Privacy Policy

    langbox.ai – Two Impulse GmbH

    Effective: June 2026

    We respect the privacy of our customers and other interested parties and comply with the applicable laws protecting your privacy. These laws include in particular the General Data Protection Regulation of the European Union ("GDPR") and the German Federal Data Protection Act (BDSG).

    This document can be printed for reference by using the print function in the settings of any browser.

    1. Data Protection, Responsibility and Scope

    This privacy notice covers: • Website: https://langbox.ai • Service: B2B langbox.ai web app – AI-powered platform for automated screening interviews and interactive role-play training The following categories of data subjects are covered by this privacy notice: • Website visitors • Employees of customers (users of the platform) • Candidates participating in AI-supported screening interviews • Employees participating in AI training sessions The controller responsible for processing your personal data under this privacy notice is: Two Impulse GmbH Agnes-Pockels-Bogen 1 80992 Munich, Germany support@langbox.ai Two Impulse Lda. (Portugal), as the parent company of Two Impulse GmbH, acts as a qualified support partner for technical services (in particular software engineering and support). Responsibility under data protection law for processing in the EU remains with Two Impulse GmbH. The sections below explain the purposes for which personal data is collected and processed, which categories of personal data are involved, on which legal basis we process them, which third parties act as processors, and what rights you have.

    2. Purposes of Processing – langbox.ai Website

    This section describes the processing purposes related to the langbox.ai website.

    2.1 Website Hosting

    Our website is hosted on Microsoft Azure servers (Germany region). Data collected and processed: • Technical information such as the IP address • Device information • User behaviour relevant for error analysis • Website visit data • Browser information • Log data • Cookies Legal basis: • Legitimate interest under Art. 6(1)(f) GDPR • Consent of the data subject under Art. 6(1)(a) GDPR Processors involved: • Microsoft Ireland Operations Ltd., One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland (Microsoft Azure, Germany region) Further information: Legitimate interest: providing and operating the service offered. Data is stored exclusively on servers within Germany.

    2.2 Testing the AI Interview (Demo)

    We offer a function on our website to test an AI interview. The test conversation is recorded for quality-improvement purposes. Data collected and processed: • Identification data • Company • Contact data • Information that you submit by voice to the AI assistant Legal basis: • Legitimate interest under Art. 6(1)(f) GDPR • Consent of the data subject under Art. 6(1)(a) GDPR Processors involved: • Microsoft Ireland Operations Ltd. (Microsoft Azure, Germany and Sweden regions) Further information: Legitimate interest: providing and allowing the service to be tested. Please do not submit special categories of personal data during use (e.g. ethnic origin, political opinions, religious beliefs, health data, biometric data, data on sexual orientation).

    2.3 Contact via Email

    We publish a contact email address on our website through which you can reach us. Data collected and processed: • Email address • Information you send us by email Legal basis: • Legitimate interest under Art. 6(1)(f) GDPR Further information: Legitimate interest: answering questions about products, services and other offerings. Please do not send special categories of personal data by email.

    2.4 Online Demo Booking

    You can book a demo appointment with us through our website. Data collected and processed: • Identification data • Contact data • Company data • Any further information you provide as free text • Technical information • Cookies Legal basis: • Consent of the data subject under Art. 6(1)(a) GDPR Processors involved: • HubSpot Ireland Ltd. (Meetings/Booking)

    2.5 Analysis of User Behaviour

    We use technologies in the form of code snippets to analyse and improve user behaviour on our website and to monitor and optimise advertising campaigns. Data collected and processed: • Technical information such as the IP address • Browser data • User behaviour and interaction data • Device information • Conversion data • Cookies Legal basis: • Consent of the data subject under Art. 6(1)(a) GDPR Processors involved: • Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (Google Analytics, Google Tag Manager) • LinkedIn Ireland Unlimited Company, Wilton Plaza, Wilton Place, Dublin 2, Ireland

    3. Purposes of Processing – B2B langbox.ai Web App

    This section describes the processing purposes related to the langbox.ai web application.

    3.1 App Hosting

    Data collected and processed: • Technical information such as the IP address • Device information • User behaviour relevant for error analysis Legal basis: • (Pre-)contractual obligations under Art. 6(1)(b) GDPR Processors involved: • Microsoft Ireland Operations Ltd. (Microsoft Azure, Germany and Sweden regions) Further information: Data centre locations: Germany (primary) and Sweden (secondary), both within the EU.

    3.2 Providing the Offered Service

    Through our application we provide the following services: AI-powered screening interviews for candidates and interactive role-play training for employees. Data collected and processed: • AI prompts and other AI-related information • Interview and training configurations • Technical access data (e.g. API keys) • Audio and video recordings of interviews and training sessions • Transcripts and AI-generated evaluations • Candidate and employee data Legal basis: • (Pre-)contractual obligations under Art. 6(1)(b) GDPR • Consent of the data subject under Art. 6(1)(a) GDPR (in particular for candidates and employees) Processors involved: • Microsoft Ireland Operations Ltd. (Microsoft Azure, Germany and Sweden regions) Special note for candidates: Your data is processed on behalf of the respective company (the controller). That company is responsible for the lawfulness of processing your data within the application procedure.

    3.3 Customer Registration

    Data collected and processed: • Identification data • Contact data • Authentication data Legal basis: • (Pre-)contractual obligations under Art. 6(1)(b) GDPR Processors involved: • Microsoft Ireland Operations Ltd. (Microsoft Azure, Germany region)

    3.4 Sending Transactional Emails

    We send transactional emails (e.g. registration confirmations, password resets, interview invitations) via Microsoft Azure Communication Services. Data collected and processed: • Email address • Identification data • Metadata related to email delivery Legal basis: • (Pre-)contractual obligations under Art. 6(1)(b) GDPR Processors involved: • Microsoft Ireland Operations Ltd. (Microsoft Azure Communication Services, Germany region) Further information: Data is processed exclusively within the EU.

    3.5 Processing Payments and Invoicing

    We use a payment service provider to process payments. Data collected and processed: • Payment data • Invoice data • Technical information Legal basis: • Compliance with a legal obligation under Art. 6(1)(c) GDPR • (Pre-)contractual obligations under Art. 6(1)(b) GDPR Processors involved: • Stripe Payments Europe Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland

    3.6 Maintaining a Customer Database (CRM)

    Data collected and processed: • Identification data • Contact data • Email conversation data Legal basis: • Legitimate interest under Art. 6(1)(f) GDPR Further information: Legitimate interest: maintaining customer relationship data.

    3.7 Error Detection and Resolution

    Data collected and processed: • Error-related technical data • User behaviour and interaction data • Application logs Legal basis: • Legitimate interest under Art. 6(1)(f) GDPR Further information: Legitimate interest: detecting and fixing errors that affect the service.

    3.8 Sending Product Updates

    Data collected and processed: • Identification data • Contact data Legal basis: • Legitimate interest under Art. 6(1)(f) GDPR Processors involved: • Microsoft Ireland Operations Ltd. (Microsoft Azure Communication Services, Germany region) Further information: Legitimate interest: communicating new features that improve the use of the service or extend its functionality.

    4.1 Cookies and Local Storage

    This website stores personal data and information in cookies, session storage and local storage. Processing takes place on the legal basis specified for the respective service. You can configure how your browser handles cookies and local storage in your browser settings.

    4.2 Retention Period

    We store your personal data only for as long as is necessary to fulfil the purposes mentioned above or as required by contractual or statutory retention obligations. Personal data of the customer is generally retained for at least 10 years in accordance with § 147 AO and § 257 HGB.

    4.3 Disclosure of Data

    We disclose your personal data to third parties only where this is required by law, necessary to provide our services, or where you have consented to the disclosure. We will never sell your data to third parties without your express consent. Data may be passed to the following categories of recipients: • Processors named in this privacy policy • Banks and payment service providers (payment processing) • Tax advisors (bookkeeping and annual financial statements) • Collection agencies (debt recovery) • Lawyers (enforcement of legal claims)

    4.4 Protection of Personal Data

    We protect personal data with appropriate technical and organisational measures in accordance with Art. 32 GDPR. This includes in particular pseudonymisation and encryption of personal data during transmission and storage. All data is stored exclusively on servers within the EU (Germany, Sweden).

    4.5 Withdrawal of Consent

    If you have given consent to the processing of your personal data for a specific purpose under Art. 6(1)(a) GDPR, you may withdraw this consent at any time. The lawfulness of processing carried out before withdrawal remains unaffected.

    4.6 Special Notes on AI-Supported Processing

    When using langbox.ai, automated processing is carried out, including AI-based evaluation of interviews and training sessions. Where such processing requires a separate legal basis under Art. 22 GDPR (automated individual decisions), the customer (the company using the service) is responsible for ensuring the required legal conditions. We ask all participants not to submit special categories of personal data under Art. 9 GDPR during use, in particular: • Ethnic origin • Political opinions • Religious or philosophical beliefs • Trade union membership • Genetic data • Biometric data • Health data • Data concerning sexual life or sexual orientation

    5. Rights of Data Subjects

    5.1 Right of access — You have the right to obtain information at any time about your personal data stored by us and to receive a copy of this information (Art. 15 GDPR). 5.2 Right to rectification — If your data is inaccurate or incomplete, we will correct it on request (Art. 16 GDPR). 5.3 Right to data portability — You have the right to receive a copy of your data in a structured, commonly used and machine-readable format (Art. 20 GDPR). 5.4 Right to restriction of processing — You have the right to require us to restrict the processing of your personal data in certain circumstances (Art. 18 GDPR). 5.5 Right to erasure — You have the right to have personal data processed by us erased – provided this is permitted by law (Art. 17 GDPR). 5.6 Right to object — You may object at any time to the processing of your personal data based on a legitimate interest (Art. 21 GDPR). 5.7 Right to lodge a complaint — If you believe that we are not processing your personal data correctly, you may contact us. You also have the right to lodge a complaint with the competent data protection supervisory authority. The competent supervisory authority in Germany is the state data protection commissioner responsible for your place of residence or our registered office. All rights can be exercised by email using the contact at the beginning of this privacy policy.

    6. Changes to This Privacy Notice

    We will update this privacy notice from time to time. All changes will be published on this page with an updated revision date. Date of publication of the current version: June 2026

    langbox.ai is a product of Two Impulse GmbH | www.langbox.ai