1. Controller and legal bases
Controller: Leonid Kleimann, Breslauer Str. 14, 86356 Neusäß-Täfertingen, Germany. Data protection contact: hello@smmassistent.com.
GDPR legal bases are performance of a contract and steps at your request before entering a contract (Art. 6(1)(b)); legal obligations, including payment accounting (Art. 6(1)(c)); legitimate interests in secure service operation and responding to enquiries (Art. 6(1)(f)); and consent for optional analytics (Art. 6(1)(a)).
2. Hosting and security
The landing website and application are hosted on Hetzner Cloud in Helsinki, Finland; Chatwoot support runs on a separate Hetzner VPS in Nuremberg, Germany. Backups are enabled on both servers.
Request data, including IP address, time, requested resource and browser information, is processed for operation, diagnostics and security. The main server keeps web-server and application logs. Container log rotation limits their size; there is no single fixed retention period in days.
3. Account, payments and support
Account and service features use your email, authentication data and data you add. Authentication uses Supabase; payments and subscriptions use Stripe. Account and payment data is necessary for the respective features.
Support enquiries involve contact details, message content and connection data. Chatwoot loads only when you click “Open support chat”: before that, our code does not load its SDK, iframe, network requests or storage. Chat is independent of analytics consent; you can also contact us by email.
4. Public demo and AI analysis
The demo works without registration and processes the Instagram username or Telegram/YouTube channel reference you enter and public data to generate a report. Brief Instagram AI analysis sends the text fields name, bio, website, caption and timestamp to OpenAI; images are not sent to OpenAI. Your browser may load Instagram/YouTube images from external servers, which then receive request data, including your IP address.
5. Cookies, analytics and your choices
Necessary device storage and access for explicitly requested features are governed by § 25(2) TDDDG; optional technologies require consent under § 25(1) TDDDG. Google Analytics 4 (GA4), Microsoft Clarity and Meta are used to assess visits, interactions and advertising effectiveness only after analytics acceptance. These SDKs do not load if you reject or make no choice; analytics is disabled on legal pages.
You can change your choice or withdraw consent through “Cookie settings” at the bottom of the page. Withdrawal does not affect the lawfulness of earlier processing. Third-party SDKs already loaded may continue operating until reload; withdrawal does not delete data previously sent to providers.
Language, market, landing host, UTM parameters and consent choice may be passed to the application for language selection and source attribution. This functional source information is separate from analytics consent. The pre_auth_attribution record is retained for up to 90 days, and language preference for up to one year.
6. Recipients, transfers and retention
Hosting, authentication, payment, support and AI providers receive data as needed; analytics providers receive it with consent. Their role depends on the processing, and they may process data for their own purposes under their policies. International providers may process data outside the EEA, where protection may differ. Such transfers are subject to Chapter V GDPR requirements; you can ask us for details about specific processing.
Data is retained while needed for the relevant function, legal obligations or defence of legal claims, then deleted or anonymised. Backups may remain until overwritten in the normal cycle. GA4 event data retention is set to 2 months and user data retention to 14 months; reset on new user activity is enabled.
7. Your rights and contact
Subject to GDPR conditions, you may request access, correction, erasure, restriction and portability; object to processing based on legitimate interests and withdraw consent. Contact hello@smmassistent.com. Identity verification may be needed to protect your data. Data deletion instructions are linked below.
You may also complain to a supervisory authority, in particular the Bayerisches Landesamt für Datenschutzaufsicht (BayLDA), responsible for private businesses in Bavaria.