Privacy Policy

Radical Personas GmbH · Schillerstraße 12, 4020 Linz, Austria · FN 684660d (Regional Court of Linz) · VAT ID ATU83511549

Version of September 12, 2026

This Privacy Policy informs you, in accordance with Art. 13 and 14 of Regulation (EU) 2016/679 (General Data Protection Regulation, “GDPR”) and the Austrian Data Protection Act (DSG), about the processing of personal data by Radical Personas GmbH. It applies uniformly to the website radicalpersonas.com (Part B) and the application app.radicalpersonas.com (Part C).

---

Part A — General

§ 1 Controller

The controller within the meaning of Art. 4(7) GDPR is:

Radical Personas GmbH
Schillerstraße 12
4020 Linz, Austria

Represented by	Ing. Martin Kocijaz and Dipl.-Ing. Thomas Kasper, Managing Directors
Phone	+43 660 5032953
Email	contact@radicalpersonas.com
Commercial register	FN 684660d, Regional Court of Linz
VAT ID	ATU83511549

No data protection officer is required to be appointed under Art. 37 GDPR. For all data protection inquiries, please contact the email address given above.

Change of controller: Until July 30, 2026, Radical Innovators GmbH was the controller for the processing activities relating to Radical Personas. With the spin-off and the registration of Radical Personas GmbH in the commercial register on July 31, 2026, controllership passed to Radical Personas GmbH. Purposes, legal bases and retention periods remained unchanged. Please direct data subject requests to contact@radicalpersonas.com.

§ 2 Scope and Delimitation

(1) This Policy applies to:

• the website radicalpersonas.com, including all functions offered there (Part B), and
• the application (SaaS product) at app.radicalpersonas.com after registration or login (Part C).

(2) Parts D to F (data subject rights, recipients and third-country transfers, retention periods, security, changes) apply to both areas.

(3) The website radical-innovators.com is operated by a separate controller (Radical Innovators GmbH, shareholder); its privacy policy applies there and not to Radical Personas. Conversely, this Policy does not apply to radical-innovators.com.

(4) The offering is aimed exclusively at businesses (B2B); the free entry plan also requires confirmation of business status at registration (§ 11(3)). Insofar as personal data of natural persons is nevertheless processed (e.g. of contact persons, users of a company account or website visitors), this Policy applies without restriction.

§ 3 Legal Bases at a Glance

We process personal data only on the basis of:

• Art. 6(1)(a) GDPR — consent,
• Art. 6(1)(b) GDPR — performance of a contract and pre-contractual measures,
• Art. 6(1)(c) GDPR — legal obligations (in particular retention and documentation obligations under Austrian tax and commercial law, e.g. Section 132 of the Federal Fiscal Code (BAO), Section 212 of the Commercial Code (UGB)),
• Art. 6(1)(f) GDPR — legitimate interests (in particular IT security, abuse prevention, product improvement, fraud prevention).

For storage of and access to information on terminal equipment, Section 165(3) of the Austrian Telecommunications Act 2021 (TKG 2021) also applies (technically necessary storage).

---

Part B — Website (radicalpersonas.com)

§ 4 Provision of the Website, Hosting and Server Log Files

(1) Each time the website is accessed, the web server automatically collects technical information transmitted by your browser:

• IP address of the requesting device,
• date and time of access,
• requested URL / content of the request,
• HTTP status code,
• referrer URL (previously visited page),
• browser type and version, language, operating system.

(2) Purpose: provision of the website, ensuring IT security, detecting and defending against attacks. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in technically flawless and secure operation).

(3) Retention period: 7 days; longer retention occurs only in individual cases where necessary to analyze a security incident.

(4) The website is operated by a web host with servers located in the European Union. A data processing agreement pursuant to Art. 28 GDPR is in place with the host; the host processes the log data strictly on instructions and solely to provide and secure the website. No transfer to third countries takes place.

§ 5 Cookies and Local Storage (Website)

(1) The website does not set any tracking, analytics or marketing cookies. No cross-site tracking takes place; no advertising profiles are created. The web analytics under § 6 work without cookies.

(2) Only technically necessary stored values are set, without which the basic functionality of the website cannot be ensured (e.g. a session identifier or storing the selected menu position). This data does not leave your browser.

(3) Legal basis: Art. 6(1)(f) GDPR in conjunction with Section 165(3) TKG 2021.

§ 6 Web Analytics with Matomo (Self-Hosted, Cookieless)

(1) For statistical analysis of website usage, we use the open-source software Matomo. Matomo runs on our own server within the EU; no analytics data is transferred to third parties or third countries.

(2) Measurement takes place without cookies: no persistent identifier is stored on your device. Your IP address is truncated (anonymization of the last 2 bytes) and not stored in plain text. No personal profiles are created and no cross-site tracking is carried out.

(3) Data processed (anonymized/aggregated): pages viewed, date and time, approximate region of origin (from the truncated IP), referral source (referrer), browser and device type.

(4) Purpose: needs-based design, improvement and reach measurement of the website. Legal basis: Art. 6(1)(f) GDPR; for operations on terminal equipment, Section 165(3) TKG 2021.

(5) Retention period: statistical data is deleted after 180 days at the latest.

(6) Objection: You can object to the measurement at any time via the opt-out switch on the privacy page of the website. The opt-out decision is stored in a technically necessary cookie so that it is permanently respected in your browser.

(7) The application (Part C) does not use Matomo; only § 16 applies there.

§ 7 Contacting Us (Email, Contact Form)

(1) If you contact us by email or via a contact form, we process the data you submit (name, email address, company, message text, phone number if applicable) to handle your inquiry.

(2) Legal basis: Art. 6(1)(b) GDPR (pre-contractual measures) or Art. 6(1)(f) GDPR (legitimate interest in answering inquiries).

(3) Technical implementation: Form submissions are sent via the service Resend, Inc. (USA), with which a data processing agreement pursuant to Art. 28 GDPR is in place; data is stored in the EU data region eu-west-1 (Ireland). Insofar as personal data is transferred to the USA in the process, the transfer is safeguarded by Standard Contractual Clauses under Art. 46(2)(c) GDPR and the EU-US Data Privacy Framework (Art. 45 GDPR) (§ 25).

(4) Retention period: Pure inquiry data is deleted up to 6 months after the correspondence has ended; if a business relationship arises from the inquiry, the statutory retention periods apply (7 years pursuant to Section 132 BAO).

§ 8 Newsletter

We do not send marketing newsletters. Should we offer a product or release notification in the future, subscription will only take place with your consent (Art. 6(1)(a) GDPR); we will then provide separate information in the sign-up form about the purpose, the mailing tool and how to withdraw.

§ 9 Target Customer Analysis Tool (Public, No Login)

(1) The website offers a publicly usable analysis tool with which you can check how well a website address (URL) you enter fits typical target customer profiles. The following processing takes place:

• Retrieval and extraction of the URL you enter: the content publicly available there is retrieved by our systems and prepared for the analysis.
• AI analysis of the extracted content via the infrastructure described in § 13 (AWS Bedrock, EU regions only).
• Result cache: The analysis result is cached for 24 hours to answer repeated requests for the same URL efficiently.
• Rate limiting: To prevent abuse, your IP address is processed in truncated form (masking at network level, /64 for IPv6) in an access quota register.
• Aggregate statistics: Usage figures are recorded exclusively in aggregated, non-personal form.

(2) Legal basis for the processing under para. 1: Art. 6(1)(f) GDPR (legitimate interest in providing the tool, in its functionality and in preventing abuse).

(3) Storage of the full analysis: Your analysis is only stored beyond the 24-hour cache if you expressly consent to this in the tool (Art. 6(1)(a) GDPR). You can withdraw your consent at any time with effect for the future (§ 22).

(4) The entries in the access quota register and the result cache are stored only as long as necessary for the purposes under para. 1 and then deleted.

(5) If you enter a URL whose content contains personal data of third parties, we process this data solely to create the analysis; no other use takes place.

§ 9a Company Page on LinkedIn

(1) We operate a company page on the professional network LinkedIn (www.linkedin.com/company/radical-personas). For users in the EU, the EEA and Switzerland, the provider of LinkedIn and the controller for processing by LinkedIn is LinkedIn Ireland Unlimited Company (Ireland, “LinkedIn”).

(2) Page statistics (Page Insights): When you visit our company page, follow it or interact with it, LinkedIn processes personal data in order to provide us with statistics on the use of the page. This includes information that members have provided to LinkedIn (such as job function, country, industry, seniority and company size) as well as information about interactions with the page. We receive only aggregated analyses and have no access to personal data of individual members.

(3) Joint controllership: We and LinkedIn are joint controllers pursuant to Art. 26 GDPR for the processing relating to the page statistics. The details are set out in LinkedIn’s “Page Insights Joint Controller Addendum” (legal.linkedin.com/pages-joint-controller-addendum). Under it, LinkedIn is responsible for providing the page statistics, informs members about the processing and implements data subject rights, in particular access and erasure. You can exercise these rights in the settings of your LinkedIn account or directly with LinkedIn. If you contact us (§ 20), we will forward your request to LinkedIn. The lead supervisory authority for this processing is the Irish Data Protection Commission; your right to lodge a complaint under § 23 remains unaffected.

(4) Legal basis: Art. 6(1)(f) GDPR (legitimate interest in presenting our company, communicating with interested parties and evaluating the reach of our company page).

(5) Messages via LinkedIn: If you send us a message via LinkedIn, we process your details to handle your inquiry; § 7(2) and (4) apply accordingly.

(6) Processing by LinkedIn under its own responsibility: Beyond the page statistics, LinkedIn processes your data under its own responsibility in accordance with its privacy policy (www.linkedin.com/legal/privacy-policy). According to LinkedIn, it processes data both inside and outside the United States and relies on legally provided mechanisms for transfers. We have no influence on this processing.

(7) Links on the website: Our website refers to the company page and to the LinkedIn profiles of the managing directors exclusively by means of simple links. No LinkedIn plugins, scripts or tracking pixels are embedded; no data is transmitted to LinkedIn when you visit our website. Only when you follow such a link do you reach LinkedIn, where its privacy policy applies.

---

Part C — Application (app.radicalpersonas.com)

§ 10 Hosting and Server Log Files (Application)

(1) The application is operated by OVH in the data center in Frankfurt am Main (Germany, EU). A data processing agreement pursuant to Art. 28 GDPR is in place with the host.

(2) When the application is accessed, the server automatically collects: IP address, browser type and version, operating system, referrer URL, date and time of access, and paths accessed.

(3) Legal basis: Art. 6(1)(f) GDPR (legitimate interest in security and stability). Retention period: 7 days, then automatic deletion. No transfer to third countries takes place.

§ 11 Registration, Account and Authentication

(1) For registration and login, we process company name, name, email address and a password of your choice. The password is stored exclusively as a cryptographic hash (Argon2id); at no time do we have knowledge of the plain-text password. Legal basis: Art. 6(1)(b) GDPR. Retention period: for as long as the account exists (deletion: § 19).

(2) Login via Google or Microsoft (OAuth): Alternatively, you can log in with an existing Google or Microsoft account. We receive your email address and name from the selected provider to create the account; during the subsequent onboarding, we additionally collect the company name and the business confirmation (para. 3). The respective provider is itself the controller for processing within its login service; its privacy terms also apply. For the session, we set a technically necessary authentication cookie (short-lived JWT; the refresh token is held server-side).

(3) Business status: The offering is aimed exclusively at businesses. At registration, you confirm that you are acting as a business in the course of your business activity; this confirmation is stored together with the account data for evidentiary purposes. Legal basis: Art. 6(1)(b) GDPR and Art. 6(1)(f) GDPR (interest in evidence).

§ 12 Review and Persona Content

(1) When using the application, we process the content you enter or upload (e.g. URLs, texts, images, documents, profiles if applicable) as well as the personas, assessment results and chat inputs generated from it. Legal basis: Art. 6(1)(b) GDPR. The data resides in the respective customer’s workspace and is not accessible to other customers (workspace isolation).

(2) Website analyses: If you specify a URL for analysis, our systems automatically retrieve the content publicly available there. Screenshots of the page (desktop and mobile view), text content (up to approximately 15,000 characters) and structural and metadata (headings, meta information) are captured and prepared for the evaluation.

(3) Your responsibility: If an assessed object concerns identifiable real persons (e.g. a profile), you are responsible for ensuring that a valid legal basis exists (own profile, consent or other authorization). Do not bring strictly confidential content or special categories of personal data (Art. 9 GDPR) into the application.

(4) Retention period: until you delete the content or your account is closed (§ 19).

§ 13 AI Analysis (AWS Bedrock, EU Regions)

(1) The AI analyses of the application (reviews, summaries, persona chat) and the AI analysis of the website tool under § 9 are generated via AWS Bedrock. The contractual partner is Amazon Web Services EMEA SARL (Luxembourg); a data processing agreement pursuant to Art. 28 GDPR is in place with AWS.

(2) Processing takes place exclusively in AWS EU regions: the EU geography is technically enforced; the request endpoint is located in Frankfurt am Main, and inference takes place in a pool of six EU regions. Language models operated by AWS are used; your content is not transmitted to the model provider and, under the AWS terms for Bedrock, is neither stored nor used to train models.

(3) AI portrait images: The portrait illustrations of the personas are created as part of the editorial creation of the persona library in a separate content process that does not process customer data; no personal data of customers is transmitted to image generation services in the course of providing the persona library.

(4) Labeling: AI-generated content (personas, assessments, chat responses, persona quotes, portrait images) is labeled as AI-generated in the application and in the generated reports — including when output via integrations (Art. 50 of Regulation (EU) 2024/1689, “AI Act”).

(5) Legal basis: Art. 6(1)(b) GDPR (for processing within the application) or Art. 6(1)(f) GDPR (for the public website tool under § 9).

§ 14 Payment Processing (Stripe)

(1) Paid plans are processed via the payment service provider Stripe (Stripe Payments Europe, Ltd., Dublin, Ireland). Payment takes place on a payment page operated by Stripe (Stripe Checkout) or in the Stripe customer portal. You enter payment method data (e.g. card numbers) directly with Stripe — it does not reach our servers.

(2) Data flows: We transmit your email address and an internal customer identifier to Stripe. During the payment process, Stripe additionally collects name and billing address (mandatory) and optionally your VAT identification number. From Stripe, we receive the payment and subscription status, invoice documents and the information required for tax calculation — no complete payment method data.

(3) VAT ID check: A VAT identification number you provide is checked for validity on the server side via the European Commission’s MIAS/VIES system; the VAT number is transmitted to this system for this purpose. Legal basis: Art. 6(1)(c) GDPR (VAT obligations) in conjunction with Art. 6(1)(b) GDPR.

(4) Stripe processes the payment data for payment processing and, beyond that, for fraud prevention and to fulfill its own legal obligations (e.g. anti-money laundering) under its own responsibility; details are set out in Stripe’s privacy policy (stripe.com/privacy). During processing, data may be transferred to affiliated Stripe companies in the USA; this is safeguarded by Standard Contractual Clauses and the EU-US Data Privacy Framework (§ 25).

(5) Legal bases: Art. 6(1)(b) GDPR (contract processing), Art. 6(1)(c) GDPR (tax and commercial law obligations) and, with regard to fraud prevention, Art. 6(1)(f) GDPR.

(6) Retention period: We retain invoice and accounting data in accordance with statutory periods (in Austria generally 7 years, Section 132 BAO). This data is exempt from account deletion under § 19.

§ 15 Email Delivery (Verification, Notifications)

(1) For verification, password and notification emails, we use the delivery service Resend, Inc. (USA; data storage in the EU data region eu-west-1, Ireland), with which a data processing agreement pursuant to Art. 28 GDPR is in place. Data transmitted: email address, name (if provided), content of the respective message (e.g. confirmation or reset link).

(2) Legal basis: Art. 6(1)(b) GDPR. Insofar as personal data is transferred to the USA in the process, the transfer is safeguarded by Standard Contractual Clauses and the EU-US Data Privacy Framework (§ 25).

§ 16 Usage and Funnel Analysis (Own Method)

(1) To improve the product, we record usage and funnel events (e.g. which steps of a flow are used). This is done with a self-operated method on our own servers; no external analytics tool and no cookie is used.

(2) A session identifier is held in your browser’s sessionStorage and is discarded when the tab is closed. After login, an event may be associated with your user or workspace identifier.

(3) Legal basis: Art. 6(1)(f) GDPR (legitimate interest in improving the service). Retention period: Event data is stored only as long as necessary for the evaluation and is otherwise aggregated or deleted. No transfer to third parties or third countries takes place.

§ 17 Abuse Protection (Email Hash)

(1) To protect against abuse of the free quota (in particular repeatedly creating new accounts), we store a salted one-way hash (SHA-256) of your email address. This hash does not allow the plain-text address to be derived.

(2) The hash is deliberately retained beyond account deletion for as long as necessary to maintain the protective function. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in preventing abuse).

§ 18 Cookies (Application) and Fonts

(1) The application uses only technically necessary cookies (session authentication, § 11(2)). Legal basis: Art. 6(1)(f) GDPR in conjunction with Section 165(3) TKG 2021. No third-party tracking takes place; the usage analysis under § 16 works without cookies.

(2) Google Fonts: To display fonts, the application loads font files from Google Fonts (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). When loading, your IP address is transmitted to Google servers; no cookies are set. A transfer to Google servers in the USA cannot be ruled out; it is safeguarded by Standard Contractual Clauses and the EU-US Data Privacy Framework (§ 25). Legal basis: Art. 6(1)(f) GDPR (legitimate interest in consistent, performant display). The website (Part B) is not affected; all fonts are self-hosted there.

§ 19 Data Export, Deletion and Backups

(1) Data export (self-service): Using the account function “Data export”, you can trigger an export of your data in a structured, commonly used and machine-readable format yourself at any time (Art. 20 GDPR).

(2) Account deletion: If you actively delete your account, the account and the associated workspace content (personas, reviews, uploaded content) are deleted immediately and permanently. Excluded from this are only the email hash under § 17 and invoice and accounting data under § 14(6) (statutory retention).

(3) End of contract without active deletion: If the contract ends (e.g. through termination) without you actively deleting the account, we keep your content available for export for another 30 days; it is then deleted. Para. 2 sentence 2 applies accordingly.

(4) Backups: Deleted data is also removed from the backup copies in the course of regular backup rotation; until then, it is blocked exclusively for recovery purposes and not otherwise processed.

---

Part D — Your Rights as a Data Subject

§ 20 Data Subject Rights

Under the GDPR, you have the following rights:

• Access (Art. 15 GDPR) — confirmation as to whether and which personal data we process about you;
• Rectification (Art. 16 GDPR) — correction of inaccurate or completion of incomplete data;
• Erasure (Art. 17 GDPR) — subject to the statutory requirements;
• Restriction of processing (Art. 18 GDPR);
• Data portability (Art. 20 GDPR) — in the application also directly via the self-service function “Data export” (§ 19(1));
• Objection (Art. 21 GDPR, § 21 of this Policy);
• Withdrawal of consent given (Art. 7(3) GDPR, § 22 of this Policy).

To exercise your rights, an informal message to contact@radicalpersonas.com is sufficient. We respond to requests within the statutory period (Art. 12(3) GDPR — generally one month).

§ 21 Right to Object (Art. 21 GDPR)

You have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data concerning you that is based on Art. 6(1)(f) GDPR (legitimate interests). We will then no longer process the data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defense of legal claims. The objection can be made informally to contact@radicalpersonas.com; you can additionally object to the Matomo web analytics directly via the opt-out switch (§ 6(6)).

§ 22 Withdrawal of Consent

Insofar as processing is based on your consent (Art. 6(1)(a) GDPR), you can withdraw it at any time with effect for the future. The lawfulness of processing carried out until withdrawal remains unaffected. Withdrawal can be made informally to contact@radicalpersonas.com.

§ 23 Right to Lodge a Complaint with a Supervisory Authority

Pursuant to Art. 77 GDPR, you have the right to lodge a complaint with a data protection supervisory authority. The competent supervisory authority in Austria is:

Austrian Data Protection Authority (Österreichische Datenschutzbehörde)
Barichgasse 40–42, 1030 Vienna, Austria
Phone: +43 1 52 152-0 · Email: dsb@dsb.gv.at · www.dsb.gv.at

Alternatively, you can contact the supervisory authority of your habitual residence, your place of work or the place of the alleged infringement.

---

Part E — Recipients and Third-Country Transfers

§ 24 Recipients and Processors

(1) Personal data is only passed on to third parties insofar as this is necessary to provide the respective service or a legal obligation exists.

(2) Processors used (Art. 28 GDPR):

Recipient	Service	Registered office / place of processing
EU web host of the website	Hosting radicalpersonas.com	EU
OVH	Hosting of the application	Frankfurt am Main, Germany (EU)
Amazon Web Services EMEA SARL	AI inference (AWS Bedrock)	Luxembourg; processing exclusively in EU regions
Resend, Inc.	Email delivery (forms, verification, notifications)	USA; data region eu-west-1 (Ireland); transfer safeguards § 25

The processors OVH, Amazon Web Services EMEA SARL and Resend, Inc. are at the same time the sub-processors listed in Annex 1 to the Data Processing Agreement; the web host of the website relates exclusively to the operation of the website within our own area of responsibility and is therefore not part of Annex 1.

(3) Further recipients:

• Stripe Payments Europe, Ltd. (Dublin, Ireland) — payment processing (§ 14); with regard to fraud prevention and its own legal obligations under its own responsibility;
• Google / Microsoft — only when using the OAuth login (§ 11(2)), as separate controllers;
• Google Ireland Limited — provision of font files in the application (§ 18(2));
• LinkedIn Ireland Unlimited Company (Ireland) — company page on LinkedIn (§ 9a); for the page statistics as joint controller pursuant to Art. 26 GDPR, otherwise under its own responsibility;
• Tax advisors / accounting (Austria) — to fulfill legal obligations (Art. 6(1)(c) GDPR);
• Authorities and courts, insofar as a legal obligation exists.

(4) The complete, versioned sub-processor list (Annex 1 to the Data Processing Agreement) is published on our website in its current version (Art. 28(2) GDPR); changes are made in accordance with the procedure set out in the data processing agreement. On request, we will also provide the list directly.

§ 25 Transfers to Third Countries

(1) The core processing activities (hosting of website and application, databases, AI inference, web analytics, usage analysis) take place exclusively in the EU.

(2) Personal data is transferred to third countries — in particular the USA — only in the following cases: email delivery via Resend, Inc. (§§ 7, 15), possible transfers to affiliated Stripe companies in the USA (§ 14(4)) and the retrieval of font files in the application (§ 18(2)). For transfers that LinkedIn makes under its own responsibility, see § 9a(6).

(3) These transfers are based on the European Commission’s Standard Contractual Clauses pursuant to Art. 46(2)(c) GDPR and — insofar as the recipient is certified — the adequacy decision on the EU-US Data Privacy Framework pursuant to Art. 45 GDPR. We will provide a copy of the safeguards on request.

---

Part F — Retention Periods, Security, Changes

§ 26 Retention Periods (Overview)

Data category	Retention period
Server log files (website and application)	7 days (§§ 4, 10)
Pure contact inquiries without business relationship	up to 6 months (§ 7)
Inquiries via LinkedIn messages	like contact inquiries, up to 6 months (§§ 7, 9a(5))
Matomo statistical data (website)	180 days (§ 6)
Result cache target customer analysis	24 hours (§ 9)
Account and workspace data	for as long as the account exists (§ 19)
Content after end of contract without active deletion	30-day export window, then deletion (§ 19(3))
Invoice and accounting data	7 years pursuant to Section 132 BAO (§ 14(6))
Email hash for abuse protection	beyond account deletion, as long as the protective function requires (§ 17)
Consent-based data	until withdrawal (§ 22)

§ 27 Data Security (Technical and Organizational Measures)

We use state-of-the-art technical and organizational measures pursuant to Art. 32 GDPR to protect personal data against unauthorized access, loss or manipulation. These include, among others:

• transport encryption (TLS 1.3) on all connections,
• encryption of sensitive data at rest,
• role and least-privilege concept, two-factor authentication for administrative access,
• regular security updates and patch management,
• versioned backup concept with separate recovery paths,
• penetration test reports available to customers on request.

§ 28 Automated Decision-Making

Automated decision-making with legal effect or similarly significant impact within the meaning of Art. 22 GDPR does not take place. The AI analyses of the application (§ 13) assess the objects you submit (e.g. websites, texts); they do not make decisions about natural persons.

§ 29 Updates to This Privacy Policy

We adapt this Privacy Policy when changes to our processing activities or the legal framework require it. The current version is available on the website and in the application; the version date stated at the top is authoritative.

---

Radical Personas GmbH · Schillerstraße 12, 4020 Linz · FN 684660d (Regional Court of Linz) · VAT ID ATU83511549 · contact@radicalpersonas.com

Version of September 12, 2026