1. Data controller
Klimbee (“we”, “us”) operates and provides an innovative audio-learning platform. Under Article 4(7) of the General Data Protection Regulation (EU) 2016/679 (GDPR), we act as the controller of your personal data.
2. What data we collect
During the MVP (Minimum Viable Product) phase we follow the principle of “data minimisation” (Art. 5(1)(c) GDPR). We collect only the information strictly necessary for the service to work:
Waitlist and registration data
Your valid email address, stated interest in specific features and the confirmation timestamp of your early-access sign-up.
User study content for audio conversion
Text passages, attached files (PDF, DOCX, TXT) or public web links (URL) voluntarily submitted for summarisation and narration. We recommend not uploading sensitive personal data (national ID numbers, health data, passwords) in study material.
Technical metadata and system logs
Anonymised IP address, browser type and version, operating system, audio rendering errors and load times, collected strictly to ensure availability and diagnostics.
3. Purposes and legal basis for processing
All processing of personal data at Klimbee has a specific legal basis within the meaning of Art. 6 GDPR:
| Processing category | Specific purpose | Legal basis (GDPR) |
|---|---|---|
| Waitlist sign-up | Notifying you when access opens and sending test invitations. | Art. 6(1)(a) – Consent |
| Text-to-audio synthesis | Generating personalised audio podcasts from your texts. | Art. 6(1)(b) – Performance of a contract |
| Security & monitoring | Protection against abuse, DDoS attacks and API overload. | Art. 6(1)(f) – Legitimate interest |
4. Audio synthesis and artificial intelligence (AI) processing
At the heart of Klimbee is turning complex study texts into smooth, natural audio with modern neural networks. We apply the strictest security standards when working with AI partners:
Privacy guarantee: not used for AI training
We firmly guarantee that the text materials, links, notes or converted audio recordings you upload are NOT used for public training or fine-tuning of general language models (LLMs) or voice models without explicit, separate and informed written consent.
- In-memory transit processing: Texts are processed in isolated containers and forwarded to the synthesiser only through encrypted enterprise API endpoints with zero retention (Zero-Data Retention agreements).
- Individual sessions: Audio files are protected and accessible only to the account holder via dynamically generated signed URLs.
5. Data retention period
Your personal data is kept only as long as needed for the purposes for which it was collected, or until you withdraw your consent:
- Waitlist emails
- Until the public beta launches or until you unsubscribe.
- Max. 12 months
- Generated audio recordings
- Kept in cache for fast streaming for up to 30 days after generation.
- 30 days (auto-delete)
- Technical logs
- Anonymised server records of errors and stability.
- 90 days
6. Sharing with third parties and processors
Klimbee never sells, rents or monetises your data with advertising brokers. We use only vetted infrastructure providers (data processors) with signed data processing agreements (DPA):
- EU / Frankfurt
Cloud hosting and servers
European data centres (Germany/France) with ISO 27001 and SOC 2 certification.
- Enterprise DPA
Licensed AI audio & TTS providers
Enterprise API partners for voice synthesis with a signed zero-retention clause.
- Encrypted channel
Transactional emails (waitlist confirmations)
Secure delivery of system messages with two-factor encryption.
7. Your rights under the GDPR
You keep full control over your identity and content. You can exercise the following rights at any time, free of charge:
Right of access (Art. 15)
You can request a copy of all personal data and study materials we store about you.
Right to rectification (Art. 16)
If you notice an error in your email or profile, you have the right to have it corrected immediately.
Right to erasure (“right to be forgotten”, Art. 17)
Complete, irreversible removal of your email from the list and deletion of all uploaded files.
Right to data portability (Art. 20)
Receive your generated audio files in a structured, commonly used audio format (.mp3 / .wav).
Supervisory authority in the Republic of Bulgaria
If you suspect a breach, you have the inalienable right to lodge a complaint with the Commission for Personal Data Protection (CPDP).
8. Security and encryption
We apply state-of-the-art technical and organisational measures (TOMs) under Art. 32 GDPR to protect against accidental or unlawful loss, disclosure or unauthorised access:
TLS 1.3 encryption in transit
Every sign-in, text upload or audio stream goes through a secure SSL/TLS tunnel with Perfect Forward Secrecy.
Isolated cloud storage
Audio content is stored in encrypted block containers accessible only with unique, time-limited authentication keys.
Automated scanning
Continuous vulnerability testing and injection prevention on submitted text before generation starts.
Strict access control
Access to technical consoles is minimised, protected with hardware tokens and the principle of least privilege.
9. Contact the Data Protection Officer (DPO)
If you have questions about how your study texts are processed, want to request deletion or have security suggestions, contact our officer directly. We respond within 48 hours.