Your data and the DSGVO
If you are buying Business-Gym for a German company, you are the one who has to answer the DSGVO questions to your own auditors, works council and customers. This page states what the product does with your data in plain terms: what is stored, where it runs, who can read it, how to take a copy out, and precisely what deletion removes and what it keeps.
Two things are worth saying before the detail. This is a description of product behaviour, not legal advice — take it to your own counsel or data-protection officer and let them judge it against your obligations. And Business-Gym does not claim a certification it cannot show you; where an attestation is not in place, this page and the product both say so.
What does Business-Gym store about you?
Section titled “What does Business-Gym store about you?”Business-Gym stores three separable things: your account identity, the content your team creates inside the platform, and a record of what the system did on your behalf. Keeping them apart is what makes export and deletion answerable rather than vague.
Account identity is your name, your email address and the authentication details used to sign you in.
Workspace content is what your team puts in: the messages you exchange with a head, the documents you add as knowledge, your projects, tasks, goals and configuration.
Operational records are the by-products of running the work — audit events describing what happened, and cost rows describing what a run consumed. These exist so you can reconstruct a decision later, and they are the part that behaves differently on deletion (see below).
Data in the systems you connect stays in those systems. Business-Gym reads from them, and most connections are read-only by construction — the full per-connector picture is in integrations and data sources.
Where does your data actually live?
Section titled “Where does your data actually live?”The platform runs in Microsoft Azure’s Germany West Central region, which is inside the EU. That covers the application database, the knowledge search index and the internal work queues that carry a job from one step to the next.
The web app states the same thing back to you: Settings has a data-residency card naming the region, so you can screenshot the running system rather than quoting a document.
Content you leave in a connected system — a SharePoint site, a mailbox, an ad account — stays where it is and stays under that provider’s terms. Connecting it does not move it.
Who can see your data?
Section titled “Who can see your data?”Your data is scoped to your workspace. Every query the platform runs against a workspace-owned record is filtered to that workspace, so one customer’s content is not reachable from another’s session.
Inside a workspace, role decides reach. Owners and admins see the workspace-wide picture, including the billing records; members see their own work and what is shared with them. Which roles can approve what, and on which surface, is set out in who can approve, and where.
The data export is narrower still: it returns only the rows belonging to the person who asked for it. There is no path by which one member exports another member’s personal data.
How do you take a copy of your data out?
Section titled “How do you take a copy of your data out?”Open Settings in the web app and use the “Download my data” button in the Privacy · DSGVO card. The result is a machine-readable JSON file, named with the date, that downloads straight to your machine.
The bundle covers your identity record, the workspaces you belong to and your role in each, the messages you wrote to your heads, the audit events where you were the actor, the knowledge documents you added and — only for workspaces where you are owner or admin — the billing rows for that workspace.
Two deliberate boundaries are worth knowing. The export excludes the indexed text of your knowledge documents, because the original files are already yours and re-shipping their contents adds nothing to portability; the document metadata is there instead. And it only ever contains your own rows, so an export is not a workspace-wide extract.
Export is on-demand and self-serve. There is no scheduled export, no per-record export screen, and the separate audit-log export is marked “Coming soon” in that same card — it is not wired to any sink yet. Like billing and integration setup, this is a web-only surface; there is no mobile app.
How does account deletion work?
Section titled “How does account deletion work?”Deletion is a real erasure job, not a flag on a record and not a support ticket. It is implemented end to end, it is irreversible, and it runs the same way every time.
The path is short. In the web app, open Settings → Danger zone → “Delete account…” — the same dialog is reachable from the “Delete account” row in your profile menu. You must be signed in, and you must type your exact account email to continue; that is the accident guard. Business-Gym then emails you a single-use verification link that is valid for one hour, and nothing is deleted until you click it.
Once the link is used, an orchestrated, idempotent erasure job runs across every store that holds your data:
- the application database
- the knowledge search index
- the identity and authentication records
- the internal work queues that carry a job from one step to the next
- secrets storage
You receive a confirmation email when it completes, sent to the address captured at request time — after which that captured address is scrubbed too.
What survives deletion, and why?
Section titled “What survives deletion, and why?”One category survives, and it is anonymised before it does: a minimal accounting and audit trail. Nothing retained identifies the person or company that was deleted.
Concretely, what stays is the accounting substance — amounts, dates and the kind of charge — and the shape of the audit trail — what kind of event happened and when. Everything that could point back at a subject is replaced or removed first:
- workspace and user identifiers become irreversible salted SHA-256 references, stable enough that aggregate accounting still reconciles but not reversible back to the original
- free-form audit payloads are dropped entirely, along with integration names that could embed a customer’s name; only the fact that a payload existed is recorded
- for the residual “a deletion occurred” record, only the email domain is kept — never the local part
The reason is ordinary bookkeeping. German accounting and tax rules require booking records to remain reconcilable after a customer leaves, and the right to erasure is read alongside those retention duties rather than against them. Your advisor will know the exact periods that apply to your business; what Business-Gym guarantees on its side is that no retained record identifies the deleted subject.
What is not available yet in this area?
Section titled “What is not available yet in this area?”Some things a compliance reviewer will look for are prepared but not live, and the product labels them that way rather than implying otherwise.
Compliance attestations are not wired. Settings shows a Compliance card marked “Coming soon” for per-tenant DSGVO, GoBD, EU AI Act, SOC 2 and ISO 27001 status and their downloadable reports. No certified badge is shown anywhere in the product, because none has been earned and displayed yet. Treat any certification question as unanswered until Archibo shows you the certificate itself.
Audit-log export is not wired. The Privacy · DSGVO card labels it “Coming soon”. Audit records exist and are visible in the product, but there is no export sink for them today.
There is no step-up re-authentication prompt at the moment of the deletion request. The guard chain is a signed-in session, your exact account email typed by hand, and a single-use link sent to that mailbox and valid for one hour. A separate password or MFA re-prompt at that instant is not part of it yet.
These surfaces are web-only. There is no native mobile app and no push notifications, so export and deletion are done in a browser and the verification link arrives by email.
What should you take to your own counsel?
Section titled “What should you take to your own counsel?”Nothing on this page is a legal opinion about your obligations, and a few questions can only be answered by the contract and by someone who knows your industry.
Ask for the data-processing agreement and the sub-processor list in writing, and check them against the processing described here. Confirm the retention periods your own sector imposes, and whether any of them conflict with honouring a deletion request from one of your people. Read the privacy policy published in the app alongside this page — it names the controller and the contact address for privacy requests. And if an auditor asks how the system behaves rather than how it is documented, getting started and the FAQ describe the same behaviour from the operator’s side.
If something on this page turns out not to match the running product, that is a documentation bug worth reporting. This page is written from the shipped behaviour, and it is meant to survive being checked.
Do you train an AI model on my company data?
Section titled “Do you train an AI model on my company data?”No. Business-Gym does not build, train or fine-tune a model of its own, and nothing your team writes becomes part of one. Each request is an ordinary call out to a third-party language model: the working material for that request goes out, an answer comes back, and nothing is ever sent for training. The Knowledge Base page says the same thing in its DSGVO controls card.
What does improve is narrower, and it stays inside your workspace. Where a head learns, it learns from your own team’s decisions: an approval, an edit or a dismissal is kept as an example belonging to your company — including the pair of what the AI drafted and what you actually approved. Those examples are counted rather than fed to a model: once the same decision has been made consistently enough, it is written into your own knowledge base as a plain document your heads can draw on. They are never used for another company’s workspace, and deleting the workspace erases them along with everything else.
Some of this you can see rather than take on trust. The Knowledge Base page has an Auto-learned card listing the decision patterns picked up this way. It stays empty until enough consistent decisions sit behind a pattern, and today only one head’s proposal reviews feed it — so treat it as a narrow window on the learning, not a full record of it.
Two honest gaps: there is no switch that turns this learning off, and no screen for deleting a single learned pattern. Where a pattern has been written into your knowledge base as a document, deleting that document removes it and its entries from the search index — but the decisions it was inferred from stay until the workspace is deleted.