Privacy Policy

Note: This is the English version of DWNO's Privacy Policy. The German version is available at /datenschutz.

1. Controller

DWNO LLC, represented by Marco Kogler.
Registered office:
315 Westchester Ave, Suite 20208
Port Chester, New York 10573, USA

Mailing address:
48 Wall Street, Suite 1100, PMB 1008
New York, NY 10005, USA

Email for data protection enquiries: info@dwno.vision

2. What data we process

When using the public pages: technically necessary access data (IP address, time, page called up, browser type). These arise from the operation of any server and are not combined into profiles.

When making a purchase: name, email address, billing data, country, telephone number (voluntary), products purchased, payment method, payment status. Full credit card data reaches our servers at no time — it is entered directly with our payment service provider.

Your telephone number: Providing it in the order form is voluntary — the purchase is concluded just the same without it. We store it with your user account and use it to reach you if a payment does not go through; usually this is just an expired card. The Participant through whose referral link you purchased sees your name, your email address and — where provided — your telephone number, in order to support you with your purchase and to address you regarding further offers from DWNO. Your postal address is never shown to them. They may not store this information outside the platform, may not pass it on to third parties and may not use it for their own purposes; an export is not possible for them. A number already stored is not overwritten by a later purchase. You can have it changed or deleted at any time; if your account is deleted or anonymized, it is removed with it.

With a user account: access data, course progress, last position viewed in a video, messages from the system.

When participating in the referral program: referral code, attributed sales, commission bookings, payout requests, bank details and tax data. Bank details and tax data are stored encrypted.

For registered prospects: If a Participant registers a prospect, we process their name and contact details. This presupposes that the Participant confirms this person's consent to us; the wording and time of this confirmation are stored with it.

3. Legal bases

Art. 6(1)(b) GDPR (performance of a contract) for purchase, access and processing. Art. 6(1)(c) GDPR (legal obligation) for invoicing and retention obligations. Art. 6(1)(f) GDPR (legitimate interest) for the secure operation of the platform. Art. 6(1)(a) GDPR (consent) for the sharing of prospect data.

4. Cookies

We set exclusively technically necessary cookies:

• Login cookie — maintains your session. Without this cookie, no login is possible.

• Referral cookie (dwno_ref, 60 days) — remembers which Participant you came to the site through, so that their commission is attributed correctly.

We do not set any analytics, advertising or tracking cookies. There is no Google Analytics, no Meta pixel and no remarketing on this platform.

5. Service providers that process data for us

• Vercel Inc. — operation of the application · server location Frankfurt

• Neon Inc. — database · Frankfurt (eu-central-1)

• Stripe — payment processing · EU / USA

• Quaderno — invoices and value added tax · EU

• Resend — sending emails · USA

• Vimeo Inc. — delivery of the course videos · USA

• Close (via n8n) — customer management for prospects · USA

For transfers to the USA, we rely on standard contractual clauses under Art. 46 GDPR. We are aware that US law does not guarantee a level of protection equivalent to the GDPR.

Fonts are delivered from our own server; simply visiting the website does not establish any connection to Google servers. (If a Participant voluntarily connects their Google Calendar, the section "Google Calendar" further below applies.)

ProvenExpert ratings are retrieved and stored server-side. Your browser does not establish any connection to ProvenExpert; no data about you is transmitted there.

Videos are delivered by Vimeo. When a video is played, a connection to Vimeo is established, during which your IP address is transmitted to Vimeo. This only happens once you open a lesson.

Google Calendar (only for Participants, only voluntary)

Participants can voluntarily connect their Google Calendar in their area so that only genuinely free times are offered when scheduling appointments. Only with this connection — and only after express consent in Google's window — does DWNO access the following data of the connected Google account:

• the list of calendars of the account, so that the Participant can select which calendars should count as "busy";

• the busy times in these calendars, i.e. exclusively the start and end of busy time slots — no titles, no attendees, no descriptions, no locations;

• the creation, modification and removal of the appointments generated by DWNO, so that an appointment arranged via DWNO appears in the Participant's calendar and also disappears again there if it is cancelled.

• the Participant's own appointments in these calendars — with title, note and the email addresses of the attendees — exclusively so that the Participant can see their own calendar within DWNO; this information is shown only to them and is not stored on our servers;

For this, the following are stored: the encrypted access token of the Google account, the email address of the connected Google account, the selection of the calendars taken into account and the identifiers of the appointments generated by us. Busy times are only queried for displaying the free times and are not stored permanently.

This data is used exclusively for scheduling within DWNO. It is not sold, not used for advertising, not used to train AI models and not passed on to third parties.

How we protect this data

The following technical and organizational measures apply to the data from a connected Google account:

Encryption in transit. Every connection to DWNO and every call to the Google interface runs over HTTPS (TLS). Calls over an unencrypted connection are redirected to the encrypted one.

Encryption at rest. The access token and the refresh token of the Google account are stored encrypted with AES-256-GCM. The master key required for this lies exclusively in the operator's protected environment configuration — never in the program code and never in the database. In plaintext, these keys exist only for the duration of a single access in memory.

Data minimization. For displaying free times, only the start and end of busy time slots are read via Google's freeBusy interface — without title, description, attendees or location. These busy times are not stored, but only used to calculate the free times and then discarded.

So that a Participant can see their own calendar within DWNO, their own appointments are additionally read with title, note and the email addresses of the attendees. This data is shown exclusively to them, not stored on our servers and not made accessible to any other person — not even to an administrator. In writing, DWNO exclusively creates, modifies or cancels the conversations arranged via DWNO as appointments; other appointments are not changed and no calendars are created or deleted.

Access restriction. Only the Participant themselves can access a Participant's calendar data. Even an administrator who temporarily takes on a Participant's view in the system ("acting as") expressly does not get to see their Google Calendar data. Every administrative action is logged.

Protection against accidental disclosure. Access and refresh tokens as well as authorization headers are automatically removed from error messages and logs before these are stored or transmitted to our error service. Incident reports to the operator contain only counts, no personal data.

Deletion. If a Participant disconnects — in the DWNO account or in the Google account — the stored keys are deleted. Access to the Google account is then no longer possible.

Server location. Application and database are operated in Frankfurt am Main (European Union).

Purpose limitation. This data is used exclusively for scheduling within DWNO. It is not sold, not used for advertising, not used to train AI or machine learning models and not passed on to third parties — not even to human reviewers, except insofar as this is necessary to remedy a specific incident reported by the user, is required by law or the user expressly consents. DWNO's use of Google user data complies with the Google API Services User Data Policy, including the Limited Use requirements.

The connection can be ended at any time — in the DWNO account under "My Leads → Google Calendar → Disconnect" or in the Google account under "Third-party apps with account access". Upon disconnecting, the stored access token is deleted.

The legal basis is consent (Art. 6(1)(a) GDPR).

DWNO's use of Google user data complies with the Google API Services User Data Policy, including the Limited Use requirements.

6. Watermark in videos

A discreet watermark with your email address is displayed over course videos. It serves solely to protect against unauthorized sharing of the content and is not analyzed or stored.

7. Retention period

We retain contract, payment and accounting data for the duration of the statutory retention periods. We delete account data when the account is deleted and no retention obligation stands in the way. Registered prospects who have not become customers are automatically deleted at the latest after twelve months.

Bookings in the commission ledger are immutable and can neither be changed nor deleted. When an account is deleted, the personal details are made unrecognizable; the amounts themselves remain for accounting reasons.

8. Your rights

Access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20) and objection (Art. 21). You can withdraw consent granted at any time with effect for the future. To do so, contact info@dwno.vision.

You also have the right to lodge a complaint with a data protection supervisory authority.

9. Minors

Our offers are directed exclusively at persons aged 18 and over.

10. Changes

We adjust this policy if the processing changes. The version published on this page at the given time applies.