Privacy Policy & Data Protection Declaration

Applicable Laws

This privacy policy complies with the EU General Data Protection Regulation (GDPR), the German Federal Data Protection Act (Bundesdatenschutzgesetz - BDSG), and the German Telecommunications and Telemedia Data Protection Act (TTDSG).

Legal Bases Used

• Art. 6 (1) lit. b GDPR: Processing necessary for contract performance (user accounts, service delivery)
• Art. 6 (1) lit. c GDPR: Processing for legal compliance (tax records, data retention requirements)
• Art. 6 (1) lit. f GDPR: Legitimate interests (security, fraud prevention, service improvement)
• Art. 6 (1) lit. a GDPR: Your explicit consent (marketing communications, optional features)

User Account Data

Website Audit Data

Technical Data

Hosting & Infrastructure

Payment Processing

Analytics

Error Monitoring

AI Processing Services

Email Services

Transfers Outside EU

We primarily process data within the EU. Limited transfers to third countries occur only with adequate safeguards:

• Sentry (USA): Error monitoring, EU Standard Contractual Clauses
• Anthropic (USA): AI services, EU Standard Contractual Clauses
• Perplexity AI (USA): AI search services, EU Standard Contractual Clauses
• OpenAI (USA): AI services, EU Standard Contractual Clauses
• Google LLC (USA): AI services, EU Standard Contractual Clauses
• Resend (USA): Email services, EU Standard Contractual Clauses

All third-country transfers are covered by appropriate safeguards under GDPR Art. 46 and include data processing agreements.

AI Analysis Systems

Our service uses automated systems to analyze website content and generate recommendations:

• Technical Scoring: Automated evaluation of SEO and technical factors
• Content Analysis: AI-powered assessment of website content quality
• Brand Monitoring: Automated tracking of brand mentions and sentiment
• Recommendation Engine: AI-generated suggestions for improvements

Your Rights: You can request human review of any automated decisions. These systems do not make legally binding decisions affecting you.

Technical Safeguards

• • End-to-end SSL/TLS encryption (HTTPS) for all data transmission
• • Password encryption using bcrypt with salt (never stored in plain text)
• • Database encryption at rest using AES-256
• • Regular automated security updates and vulnerability scanning
• • Network-level firewalls and intrusion detection systems
• • Two-factor authentication available for user accounts

Organizational Measures

• • Access controls based on principle of least privilege
• • Regular staff training on data protection procedures
• • Data processing agreements with all third-party providers
• • Incident response procedures and breach notification protocols
• • Regular security audits and penetration testing
• • Secure development practices and code reviews

Data Minimization

We collect and process only the minimum data necessary for service provision. Personal data is automatically deleted when no longer needed, and we regularly review data retention practices.

GDPR Rights

Under the GDPR, you have the following rights regarding your personal data:

How to Exercise Your Rights

To exercise any of these rights, please contact us at:

We will respond to your request within one month. In complex cases, we may extend this period by two additional months.

Right to Lodge a Complaint

You have the right to lodge a complaint with a supervisory authority if you believe your data protection rights have been violated. The competent authority for our company is:

Cookie Usage

Our website uses minimal cookies in accordance with the TTDSG (German cookie law):

Cookie Management

You can control cookies through your browser settings. However, disabling essential cookies may affect website functionality. Our analytics cookies are privacy-friendly and do not require consent under current EU guidelines.

Children and Minors

Our services are intended for users aged 18 and older. We do not knowingly collect personal data from children under 18 years of age. If you are under 18, please do not use our services or provide personal information. If we become aware that we have collected personal data from someone under 18, we will delete such information immediately.

Data Breach Notification

In the unlikely event of a data breach that poses a high risk to your rights and freedoms, we will notify you within 72 hours of becoming aware of the breach, in accordance with GDPR requirements. We will provide information about the nature of the breach, the data involved, and the measures we are taking to address it.

Business Transfers

In the event of a merger, acquisition, or sale of all or part of our assets, user data may be transferred as part of the transaction. We will provide notice before personal data is transferred and becomes subject to a different privacy policy. You will have the option to delete your account before any such transfer.

Research and Development

We may use aggregated, anonymized data for research and development purposes to improve our AI algorithms and services. This processing is based on our legitimate interests and involves no personal data identification.

Retention Schedule

Automated Deletion

We have implemented automated systems to ensure data is deleted according to these retention periods. You can request early deletion of your data at any time by exercising your right to erasure.

How We Handle Updates

We may update this privacy policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors.

• • Minor changes: Updated policy published with new effective date
• • Material changes: Email notification to registered users 30 days before effective date
• • Significant changes affecting rights: Additional consent may be required
• • Version history: Previous versions available upon request

Staying Informed

We recommend reviewing this privacy policy periodically. The "Last updated" date at the top indicates when changes were last made. Continued use of our services after policy updates constitutes acceptance of the revised policy.