Privacy Policy

Scope

This privacy policy applies centrally to all websites of CARLOS ROSAL GmbH:

• • carlosrosal.com (incl. DEEP TALK.)
• • changeindepth.com
• • tools.carlosrosal.com

Section A applies to all three websites. Sections B to D contain additional information for each website.

None of the websites uses tracking or analytics tools of the operator (no Google Analytics, no Meta Pixel, no Plausible, no Matomo or similar) or advertising or social-media plugins. Fonts are served locally; no fonts are loaded from external servers (e.g. Google Fonts).

Data controller

CARLOS ROSAL GmbH

Heimatweg 28

4806 Wikon

Switzerland

Privacy contact: datenschutz@carlosrosal.com

General enquiries: carlos@carlosrosal.com · Phone: +41 79 640 60 61

Hosting and technical service providers

All three websites are operated and hosted on the Lovable platform. A Data Processing Agreement is in place for the use of Lovable under the Business plan. The contracting party and data importer under this agreement is Lovable Labs Incorporated, 1111b South Governors Avenue, Dover, DE 19904, USA. The agreement also names Lovable Labs AB with a contact address in Sweden.

The websites are delivered through the Cloudflare network. tools.carlosrosal.com and DEEP TALK. additionally use the database infrastructure of Lovable Cloud (details in sections B and D).

Technical log data

When you access a website, the hosting layer processes technical details such as request URL, HTTP method, IP address, response status and timing information. This data is used to deliver the websites, to ensure their stability and security, and to detect and defend against misuse.

There is no analysis of user behaviour for marketing purposes, no profiling and no sharing with third parties for advertising. Lovable does not publish specific retention periods for these logs.

Cookies, security and measurement functions of the platform

Independently of our own content, the platform and its network provider use technical functions:

• • Cloudflare cookie "__cf_bm": set for security purposes (distinguishing automated traffic); according to Cloudflare it expires after about 30 minutes.
• • Scripts embedded by Lovable ("/~flock.js", "/__l5e/events…js"): these may transmit technical performance and event data (e.g. page load times) to Lovable. We are currently clarifying the exact scope of the transmitted data and its retention with Lovable.

Website-specific, strictly necessary cookies and browser storage are described in sections B and D. None of these elements is used by us for advertising or tracking.

International transfers

Data may be processed outside Switzerland, in particular in the EU and the USA. For transfers outside Switzerland or the EEA, Lovable refers to its privacy policy (section 12) and to EU Standard Contractual Clauses with its service providers. According to Lovable, it is not certified under the Swiss–U.S. Data Privacy Framework.

Contact

The websites do not include a general contact form. If you contact us by email, phone or WhatsApp, the information you provide (e.g. name, email address, phone number, content of your message) is processed to handle your request and is not shared with third parties for advertising. When using WhatsApp, the provider's terms also apply.

Your rights

Under the Swiss Federal Act on Data Protection and – where applicable – the EU General Data Protection Regulation, you have in particular the right to:

• • request information about the data processed about you
• • have inaccurate data corrected
• • request deletion of your data
• • object to certain processing or request its restriction
• • request the handover or transfer of your data in a common electronic format

These rights apply subject to the statutory requirements and may be restricted by law, for example by retention obligations.

You also have the right to lodge a complaint with the Swiss Federal Data Protection and Information Commissioner (FDPIC/EDÖB); where the GDPR applies, also with a competent supervisory authority in the EU.

For privacy enquiries: datenschutz@carlosrosal.com

Retention period

Personal data is only stored for as long as necessary for the respective purpose or as required by statutory retention obligations. Different or additional information can be found in sections B to D.

DEEP TALK. (AI sparring partner)

Purpose: DEEP TALK. is an AI-powered sparring partner on topics such as sales, leadership and transformation. What you enter is processed solely to generate a response for you within the current conversation.

Technical service provider: responses are generated by AI models accessed through the Lovable AI Gateway. For this purpose, your input and the conversation so far are transmitted to Lovable and the underlying AI model providers. A Data Processing Agreement is in place for the use of Lovable.

Place of processing: according to Lovable, the entry point of the Lovable AI Gateway is hosted in the EU. AI requests are then forwarded to AI model provider endpoints in the USA.

Model training: according to Lovable, its agreements prohibit the AI model providers from using the content to train their models. The Data Processing Agreement distinguishes between personal data that Lovable processes on our behalf (Customer Personal Data) and data about the use and operation of the service (Service Data); Lovable's own terms apply to Service Data. We therefore cannot give a blanket assurance that no data whatsoever is used for training purposes.

Storage: DEEP TALK. does not permanently store conversations in a conversation database of its own. The conversation exists only in your browser window and is lost when you close or restart it. Immediate deletion by the AI model providers (zero data retention) is not guaranteed; Lovable does not publish retention periods for prompts and responses.

Technical log data: the project's AI logs contain only technical metadata such as status, model used, token usage, cost and duration, but not the conversation content.

Cookie and browser storage: when you use DEEP TALK., the strictly necessary cookie "dt_session" is set (HttpOnly, at most 12 hours) to secure the session and enforce usage limits. In addition, your browser's session storage records for the duration of the session that you have acknowledged the privacy notice. Neither is used for tracking.

Security and abuse prevention: to enforce usage limits, technical counters are kept in Lovable Cloud using a pseudonymised (salted hash) value of your IP address – without any conversation content and without the IP address in plain text. The counters are limited to at most 24 hours; expired entries are removed automatically during later DEEP TALK. requests and may technically remain until then. Failed sign-in attempts are also counted briefly in the server's memory.

Usage statistics: to operate DEEP TALK., only aggregated counts per Swiss calendar day are recorded in Lovable Cloud (number of new conversations, number of AI requests, referring website of new conversations and tokens used). No conversation content, no IP addresses and no information that could identify individual visitors are stored. On days with usage, this summary is sent once a day by e-mail to CARLOS ROSAL GmbH (sent via Microsoft 365). The counts are deleted automatically after 90 days.

Please do not enter any personal, sensitive or confidential information, and describe your situation as anonymously as possible. DEEP TALK. responses are AI-generated, may contain errors and are no substitute for personal advice.

Additional information for changeindepth.com

changeindepth.com is an informational website. It has no AI processing of its own, no forms, no user accounts and no application database of its own.

The technical log data, the Cloudflare cookie and the Lovable platform scripts described in section A apply. The website sets no cookies or browser storage of its own; the technical page navigation may temporarily keep the scroll position in session storage.

Links to DEEP TALK. lead to the application operated centrally on carlosrosal.com; section B applies.

Additional information for tools.carlosrosal.com

Access request: to access the tools, you can submit your name, email address, the requested tool and optionally a message. This information is stored together with the time of the request and processing information in order to handle your request and send you an access code.

Storage in Lovable Cloud: access requests, access codes and redemptions are stored in a Lovable Cloud database. When a code is redeemed, name, email address, a hashed identity value, a hashed value of the IP address and the browser identifier are stored. This data is used for access control and to prevent access codes from being shared. It can only be accessed server-side.

Retention of access requests: open requests remain stored until they have been processed. Completed requests are deleted automatically, no earlier than 90 days after receipt and not before the completion date.

Retention of access codes and redemptions: active access codes and the related redemptions remain stored as long as they are needed for access and usage limits. For expired or blocked codes, personal data is removed after 90 days. Codes and redemptions that are no longer needed are deleted after 12 months at the latest. On request to datenschutz@carlosrosal.com we will also delete your data earlier unless retention obligations apply.

Email delivery: access codes and internal notifications are sent via the Lovable platform's Microsoft Outlook integration. The emails contain name, email address, your message if provided, and the personal access code.

Cookies: two strictly necessary cookies are set for access; they are not used for tracking. "cr_access" stores the access session (lifetime 10 days). "cr_identity_v2" contains only a random identifier, no names or email addresses (lifetime 30 days at most). Name and email address are stored server-side, where the identifier exists only as a non-reversible check value. These identity entries are kept for 30 days at most and deleted automatically once expired.

Browser storage: your browser's local storage holds only a technical copy of the sign-in ("cr_access_token"), without name or email address. The application does not store names or email addresses in cookies or local storage. As a transitional measure, older entries containing name and email address (cookie "cr_identity", local storage entry "cr_identity_hint") are no longer used and are removed automatically on your next visit.

Questionnaires and results: your answers in the tools and the results are calculated exclusively in your browser and are not transmitted to or stored by us or third parties.

Security: access is protected by server-side verified access codes and signed sessions; administrative functions are only reachable with separate access. Repeated incorrect entries of access codes and the master password are limited. For this we use pseudonymised security identifiers instead of plain-text IP addresses; failed-attempt counters are cleaned up automatically after 24 hours at the latest.

Changes

We reserve the right to adapt this privacy policy as needed. The version published here applies.