Information pursuant to § 25 MedienG and § 5 ECG: beya consulting Roland Wolfig Margaretenstraße 95/32 1050 Vienna, Austria Email: hello@tabularasa.ai Phone: +43 676 4470825 tabularasa.ai is a product of beya consulting.

[DRAFT - pending legal review] 1. Controller The controller within the meaning of the GDPR is beya consulting, Roland Wolfig, Margaretenstraße 95/32, 1050 Vienna, Austria, email: hello@tabularasa.ai, phone: +43 676 4470825. 2. What data we process We process the following categories of personal data: account and sign-in data (name, email address, password hash or OAuth identity, managed via Better Auth); free-text input from reflections and conversations with the AI sparring partner; answers from the kickoff interview (assessment) and the individual learning profile derived from it; where applicable, special category data under Art. 9 GDPR (e.g. references to health, beliefs, or similarly sensitive topics you voluntarily mention in reflections) - we process this only with your explicit, separately obtained consent; usage and telemetry data (e.g. which modules you completed, technical error reports); when using voice mode, additionally voice audio, which is transmitted to our voice service provider. 3. Purposes and legal bases We process your data on the following legal bases: core platform functions (learning journey, sparring, kickoff interview) based on performance of a contract or pre-contractual measures (Art. 6(1)(b) GDPR) and your consent to core processing (Art. 6(1)(a) GDPR, consent category 'core_processing'); product improvement, where conversation data is analysed by AI only in anonymised or aggregated form, solely with your separate consent (Art. 6(1)(a) GDPR, consent category 'product_improvement') - no human reads individual conversations, and this analysis is excluded from our internal analytics/admin views; processing of sensitive content (Art. 9 GDPR) only on the basis of your explicit consent (Art. 9(2)(a) GDPR, consent category 'sensitive_content'); operational error and security telemetry based on our legitimate interest in a stable and secure platform (Art. 6(1)(f) GDPR). 4. Recipients and processors We use the following processors, each under a data processing agreement (Art. 28 GDPR): Mistral AI (EU) processes text input to generate AI responses (sparring, learning content, kickoff-interview evaluation); Google Cloud (EU, region europe-west1/Belgium) provides hosting and database, plus file storage [TBC: GCS storage bucket location being confirmed]; Brevo (EU, France) sends transactional emails (e.g. account confirmation); ElevenLabs (USA) converts text to speech and processes voice audio in voice mode. There are no other recipients; in particular, no data is shared with employers or organisations that contains individual evaluations, scores, or the conversation content of individual users - organisations only see aggregated participation and progress data (e.g. modules started/completed), never individual assessments. 5. International transfers ElevenLabs processes data in the USA. This transfer is intended to rely on Standard Contractual Clauses (SCCs) and, where applicable, the EU-US Data Privacy Framework. [TBC: the corresponding agreement with ElevenLabs has not yet been signed - it is also open whether an EU data-residency option will additionally be contractually agreed.] All other processors process data exclusively within the EU. 6. Retention period We store account data until you delete your account, or upon request. Memory facts (facts derived from conversations) are stored until you revoke consent or request deletion. Conversation and reflection data remain part of your account and are deleted together with it. [TBC: specific retention window for telemetry and log data.] Purely technical session data (e.g. an in-progress sparring or kickoff-interview session) is deleted automatically after a short time. 7. Your rights You have the right to access (Art. 15 GDPR), rectification (Art. 16 GDPR, including for profile data derived from conversations, which you can correct in your account settings), erasure (Art. 17 GDPR), restriction of processing, data portability (Art. 20 GDPR), objection, and to withdraw any consent you have given at any time with effect for the future. You can export and delete your account and memory data directly in the app; you manage your consents (core_processing, product_improvement, sensitive_content) in your account's privacy settings. 8. Automated decision-making and artificial intelligence Content in tabularasa.ai (learning texts, sparring responses, kickoff-interview evaluation) is generated with the help of AI; voice mode additionally uses a synthetic voice. Both are disclosed in accordance with Art. 50 EU AI Act. There is no automated decision-making with legal or similarly significant effects within the meaning of Art. 22 GDPR: the results of your kickoff interview and your learning profile are visible only to you, never to employers or third parties, and are never used for any automated personnel decision. We do not perform emotion recognition from voice or speech patterns. 9. Right to complain You have the right to lodge a complaint with the Austrian Data Protection Authority (Österreichische Datenschutzbehörde, Vienna) if you believe that the processing of your personal data violates the GDPR. 10. Contact For privacy-related questions, reach us at hello@tabularasa.ai.

[DRAFT - pending legal review] 1. Scope and provider These terms of use govern the use of tabularasa.ai, offered by beya consulting, Roland Wolfig, Margaretenstraße 95/32, 1050 Vienna, Austria (referred to below as 'we' or 'tabularasa.ai'). By registering for or using the platform, you accept these terms. 2. Description of services tabularasa.ai is a learning platform for reflective future skills, offering personalized learning journeys, a curated knowledge library, and an AI-powered sparring partner. tabularasa.ai expressly does NOT provide legal, medical, or therapeutic advice. Content is intended solely for personal development and reflection and does not replace professional advice. 3. Registration and account Using the platform requires an account. You must provide accurate information and keep your credentials confidential. You are responsible for all activity that occurs under your account. 4. User obligations and permitted use You agree not to misuse the platform, not to submit unlawful, offensive, or third-party-rights-infringing content, and not to use the platform for automated bulk scraping or to train competing AI models. 5. AI-generated content Learning content, sparring responses, and the kickoff-interview evaluation are generated with the help of artificial intelligence. AI-generated content may contain errors; we make no warranty as to its accuracy or completeness. It does not constitute professional advice and does not replace an expert assessment in any individual case. 6. Intellectual property and license to your own content All platform content (text, structure, design, curated knowledge library) is protected by copyright. For your own input (reflections, answers), you grant us a simple license, limited to what is necessary to provide the service; you remain the owner of your content. 7. Availability and changes We aim to keep the platform available but cannot guarantee uninterrupted availability. We may develop, change, or discontinue platform features. 8. Limitation of liability We are liable without limitation for intent and gross negligence, and for damages arising from injury to life, body, or health. Otherwise, our liability is limited to the extent permitted by law. [TBC: specific liability caps or exclusions.] 9. Termination and account deletion You can have your account deleted at any time via your account settings or by emailing hello@tabularasa.ai; your data will be deleted in accordance with the privacy policy. We may terminate an account for serious violations of these terms. 10. Changes to these terms We may amend these terms of use where required for legal reasons or due to platform development. We will inform you of material changes in a timely manner. 11. Governing law and jurisdiction Austrian law applies, excluding the UN Convention on Contracts for the International Sale of Goods. To the extent permitted by law, the courts of Vienna have jurisdiction. 12. Contact Questions about these terms of use can be sent to hello@tabularasa.ai.