Version: August 2026
We take the protection of your personal data seriously. This privacy policy informs you in accordance with Articles 13 and 14 of the General Data Protection Regulation (GDPR) and the Austrian Data Protection Act (DSG) about what data we process, for what purpose, and on what legal basis. You will also learn about your rights and who you can contact.
Personal data is any information relating to an identified or identifiable person (Art. 4(1) GDPR) – such as your name, email address, or the content of a message you send to us.
The controller responsible for data processing under the GDPR is:
Office of Dr. Matthias Strolz
Anton-Krieger-Gasse 0, 1230 Vienna, Austria
VAT ID: ATU48718302 · GISA: 25533927
Email (Website/general): office@strolz.eu
Email (Sparring partner): sparring@homo-universus.org
We only process your data if at least one of the following legal bases applies:
Should special categories of personal data (Art. 9 GDPR) be processed, we rely on your explicit consent (Art. 9 para. 2 lit. a GDPR). Further details can be found in Part B.
We only store personal data for as long as is necessary for the respective purpose. If the purpose no longer applies or you withdraw your consent, we will delete the data, provided there are no legal retention obligations to the contrary. We retain accounting-related documents for seven years in accordance with § 132 BAO. We specify concrete time limits for individual processing activities.
You have the following rights with respect to us:
To exercise these rights, an informal message to the contact addresses mentioned above is sufficient. If you believe that the processing of your data violates data protection law, you may lodge a complaint with the supervisory authority. In Austria, this is the Austrian Data Protection Authority (www.dsb.gv.at). Users from other EU countries can contact their respective national supervisory authority.
Our website is hosted and delivered via the platform Webflow (Webflow, Inc., 398 11th Street, San Francisco, CA 94103, USA). When you visit the website, Webflow processes technically necessary access data (specifically IP address, date and time of access, page accessed, browser type, and operating system) as our data processor. This data is required to provide the website in a stable and secure manner.
Legal Basis: Art. 6(1)(f) GDPR (legitimate interest in a secure, functional website).
Third Country: Processing may take place in the USA. Webflow is certified under the EU-U.S. Data Privacy Framework; in addition, standard contractual clauses are in place. Server logs are stored only for a short period.
This website uses no cookies and no tracking. There is no reach measurement, analysis, or profiling. A cookie banner is therefore not required.
When you contact us via email, we process the information you provide (name, email address, message content) to handle your request. The legal basis is Art. 6(1)(b) GDPR for contract-related inquiries, and otherwise Art. 6(1)(f) GDPR (interest in responding to your request). We store the data until your request has been fully resolved and delete it thereafter, provided there are no legal retention obligations.
We use the service Brevo (Sendinblue GmbH / Brevo SA, 106 Boulevard Haussmann, 75008 Paris, France) to send our newsletter. Only your email address is required to sign up; providing your first and last name is optional. We use the double opt-in process: after signing up, you will receive an email asking you to confirm your registration by clicking a link. You will only receive the newsletter after this confirmation. This ensures that the registration was actually made by you.
Purpose: Sending information about the book Homo Universus and related offers. Legal Basis: Your consent (Art. 6(1)(a) GDPR). Logging: To verify consent, we store the time of registration and confirmation, as well as the IP address used.
Withdrawal: You can unsubscribe from the newsletter at any time using the unsubscribe link in any newsletter email or by sending us a message. After unsubscribing, your address will be removed from our distribution list; an entry may remain on a blocklist to provide proof of your prior consent. Data Processing: We have a data processing agreement with Brevo (Art. 28 GDPR). Brevo processes data within the EU.
What the sparring partner is.
The virtual sparring partner is an AI-supported dialogue via email centered around the book Homo Universus. You describe a question or situation and receive a thoughtful, personal response. The responses are generated by an AI system (language model).
Transparency notice pursuant to the EU AI Act (Art. 50 AI Act). You are interacting with an AI system, not a human. The responses are hypotheses and suggestions, not absolute truths, and do not replace therapy, medical advice, or legal counsel.
Depending on how you use the sparring partner (form on the landing page or email to sparring@homo-universus.org), we process the following data:
Please do not share sensitive data unless necessary. Describe your concerns in a way that feels right to you – but avoid sharing information you would prefer to keep private. If your message contains special categories of data (e.g., health information, religious or philosophical beliefs, sexual orientation; Art. 9 GDPR), we will process this data exclusively on the basis of your explicit consent (Art. 9 (2)(a) GDPR), which you provide by sending your message and may withdraw at any time.
Responses are created by a language model from the provider Mistral AI (Mistral AI, 15 rue des Halles, 75001 Paris, France). Your message and relevant parts of the conversation history are transmitted to Mistral and processed there to generate the response. Processing takes place on servers within the EU. Mistral processes the data as our data processor and—according to the agreed terms and conditions—does not use it to train its own models.
Automated processing (Art. 22 GDPR). Responses are generated automatically. However, they have no legal effect and no similarly significant impact on you; they are suggestions and hypotheses, and you alone decide how to use them. There is no exclusively automated decision-making with legal consequences within the meaning of Art. 22 GDPR. You can contact a human at any time.
To protect against abuse, every generated response undergoes an automated security check. If this is triggered, or if an incoming message appears to be a complaint or is addressed to a specific person, the relevant process is forwarded to a responsible person and reviewed before any action is taken. This internal review is conducted exclusively for quality and abuse control purposes.
Confidentiality: Content from the sparring sessions is not published or shared with third parties not mentioned in this statement. Internal forwarding is handled technically via a separate mailbox and is kept separate from user communication. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in a secure, abuse-free service and in the quality of the responses).
We use the following service providers to operate the sparring partner. For all providers that process data on our behalf, we have entered into a data processing agreement in accordance with Art. 28 GDPR:
Payments are processed via Stripe (Stripe Payments Europe Ltd., 1 Grand Canal Street Lower, Dublin, Ireland; Stripe, Inc., USA). You enter your payment details (specifically full credit card information) directly into Stripe; we do not receive them. We only process the payment status, the selected offer, and a Stripe customer ID to manage your response quota. Legal basis: Art. 6(1)(b) GDPR. Stripe's privacy policy also applies.
We store master data and content data as long as your account is active or as long as it is necessary for the ongoing dialogue. You can request the deletion of your data at any time – a simple informal message to sparring@homo-universus.org is sufficient. We will then delete your master data and message history, provided there are no legal retention obligations to the contrary.
Retention requirements: We retain invoices and payment records for seven years in accordance with § 132 BAO. Standard period: If an account remains inactive, we automatically delete or anonymize content data after a maximum of 24 months.
Our core infrastructure (database, AI, email delivery, automation) is operated within the European Union. Data may be transferred to the USA during payment processing (Stripe).
We implement appropriate technical and organizational measures to protect your data, specifically encrypted transmission (TLS), access control for the database and automation environment, and storage within the EU. Our service providers are carefully selected.
We update this privacy policy whenever the legal situation or our processing activities change. The current version published on the website always applies.
If you have any questions regarding data protection or wish to exercise your rights, please contact us at office@strolz.eu or, for matters concerning your sparring partner, at sparring@homo-universus.org.
