Privacy Policy

Free AI tools (Project Health Check, AI Readiness Check)

When you use one of our free analysis tools, we collect your name, your email address, optional information about your role, and your answers to that tool’s questions. This data is stored on our own server (Neon, EU) and serves to produce your result and to notify us, as the provider of the tool, that a new result has come in. For the written evaluation of your answers we use the API of Anthropic, PBC (San Francisco, USA). Only your answers and the scores calculated from them are transmitted — not your name and not your email address. Anthropic processes the data as a processor and does not use it for training. The transfer to the USA is based on the European Commission’s standard contractual clauses (SCCs) pursuant to Art. 46(2)(c) GDPR. Legal basis for the processing: your request to carry out the analysis (Art. 6(1)(b) GDPR).

Contact form

When you complete a form (for example a contact request), your name and email address are collected and stored on our own server. Legal basis: pre-contractual measures and legitimate interests (Art. 6(1)(b) and (f) GDPR).

Emails about courses and offers

If you opt in to receiving news by ticking the corresponding box, we store your email address, your name and the page through which you signed up. You first receive a confirmation email; your consent is given only once you click the link in it (double opt-in). We record the time of that confirmation — it is the proof required by Art. 7(1) GDPR. Legal basis: your consent (Art. 6(1)(a) GDPR, § 7(2) UWG, the German Act Against Unfair Competition).

If you have purchased a course, we may also send you emails about our own similar offers without your prior consent (§ 7(3) UWG).

In either case you can opt out at any time — by withdrawing your consent (Art. 7(3) GDPR) or by objecting to direct marketing (Art. 21(2) GDPR). The unsubscribe link in every email works with a single click, without any login and without stating reasons. Withdrawal and objection take effect for the future; the lawfulness of processing carried out until then is unaffected. Emails about your account and your purchased courses (order confirmation, invoice, certificate) are not affected — they form part of the contract and are not advertising.

Praxis by Agile Forge learning platform

This policy covers both sites: agile-forge.com and the learning platform at praxis.agile-forge.com. There is only this one document — the platform footer links here.

Signing in with a Google account

You may register either with an email address and password or with your Google account. If you choose Google, you are taken to Google’s sign-in page and grant the required permission there. Google then passes us your email address, your name and your Google identifier; we never receive a password. Google is thereby made aware that you are signing in to our service.

The legal basis is your consent to using this sign-in method (Art. 6(1)(a) GDPR) together with performance of the user contract (Art. 6(1)(b) GDPR). The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Signing in via Google is optional — registration with an email address is available as an equivalent alternative.

Weekly league (optional)

In the app you can join the weekly league. It is optional; if you do not join, you are not disadvantaged and do not appear in any league.

What we store: the display name you choose, the language of your impulses, the time of your consent and your group for each week.

Who sees it: The other members of your group (at most nine) see your display name and your points for the current week. They do not see your real name, your email address or your answers. We work out the points from the impulses you have completed (ten per impulse, five more if Kai replied).

Reporting names: Any member of your group can report a display name they find abusive or misleading. They pick a reason and can add up to 200 characters of text. Only we see the report, not the person reported. We review it and can reset the display name to “Participant” followed by a number. We keep the report for as long as we need it for the review, and delete it at the latest together with the account of the person who reported or the person reported. The legal basis is our legitimate interest in respectful interaction (Art. 6(1)(f) GDPR).

Legal basis and retention: Your consent (Art. 6(1)(a) GDPR). We keep the display name and group assignment until you leave the league or delete your account.

Withdrawal: You can withdraw your consent at any time in your profile with one tap (leaving the league). We then delete your display name and all group assignments straight away. Withdrawal takes effect for the future; processing up to that point remains lawful.

Community and course discussions

Inside the platform you can publish posts and replies. Your first and last name, your figure if you chose to show it (see “Profile picture and figure”), your post and the time of posting are visible. Posts in the public areas of the community can be read by anyone, even without an account; posts in a course community are only visible to participants of that course. If you have not provided a name, you appear as “Teilnehmer:in” (participant); your email address is never shown.

Pro badge. As soon as you have taken at least one course, the public areas of the community show a small “Pro” badge next to your name. Every enrolment counts, however it came about: a purchase on the web, in the App Store or on Google Play, a seat in a team licence, a voucher, or a course unlocked free of charge. Other signed-in members can tell from it that you have taken a course. The badge does not appear in course communities or for visitors without an account. To show it, we check on each page view, using your account ID, whether you have an enrolment. The only thing we store is your setting for whether the badge is shown. It stays until your account is deleted (see “Deleting your account” below and Section 4, “Retention”). The setting starts as “on”. You can turn the badge off at any time in your profile under “Show the Pro badge in the community”; it then disappears everywhere, including on older posts. The legal basis is our legitimate interest in a community where course participants can be recognised (Art. 6(1)(f) GDPR). Under Art. 21 GDPR you can object to this processing at any time, with the switch in your profile or by a message to info@agile-forge.com.

Automatic translation. The community is bilingual. So that everyone can follow along, we automatically translate the title and text of your posts and replies into German or English. People using the platform in the other language see the translation in place of the original, marked “Automatically translated”; the original can be expanded below it. In overviews, in search and in emails the title and excerpt appear in the reader’s language. For this the text is sent to Anthropic, PBC (USA) — without your name and without your email address. Anthropic processes it as our processor and does not use it for training. Legal basis: performance of the user contract (Art. 6(1)(b) GDPR); for posts written before translation was introduced, our legitimate interest in a community where both language groups can read each other (Art. 6(1)(f) GDPR). You can object at any time; a message to info@agile-forge.com is enough. We will then stop translating your posts and replies and delete the existing automatic translations.

What you write there is voluntary. Legal basis: performance of the user contract (Art. 6(1)(b) GDPR). You can edit and delete your own posts, and deleting your account removes them as well. Bear in mind that until then a post may have been read and quoted by other participants.

Reporting posts. You can report posts and replies that break the community rules. We store who reported which post or reply, when, the reason you chose (offensive or demeaning, advertising or spam, false or misleading, something else) and a note of up to 500 characters if you write one. Only Philip, as the operator, sees the report; the person whose post you report is not told that it was you. The legal basis is our legitimate interest in a community free of insults and spam (Art. 6(1)(f) GDPR). The report is deleted when the reported post or your account is deleted, and at the latest twelve months after we have dealt with it.

Blocking people. You can block another member. The platform then hides their posts and replies from you, including in the weekly email summary of new community posts, and you no longer receive emails or push notifications about their replies. For this we store whom you have blocked and since when. The block only affects you; the other person is not told. You can undo it in your profile. The block is deleted when your account or theirs is deleted. Legal basis: performance of the user contract (Art. 6(1)(b) GDPR).

Posting restrictions. If someone breaks the community rules, Philip can stop the account from posting in the community. For this we record on the account that it is restricted. Reading, the account’s own courses and deleting its own posts remain possible. The legal basis is our legitimate interest in a community free of insults and spam (Art. 6(1)(f) GDPR).

Messages to Philip

With a course, you can write to Philip Müller directly on the platform. We store the text, who wrote it, when, and whether it has been read. Only you and Philip can read the conversation — not the community and not a company that assigned you a licence.

When Philip writes to you, you receive an email containing the text via our email service Resend (see below). When you write to him, he only receives a notice without the text. Legal basis: performance of the user contract (Art. 6(1)(b) GDPR). Deleting your account deletes the entire conversation, including Philip’s messages.

Push notifications

If you turn on push notifications for a device in your profile, we store, linked to your account, a delivery address at the push service for that device, two technical keys your browser generates for it, and the time you turned it on. We send notifications through your browser vendor’s push service (Apple, Google, Mozilla or Microsoft); your browser determines which one. The services of Apple, Google and Microsoft are based in the USA. Notifications are encrypted and only say what the notification is about, such as “New reply in the community”, with a link — never the text of a post or message.

The legal basis is your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG, the German act on data protection in telecommunications and digital services), which you give by turning on push notifications in your profile and allowing them in your browser. You can turn push notifications off at any time in your profile, and we delete the delivery address straight away. If you only turn them off in your device or browser settings, we delete it as soon as the push service reports it as no longer valid. We also delete it when you delete your account.

We only send learning reminders if you also turn on “Remind me to learn” in your profile. For this we store that choice and when you changed it. The reminder does not name your course; it only links to your next lesson.

The Praxis app for iPhone and Android

The app gives you the same platform as praxis.agile-forge.com and uses the same account. Everything described above for the learning platform applies to the app as well. In addition, the app processes the following data.

Push notifications in the app. You only receive push notifications if you turn them on in your profile or on the dashboard and then allow them when your device asks. The app does not show this request before then. We then store, linked to your account, a push identifier for your device (token), whether it is an iPhone or an Android device, and when you turned notifications on. Notifications are delivered through Google’s Firebase Cloud Messaging and, on an iPhone, also through Apple’s push service. Apple Distribution International Ltd. (Cork, Ireland) is responsible for its part of the delivery as an independent controller. A notification only says what it is about, such as “New reply in the community”, and links to the post or lesson. It never contains the text of a post or message, and it does not name your course. You receive notifications when someone replies to your posts, when Philip sends you a message and, only if you turn this on as well, as learning reminders.

The legal basis is your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG). If you turn push notifications off in your profile, we delete the identifier straight away. If you sign out of the app or only turn notifications off in your device settings, we delete it as soon as Firebase reports it as no longer valid. We also delete it when you delete your account.

Reading courses offline. So that you can keep learning without an internet connection, the app stores the courses you have access to on your device: lesson texts, exercises, the questions within lessons with their model answers, the questions of any quiz you have passed (for practice), handouts as PDFs, which lessons you have completed, and your notes. Videos are not part of this; the app only downloads them on Android, and only when you ask it to (see below). This data is kept in the app’s protected storage, is excluded from device backups and cannot be read by other apps. The app also remembers on your device where you paused a video. Anything you write offline is sent once you are back online. If you download a handout on an Android device, Android saves it to the “Downloads” folder, where it stays until you delete it yourself.

When you sign out or switch accounts, the app deletes the stored courses. When your access to a course ends, it deletes that course. Notes that have not been sent yet stay on the device until you next sign in: if you sign in with the same account, the app sends them; with a different account, it deletes them. If you delete your account in the app, the app removes all of this data from the device, including notes not yet sent. If you delete the app, the operating system removes its data from the device. The legal basis is performance of the user contract (Art. 6(1)(b) GDPR).

Watching videos offline (Android). In the Android app you can save lesson videos to your device with “Download for offline”. Unless you tap it, the app stores no videos. For each video the app asks us for a download address, and we check that you have the course. The address is valid for 30 minutes and points to Bunny.net (see “Video streaming”). On your device the video is then kept encrypted in the app’s private storage, together with a list giving the lesson title, file size, download date and expiry date. Android keeps the key in its protected key store. Other apps, the gallery and the file manager cannot see the videos, and they are excluded from device backups and from transfers to a new device. The videos do not leave your device, and we pass none of this on.

A downloaded video plays for 30 days without a connection. When the app is back online, it checks with us whether you still have access to the course: if you do, the 30 days start again; if not, it deletes the video. Once the period has run out, the app only plays the video again after this check. If you watch a video to the end while offline, the app marks the lesson as completed and sends this once you are back online. You can delete a video at any time with “Remove download” in the lesson, or in the app under Profile → Settings → “Offline storage”, one by one or all at once. When you sign out or delete your account in the app, it removes all offline videos from the device; if you delete the app, the operating system removes them. The legal basis is performance of the user contract (Art. 6(1)(b) GDPR).

Widget and iPhone search. If you add the Praxis widget to your home screen, it shows your current course, your next lesson and your progress. On an iPhone you can also find your lessons through the device’s search (Spotlight). For this, the app adds each lesson’s title, course and module and the opening lines of its text to the device’s search index, without model answers. The widget and the search index stay on your device, and the widget does not fetch anything from the internet itself. Bear in mind that anyone who can see your screen can see the widget. When you sign out, the app clears the widget and the search index. Legal basis: performance of the user contract (Art. 6(1)(b) GDPR).

Buying courses in the App Store (iPhone). In the iPhone app you can buy courses through the App Store. You then make the purchase with Apple Distribution International Ltd. (Cork, Ireland). Apple sells in its own name on our behalf (as a commissionaire), handles the payment, issues the invoice and deals with refunds. Apple processes the payment and account details you hold with Apple as an independent controller, under its own privacy policy. So that we can add the course to your account, the app passes Apple an identifier derived from your account’s internal ID; it cannot be used to work out your name or email address. From Apple we receive the purchase data: transaction number, the product purchased, the time of purchase, price, currency, the App Store country and, where applicable, the time of a refund. We do not receive your name, email address or payment details from Apple. If Apple refunds a purchase, your access to the course ends. The legal basis is performance of the user contract (Art. 6(1)(b) GDPR). When you delete your account, we detach the purchase data from it. The order number, product and time of purchase are kept so that a purchase cannot be redeemed a second time, and to meet statutory retention periods.

Buying courses on Google Play (Android). In the Android app you can buy courses through Google Play. You then make the purchase with Google Commerce Limited (Gordon House, Barrow Street, Dublin 4, Ireland): Google sells as the merchant, handles the payment, issues the invoice and deals with refunds. Google processes the payment and account details you hold with Google as an independent controller, under its own privacy policy. So that we can add the course to your account, the app passes Google an identifier derived from your account’s internal ID; it cannot be used to work out your name or email address. From Google we receive the purchase data: order number, a purchase identifier, the product purchased, the time of purchase, the country of purchase, the payment status and, where applicable, the fact that Google has refunded the purchase. We do not receive your name, email address, payment details or the price from Google. If Google refunds a purchase, your access to the course ends. The legal basis is performance of the user contract (Art. 6(1)(b) GDPR). When you delete your account, we detach the purchase data from it. The order number, product and time of purchase are kept so that a purchase cannot be redeemed a second time, and to meet statutory retention periods.

What the app does not do. The app itself contains no advertising and no analytics, sends no crash reports to third parties and does not track you across other companies’ apps. The only permission it asks for is to send you push notifications; it does not use your camera, photos, microphone, contacts or location.

Deleting your account. You can also delete your account in the app (Profile → Account → “Delete account”) or in your browser at praxis.agile-forge.com/dashboard/billing#konto. How it works without signing in is explained at praxis.agile-forge.com/konto-loeschen. Section 4, “Retention”, describes what then happens to your data.

Impulses in the app

Every day the app offers a short impulse from everyday project work: a situation with three options, a knowledge card with a check question, a question you answer in one or two sentences, or a short conversation in which Kai plays a role. You can use the impulses without an account. For them, the app processes the following data.

Without an account. Which impulses you have completed, on which day, which option you chose, your weekly goal, the language you chose, whether you have completed or skipped the set-up and whether the welcome on first launch was shown are stored only on your device, in the app’s protected storage, which is excluded from backups and cannot be read by other apps. There is also a random device identifier without any personal reference; it only determines the order of the impulses. This data does not leave the device, not even when you sign out or switch accounts. It goes to your account only if you create a new account, or if you sign in to an existing account and confirm the transfer (see below). The notes on the welcome and the set-up, and the note on whether an account was signed in last, always stay on the device. Without an account the app also notes there which path you are on, so the Practices tab opens it directly; signing in removes that note. As long as you don’t use an account, we don’t receive this data. Storing it on the device is strictly necessary for the feature (§ 25(2) no. 2 TDDDG). Deleting the app, or deleting your account in the app, removes the progress from the device.

With an account. If you create a new account, the app transfers the state from your device to your account without asking first; this applies only to an account that is at most 15 minutes old and has no progress of its own yet. When you sign in to an account that already exists, the app asks you once whether it should transfer the state from your device to your account. If you say no, the state stays on the device and is not transferred, so on a shared device you do not take over someone else’s progress. If the account already has progress of its own, that takes precedence. Your own answers and Kai’s answers do not go into the account, only the option you chose. If the last completed impulse or the start of a path on the device is more than 14 days ago, the app neither transfers the state nor asks; it stays on the device. We store, linked to your account, which impulse you completed and when, the option you chose, your weekly goal, the language of the impulses, your progress on topic paths and, if you turn it on, the time and time zone of your daily reminder. We need this so that your progress is the same on every device. Legal basis: performance of the user contract (Art. 6(1)(b) GDPR). We delete this data together with your account; it is part of your data export. You can delete your account yourself, in the app and in the browser (see “Deleting your account” above). In the browser the entry on the device stays after that; you delete it in your browser settings.

Your own answer, with Kai. For some impulses you write a short answer and Kai, the AI learning assistant, gives you feedback against a fixed rubric. This is available only with an account. For this, your answer is sent together with the situation and the rubric to Anthropic (processor, see section 3) and is not used for training there. We store your answer and Kai’s feedback with your account. The number of Kai responses per day is limited, per account and for everyone together; for this we count, per account, how often you have asked Kai on a given day, and once, without any personal reference, for everyone. You can report Kai’s feedback (see “Reporting AI answers”). Legal basis: performance of the user contract (Art. 6(1)(b) GDPR).

Daily reminder. With an account you can have the app remind you of the impulse every day. The reminder comes as a push notification from the time you choose, to the nearest quarter of an hour, only on days when your weekly goal is still open, and at most once a day. It only says what it is about, not which impulse. It requires push notifications to be turned on in the app (see above); the reminder is a separate consent that you can withdraw at any time under “Your impulses”. Legal basis: your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG). Without an account there is no reminder.

Topic paths. You can choose a topic path: four weeks with four practices each on one topic, in a fixed order. For this we store which path you chose, in which language, whether it is in progress, paused or completed, when you started it, which of its practices you completed and which you skipped without Kai. Without an account this stays on your device like the rest of your progress without an account, and only moves to your account if you create a new account or confirm the transfer; with an account we store it with your account. Legal basis without an account: § 25(2) no. 2 TDDDG; with an account: performance of the user contract (Art. 6(1)(b) GDPR). We delete this data together with your account; it is part of your data export.

A conversation with Kai in a role. In one practice per path, Kai plays a person from everyday project work, such as a sponsor, and you have a short conversation with him of at most two turns of your own. Afterwards Kai steps out of the role and gives you feedback against a fixed rubric. This is available only with an account. For this, your turns are sent together with the role, the starting point and the conversation so far to Anthropic (processor, see section 3) and are not used for training there. We store the conversation, that is Kai’s turns and yours, and Kai’s feedback with your account. A conversation counts as one Kai practice towards the daily limits (see above). You can pause the conversation at any time with “Continue later”; it stays open until you finish it, and you can pick it up on any day without it counting a second time. You can report each of Kai’s turns in the role and the feedback (see “Reporting AI answers”). Legal basis: performance of the user contract (Art. 6(1)(b) GDPR). We delete conversations twelve months after they began, finished or not; Kai’s feedback stays as part of your completed practices. When you delete your account, we delete the conversations straight away; they are part of your data export.

Week in review. On Sundays the app shows a review of your week: how many practices you completed, whether you reached your weekly goal, the topic you practised most and, if you chose a path, your progress on it. The app works these figures out from your progress; without an account, on the device. With an account, Kai adds one sentence on what is worth practising next week, once you have completed at least one practice that week. For this, only the figures and topic names of the review are sent to Anthropic (see above), none of your own text; we store the sentence with your account, at most one per week. You can report that sentence too. If you have turned on the daily reminder, on Sunday you receive a push notification about the review at the time you chose instead of the reminder, even if you have already reached your weekly goal, and no second notification that day. Legal basis for Kai’s sentence: performance of the user contract (Art. 6(1)(b) GDPR); for the push notification, your consent to the reminder (see above). We delete the sentences together with your account; they are part of your data export.

Widget. For everyone, the widget shows today’s impulse and your weekly progress; for course buyers it also shows the course and the next lesson. It stays on the device and does not fetch anything from the internet itself.

Users assigned by a company (team licences)

Where a company purchases a team licence, it assigns the seats to its employees. We then process the assigned person’s name and work email address as well as their learning progress and any certificates obtained. The legal basis is our legitimate interest and that of the company in performing the licence agreement (Art. 6(1)(f) GDPR) — the assigned person is not themselves our contracting party.

Selecting those individuals, and the lawfulness of passing their data to us, is the company’s responsibility. The company’s licence administration can see the name, email address, course progress and completion status — but not notes, conversations with the AI learning assistant, answers given in exercises or messages to Philip. You may assert the rights set out in section 5 against us here as well, including the right to object under Art. 21 GDPR.

Withdrawal via this website

If you use the online withdrawal function, we process your name, contract reference, email address, any voluntarily stated reason, as well as the content of your declaration and the date and time of its receipt. We need these details to process the withdrawal (Art. 6(1)(b) GDPR) and to evidence its receipt, which we are required to do under § 356a BGB (German Civil Code) (Art. 6(1)(c) GDPR).

The function is deliberately accessible without signing in, so that guest orders can be withdrawn too. To prevent abuse, the number of declarations per IP address is limited for ten minutes; the IP address is processed only transiently for that purpose and is not stored permanently (Art. 6(1)(f) GDPR). Declarations of withdrawal are retained for the duration of the statutory commercial and tax retention periods.

Embedded YouTube videos (blog)

Some blog posts on agile-forge.com include a YouTube video. When you open the post, we show only a preview image that we deliver ourselves; there is no connection to YouTube at that point. Only when you click the preview image do we load the YouTube video player into the page, and the video starts.

We load the player from the address www.youtube-nocookie.com. In doing so, your browser sends Google your IP address, technical details about your device and browser, and the information which video you are requesting. After the video starts, Google may store entries in your browser and read them; we have no influence over these. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; Google processes the data under its own responsibility, not on our behalf. Google may also process data outside the EU, including in the USA at Google LLC. The transfer to Google LLC rests on the European Commission’s adequacy decision for the EU-U.S. Data Privacy Framework; Google LLC is certified under it. What Google does with the data and how long it keeps it is governed by Google’s privacy policy (policies.google.com/privacy). We embed the video so that you can watch it directly in the post. The legal basis is your consent by clicking the preview image (Art. 6(1)(a) GDPR, Section 25(1) TDDDG). You can withdraw it with effect for the future by reloading the page; the player is then gone until you click again.

Links to YouTube elsewhere, for example on the page for the video series, are ordinary links: you are on YouTube only once you open them, and YouTube’s privacy policy applies there.

Server log data

When this website is accessed, our hosting provider Vercel automatically records technical log data (HTTP method, path, timestamp, status code, user agent). IP addresses are not stored in application logs, and log data is deleted after no more than one day. Legal basis: legitimate interests (Art. 6(1)(f) GDPR).