WORKAIOUT A service from Epic Fusion AG
Back to home

As of 31 October 2026

Privacy notice

This notice describes the operation of Workaiout. Technical delivery is provided through Cloudflare. Personal contact enquiries are not collected through an internal form on this website; introductory appointments are booked through the linked Microsoft booking page.

Workaiout newsletter

By subscribing voluntarily, you receive free AI guides, templates and selected news about Workaiout services. We store your email address, chosen language, subscription status, signup source, and the time and version of your consent. Emails start only after you confirm your address. You can unsubscribe using the link in every message.

If you subscribe on a resource page, for example one we send you after a comment on Instagram, we also store which resource you requested. We email you the PDF after you confirm your address. If you are already subscribed, we send it to your confirmed address without a new subscription.

The recipient list and email queue are stored separately from Jannik Reinhard’s personal blog in Cloudflare D1. To deliver emails, Resend (Plus Five Five, Inc., USA) processes your email address, message content and technical delivery data. Processing may take place in the United States. Provider information: Resend privacy policy and Data processing addendum.

After you confirm, we transfer your email address, language, signup source, status, consent version and the signup, confirmation and unsubscribe times to a dedicated Workaiout recipient list in Notion. Notion is used to manage this list; editing it does not trigger an email. Newsletter unsubscriptions are reflected there. Unconfirmed addresses are not sent to Notion. Processing may take place outside the EEA. The withdrawal, retention and deletion information applies to both lists. Provider information: Notion privacy policy.

The newsletter is based on your consent under Article 6(1)(a) GDPR. Unsubscribing stops future emails without affecting the lawfulness of prior processing. Unconfirmed signups are removed after seven days. Technical rate limits briefly use pseudonymous identifiers rather than stored IP addresses. Completed delivery records are removed after 30 days. Unsubscribe status and consent evidence remain stored to respect your withdrawal and document consent; you can request deletion by contacting us. The newsletter does not track opens or clicks.

1. Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) and the Swiss Federal Act on Data Protection (FADP) is:

Epic Fusion AG
Bahnhofplatz 10B
CH-3011 Bern
Switzerland
Phone: +41 31 512 14 14
Email: hello@epicfusion.com

Epic Fusion AG has an establishment in Annweiler am Trifels, Germany: Bürgermeister-Stöcklein-Strasse 1, DE-76855 Annweiler. Because of this establishment in the Union, we do not appoint a separate representative under Article 27 GDPR.

2. Visiting the website

When you access the website, the hosting provider processes technically necessary access data, in particular your IP address, the date and time of access, the requested file, the referrer URL, and browser and device data. This processing is necessary to provide the website securely and reliably and is based on Article 6(1)(f) GDPR. The legitimate interest is the secure operation of the website and the prevention of abuse.

This website does not embed marketing or social media pixels or external Google Fonts resources. The optional analytics services Microsoft Clarity and Cloudflare Web Analytics described in sections 3 and 4 only start after your explicit, separate choice.

3. Optional analytics with Microsoft Clarity

With your voluntary consent, we use Microsoft Clarity to improve the usability of this website. Clarity creates heatmaps and session replays from clicks, mouse movements, scrolling and page rendering. Page and referrer information, browser and device data, technical connection data including the IP address, and pseudonymous user and session identifiers are also processed. Replays represent interactions with the website; they are not videos from your camera or recordings of your entire screen. Microsoft receives this data. We do not send names or contact details as our own user identifiers to Clarity.

The provider is Microsoft Corporation, One Microsoft Way, Redmond, WA 98052, USA, including the Microsoft group companies responsible for the service. Microsoft describes itself as an independent data controller for Clarity. Further information about Microsoft’s processing purposes and your rights is available in the Microsoft Privacy Statement and the Clarity privacy information.

Clarity only loads if you select “Microsoft Clarity” and save your selection or choose “Allow all”. Without this consent, neither the Clarity script nor Clarity measurements are requested. The website remains fully usable if you decline. The legal bases are Article 6(1)(a) GDPR and section 25(1) TDDDG. Advertising consent is explicitly sent to Microsoft as denied; we do not integrate Microsoft Advertising or Google Analytics. Previous consent is not automatically extended to a newly added service.

After your consent, Clarity may set the cookies _clck to recognise a browser (up to one year) and _clsk to combine page views into a session (up to one day). Microsoft describes these and other technically possible cookies in its cookie overview. Clarity masks input content; the entire interactive AI check, including its recommendation, and the analytics settings are also masked. We do not record meetings on the legal notice or privacy pages.

You can change or withdraw consent for either service independently through “Analytics settings” on content pages or here: . “Reject all” disables both optional services. On withdrawal, further external analytics connections are blocked and the page reloads to stop previously loaded measurement code. Accessible Clarity cookies are removed, and the change is also applied in other open tabs. Data lawfully transmitted earlier is not retroactively erased. You can contact us or the relevant provider to exercise your privacy rights.

Microsoft states that ordinary replay data is retained for 30 days, and heatmap and click data and labelled or favourited meetings for nine months. The Clarity FAQ also mentions longer retention for randomly selected samples. Microsoft states that individual visitor data cannot be deleted separately in the Clarity portal; deleting the project would affect all project data. Details are available in Microsoft’s retention information and Clarity FAQ.

Microsoft may also process data outside the European Economic Area, particularly in the USA. Clarity processing is separate from this website’s hosting. Microsoft explains that it uses standard contractual clauses for transfers from its European company to Microsoft Corporation. Further information about international transfers and the safeguards used by Microsoft is available in the linked Microsoft Privacy Statement. The “advertising consent denied” setting does not replace these safeguards.

4. Hosting and Cloudflare Web Analytics

The website is provided through Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA, and the group companies involved in providing the service. Necessary technical processing under section 2 is independent of your optional analytics choice. We do not operate our own permanent database of website visitors’ IP addresses. Technical data is only processed for as long as necessary for delivery, security, troubleshooting or legal obligations.

We additionally use Cloudflare Web Analytics only with your consent. The service counts page views and visits and measures loading performance and Core Web Vitals. It processes the page visited, the referring page without query parameters and fragments, timestamps, browser, operating system and device information, and performance data. The IP address is technically transmitted when connecting and may be used to determine an approximate country. According to the provider, Cloudflare Web Analytics does not set analytics cookies or create persistent cross-website user profiles. An identifier may be used to associate measurements for a page view.

The legal bases for this optional service are Article 6(1)(a) GDPR and section 25(1) TDDDG. We load the measurement script only after you select “Cloudflare Web Analytics” or “Allow all”. Cloudflare’s automatic injection is disabled. “Reject all” or withdrawal stops future measurement. Our integration does not measure the legal notice, privacy pages or preview domains.

Cloudflare states that Web Analytics reports are available for the previous six months. We do not import historical visitor data into this service or send entries from the AI check. Further information: data collection, storage and reporting and Cloudflare’s privacy policy.

Your separate selection for both services, the timestamp and the version of the consent notice are stored only in your browser under workaiout.analytics.consent.v2 . This is necessary to respect your privacy decision. Consent is valid for no more than 180 days; we then ask again. Previous refusals are respected. Previous consent is not treated as consent to additional services.

The former first-party event analytics using Azure Blob Storage and Azure Log Analytics is disabled. Its collection and reporting APIs no longer accept new analytics events. Data held there is separate from Cloudflare Web Analytics and Clarity.

5. Getting in touch

Workaiout does not provide its own booking function. The “Book a free intro call” link opens an external Microsoft Bookings page. The details required to book an appointment are entered there. This processing is covered by Microsoft’s privacy statement.

We do not transmit form entries or answers from the AI check to Microsoft Bookings. Opening the external link nevertheless sends technical connection data to Microsoft, particularly your IP address and potentially the referring domain. Appointment booking takes place in the booking environment. Please do not enter special categories of personal data under Article 9 GDPR, credentials or confidential third-party documents there.

Memberspot learning platform

For the Academy, and for the Academy access included in coaching, we use the Memberspot learning platform. Memberspot describes itself as a German limited company and processes, on our behalf, in particular name, email address, learning progress and community posts. The legal basis is the contract under Article 6(1)(b) GDPR. Processing is covered by a data processing agreement. Memberspot states that the platform is hosted exclusively in Frankfurt, Amsterdam and Dublin. Source, retrieved on 31 October 2026: Integrations and security.

Retention of contract and invoice data

We keep contract and invoice data for ten years, Article 958f of the Swiss Code of Obligations.

6. Recipients and transfers to third countries

Cloudflare receives necessary hosting data and, after your selection, the Web Analytics data described in section 4. Microsoft receives the Clarity data described in section 3 after separate consent. Section 5 covers Microsoft Bookings. Cloudflare describes its processing on behalf of customers and safeguards for international transfers in its Data Processing Addendum, including standard contractual clauses and the Data Privacy Framework where applicable. Processing exclusively within the EU or Switzerland is not guaranteed.

7. Obligation to provide data and automated decisions

No information needs to be provided to visit Workaiout. The details required for an appointment through Microsoft Bookings are described in its privacy information. Workaiout does not carry out automated decision-making, including profiling, under Article 22 GDPR.

8. Your rights

You have the right to access, rectification, erasure, restriction of processing, data portability and, where processing is based on legitimate interests, objection. You may withdraw consent at any time with future effect. Please contact the address given in section 1.

9. Right to lodge a complaint

For persons in Switzerland, the Swiss Federal Act on Data Protection (FADP) applies. The supervisory authority is the Federal Data Protection and Information Commissioner (FDPIC). You have the right to complain to a data protection supervisory authority. As the controller is based in Switzerland, data subjects in the European Economic Area may contact the supervisory authority at their habitual residence or place of work. An overview of German supervisory authorities is available from the Federal Commissioner for Data Protection and Freedom of Information.

The competent authority in Switzerland is:
Federal Data Protection and Information Commissioner (FDPIC)
Feldeggweg 1, CH-3003 Bern
www.edoeb.admin.ch