Privacy Policy

Welcome to our websites — we are delighted that you are interested in our services. Protecting your personal data is important to us. We therefore conduct our activities in accordance with the applicable legal provisions on the protection of personal data and on data security. In the following, we would like to inform you about which data collected during your visit is used and for which purposes.

Controller responsible for processing under the GDPR

The controller within the meaning of the General Data Protection Regulation and other data protection laws applicable in the Member States of the European Union, as well as other provisions of a data protection nature, is:

Kristof Puller

Toulouser Allee 7

40211 Düsseldorf

E-mail: datenschutz@maebe.app

Data Protection Officer

Nils Möllers

Keyed GmbH

Siemensstraße 12

48341 Altenberge

E-mail: info@keyed.de

What is personal data?

The term "personal data" is defined in the German Federal Data Protection Act (BDSG) and in the EU GDPR. According to these, personal data is any individual information about the personal or factual circumstances of an identified or identifiable natural person. This includes, for example, your name, your address, your telephone number or your date of birth.

Scope of anonymous data collection and data processing

Unless otherwise stated in the following sections, no personal data is generally collected, processed or used when you use our websites. However, through the use of analytics and tracking tools, we do learn certain technical information based on the data transmitted by your browser (for example browser type/version, operating system used, pages visited on our site including time spent, previously visited website). We evaluate this information for statistical purposes only.

Relevant legal bases for the processing of personal data

- Where we obtain the consent of the data subject for processing operations involving personal data, Art. 6 (1) (a) of the EU General Data Protection Regulation (GDPR) serves as the legal basis for the processing of personal data.

- When processing personal data that is necessary for the performance of a contract to which the data subject is a party, Art. 6 (1) (b) GDPR serves as the legal basis. This also applies to processing operations that are necessary to carry out pre-contractual measures.

- Where the processing of personal data is necessary to fulfil a legal obligation to which our company is subject, Art. 6 (1) (c) GDPR serves as the legal basis.

- In the event that vital interests of the data subject or another natural person make the processing of personal data necessary, Art. 6 (1) (d) GDPR serves as the legal basis.

- If the processing is necessary to safeguard a legitimate interest of our company or of a third party, and if the interests, fundamental rights and freedoms of the data subject do not override the former interest, Art. 6 (1) (f) GDPR serves as the legal basis for the processing.

Use of cookies

Our websites use cookies. On our website, we use the Cookiebot service.

Description and purpose

We use the Cookiebot service provided by Usercentrics A/S, Havnegade 39, 1058 Copenhagen, Denmark. Cookiebot is a cloud-based consent management platform (CMP) and is used to manage cookies and comparable technologies on our website. Via the consent management tool, users can decide on their first visit which cookies may be set. In doing so, Cookiebot processes information about your consent (e.g. IP address in truncated form, time and scope of consent or refusal, device used, browser information). The purpose is the legally compliant obtaining, documentation and management of consents in accordance with the GDPR and the German TDDDG, as well as the correct display of the cookie banner when the website is accessed.

Legal basis

The use of Cookiebot is based on Art. 6 (1) (c) GDPR (legal obligation to manage consents) and Art. 6 (1) (f) GDPR (legitimate interest in legally compliant website operation).

Recipient

The recipient of the data is Usercentrics A/S, Havnegade 39, 1058 Copenhagen, Denmark, acting as our processor.

Transfer to third countries

As a rule, no transfer to third countries takes place. Nevertheless, a transfer of data to a third country can never be completely ruled out. In the event of a transfer of personal data, the provider ensures the level of protection required by the GDPR through compliance with Art. 44 et seq. GDPR. If you have any questions, please feel free to contact our Data Protection Officer.

Duration of data storage:

Contractual and statutory obligation

Furthermore, personal data must be provided where we are legally obliged to collect it, or where the provision of this data is necessary to fulfil a legal obligation. The legal obligation is determined by Union law or the law of the Member States to which the controller is subject. Failure to provide the data would mean that this legal obligation cannot be fulfilled.

Further privacy information

Further information on the processing of your personal data can be found here: https://www.cookiebot.com/en/privacy-policy/

Creation of log files

Each time our website is accessed, we collect data and information through an automated system. This data is stored in the server's log files. The data is also stored in the log files of our system. This data is not stored together with other personal data of the user.

The following data may be collected:

(1) Application log: rotated daily and deleted after 14 days. For login and security events (login, logout, failed login attempts, two-factor authentication) it contains the time, IP address, browser identifier and the e-mail address of the account; in the event of errors, technical details about the request. IP addresses are not truncated there.

(2) All requests pass through the CDN (Bunny), which keeps its own technical connection logs

(3) A classic access log with referrer and "subsequent pages" is not kept on our own server

Duration of storage of personal data

Personal data is generally stored for a period of 14 days. After this period, the data is routinely deleted unless a statutory retention obligation exists or longer storage is required for the initiation or performance of a contract.

Ways to contact us

Our websites contain a contact form that can be used to get in touch with us electronically. The contact form does not send e-mails but creates a case in our own ticket system. In the process, the name, e-mail address, subject and content of the message as well as the time of contact, the page accessed, the referring page and the browser identifier are stored. If the data subject is logged in, the case is assigned to the respective user account.

The data is stored and processed exclusively for the purpose of handling the enquiry and contacting the data subject. The data is not passed on to third parties unless there is a legal obligation to do so.

For enquiries from non-profit organisations, it is alternatively possible to get in touch via the e-mail address provided. In this case, the personal data transmitted by the data subject by e-mail is stored and processed for the purpose of handling the enquiry and for further communication.

The legal basis for the processing of data from the contact form and for the processing of data transmitted by e-mail is Art. 6 (1) (f) GDPR. Our overriding legitimate interest lies in handling and responding to contact enquiries. If the contact is aimed at concluding a contract or at pre-contractual measures, Art. 6 (1) (b) GDPR is an additional legal basis for the processing. Where consent is obtained, the processing is based on Art. 6 (1) (a) GDPR.

The data is deleted as soon as it is no longer required to achieve the purpose of the respective processing and no statutory retention obligations stand in the way. This is generally the case when the respective communication with the data subject has ended and the matter in question has been conclusively resolved.

Newsletter

If you subscribe to our company's newsletter, the data from the respective input mask is transmitted to the controller. Registration for our newsletter uses a so-called double opt-in procedure. This means that after registering, you will receive an e-mail asking you to confirm your registration. This confirmation is necessary to prevent anyone from registering with someone else's e-mail address.

When you register for the newsletter, the time of registration and the time of confirmation are stored. No IP address is recorded. Further data processed are the e-mail address, first name, last name and the language setting, which is used to assign you to the German or English newsletter list. Storing the registration and confirmation times serves to prevent misuse of the services or of the data subject's e-mail address.

The data is not passed on to unauthorised third parties. However, data required for the purpose of sending the newsletter may be transmitted to the relevant service providers. A further exception applies where there is a legal obligation to pass on the data. The data is used exclusively for sending the newsletter.

The newsletter subscription can be cancelled at any time. Likewise, consent to the storage of personal data can be revoked at any time. A corresponding link can be found in every newsletter.

The legal basis for the processing of data following registration for the newsletter is, where the user has given consent, Art. 6 (1) (a) GDPR.

E-mail delivery and newsletter (Brevo)

Description and purpose

This website uses Brevo for sending newsletters as well as for e-mail delivery; see also "Ways to contact us". The provider is Brevo SAS, 106 Boulevard Haussmann, 75008 Paris, France. Brevo is a service that can be used to organise and analyse newsletter delivery. The data you enter for the purpose of receiving the newsletter (e.g. e-mail address) is stored on Brevo's servers. In addition, we use Brevo as the delivery relay for all e-mails of the platform — not just the newsletter: registration, password reset, approval notifications, activity summaries, reminders, support tickets. The data transmitted in this context comprises e-mail address, name, e-mail content and delivery metadata.

The return path of the ticket system also runs via Brevo: if a customer replies by e-mail to a ticket message, Brevo receives the e-mail and passes its content and attachments on to our ticket system.

The newsletters we send allow us to analyse the behaviour of newsletter recipients. Among other things, it is possible to analyse how many recipients have opened the newsletter message and how often which link in the newsletter was clicked. All links in the e-mail are so-called tracking links with which your clicks can be counted.

Legal basis

The legal basis for the processing of your personal data is Art. 6 (1) (a) GDPR.

Recipient

The recipient of your personal data is Brevo SAS, 106 Boulevard Haussmann, 75008 Paris, France.

Transfer to third countries

Through the use of this service, personal data may be transferred to a third country. In the event of a transfer of personal data, the provider ensures the level of protection required by the GDPR through compliance with Art. 44 et seq. GDPR. If no adequacy decision exists for the third country in which the data importer is established, the transfer takes place subject to appropriate safeguards. If you have any questions, please feel free to contact our Data Protection Officer.

Duration of data storage

Withdrawal of consent

You have the right to withdraw your consent at any time, cf. Art. 7 (3) sentence 1 GDPR. This can be done informally and without giving reasons, and takes effect for the future. The withdrawal of consent does not affect the lawfulness of the processing carried out on the basis of the consent up to the point of withdrawal.

Contractual and statutory obligation

There is no contractual or statutory obligation to provide the data.

Further privacy information

Further information on the processing of your personal data can be found here:

https://www.brevo.com/de/legal/privacypolicy/

Subscriptions and payment processing

Our website offers the option of taking out paid subscriptions. The contract and payment processing is not handled directly by us but by Lemon Squeezy (Sold through Link, LLC (f/k/a Lemon Squeezy LLC), 222 South Main Street, Suite 500, Salt Lake City, UT 84101, USA) as Merchant of Record. As part of the ordering and payment process, the personal data required for this purpose is processed, in particular for the performance of the contract, payment processing, provision of the booked service and the handling of refunds, complaints or support requests.

Description and purpose

The purpose of using Lemon Squeezy is payment processing, invoicing and subscription management. Lemon Squeezy acts as "Merchant of Record" — this means that Lemon Squeezy concludes the purchase contract for the payment with you and issues you the invoice. Maebe is the content provider of the underlying service. Data transferred: name, e-mail address, billing address, VAT ID (B2B), payment data (card number, IBAN, PayPal identifier — depending on the chosen method), transaction data, order history.

Note on the iOS app: no purchases or subscriptions are concluded in the iOS app. Bookings and payments are made exclusively via our website in the browser.

Legal basis

The legal basis for the processing of your personal data is Art. 6 (1) (b) GDPR.

Recipient

The recipient of your personal data is Sold through Link, LLC (f/k/a Lemon Squeezy LLC), 222 South Main Street, Suite 500, Salt Lake City, UT 84101, USA.

Transfer to third countries

The personal data is transferred to the United States. The transfer takes place subject to appropriate safeguards pursuant to Art. 46 GDPR. To this end, we have concluded standard contractual clauses with the data importer. The service is certified under the EU-US Data Privacy Framework. Furthermore, we are aware of our responsibility and, where necessary, take additional measures to protect the rights and freedoms of natural persons and to ensure the protection of personal data.

Duration of data storage

Contractual and statutory obligation

Insofar as we receive personal data in connection with your subscription, we use it exclusively to provide our services, for customer communication and to manage your user account and your subscription. The verification, collection and processing of payment-related data is generally carried out by Lemon Squeezy or the payment service providers engaged by Lemon Squeezy.

Further privacy information

Further information on the processing of your personal data can be found here: https://www.lemonsqueezy.com/privacy

Registration on our website

If the data subject uses the option of registering on the controller's website by providing personal data, the data from the respective input mask is transmitted to the controller. Registration can alternatively also take place via the sign-in services of Google or Apple. In this case, first name, last name, e-mail address and a user identifier are transmitted. When signing in with Apple, the e-mail address transmitted may be a forwarding address provided by Apple. A profile picture is not imported or stored in this process.

Registered persons optionally have the possibility of two-factor authentication. For members of teams with a connected social media account, two-factor authentication is mandatory. The secret used for this purpose and the associated recovery codes are stored in encrypted form.

As part of the registration, consent to the General Terms and Conditions and, where applicable, to the data processing agreement is also documented. The time of consent, the version of the respective document consented to, the IP address and the browser identifier are stored.

The data is stored exclusively for internal use by the controller. The data is deleted as soon as it is no longer required to achieve the purpose for which it was collected. This serves to prevent misuse of the services. The data is not passed on to third parties. An exception applies where there is a legal obligation to pass on the data. The registration of the data is necessary for the provision of content or services. Registered persons can at any time have the stored data deleted or amended. The data subject can at any time obtain information about their stored personal data.

In the course of the process, we collect the following data:

At registration:

- First name and last name

- E-mail address

- Password (stored encrypted using bcrypt)

- Consent to the General Terms and Conditions

- Optional: consent to receive the newsletter

Added later in the account:

- Optional: profile picture

- Optional: colour scheme

- Optional: two-factor authentication

- Time zone (set per team)

Storage period: for as long as the account exists. After termination, deletion takes place within 30 days, unless statutory retention obligations prevent this (accounting data 10 years pursuant to Section 147 of the German Fiscal Code (AO)).

Collaboration in a team in the course of registration

Maebe enables an account to be used jointly in a team. If you wish to invite another person to your team, they can be invited by e-mail address. The e-mail address entered is stored until the invitation is accepted; if the invited person does not accept the invitation, the e-mail address is deleted again.

Within a team, the name, profile picture and role of each team member are visible to the other members of the same team. In addition, the actions taken by a team member appear with their name and time in the team's activity feed, so that all team members can see who made which change and when.

This serves to enable several people to work together within a shared account and to make changes traceable for all team members. The legal basis for this processing is Art. 6 (1) (b) GDPR. The visibility of name, profile picture and role, as well as the entries in the activity feed, exist for as long as the data subject is a member of the respective team.

Routine erasure and blocking of personal data

The controller processes and stores the personal data of the data subject only for as long as is necessary to achieve the purpose of storage. Storage beyond this may take place where provided for by the European or national legislator in Union regulations, laws or other provisions to which the controller is subject. As soon as the purpose of storage no longer applies or a storage period prescribed by the aforementioned provisions expires, the personal data is routinely blocked or erased.

Overview of storage periods:

Account data: until account deletion + 30 days of backup retention

Uploaded content: until account deletion + 30 days of backup retention

Approval logs (incl. IP address of the approval action): until the post or account is deleted

Invoicing and accounting data: 10 years (Section 147 of the German Fiscal Code (AO))

Server logs: 14 days

Error/diagnostic data (Sentry, incl. session replay): according to Sentry's retention (typically 30–90 days)

Newsletter registration data: until unsubscription

Cookie consents: 12 months

Support communication: 3 years

Push tokens (APNs / FCM / web push): until withdrawal of the push permission, deregistration of the device/browser or uninstallation of the app

Rights of the data subject

If your personal data is processed, you are a data subject within the meaning of the GDPR and you have the following rights vis-à-vis the controller:

Right of access pursuant to Art. 15 GDPR

You may request confirmation from the controller as to whether personal data concerning you is being processed by us. If such processing is taking place, you may request information from the controller about the following:

- the purposes for which the personal data is processed;

- the categories of personal data that are processed;

- the recipients or categories of recipients to whom your personal data has been or will be disclosed;

- the planned duration of storage of your personal data or, if specific information on this is not possible, criteria for determining the storage period;

- the existence of a right to rectification or erasure of your personal data, a right to restriction of processing by the controller, or a right to object to such processing;

- the existence of a right to lodge a complaint with a supervisory authority;

- all available information about the origin of the data, if the personal data was not collected from the data subject;

- the existence of automated decision-making, including profiling, pursuant to Art. 22 (1) and (4) GDPR and — at least in these cases — meaningful information about the logic involved as well as the scope and intended effects of such processing for the data subject.

You have the right to request information as to whether your personal data is transferred to a third country or to an international organisation. In this context, you may request to be informed of the appropriate safeguards pursuant to Art. 46 GDPR in connection with the transfer.

Right to rectification pursuant to Art. 16 GDPR

You have a right to rectification and/or completion vis-à-vis the controller if the personal data processed concerning you is inaccurate or incomplete. The controller must carry out the rectification without undue delay.

Right to erasure pursuant to Art. 17 GDPR

(1) You may request the controller to erase your personal data without undue delay, and the controller is obliged to erase this data without undue delay, if one of the following reasons applies:

- The personal data concerning you is no longer necessary for the purposes for which it was collected or otherwise processed.

- You withdraw your consent on which the processing was based pursuant to Art. 6 (1) (a) or Art. 9 (2) (a) GDPR, and there is no other legal basis for the processing.

- You object to the processing pursuant to Art. 21 (1) GDPR and there are no overriding legitimate grounds for the processing, or you object to the processing pursuant to Art. 21 (2) GDPR.

- The personal data concerning you has been processed unlawfully.

- The erasure of the personal data concerning you is necessary to fulfil a legal obligation under Union law or the law of the Member States to which the controller is subject.

- The personal data concerning you was collected in relation to information society services offered pursuant to Art. 8 (1) GDPR.

(2) If the controller has made your personal data public and is obliged to erase it pursuant to Art. 17 (1) GDPR, the controller shall, taking account of available technology and the cost of implementation, take reasonable steps, including technical measures, to inform controllers processing the personal data that you, as the data subject, have requested them to erase all links to this personal data or copies or replications of this personal data.

(3) The right to erasure does not apply insofar as the processing is necessary

- to exercise the right to freedom of expression and information;

- to fulfil a legal obligation which requires processing under Union or Member State law to which the controller is subject, or to perform a task carried out in the public interest or in the exercise of official authority vested in the controller;

- for reasons of public interest in the area of public health pursuant to Art. 9 (2) (h) and (i) and Art. 9 (3) GDPR;

- for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes pursuant to Art. 89 (1) GDPR, insofar as the right referred to in paragraph 1 is likely to render impossible or seriously impair the achievement of the objectives of that processing, or

- for the establishment, exercise or defence of legal claims.

Right to restriction of processing pursuant to Art. 18 GDPR

You may request the restriction of the processing of your personal data under the following conditions:

- if you contest the accuracy of your personal data for a period enabling the controller to verify the accuracy of the personal data;

- the processing is unlawful and you refuse the erasure of the personal data and instead request the restriction of the use of the personal data;

- the controller no longer needs the personal data for the purposes of the processing, but you require it for the establishment, exercise or defence of legal claims, or

- if you have objected to the processing pursuant to Art. 21 (1) GDPR and it has not yet been determined whether the legitimate grounds of the controller override your grounds.

Where the processing of your personal data has been restricted, this data may — apart from being stored — only be processed with your consent or for the establishment, exercise or defence of legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest of the Union or of a Member State. Where the restriction of processing has been imposed in accordance with the above conditions, you will be informed by the controller before the restriction is lifted.

Right to notification pursuant to Art. 19 GDPR

If you have asserted the right to rectification, erasure or restriction of processing vis-à-vis the controller, the controller is obliged to communicate this rectification or erasure of the data or restriction of processing to all recipients to whom the personal data concerning you has been disclosed, unless this proves impossible or involves disproportionate effort. You have the right vis-à-vis the controller to be informed about these recipients.

Right to data portability pursuant to Art. 20 GDPR

You have the right to receive the personal data concerning you that you have provided to the controller in a structured, commonly used and machine-readable format. You also have the right to transmit this data to another controller without hindrance from the controller to whom the personal data was provided, provided that

- the processing is based on consent pursuant to Art. 6 (1) (a) GDPR or Art. 9 (2) (a) GDPR or on a contract pursuant to Art. 6 (1) (b) GDPR, and

- the processing is carried out by automated means. In exercising this right, you also have the right to have your personal data transmitted directly from one controller to another controller, where technically feasible. The freedoms and rights of other persons must not be adversely affected by this. The right to data portability does not apply to processing of personal data necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.

Right to object pursuant to Art. 21 GDPR

You have the right to object at any time, on grounds relating to your particular situation, to the processing of your personal data carried out on the basis of Art. 6 (1) (e) or (f) GDPR; this also applies to profiling based on these provisions. The controller will no longer process your personal data unless it can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims. If your personal data is processed for direct marketing purposes, you have the right to object at any time to the processing of your personal data for the purpose of such marketing; this also applies to profiling insofar as it is associated with such direct marketing. If you object to processing for direct marketing purposes, your personal data will no longer be processed for these purposes. In connection with the use of information society services — notwithstanding Directive 2002/58/EC — you may exercise your right to object by automated means using technical specifications.

Right to withdraw consent under data protection law pursuant to Art. 7 (3) GDPR

You have the right to withdraw your declaration of consent under data protection law at any time. The withdrawal of consent does not affect the lawfulness of the processing carried out on the basis of the consent up to the point of withdrawal.

Right to lodge a complaint with a supervisory authority pursuant to Art. 77 GDPR

Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work or place of the alleged infringement, if you consider that the processing of your personal data infringes the GDPR. The supervisory authority with which the complaint has been lodged shall inform the complainant of the status and outcome of the complaint, including the possibility of a judicial remedy pursuant to Art. 78 GDPR.

Competent supervisory authority:

Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen

Kavalleriestraße 2-4

40213 Düsseldorf

E-mail: poststelle@ldi.nrw.de

Automated individual decision-making, including profiling

You have the right not to be subject to a decision based solely on automated processing — including profiling — which produces legal effects concerning you or similarly significantly affects you. This does not apply if the decision

- is necessary for entering into, or performance of, a contract between you and the controller,

- is authorised by Union or Member State law to which the controller is subject and which lays down suitable measures to safeguard your rights and freedoms and legitimate interests, or

- is based on your explicit consent.

However, these decisions must not be based on special categories of personal data pursuant to Art. 9 (1) GDPR, unless Art. 9 (2) (a) or (g) applies and suitable measures to safeguard your rights and freedoms and legitimate interests have been taken.

With regard to the cases referred to in a. and c., the controller shall take suitable measures to safeguard your rights and freedoms and legitimate interests, including at least the right to obtain human intervention on the part of the controller, to express your own point of view and to contest the decision.

Integration of other third-party services and content

Description and purpose

Within this online offering, third-party content such as videos, fonts or graphics from other websites may be embedded. This always requires that the providers of this content (hereinafter referred to as "third-party providers") perceive the IP address of the users. Without the IP address, they could not send the content to the browser of the respective user. The IP address is therefore required for the display of this content. We endeavour to use only content whose respective providers use the IP address solely for the delivery of the content. However, we have no influence on whether the third-party providers store the IP address, e.g. for statistical purposes. Insofar as this is known to us, we inform users about it. Through these integrations, we aim to provide and improve our online offering.

Specifically, we embed the following third-party content:

In the Visuals editor, which is available exclusively to logged-in users, fonts from the provider Bunny Fonts are embedded. The provider is based in the European Union. When the Visuals editor is accessed, a connection to the Bunny Fonts servers is established, whereby the IP address of the accessing person may be transmitted to Bunny Fonts.

Video embeds, Google Fonts, reCAPTCHA, map services or third-party script CDNs are not used. Fonts and scripts that are not obtained via Bunny Fonts are hosted exclusively on our own servers.

Legal bases

The legal basis for the integration of other third-party services and content is Art. 6 (1) (f) GDPR. Our overriding legitimate interest lies in the appropriate presentation of our online presence and in user-friendly and economically efficient services on our part. For further information, please refer to the respective privacy notices of the providers.

Contractual or statutory obligation to provide personal data

The provision of the personal data is neither legally nor contractually required, nor is it necessary for the conclusion of a contract. You are also not obliged to provide the personal data. However, failure to provide it may mean that you cannot use this function, or cannot use it to its full extent.

Google Analytics

Description and purpose

This website uses the "Google Analytics 4" service (property G-KQZQ3XBMWN), which is offered by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, to analyse how users use the website. Google Analytics 4 does not process users' IP addresses.

Google Analytics is embedded exclusively on the home page, the FAQ page, the contact page, the legal texts and the use-case pages. It is not embedded in the logged-in area, on approval or link-in-bio pages, in the help centre or in the apps.

The script is only loaded after consent has been given via our consent management tool Cookiebot. In addition, Google Consent Mode v2 is preconfigured so that all storage types are rejected by default and are only activated after the corresponding consent has been given.

Under the data processing agreement we have concluded with Google Ireland Limited, Google uses the information collected to evaluate website usage and website activity and to provide services related to internet use.

Legal basis

The legal basis for the processing of your personal data is Art. 6 (1) (a) GDPR.

Recipient

The recipient of your personal data is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

Transfer to third countries

The personal data may be transferred to the United States. The transfer takes place subject to appropriate safeguards pursuant to Art. 46 GDPR. The information collected by Google Analytics is processed on Google servers, and a transfer to the USA may also take place. Google Ireland Limited is certified under the EU-U.S. Data Privacy Framework, so that an adequacy decision of the European Commission exists for transfers to the USA.

Duration of data storage

The data is deleted as soon as it is no longer required to achieve the purpose for which it was collected. In addition, the data is deleted if you assert your right to erasure pursuant to Art. 17 (1) GDPR. The maximum storage period is 14 months.

Withdrawal of consent

Contractual and statutory obligation

There is no contractual or statutory obligation to provide the data.

Further privacy information

Further information on the processing of your personal data can be found here: https://support.google.com/analytics/answer/6004245?hl=de https://policies.google.com/privacy?hl=de&gl=de.

Sentry

Description and purpose

We use the Sentry service provided by Functional Software Inc., 45 Fremont Street, 8th Floor, San Francisco, CA 94105, USA. Sentry is an application monitoring and error tracking service. When errors occur, the IP address, usage data and device information of the respective users are recorded. This enables us to fix errors as quickly as possible.

In the event of an error, Sentry additionally records the session history for logged-in users (session replay) to facilitate error analysis. Texts, inputs and media are masked by default. For visitors without a login and on all approval pages, the session replay function is deactivated. As a user identifier, we transmit exclusively the user ID, the team ID and the role of the respective user; name and e-mail address are not transmitted.

Legal basis

The legal basis for the processing of your personal data is Art. 6 (1) (f) GDPR. Our overriding legitimate interest lies in providing a functioning website and in the ability to quickly diagnose and fix errors. This is also intended to improve the performance and user-friendliness of the website.

Recipient

The recipient of your personal data is Functional Software, Inc., 45 Fremont Street, 8th Floor, San Francisco, CA 94105.

Transfer to third countries

The personal data may be transferred to the USA. The transfer takes place subject to appropriate safeguards pursuant to Art. 46 GDPR. To this end, we have concluded officially approved contractual clauses with the data importer pursuant to Art. 46 (2) (c), such as the standard contractual clauses approved by the European Commission. Furthermore, we are aware of our responsibility and, where necessary, take additional measures to protect the rights and freedoms of natural persons and to ensure the protection of personal data.

Data processing takes place in Sentry's EU region, meaning that the data is stored and processed in a data centre in Frankfurt am Main. Although the contractual partner is Functional Software Inc., based in the USA, a transfer of the data to the USA generally does not take place due to storage in the EU region. Functional Software Inc. is also certified under the EU-U.S. Data Privacy Framework, so that an adequacy decision of the European Commission exists even in the event of exceptional access from the USA.

Duration of data storage

Objection

Pursuant to Art. 21 (1) GDPR, you have the right to object at any time to the processing of your personal data. If you exercise this right, processing for this purpose will no longer take place. Further information on this can be found above in this privacy policy under "Rights of the data subject".

Contractual and statutory obligation

There is no contractual or statutory obligation to provide the data.

Further privacy information

Further information on the processing of your personal data can be found here: https://sentry.io/privacy/

Hetzner Online

Description and purpose

We use the services of Hetzner Online GmbH, Industriestraße 25, 91710 Gunzenhausen, Germany, for hosting and providing our website. Hetzner operates our application servers, including a dedicated server for video processing, the database and the object storage for all media files. Backups are also kept there. Ongoing operations take place at the Nuremberg location; backups are stored at the Falkenstein location. Both locations are in Germany.

As part of this processing, technical connection data such as IP addresses and server log files arise, as well as all other data generated in the course of using our website and our services, including the media files uploaded by users. Hetzner exclusively provides the technical infrastructure on which our website and our services are operated.

Legal basis

For data arising in the course of the actual performance of the contract — that is, data that users actively upload or generate (media files, database content from the use of the platform) — Art. 6 (1) (b) GDPR is the relevant legal basis. The legal basis for the processing of your personal data is also Art. 6 (1) (f) GDPR. Our overriding legitimate interest lies in providing a functioning website and in the ability to quickly diagnose and fix errors. This is also intended to improve the performance and user-friendliness of the website.

Recipient

The recipient of the data is Hetzner Online GmbH, Industriestraße 25, 91710 Gunzenhausen, Germany, which acts for us as a processor pursuant to Art. 28 GDPR.

Transfer to third countries

Personal data is generally processed within the European Union. If, in individual cases, a transfer to third countries takes place, it is carried out exclusively in compliance with Art. 44 et seq. GDPR and using appropriate safeguards to protect personal data.

Duration of data storage

Objection

Contractual and statutory obligation

There is no contractual or statutory obligation to provide the data.

Further privacy information

Further information on the processing of your personal data can be found here: https://www.hetzner.com/legal/privacy-policy/

Bunny CDN and Bunny Stream

Description and purpose

We use the services Bunny CDN, Bunny Stream and Bunny DNS provided by BunnyWay d.o.o., Dunajska cesta 165, 1000 Ljubljana, Slovenia.

The entire website and application is delivered via the Bunny CDN. Every request, including visits to approval and link-in-bio pages, is received by a Bunny server and forwarded to our Hetzner server. In doing so, Bunny processes the IP address, the browser identifier, the address accessed and the time of the respective request. A web application firewall with integrated bot protection (Bunny Shield) is placed in front, protecting our website against attacks and automated abuse.

Bunny Stream is used to provide and deliver video and media content. From uploaded videos, Bunny Stream additionally creates streaming versions for preview display with a resolution of up to 720p. These preview copies are stored permanently at the Frankfurt am Main server location and are automatically deleted when the underlying video is deleted.

The name servers of our domain are operated via Bunny DNS.

Through the use of these services, content and videos can be delivered with high performance and low loading times. In particular, IP addresses, browser information, device information, access times and other technical connection data may be processed.

Legal basis

Recipient

The recipient of the data is BunnyWay d.o.o., Dunajska cesta 165, 1000 Ljubljana, Slovenia. The processing takes place within the framework of a data processing agreement pursuant to Art. 28 GDPR.

Transfer to third countries

As Bunny has server locations distributed worldwide, visitors from the European Union are served via server locations within the EU. Personal data is therefore generally processed within the European Union. If, in individual cases, a transfer to third countries takes place, it is carried out exclusively in compliance with Art. 44 et seq. GDPR and using appropriate safeguards to protect personal data.

Duration of data storage

Objection

Contractual and statutory obligation

There is no contractual or statutory obligation to provide the data.

Further privacy information

Further information on the processing of your personal data can be found here: https://bunny.net/privacy/

Ploi

Description and purpose

We use the Ploi service provided by Ploi B.V., Amperestraat 16J, 3861NC Nijkerk, Netherlands, to manage, configure and monitor our server infrastructure. Ploi is a server management platform that facilitates the administration, provisioning, maintenance and securing of our hosting environment. Ploi has administrative access to our servers for this purpose, but does not process any visitor or user data of our website in ongoing operations. As part of server management, technical system and configuration information of our servers may be processed where required for the administration, maintenance and securing of the hosting environment.

Legal basis

Recipient

The recipient of the data is Ploi B.V., Amperestraat 16J, 3861NC Nijkerk, Netherlands.

Transfer to third countries

Duration of data storage

Objection

Contractual and statutory obligation

There is no contractual or statutory obligation to provide the data.

Further privacy information

Further information on the processing of your personal data can be found here: https://ploi.io/privacy-policy

Mistral AI

Description and purpose

We use the services of Mistral AI SAS, 15 rue des Halles, 75001 Paris, France, to provide AI-powered functions on our website and in our services. In each case, only the scope of data required for the specific function used is transmitted to Mistral AI. The following functions are used and data transmitted:

- Text suggestions: caption texts, the team context stored by the customer, as well as stored writing samples and style personas.

- Campaign assistant: the respective briefing and the associated project context.

- Content suggestions: images from the customer's media pools, which are reduced to 512 pixels before transmission, for the automated creation of image descriptions. If people are depicted in the images, they are transmitted as well and may be processed by Mistral AI as part of the image analysis.

- Insights: metrics on the customer's own posts as well as publicly accessible post texts of monitored competitors.

- Support chatbot: the respective message history, including from visitors without a customer account, as well as the page accessed at the time of the enquiry. Account data is not transmitted in this context.

- AI assistant in the team (beta): the conversation history, the team name, the first name of the respective user and notes stored by the team.

- Translation of texts: the text to be translated.

In the course of using these functions, technical usage data and IP addresses may also be processed where necessary for the provision of the services.

Input and output data is stored by Mistral AI for a period of up to 30 days for abuse monitoring and is deleted thereafter. The data entered is not used to train Mistral AI's AI models.

Where our support chatbot is used, it is made clear to users that it is an AI system.

Legal basis

The processing is based on Art. 6 (1) (b) GDPR insofar as the respective AI function is part of the service booked by the customer. The legal basis for the processing of your personal data may also be Art. 6 (1) (f) GDPR. Our overriding legitimate interest lies in answering users' questions.

Recipient

The recipient of your personal data is Mistral AI SAS, 15 rue des Halles, 75001 Paris, France.

Transfer to third countries

Duration of data storage

Objection

Contractual and statutory obligation

There is no contractual or statutory obligation to provide the data.

Further privacy information

Further information on the processing of your personal data can be found here: https://legal.mistral.ai/terms/privacy-policy.

Postproxy

Description and purpose

We use the Postproxy service provided by 64Bit Labs UG (haftungsbeschränkt), Kolonnenstr. 8, 10827 Berlin, Germany. Postproxy enables the centralised publishing and management of content on various social media platforms. In this context, the data required for publishing and managing posts is processed, in particular account and profile data of the connected social media accounts, authentication information, publishing content and technical usage and connection data. The service enables the efficient management and automated publication of content on different social networks.

Legal basis

The legal basis for the processing of your personal data is Art. 6 (1) (b) GDPR.

Recipient

The recipient of your personal data is 64Bit Labs UG, Kolonnenstr. 8, 10827 Berlin, Germany.

Transfer to third countries

Duration of data storage

Contractual and statutory obligation

There is no contractual or statutory obligation to provide the data.

Further privacy information

Further information on the processing of your personal data can be found here: https://www.postproxy.dev/privacy-policy/

Apify

Description and purpose

We use the Apify service provided by Apify Technologies s.r.o., Vodičkova 704/36, 110 00 Prague 1, Czech Republic. Apify is used as part of the "Radar" function (available from the Pro plan), with which our customers can monitor publicly accessible profiles of competitors on Instagram and TikTok. This does not concern the data of our own users, but the publicly accessible profile data of the competitor accounts entered by our customers. These accounts may be both company and private profiles.

Only publicly visible information is collected: profile name, display name, follower count, post texts, time of publication, the link to the respective post and metrics with a daily history. Images of the monitored posts are not stored; instead, only a blurred colour gradient is displayed as a placeholder. The collected post data is automatically deleted after 180 days.

Legal basis

The legal basis for the processing of your personal data is Art. 6 (1) (f) GDPR. Our overriding legitimate interest lies in enabling market observation for our customers based exclusively on publicly accessible information.

Recipient

The recipient of your personal data is Apify Technologies s.r.o., Vodičkova 704/36, 110 00 Prague 1, Czech Republic.

Transfer to third countries

Duration of data storage

Objection

Contractual and statutory obligation

There is no contractual or statutory obligation to provide the data.

Further privacy information

Further information on the processing of your personal data can be found here: https://docs.apify.com/legal/privacy-policy

Permissions of the mobile apps

Our services are also available to you via native apps for iOS and Android. Below we inform you about which permissions these apps request on your device. Our iOS app requests access to the photo library, the camera and the microphone only when you wish to use a function that requires the respective access (e.g. when uploading a photo or recording a video). Without your express permission via your operating system's permission prompt, the app does not gain access to these functions of your device. Our Android app requires only an internet connection and the permission to display notifications for its operation.

Biometric login (e.g. Face ID or fingerprint) is not used by us. Likewise, no third-party analytics SDKs are used in our apps.

This serves to provide the respective app functions that require access to device functions (e.g. photo or video recording, media selection).

The legal basis for these processing operations is Art. 6 (1) (a) GDPR. Your consent via the respective permission prompt of your operating system is therefore required, unless the function is in any case necessary for the performance of the contract pursuant to Art. 6 (1) (b) GDPR.

The permission prompt itself is not separately stored by Maebe. What is decisive is the permission, which you can change at any time in your device settings.

Apple Push Notification Service (APNs)

Description and purpose

To provide push notifications in our iOS app, we use the Apple Push Notification Service (APNs) provided by Apple Inc., One Apple Park Way, Cupertino, CA 95014, USA. If you allow the receipt of push notifications on your device, Apple generates a device-specific push token that enables the delivery of notifications to your app on your device. In the course of use, in particular the push token, technical device information and connection data may be processed. The processing takes place exclusively for the purpose of delivering push notifications and app-related information.

Legal basis

The legal basis for the processing of your personal data is Art. 6 (1) (a) GDPR.

Recipient

The recipient of your personal data is Apple Inc., One Apple Park Way, Cupertino, CA 95014, USA.

Transfer to third countries

The personal data is transferred to the USA. The transfer takes place subject to appropriate safeguards pursuant to Art. 46 GDPR. To this end, we have concluded officially approved contractual clauses with the data importer pursuant to Art. 46 (2) (c), such as the standard contractual clauses approved by the European Commission. Furthermore, we are aware of our responsibility and, where necessary, take additional measures to protect the rights and freedoms of natural persons and to ensure the protection of personal data

Duration of data storage

Withdrawal of consent

Contractual and statutory obligation

There is no contractual or statutory obligation to provide the data.

Further privacy information

Further information on the processing of your personal data can be found here: https://www.apple.com/legal/privacy/

Firebase Cloud Messaging (FCM)

Description and purpose

To provide push notifications in our Android app, we use Firebase Cloud Messaging (FCM), a service of Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. FCM enables the delivery of push notifications to Android devices. A device-specific registration token (FCM token) is generated and processed so that notifications can be assigned and delivered to the respective device. In the course of use, technical device and connection data may also be processed, in particular IP address, device information and times of message transmission.

Legal basis

The legal basis for the processing of your personal data is Art. 6 (1) (a) GDPR.

Recipient

The recipient of your personal data is Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA.

Transfer to third countries

The personal data is transferred to the USA. The transfer takes place subject to appropriate safeguards pursuant to Art. 46 GDPR. To this end, we have concluded officially approved contractual clauses with the data importer pursuant to Art. 46 (2) (c), such as the standard contractual clauses approved by the European Commission. Furthermore, the service is certified under the EU-US Data Privacy Framework. In addition, we are aware of our responsibility and, where necessary, take additional measures to protect the rights and freedoms of natural persons and to ensure the protection of personal data.

Duration of data storage

Withdrawal of consent

Contractual and statutory obligation

There is no contractual or statutory obligation to provide the data.

Further privacy information

Further information on the processing of your personal data can be found here: https://policies.google.com/privacy

Data transfers to third countries

The controller may transfer personal data to a third country. In principle, the controller can ensure an adequate level of protection for the processing operations through various appropriate safeguards. Data transfers may be carried out on the basis of an adequacy decision, binding corporate rules, approved codes of conduct, standard data protection clauses or an approved certification mechanism pursuant to Art. 46 (2) (a)–(f) GDPR.

Specifically, we transfer personal data to the following recipients established in, or processing data in, a third country:

- Lemon Squeezy (payment processing)

- Google LLC / Google Ireland Limited (in the context of Google Analytics, registration via Google sign-in services and Firebase Cloud Messaging)

- Apple Inc. (in the context of registration via Apple sign-in services and the Apple Push Notification Service)

- where applicable, Apify Technologies s.r.o. (in the context of the competitor monitoring function "Radar")

- where applicable, the respective push notification services of the manufacturer of your browser, if you activate web push notifications

For these transfers, we rely, where applicable, on adequacy decisions of the European Commission (in particular under the EU-U.S. Data Privacy Framework), on standard data protection clauses pursuant to Art. 46 (2) (c) GDPR, or on another appropriate safeguard within the meaning of Art. 46 GDPR. We do not carry out transfers on the basis of Art. 49 (1) (a) GDPR (explicit consent for the individual case). All other service providers we use process personal data exclusively within the European Union.

If the controller carries out a transfer to a third country on the legal basis of Art. 49 (1) (a) GDPR, you will be informed at this point about the possible risks of a data transfer to a third country.

There is a risk that the third country receiving your personal data may not offer a level of protection equivalent to the protection of personal data in the European Union. This may be the case, for example, if the EU Commission has not issued an adequacy decision for the respective third country, or if certain agreements between the European Union and the respective third country are declared invalid. Specifically, in some third countries there are risks regarding the effective protection of EU fundamental rights due to the use of surveillance laws (for example the USA). In such a case, it is the responsibility of the controller and the recipient to assess whether the rights of the data subjects in the third country enjoy a level of protection equivalent to that in the Union and whether they can also be effectively enforced.

However, under the General Data Protection Regulation, the level of protection guaranteed throughout the Union for natural persons should not be undermined when personal data is transferred from the Union to controllers, processors or other recipients in third countries or to international organisations, including in cases of onward transfers of personal data from a third country or an international organisation to controllers or processors in the same or another third country or to the same or another international organisation.

Further functions of the website

Maebe

Description and purpose

As part of our "maebe" service, we use technically necessary session and security cookies. These cookies serve in particular to maintain user sessions, authenticate users, ensure the security of our systems and protect against misuse and unauthorised access. As a rule, the cookies do not contain directly personal content, but may contain identifiers or information that enable an assignment to an active session.

Legal basis

The processing is based on Art. 6 (1) (b) GDPR (provision of the service) and Art. 6 (1) (f) GDPR (legitimate interest in the secure and functional operation of the website). The setting of technically strictly necessary cookies is permitted without consent pursuant to Section 25 (2) no. 2 of the German TDDDG.

Recipient

The data is not passed on to third parties. The processing is carried out exclusively by us as the controller.

Transfer to third countries

No transfer of personal data to third countries takes place.

Duration of data storage:

Session cookies are deleted at the latest when you end your browser session. Security-related information is stored only for as long as is necessary to ensure system security and to achieve the purpose of the processing.

Objection

The cookies used are necessary for the operation and security of our website. Objecting to this processing may therefore mean that individual functions of the website cannot be used, or can only be used to a limited extent.

Contractual and statutory obligation

There is no statutory or contractual obligation to provide the data. However, without the processing of the technically necessary cookies, essential functions of our website cannot be provided.

Further privacy information

Further information on the processing of your personal data can be found in the general provisions of this privacy policy.

Uploaded content (media and posts)

When you upload images, videos, texts (captions) and other media via Maebe, they are stored on our servers and in our object storage. This content may contain personal data (e.g. persons depicted).

The original files are stored with our hosting provider Hetzner at the Nuremberg location. The content is delivered via our content delivery provider Bunny. Preview copies of uploaded videos are additionally stored with Bunny Stream at the Frankfurt am Main location.

Original files are stored unchanged, exactly as you upload them, including any metadata they contain, such as the time of capture and, where applicable, GPS coordinates of the capture location. Automatically generated previews do not contain this metadata. If you do not want location data to be stored with your media content, we recommend removing such metadata from the file before uploading.

Purpose of processing: provision of the platform functions (storage, editing, approval, publishing to social media platforms, download).

Legal basis: Art. 6 (1) (b) GDPR.

Important notes on uploaded content: As a user, you are responsible for holding the necessary rights (e.g. copyrights, personality rights of persons depicted) to the uploaded content. You are responsible for obtaining any required consents from persons depicted (Art. 6 (1) (a) GDPR or Section 22 of the German Art Copyright Act (KUG). For B2B customers processing third-party data, the separately concluded data processing agreement (DPA) applies.

Storage period: for as long as you keep the content in your account or for as long as your account exists. After termination, retention as a backup for 30 days, followed by deletion.

Approval links for external persons

Maebe enables you to generate approval links that give external persons (e.g. artists, clients, approvers) access to specific content. The mere opening of an approval link is not logged. There is no visit statistic, no cookie banner integration, no analysis by third-party services and no session replay; only a technically necessary session cookie is set.

If you share such a link and the external person carries out an approval or rejection action, the following data of the external person is processed:

- IP address (at the time of an approval action, as part of the approval log)

- Browser identifier (at the time of an approval action, as part of the approval log)

- Time of access or of the action

- PIN entered (for authentication; stored as a hash, and for named approvers additionally stored encrypted so that team administrators can view the PIN and share it again)

- Actions taken by the external user (selection, order, caption adjustments, comments, approval confirmation, and rejection reasons entered in the comment field)

- Optional: name (or alternatively "Guest") and role of the external approver, if provided by the main user when creating the access

External approvers are created by the account holder with a name and a PIN. No e-mail address is stored for external approvers; they receive neither e-mails nor push notifications from us. The name (or alternatively the designation "Guest"), the actions taken and comments by external persons appear in the activity feed of the respective team.

Failed PIN entry attempts are counted per approval link, not per IP address. After several failed attempts, the affected link is temporarily blocked.

For approvals via the media pool, where an assessment is made using a traffic-light system and comments, no data whatsoever is stored about the external person carrying out the assessment; in particular, no name, no IP address and no other identifier.

Purpose and necessity of IP storage: In the event of an approval or rejection action, we log the IP address and the browser identifier together with the timestamp and PIN verification in order to be able to prove the approval in a reliable and audit-proof manner (evidence of who approved which content and when). Without this evidence, the approval would lose its evidential value.

Legal basis: Art. 6 (1) (f) GDPR. The overriding legitimate interest lies in the functioning of the platform and in the verifiability of granted approvals.

Storage period: until the post or account is deleted by the main user.

Link in bio function

Maebe enables you to create a publicly accessible page at maebe.app/hub/… on which you can bundle several links to your own content or profiles (a so-called "link in bio" page).

When this page is accessed and when one of the links stored there is clicked, we record a simple counter in each case. No IP addresses are stored in the process, and no third-party analytics or tracking services are used. This serves to provide an overview statistic of visits and clicks for the operator of the respective link-in-bio page.

As no personal data of the accessing person is processed in this context (no IP address, no identifier), it is already questionable whether personal data within the meaning of the GDPR is affected at all; nevertheless, we provide information about how this function works at this point for reasons of transparency.

As the counters are not personal data, there is no storage period relevant to erasure for personal data.

Direct publishing to social media platforms

Maebe currently enables the direct publishing of approved posts to third-party platforms (Instagram, TikTok, YouTube, LinkedIn and XING). Publishing takes place via our technical aggregator. Further platforms may be added over time.

Purpose of processing: transfer of approved media, captions and publishing metadata to the selected third-party platform; receipt of status webhooks (successfully published, failed, etc.).

Legal basis: Art. 6 (1) (b) GDPR (performance of the contract).

Important: As soon as a post has been transferred to a social media platform, the respective privacy policies of the target platform additionally apply. Maebe has no influence on the further processing by the target platform.

Calendar subscriptions

Maebe enables you to generate a secret, personalised calendar link that you can subscribe to in your calendar application (e.g. Apple Calendar, Google Calendar or Outlook). Via this link, the title of the respective entry, the platform concerned and an excerpt of the associated caption of up to 800 characters are transmitted to your calendar application.

The legal basis for the processing of the personal data is Art. 6 (1) (b) GDPR.

Push notifications

If you activate push notifications, we send you notifications about approval requests, comments and status changes. We distinguish between three channels:

- iOS app: we process your APNs device token (Apple Push Notification service).

- Android app: we process your FCM token (see the section on Firebase Cloud Messaging (FCM)).

- Browser (web push): we process the push subscription provided by your browser (endpoint URL of your browser manufacturer's push service and cryptographic keys). Delivery takes place via the web push protocol (VAPID); the actual delivery is handled by the push service of the respective browser manufacturer.

Purpose of processing: sending push notifications.

Legal basis: Art. 6 (1) (a) GDPR (consent via the operating system or the browser).

Storage period: until withdrawal of the push permission, deregistration of the device/browser or uninstallation of the app.

Referral links

Maebe offers you the option of drawing other people's attention to our service via a personal referral link. If a person opens this link, we set a cookie with a storage period of 30 days in order to be able to attribute that person's later registration to your referral.

If the referred person registers within this period, their e-mail address is stored with the account of the referring person so that the referral can be traced and any reward or benefit can be attributed.

This processing serves to attribute new registrations to a referral that has taken place, as well as to enable referral-based benefits within our referral programme.

The legal basis for this processing is Art. 6 (1) (f) GDPR. The controller's overriding legitimate interest lies in operating our referral programme and in its traceability.

The attribution cookie is automatically deleted after 30 days. The e-mail address of the referred person remains stored with the account of the referring person.

Video processing (self-operated)

Uploaded videos are converted into platform-specific formats, resolutions and aspect ratios (e.g. 9:16 for reels, 1:1 for feed posts). This processing takes place entirely on our own server infrastructure (see the section on Hetzner) — without the involvement of external encoding service providers. For preview display in the browser, a streaming version of the video is additionally created and stored with Bunny Stream (see the section on Bunny CDN and Bunny Stream).

Support chat and ticket system (self-operated)

For support requests, we operate our own chat and ticket service (chat icon at the bottom right in the application and on the website) directly on our own server infrastructure — no external chat provider is used. The functions are described below:

Data processed: chat and ticket content; for guests, the voluntarily provided e-mail address and, where applicable, the name; for logged-in users, uploaded file attachments; the page accessed (URL), the referring page (referrer), browser information and timestamps of the messages. For guests, if contact by e-mail is requested, the time and wording of the consent given for this purpose are also stored. IP addresses are not stored in the ticket system.

Uploaded file attachments are stored in our object storage at Hetzner (see the section on Hetzner). The chatbot used for automatic replies does not read or process these attachments.

Data location: Germany/EU (own servers, see the section on Hetzner).

AI replies: for the automatic answering of chat enquiries, chat content is transmitted to Mistral AI (see the section on Mistral AI).

E-mail notifications about support tickets are sent via Brevo; incoming e-mail replies to ticket messages are also received via Brevo (see the section on e-mail delivery and newsletter)

Cookies: the support chat does not set any third-party tracking cookies and does not require consent via the cookie banner.

Legal basis: Art. 6 (1) (b) GDPR (performance of the contract or implementation of pre-contractual measures) and Art. 6 (1) (f) GDPR (legitimate interest in efficient support).

Storage period: 3 years after the conclusion of the respective case.

MCP interface for external AI applications

Description and purpose

From the Pro plan onwards, you can connect an AI application of your choice (e.g. Claude, ChatGPT or another application that supports the Model Context Protocol) to your Maebe account via OAuth. Within the scope of the permissions you grant, the connected AI application can read your posts, projects, media pools (including reduced image previews), insights and notes stored by the team, and can create or modify drafts.

You choose the AI application you connect your account to at your own responsibility. The data transferred in the course of use is transmitted to the provider of the AI application you have chosen. This transfer may also take place to a third country. We have no influence on the further processing by the provider you have chosen; the provider's own privacy policies apply in this respect, and we recommend reviewing them before connecting.

Legal basis

The legal basis for the processing of your personal data is Art. 6 (1) (a) GDPR.

Transfer to third countries

As you choose the provider of the AI application yourself, we cannot make any general statement about the respective destination country and the safeguards existing there. Please inform yourself about the registered office and the data protection practices of the respective provider before connecting.

Duration of data storage

The log data is deleted after 90 days. Issued access tokens are valid for 30 days and can be revoked by you at any time with immediate effect.

Withdrawal of consent

Contractual and statutory obligation

There is no contractual or statutory obligation to provide the data.

Data recipients

Where legally permitted or required, or where you have given your consent, we also share your personal data with other recipients who provide services for us. We limit the disclosure of your personal data to what is necessary. In some cases, our service providers receive your personal data as processors and are then strictly bound by our instructions when handling your personal data (data processing agreement pursuant to Art. 28 GDPR). In some cases, the recipients act independently with your data, which we transmit to them. The following categories of service providers/recipients may receive your data:

- Providers of e-mail marketing via newsletter

- Providers of hosting services for the operation of our servers

- Service providers for development work, including programming, development, maintenance and support of software applications

- External legal advisors

- Marketing agencies / website support

- Other IT service providers (e.g. system houses)

- Other services and tools

The service providers we engage must meet strict confidentiality requirements. They are only granted the access to your data required to fulfil the tasks assigned to them.

In the event of a suspected criminal offence, data may be passed on to law enforcement authorities.

Security

We have taken extensive technical and operational precautions to protect your data against accidental or intentional manipulation, loss, destruction and access by unauthorised persons. Our security procedures are reviewed regularly and adapted to technological progress. In addition, data protection is continuously ensured through ongoing auditing and optimisation of our data protection organisation.

Final provisions

We reserve all rights to make changes and updates to this privacy policy. This privacy policy was prepared by Keyed GmbH.

Version: September 2026 — the current version of this privacy policy is available at any time at https://maebe.app/legal/datenschutz