Privacy Policy

Moral Mirror lets the participants in a session observe patterns in their own moral judgment: they answer short ethical questions and the group sees aggregate results. It is descriptive, not prescriptive. One activity works differently: in the personal ethics case, a participant describes a real ethical decision from their working life, under their name, for their educator to read, and may answer research questions about it.

Controller

The controller within the meaning of Art. 4(7) GDPR is
Urs Müller, Gotenstr. 21, 10829 Berlin, Germany — info@moral-mirror.org.

Who is responsible for what. For educator and administrator accounts, for security and abuse prevention, and for the retained analysis data — anonymous counters in some tools, pseudonymous rows in others; each tool's retention section says which — we are the controller. Where an institution has contracted us to run this tool for its own programme, the institution is the controller for the identifiable data of that cohort, and we process it on the institution's behalf (Art. 28 GDPR). In practice: for a request concerning your cohort's identifiable data, please approach your educator or institution first; for anything concerning accounts, security or the retained analysis data, contact us. We assist the institution in answering requests in either case (Art. 28(3)(e) GDPR).

Data protection officer: no data protection officer is appointed. § 38 BDSG has three separate triggers and we have assessed all three: headcount (at least 20 persons constantly engaged in automated processing — this service is operated by one person), processing that requires a data protection impact assessment under Art. 35 GDPR, and commercial processing for the purpose of transfer, anonymised transfer, or market or opinion research. The last two apply regardless of headcount. Our assessment is recorded in DPIA-DETERMINATION.md and is revisited whenever the scope or purpose of processing changes — in particular if cross-session research use becomes a purpose in its own right rather than support for the individual course.

What data we process

From participants

Apart from the personal ethics case (below), we do not ask for your name, e-mail address or any account. We store, per submission:

• Your answers to the activity's questions — including, for the one open question in the Thief's Mirror set, the text you type. Your answers can reveal your moral views. The matrix test is the exception: what you enter there is not stored on its own. It is added at once to your group's totals (how many people claimed each matrix, and how many matrices each claimed in all), and nothing records which part of those totals came from you.
• Optional demographics — only the fields you choose to answer, and only in sessions where the educator asks for them.
• A session code — attaches responses to the correct session, not to you.
• A pseudonymous token in a cookie, so your answers within one session hang together. Because such a token exists, the data is pseudonymous rather than anonymous.
• Which version of a question you were shown — some questions exist in more than one wording, and which one you saw is assigned at random and recorded. Comparing those groups is the point of the activity.
• A record that this notice was shown to you — the moment you pressed "I understand" and the version of the wording you saw. It is not a consent, and nothing here depends on your agreeing: it records that you were informed, which we must be able to show either way.

From participants in the personal ethics case

An educator runs this activity on its own in a session. You describe a real ethical decision from your working life, and we store:

• Your name (family and given name), so that your educator knows whose case it is.
• Your case as you write it: your job title at the time, the background, the situation, its moral dimension, the options you considered, your considerations and the outcome. Also whether your educator may mention your case during the course, any comment you add about confidentiality, and when you started, changed and completed it.
• A resume code, stored only as a one-way hash, so that you can continue later or on another device. The code itself is on your screen and in your browser's cookie.
• Only if you agree to the research part: your answers to its questions (how you look back on the decision, how long it took, whom you talked to, some details about you such as gender, age, nationality and education, and ten short personality statements), with the time and the wording of your agreement.
• A record of the notices shown to you: the version of this privacy notice and of the case's own start page when you began.

A case can contain information about other people and, if you choose to write it, about your health, beliefs or other special categories of data. Please describe other people by their role, without their names, and leave out anything you do not want your educator to read.

From educators

• E-mail address — for backoffice sign-in.
• Password — stored only as a bcrypt hash.
• Passkeys — only if you add one: the public key and identifier your device created, the name you gave it, and when it was added and last used. Your fingerprint, face or device PIN never leave your device; we never see them.

Legal bases

• Running the activity and showing group results — Art. 6(1)(f) GDPR, our legitimate interest in supporting the session in which participants take part.
• The personal ethics case: Art. 6(1)(f) GDPR, our legitimate interest in running the course exercise in which you describe a case for your educator to read and discuss.
• The research part of the personal ethics case: your consent, Art. 6(1)(a) GDPR and, where your case or answers contain special categories of data, Art. 9(2)(a) GDPR. You can withdraw it at any time with effect for the future (see "Your rights" below).
• Educator accounts — Art. 6(1)(b) GDPR.
• Security, rate-limiting and abuse prevention — Art. 6(1)(f) GDPR.

Recipients and third-country transfers

We use no third parties for advertising, analytics or tracking, and we do not sell or share personal data for marketing purposes. The following providers process data on our behalf as processors under a data processing agreement pursuant to Art. 28 GDPR:

• IONOS SE (Germany) — hosting and outgoing e-mail.
• Microsoft Ireland Operations Ltd. (OneDrive) — storage of the weekly off-site backup copies. Those backups are encrypted before they leave the server, and the private key exists only on the operator's own machine — never at the provider. So Microsoft holds ciphertext it cannot read.
• healthchecks.io — monitoring that the backup run happened. Only status pings are sent ("run succeeded / failed"); no content and no participant data.

Transfers outside the EU/EEA: processing takes place in the EU; the servers and databases are in Germany. Two things are worth stating in full. Microsoft (OneDrive) provides for transfers outside the EEA under Art. 46 GDPR safeguards (EU standard contractual clauses) — what reaches it is only the backup copies, encrypted before they leave the server, whose key we do not hand over. And healthchecks.io runs infrastructure in the EU and the US, but receives only backup-run status pings: no participant data and no content.

What this means for erasure: when a record is deleted, a copy may remain inside backups until those expire: up to 14 days in the backups held on the server, and up to 30 days in the encrypted off-site copies. Backups are used only to restore the service after a failure, never for ordinary processing.

How long we keep data

• Session responses (every activity except the personal ethics case) — deleted automatically 30 days after the session is closed, or 30 days after the last answer if it is never closed. A session nobody ever joined is removed 90 days after it was created. Deletion removes the whole session: every answer, the optional demographics and the condition each participant was assigned. Educators are warned 14 days beforehand and can postpone up to three times by 30 days. The latest possible date is 120 days after the session closed or the last answer — 90 days beyond the original deletion date.
• Session-level figures — when an educator closes a session, its answers are added to cross-session benchmarks as counts only. Those counts contain no participant records and are not affected by the deletion above; they cannot be traced to a session or a person. Once a session is closed it takes no new participants and no new answers, and an answer you withdraw after the close is taken back out of those counts.
• Matrix test totals — a session's matrix test totals hold no participant records. They are kept for two years after the session closes, also after the session itself has been deleted, so that a course page showing them keeps working. An educator who deletes the session deletes them with it.
• Unfinished answers — if you start the activity and leave without reaching your reflection card, what you answered so far is deleted automatically once your 8-hour pass expires. That pass is the only thing that could bring you back to it, so nothing you could still return to is removed. It is also why an unfinished attempt never needs a deletion code: it is gone before the session's own deadline.
• The personal ethics case — the cases of a session are deleted 20 weeks after the first case in it was started. The educator is warned 14 days beforehand, can postpone this up to three times by 30 days, and can delete a case or the whole session earlier. If you agreed to the research part, your case and research answers are kept for research after that date, without your name, the session and your answers about confidentiality: what is kept is the text of your case, your research answers and the month the case was completed. They are kept for research for up to ten years after that date and then deleted, and research results are published only in a form that does not identify you.
• Educator accounts — retained until deleted.

Who can see your data

• Everyone in the session sees group aggregates. Demographic breakdowns are shown only when at least 5 participants stand behind a group, so no individual can be singled out.
• Educators see the same aggregates for their own sessions.
• The one open question (in the Thief's Mirror set, only if you said you had once stolen something) is the exception: what you write there is shown as written — with no name and no token — to the educator and on the reveal screen in the session, once at least three people have answered it. The educator can hide any such answer from the reveal. Free-text answers never enter the cross-session benchmarks or your reflection card. Please write nothing there you would not want the room to read.
• The matrix test's results page shows one session's group totals: how many matrices each randomly assigned group claimed, matrix by matrix. Anyone with its address can open it, and an educator can embed it in a course page. It names no session, course or person, and from the second session on it also shows the totals of all closed sessions together.
• The personal ethics case: your educator sees your name and your case and can download it as a PDF or a spreadsheet; other participants do not see it. If you allowed it, your educator may refer to, mention or summarise your case during the course. Your answers to the research questions are never shown next to your name: they appear as group charts, once at least five people have answered, and in the research file described under “How long we keep data”.
• The administrator has technical access for maintenance and security only.

Pseudonymised, aggregated answers may contribute to cross-session benchmarks; these are labelled as a convenience sample, not a representative one.

Data security

• The server is located in Germany.
• All transmission is encrypted using HTTPS/TLS.
• Passwords are stored only as bcrypt hashes, never in plain text.
• Session cookies are signed and HTTP-only.
• Web fonts are served from our own server — no third-party CDNs, so no data flows to third parties when fonts load.
• IP addresses processed for rate-limiting are held in memory only and never written to the database.

Server log files

Our web server records standard access log entries: IP address, date and time, the resource requested, HTTP status, referrer and browser identifier. These logs are used solely to operate and secure the service, are not combined with other data, are not used to identify individuals or build profiles, and are rotated and deleted after 14 days. IP addresses processed for rate-limiting are held in memory only and never written to the database.

Administrative audit trail. If you use an educator account, we record security-relevant actions — successful and failed sign-ins, password changes and resets, creating, changing and deleting accounts, and deleting or anonymising session data — each with the time, the account's e-mail address and the IP address. The basis is our legitimate interest (Art. 6(1)(f) GDPR) in being able to reconstruct unauthorised access to an account. These entries are deleted after 12 months. Participants are not affected.

Your rights

You have the following rights:

• Access (Art. 15 GDPR) — what data we hold about you.
• Rectification (Art. 16 GDPR) — correction of inaccurate data.
• Erasure (Art. 17 GDPR) — deletion of your personal data.
• Restriction of processing (Art. 18 GDPR).
• Data portability (Art. 20 GDPR) — your data in a structured, machine-readable format.
• Withdrawal of consent (Art. 7(3) GDPR) — at any time, with effect for the future, as easily as it was given.

Response time. We aim to respond to enquiries promptly. Requests concerning your personal data are answered within the period required by Art. 12(3) GDPR (one month at the latest).

Erasure and withdrawal on this tool

The deletion code on your reflection card is how you erase your answers in every activity except the personal ethics case (next paragraph). It is shown once, on the card, and it is the only way: we collect no name and no e-mail address, so we cannot send you a replacement and cannot look your answers up any other way. That is the same design that stops anyone else finding them. Enter the code at /withdraw; the page shows what would go and asks you to type a word to confirm.

The personal ethics case is erased with your resume code: on the case's last page you can delete your case and all your answers yourself, by typing a word to confirm, and you can change your answer to the research question, which deletes your research answers. You can also ask your educator, who can delete your case. Once a research case has been kept without your name it can no longer be linked to you, so it cannot be found to be erased.

One thing the code cannot reach: your result in the matrix test is added to your group's totals the moment you send it and is not stored on its own, so it cannot be taken back out. Nothing in those totals says which part came from you.

If you did not save the code, everything from the session is deleted at its retention deadline in any case, and your educator can delete the whole session at any time.

After the deadline there is nothing to withdraw. The session is deleted outright — every participant, answer and assignment. What remains is a count of how often each question set has been used, which holds no participant records and cannot be traced to anyone, and for two years the matrix test's group totals described above.

Whether you must provide data

Providing data is neither a statutory nor a contractual requirement. Nothing identifying is required, except in the personal ethics case, where your name and your case are what the exercise consists of; its research questions are voluntary. Demographic questions are optional and skipping them has no consequence.

Supervisory authority

You also have the right to lodge a complaint with a data protection supervisory authority. The authority competent for our location is:

Berliner Beauftragte für Datenschutz und Informationsfreiheit
Alt-Moabit 59–61
10555 Berlin
Germany
www.datenschutz-berlin.de

Automated decision-making

No automated decision-making, including profiling, within the meaning of Art. 22 GDPR takes place.