interviewer's consent step supports this; uploads of existing recordings require consent obtained by you beforehand.

Liability follows Art. 82 GDPR and the general agreement between the parties. This DPA prevails over conflicting terms regarding the processing of workspace content. German law applies. Should a provision be invalid, the remainder stays unaffected; the invalid provision is replaced by what comes closest to its purpose. We update this DPA when the Service or the law changes; the version and effective date above always identify the current text, and material changes are announced in advance like sub-processor changes.