Privacy information
Information under Art. 13 and 14 GDPR about this website and about test access to the conversation simulator of the Centre for University Teaching.
Status: 20 September 2026. This version is a draft and will be agreed with the university before the site goes live.
1. Controller
The controller within the meaning of Art. 4 no. 7 GDPR is the University of Bayreuth, Universitätsstraße 30, 95447 Bayreuth, Germany, legally represented by its president. The unit responsible for this service is:
Zentrum für Hochschullehre (ZHL)
Nürnberger Straße 38, 95447 Bayreuth, Germany
Phone: +49 921 55-4650
E-Mail: zhl@uni-bayreuth.de
The data protection officer of the University of Bayreuth can be reached through the university.
Technical operation of the site and the application is carried out on behalf of the Centre for University Teaching by Trainexus UG (haftungsbeschränkt), Zum Wachtfels 17, 91241 Kirchensittenbach, Germany. It processes personal data solely on instruction of the university.
2. Visiting this website
This website runs on a rented server of Hetzner Online GmbH in the data centre Helsinki (Finland). A move to a server of the University of Bayreuth is prepared; once it has taken place, this statement will be updated here.
Whenever a page is requested, the web server processes technically necessary connection data: IP address, time, requested address, volume of data transferred, status code and browser identification. The purpose is delivery of the page, its stability and defence against attacks. The legal basis is Art. 6 (1) (e) GDPR together with Art. 4 BayDSG (performance of a task carried out in the public interest, here teaching and university didactics).
The access log is kept by the operator of the hosting; the site itself does not evaluate it and does not combine it with other data. The retention period applying there is currently being clarified.
A note on the links in our mails. The confirmation link and the link to your status page carry a random string in the path, which therefore also appears in the access log of the host. The confirmation link is valid once and for at most 72 hours; the status page shows only the state of processing, neither your name nor your address nor your request text. Neither page passes the string on: they load nothing from third-party servers and send no referrer.
No analytics, no third-party content. This site embeds no fonts, maps, videos or scripts from third-party servers and measures no reach. The Hind typeface is delivered from the same server.
Cookies
| Name | Purpose | Content and duration |
|---|---|---|
| txs | Counts the turns of a pre-chat so that the per-session limit also works behind the shared network of the university. | A signed random identifier with no reference to your person, 24 hours. |
| txc | Recognises you on a further request from the same browser so that you confirm your address only once. | A keyed value of your address from which the address cannot be recovered, 30 days. It is set only after your confirmation. |
Both cookies are required for the function you asked for (§ 25 (2) no. 2 TDDDG). The site sets no other cookies.
3. The pre-chat on the start page
In the pre-chat an assistant clarifies which conversation you would like to practise. Your messages are passed through our server to Anthropic (USA), whose language model generates the follow-up questions and the summary.
- No transcript on the server. The conversation history stays in your browser. On the server it is processed only for the duration of a single reply.
- Abuse protection. For limiting requests we process your IP address solely as a salted hash value. Stored are the time, this hash value and the number of calls, no conversation content.
- Your request text. The summary of the pre-chat is stored as your request text only when you submit the form.
The legal basis is Art. 6 (1) (e) GDPR. Please do not enter special categories of personal data or information about third parties in the pre-chat.
4. Form, confirmation and test access
When you request test access, we process the details from the form in order to set up a practice scenario and an account in the application for you.
| Data | Purpose | Retention |
|---|---|---|
| Name, university address | Confirmation of the address, creation of the account, sending of the access details and of a follow-up question a few days later | 120 days after the day on which you submitted your request, then deletion |
| Request text and summary of the pre-chat | Construction of the practice scenario | Deleted on this site as soon as processing has taken the text over; deleted in processing as soon as your access is complete without errors |
| Confirmation and status identifier | One-time confirmation of your address, display of the processing state | Confirmation valid for 72 hours; the identifiers are stored encrypted, with the key outside the web area |
| Timestamps, processing state, technical identifiers, hash value of the IP address | Course of processing, protection against abuse and repeated requests | The hash value of the IP address goes after 120 days; timestamps, state and technical identifiers remain without a personal reference |
| Hash value of your address (in processing, not on this site) | Recognising whether someone already received access, so that a further wish lands in the same course | Kept permanently; the address cannot be recovered from it |
The legal basis is Art. 6 (1) (e) GDPR together with Art. 4 BayDSG. Name and address are required for setting up access; otherwise we cannot provide it. No consent is obtained for this; the checkbox in the form only confirms that you have read this information.
The mails are sent by the mail server of the University of Bayreuth. Your request is processed on a machine of the Centre for University Teaching that collects the requests from this site.
5. The application after sign-in
The practice conversation itself takes place in the application at zhl-ubt-avatar.de. Application and database are located on a server of Hetzner Online GmbH in Falkenstein (Germany). The privacy notice of the application applies there and can be opened after sign-in. The following services take part in the simulation:
| Service | Location | Purpose | Basis |
|---|---|---|---|
| Hetzner Online GmbH | Germany (Falkenstein) for the application, Finland (Helsinki) for this site | Operation of server and database | Processing on behalf within the EU |
| OpenAI Ireland Ltd. | Contracting party Ireland, processing also in the USA | Replies of the practice partner, transcription, evaluation of your own documents | Contract of the University of Bayreuth with EU standard contractual clauses |
| HeyGen Inc. | USA | Image and sound of the avatar in real time: the audio stream generated by us and connection data | Contract of the University of Bayreuth with EU standard contractual clauses |
| ElevenLabs | USA | Speech output of the avatar, that is the generated output text | Processing on behalf with EU standard contractual clauses, no storage |
| Anthropic | USA | Only the pre-chat on this site | Processing on behalf; the transfer to the USA relies on standard contractual clauses under Art. 46 GDPR |
Data are passed to no other parties, apart from legal obligations.
6. Retention at a glance
| Data | Duration |
|---|---|
| Request text and summary of the pre-chat | On this site with the handover to processing, there with the completion of your access |
| Name and address | 120 days after the day on which you submitted your request |
| Hash value of the address in processing | Kept as a recognition feature |
| Confirmation identifier | Valid for 72 hours. Only a check value of a random string is stored; once your data are deleted it no longer relates to you |
| Counters and session identifiers of the pre-chat | Counters after two days, session identifiers after seven days. The hosting has no scheduler, so the site clears them along the way during the next pre-chat |
| Operating log of the site | Holds type of event, time, shortened identifiers and counts, neither conversation content nor addresses. It is cleared by hand when needed |
| Access log of the host | Period of the host, see section 2 |
| Account and conversation history in the application | As stated in the notice of the application |
7. Your rights
- Access to the data stored about you (Art. 15 GDPR)
- Rectification of inaccurate data (Art. 16 GDPR)
- Erasure (Art. 17 GDPR)
- Restriction of processing (Art. 18 GDPR)
- Objection to processing in the public interest on grounds relating to your particular situation (Art. 21 GDPR)
How to have your data deleted. A short mail to zhl@uni-bayreuth.de is enough. We then delete your request on this site and your account in the application. What remains is a row without a personal reference: processing state, timestamps, technical identifiers and check values of random strings. In processing, the hash value of your address remains as well, and your address cannot be recovered from it.
No automated decision in individual cases. The evaluation of a practice conversation is feedback for practising. It has no legal effect and enters into no examination result.
8. Right to lodge a complaint
You may lodge a complaint with a supervisory authority (Art. 77 GDPR). For the University of Bayreuth as a public body, the Bavarian Data Protection Commissioner is competent, Wagmüllerstraße 18, 80538 Munich.
We adapt this information when the processing changes. The version published here, with the date at the top of the page, is the one that applies.