BiasGap by Adrian, home
ENDE

Privacy policy

This policy explains how we process personal data when you visit biasgap.com, contact us, use the self-check, or when we contact you. It provides the information required by Articles 13 and 14 of the EU General Data Protection Regulation (GDPR) and the UK GDPR.

1. Controller

Adrian Brzenska (sole proprietor, trading as BiasGap)
Carl-Spindler-Straße 13, 12555 Berlin, Germany
Email: hello@biasgap.com
Phone: +49 176 304 56 463

We have not appointed a data protection officer, as we are not required to do so.

2. Principles and applicable law

This website is an information and contact site for business customers. We process personal data only where this is necessary to run the site, to handle your enquiry, to deliver our services or to start a business relationship. We do not sell personal data. We do not use advertising networks, retargeting or third-party tracking. We do not process special categories of personal data (Art. 9 GDPR).

We are based in Germany, so the GDPR and German law apply. If you are in the United Kingdom, the UK GDPR and the Data Protection Act 2018 also apply. Sections 14 and 15 contain additional information for people in the United States and the United Arab Emirates.

3. Your rights

You have the right to:

A short email to hello@biasgap.com is enough. We reply within one month.

4. Hosting and server log files

This website is hosted by Vercel Inc. (340 S Lemon Ave #4133, Walnut, CA 91789, USA). Content is delivered through Vercel's European edge network. When you visit the site, server log files are created automatically (shortened IP address, date and time, requested URL, browser and operating system). Purpose: secure and reliable operation. Legal basis: Art. 6(1)(f) GDPR. Logs are deleted after 30 days at the latest. For transfers to the USA, see section 12.

5. Cookies and local storage

We store your cookie choice in your browser's local storage (biasgap-consent). This is strictly necessary to respect your choice (§ 25(2) no. 2 German TDDDG; regulation 6 UK PECR). We do not set advertising cookies. Optional audience measurement (section 6) only starts after you agree in the banner, where “Reject” and “Accept” are equally prominent. You can change your choice at any time via “Cookie settings” in the footer.

6. Audience measurement (Vercel Web Analytics)

With your consent we use Vercel Web Analytics to count visits. It sets no cookies and builds no cross-site or cross-device profiles. To tell visits apart, a hash that cannot be reversed is generated from technical data (including the IP address and user agent); we cannot identify you from it. Legal basis: Art. 6(1)(a) GDPR (consent). You can withdraw consent at any time via the cookie settings.

7. Contact form, intro call and email

If you use the form or email us, we process the data you provide (name, company, email address, team size and your message) to handle your enquiry and, if you wish, to schedule an intro call. Legal basis: Art. 6(1)(b) GDPR (steps before a contract) and Art. 6(1)(f) GDPR (answering business enquiries). Name, email address and message are required; all other fields are optional. There is no legal or contractual obligation to provide your data.

After you submit the form, you receive an automatic confirmation email. Form emails are sent through Resend (Resend Inc., USA; data processed in the EU region, Ireland). Our mailbox and calendar run on Google Workspace (Google Cloud EMEA Limited, Ireland). We keep enquiries until they are fully handled and then delete them, unless a contract follows or statutory retention periods apply (6 years for business letters and 8 to 10 years for accounting records under German law).

8. Self-check and BiasGap analysis

The self-check and the BiasGap analysis run on app.biasgap.com, a separate application operated by us. This policy covers both.

Self-check (7 questions): we do not ask for your name or email address. Your answers, the type and size of your business and an optional context note are stored under a pseudonym and scored automatically. Legal basis: Art. 6(1)(b) GDPR (providing the check you requested) and Art. 6(1)(f) GDPR (aggregated pattern analysis to improve the method). If you ask for your result by email and tick the consent box, we send it to you and get in touch personally once (Art. 6(1)(a) GDPR).

BiasGap analysis (16 questions): to start, you enter your email address and details about your business. We then send you a confirmation link (double opt-in); the analysis only starts after you click it. We process your email address, your answers, two to three AI-generated follow-up questions and your answers to them, timing and answer-change signals, and the date of participation. We store the time and version of your confirmation to document it (Art. 7(1) GDPR). Legal basis: Art. 6(1)(b) GDPR (providing the free analysis). The analysis is free of charge; there is no payment.

AI-assisted findings: to write your findings, your answers, signals and optional context are sent to the API of Anthropic PBC (USA). Anthropic processes them only to generate the response and does not use them to train its models. The findings are an automated first indication; no decision with legal or similarly significant effect is made about you (Art. 22 GDPR).

Newsletter: if you tick the newsletter box (it is never pre-ticked), you subscribe when you click the confirmation link. Legal basis: your consent (Art. 6(1)(a) GDPR). You can unsubscribe at any time via the link in every newsletter or by email; we then delete your address from the list.

Reminder after 90 days: we send you one reminder so that you can measure what has changed. Legal basis: Art. 6(1)(f) GDPR. You can opt out at any time by replying to any of our emails.

Feedback: after the findings you can rate them and leave a comment. Your email address is optional there.

Database: the data is stored in an encrypted Postgres database operated by Neon Inc. in Frankfurt, Germany.

Retention: unconfirmed sign-ups are deleted after 30 days. Analysis data and findings are kept for 24 months after completion so that you can open your findings again and compare them with a later analysis, and then deleted, unless you ask us to delete them earlier. Self-check answers are kept for up to 24 months for aggregated statistics. Earlier paid analyses (until October 2026) were processed by Stripe Payments Europe Ltd. (Ireland); related payment records are kept for 10 years under German tax law.

9. Business contact from public sources

We approach owners and managing directors of agencies, consultancies, coaching businesses and other service companies to start business relationships and arrange an intro call. For this we process data that we did not collect from you directly. This section provides the information required by Art. 14 GDPR and Art. 14 UK GDPR.

Purpose: starting business relationships for the Post-Sale Revenue Audit by individual, personal messages and arranging an intro call.

Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest is direct marketing to business representatives (recital 47 GDPR). Every message is written individually by a person, not automated and not sent in bulk.

Channels and country rules: We contact people in the EU, including Germany and Italy, through LinkedIn and not by unsolicited email. In the UK we email only corporate subscribers (limited companies and LLPs), not sole traders or partnerships, unless they have agreed. Every email identifies us, includes our postal address and a simple way to opt out, and we honour opt-outs immediately. If you are in the UAE, we only continue processing your data if you reply or agree.

Sources: publicly available professional information, in particular LinkedIn profiles, posts and comments, testimonials and case studies on company websites and YouTube, review platforms such as Trustpilot and ProvenExpert, the Meta Ad Library, company websites, public company registers and industry directories.

Categories of data: name, company, role, LinkedIn profile URL, the source with date, a business email address where publicly listed, a one-sentence summary of a public professional statement used as a conversation opener, and the status of our contact. We do not store verbatim quotes, screenshots or private information.

Recipients: we do not pass this data on. Messages run through LinkedIn (LinkedIn Ireland Unlimited Company, an independent controller) or by email via Google Workspace.

Storage and deletion: the data is stored locally in Germany, not in a cloud CRM. If we have not contacted you within 30 days of collection, we delete the record. If our message stays unanswered, we delete it at the latest 90 days after our last message. If you reply, we continue as a normal business enquiry. If you object, we delete your data immediately and keep only your name and the channel on a suppression list so that we do not contact you again (Art. 17(3)(b) GDPR).

Objection: you can object to direct marketing at any time without giving reasons (Art. 21(2) GDPR), simply by replying to our message or by email to hello@biasgap.com.

10. Clients and audit interviews

When we deliver an audit, we process contact and interview data of our client's team members and, where agreed, of the client's customers. Where we act on our client's behalf, we do so under a data processing agreement (Art. 28 GDPR), and the client informs the people concerned. Interview participants receive their own privacy notice before the interview. Calls are only recorded if every participant agrees in advance.

11. Processors

We use the following service providers under data processing agreements (Art. 28 GDPR):

12. International data transfers

Some providers are based in the USA or may access data from there. Where a recipient is certified under the EU-U.S. Data Privacy Framework (and its UK Extension), transfers rely on the adequacy decision of the European Commission (Art. 45 GDPR). Otherwise they rely on the EU Standard Contractual Clauses and, for UK data, the UK International Data Transfer Addendum (Art. 46(2)(c) GDPR). Transfers between the UK and the EU rely on mutual adequacy decisions. If you contact us from outside the EU, your data is transferred to Germany.

13. Fonts and encryption

We use only fonts hosted on our own server (Source Serif 4, Geist). Your browser does not connect to Google Fonts or other font providers. All data is transmitted over an encrypted TLS connection (“https://”).

14. Information for people in the United States

We do not sell or share personal information as defined by California law, and we do not use it for targeted advertising. Our website does not load advertising technologies, so browser signals such as Global Privacy Control or Do Not Track do not change how the site works for you. If you want to know what we hold about you or want it deleted, email hello@biasgap.com.

15. Information for people in the United Arab Emirates

If you are in the UAE, we process your personal data on the basis of your consent or to perform or prepare a contract with you, as applicable. You have the rights to access, correct, delete and restrict processing of your data and to object to processing, and you can withdraw consent at any time. Your data is processed in Germany and the EU under the safeguards described in section 12.

16. Changes

We update this policy when the law or our services change. The current version is always available on this page. A German version is available at biasgap.com/datenschutz.

Last updated: October 2026