Privacy Notice
1. Privacy at a Glance
General Information
The following notices provide a simple overview of what happens to your personal data when you visit this website. Personal data is any data that can be used to personally identify you. For detailed information about data protection, please refer to our privacy notice below.
Data Collection on this Website
Who is responsible for data collection on this website?
Data processing on this website is carried out by the website operator. You can find their contact details in the section 'Information about the Responsible Party' in this privacy notice.
How do we collect your data?
Some data is collected when you provide it to us. This could be data that you enter in a contact form, for example.
Other data is collected automatically or with your consent when you visit the website by our IT systems. This is primarily technical data (e.g., internet browser, operating system, or time of page access). This data is collected automatically as soon as you enter this website.
What do we use your data for?
Some of the data is collected to ensure error-free provision of the website. Other data may be used to analyze your user behavior. If contracts can be concluded or initiated via the website, the transmitted data is also processed for contract offers, orders, or other order requests.
What rights do you have regarding your data?
You have the right to receive information about the origin, recipient, and purpose of your stored personal data free of charge at any time. You also have the right to request the correction or deletion of this data. If you have given consent to data processing, you can revoke this consent at any time for the future. You also have the right to request restriction of the processing of your personal data under certain circumstances. Furthermore, you have the right to lodge a complaint with the competent supervisory authority. You can contact us at any time regarding this and other questions about data protection.
2. Hosting
External Hosting
This website is hosted externally. The personal data collected on this website is stored on the host's servers. This may include IP addresses, contact requests, meta and communication data, contract data, contact details, names, website accesses, and other data generated via a website.
External hosting is carried out for the purpose of fulfilling contracts with our potential and existing customers (Art. 6 (1) (b) GDPR) and in the interest of a secure, fast and efficient provision of our online offering by a professional provider (Art. 6 (1) (f) GDPR). Our server functions are executed in the Frankfurt (EU) region; static content may be delivered via the provider's global content delivery network. Vercel is certified under the EU-US Data Privacy Framework (DPF); EU Standard Contractual Clauses apply in addition.
Provider:
Vercel Inc.
440 N Barranca Avenue #4133
Covina, CA 91723, United States
Data Processing Agreement
We have concluded a Data Processing Agreement (DPA) for the use of the above-mentioned service. This is a contract required by data protection law that ensures that the provider processes the personal data of our website visitors only according to our instructions and in compliance with the GDPR.
3. General Information and Mandatory Disclosures
Data Protection
The operators of these pages take the protection of your personal data very seriously. We treat your personal data confidentially and in accordance with statutory data protection regulations and this privacy notice.
When you use this website, various personal data is collected. Personal data is data with which you can be personally identified. This privacy notice explains what data we collect and what we use it for. It also explains how and for what purpose this happens. We point out that data transmission over the Internet (e.g., when communicating by e-mail) may have security gaps. Complete protection of data against access by third parties is not possible.
Information about the Responsible Party
The responsible party for data processing on this website is:
DIGITALPASSION Ltd.
Tassou Papadopoulou 16, House 2
8270 Tremithousa, Cyprus
Email: info@kontiqo.io
The responsible party is the natural or legal person who alone or jointly with others decides on the purposes and means of processing personal data (e.g., names, e-mail addresses, etc.).
Storage Duration
Unless a more specific storage period has been stated within this privacy notice, your personal data will remain with us until the purpose for data processing no longer applies. If you assert a legitimate request for deletion or revoke your consent to data processing, your data will be deleted unless we have other legally permissible reasons for storing your personal data; in such cases, deletion will take place after these reasons cease to apply.
Specific Retention Periods
The following automated retention periods apply:
- IP addresses and browser identifiers from consent and acceptance records (T&C acceptance, avatar consent, consent to connecting a third-party service, cookie consent for the Meta Pixel (where requested), waiver of the right of withdrawal, acceptance of the data processing agreement): 90 days from the time the declaration is made, then automatic anonymisation
- Payment webhook data (Stripe): 90 days, then automatic deletion
- Usage logs: 365 days, then automatic deletion
- AI learning and feedback data (ratings, usage signals and image feedback for style personalization): 365 days, then automatic deletion; the aggregated style profile is kept until account deletion
- Post analytics data (own posts, statistics, LinkedIn insights): 730 days (2 years), then automatic deletion. Shorter periods apply to posts from your LinkedIn company page that we retrieve via the LinkedIn API: the post text is deleted after 182 days (six months), the associated metrics after 365 days (LinkedIn platform requirement).
- Images of published posts: 90 days after publication, then automatic deletion from our file storage. This affects only images of posts that are verifiably live; images from your image gallery are retained, as is an image that a post not yet published still uses; it is deleted once the last post using this image has reached the period. If a post is still scheduled on a further channel, its images are retained until that scheduling has been completed. The published post itself is not affected.
- Temporary Telegram input data: 4 hours, then automatic deletion
- Third-party data from LinkedIn comments: comment texts 48 hours, name/profile details 24 hours, then automatic anonymisation (LinkedIn platform requirement)
- AI chat histories: 365 days after the last activity, then automatic deletion
- Messages on support requests: 365 days after the request is closed, then automatic deletion; the request itself remains stored until your account is deleted, and while it has not yet been processed you can delete it yourself
- Processed questions from the help chat: 180 days from receipt, then automatic deletion; questions not yet processed remain stored until they are processed or your account is deleted
- Records of withdrawals, cancellations and waivers of the right of withdrawal: at most 6 years, then automatic deletion; if you delete your account, they are kept until then without a link to the account, and any stated reason is deleted
- Unconfirmed accounts: reminder after 3 days, deletion after 30 days. Accounts without activity receive a one-time reminder email after 90 days; the account remains.
- Portrait photos for the avatar feature: if your account no longer has access to a plan, they are deleted automatically 90 days after we detect this (checked daily), but no earlier than 14 days after our email notice. If access is restored before then, they are kept. Withdrawing your consent deletes them immediately.
- Encrypted backups (storage files): 30 daily, 4 weekly, 12 monthly, and 8 yearly snapshots. Individual records cannot be removed from encrypted backups for technical reasons. Backups automatically expire after the retention periods. In the event of a restore from an older backup, previously deleted personal data is immediately re-deleted.
- Daily database backups (Supabase): we keep the backups of the last eight days; older ones are removed automatically. Individual records cannot be removed from these backups; after an account deletion, your data is therefore gone from the last backup after at most eight days. For technical database changes we additionally back up the affected entries for up to 30 days; deleting your account removes this copy immediately as well.
- Account data: Until account deletion by user
General Information on the Legal Basis for Data Processing on this Website
If you have consented to data processing, we process your personal data on the basis of Art. 6(1)(a) GDPR or Art. 9(2)(a) GDPR, if special categories of data pursuant to Art. 9(1) GDPR are processed. If you have consented to the storage of cookies or to access to information on your device (e.g. via device fingerprinting), the data processing is additionally carried out on the basis of § 25(1) TDDDG or the corresponding provision of the country in which you use the website (Art. 5(3) Directive 2002/58/EC). The consent can be revoked at any time. If your data is required for the fulfillment of a contract or for the implementation of pre-contractual measures, we process your data on the basis of Art. 6(1)(b) GDPR. Furthermore, we process your data if this is necessary for the fulfillment of a legal obligation on the basis of Art. 6(1)(c) GDPR. Data processing may also be carried out on the basis of our legitimate interest pursuant to Art. 6(1)(f) GDPR. Information about the relevant legal bases in each individual case is provided in the following paragraphs of this privacy notice.
Obligation to Provide Data and Automated Decisions
You are under no statutory or contractual obligation to provide us with personal data. Without the information requested at registration (first and last name, email address and password, or sign-in via LinkedIn or Facebook) we cannot set up an account for you, however, and without the information for a feature (such as portrait photos for the avatar feature) you cannot use that feature. We do not make any decision based solely on automated processing that produces legal effects concerning you or similarly significantly affects you (Art. 22 GDPR). The style profile and the selection of activation emails do evaluate your information and your usage, but they only serve to provide you with suitable drafts and hints.
Transfers to Third Countries
Some of the service providers named in this privacy notice are based outside the European Union or the European Economic Area or process data there, in particular in the USA. For each service provider we state the basis for the transfer: an adequacy decision of the European Commission - for the USA, Decision (EU) 2023/1795 on the EU-US Data Privacy Framework, which only applies to companies certified under it -, the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR) or a derogation under Art. 49 GDPR. In countries without an adequacy decision, authorities may be able to access data without legal remedies comparable to those in the EU being available to you. You can obtain a copy of the Standard Contractual Clauses we have agreed on request to info@kontiqo.io.
Recipients of Personal Data
In the course of our business activities, we work with various external parties. In some cases, this also requires the transfer of personal data to these external parties. We only pass on personal data to external parties if this is necessary for the fulfillment of a contract, if we are legally obligated to do so (e.g. transfer of data to tax authorities), if we have a legitimate interest pursuant to Art. 6(1)(f) GDPR in the transfer, or if another legal basis permits the data transfer. When using data processors, we only pass on personal data of our customers on the basis of a valid data processing agreement. In the case of joint processing, a joint processing agreement is concluded.
Revocation of Your Consent to Data Processing
Many data processing operations are only possible with your express consent. You can revoke consent you have already given at any time. The legality of data processing carried out until the revocation remains unaffected by the revocation.
Right to Object to Data Collection in Special Cases and to Direct Advertising (Art. 21 GDPR)
IF DATA PROCESSING IS BASED ON ART. 6(1)(E) OR (F) GDPR, YOU HAVE THE RIGHT AT ANY TIME TO OBJECT TO THE PROCESSING OF YOUR PERSONAL DATA FOR REASONS ARISING FROM YOUR PARTICULAR SITUATION; THIS ALSO APPLIES TO PROFILING BASED ON THESE PROVISIONS. THE RESPECTIVE LEGAL BASIS ON WHICH PROCESSING IS BASED CAN BE FOUND IN THIS PRIVACY POLICY. IF YOU OBJECT, WE WILL NO LONGER PROCESS YOUR AFFECTED PERSONAL DATA UNLESS WE CAN DEMONSTRATE COMPELLING LEGITIMATE GROUNDS FOR THE PROCESSING WHICH OVERRIDE YOUR INTERESTS, RIGHTS AND FREEDOMS, OR THE PROCESSING SERVES THE ASSERTION, EXERCISE OR DEFENSE OF LEGAL CLAIMS (OBJECTION PURSUANT TO ART. 21(1) GDPR). IF YOUR PERSONAL DATA IS PROCESSED FOR THE PURPOSE OF DIRECT MARKETING, YOU HAVE THE RIGHT TO OBJECT AT ANY TIME TO THE PROCESSING OF YOUR PERSONAL DATA FOR THE PURPOSE OF SUCH MARKETING; THIS ALSO APPLIES TO PROFILING INSOFAR AS IT IS RELATED TO SUCH DIRECT MARKETING. IF YOU OBJECT, YOUR PERSONAL DATA WILL SUBSEQUENTLY NO LONGER BE USED FOR THE PURPOSE OF DIRECT MARKETING (OBJECTION PURSUANT TO ART. 21(2) GDPR).
Right to Lodge a Complaint with a Supervisory Authority
If you consider that the processing of your personal data infringes the GDPR, you may lodge a complaint with a data protection supervisory authority, in particular in the Member State of your habitual residence, place of work or place of the alleged infringement (Art. 77 GDPR). If you live in Germany, you can therefore contact the data protection authority of your federal state. As our company is based in Cyprus, our lead supervisory authority is the Commissioner for Personal Data Protection, Iasonos 1, 1082 Nicosia, Cyprus, https://www.gov.cy/dataprotection/. The right to lodge a complaint is without prejudice to any other administrative or judicial remedy.
Right to Data Portability
You have the right to have data that we process automatically on the basis of your consent or in fulfillment of a contract handed over to you or to a third party in a common, machine-readable format. If you request the direct transfer of the data to another controller, this will only be done to the extent technically feasible.
Information, Rectification and Erasure
Within the framework of the applicable legal provisions, you have the right to free information about your stored personal data, its origin and recipients, and the purpose of data processing and, if applicable, a right to rectification or erasure of this data at any time. For this purpose and for further questions on the subject of personal data, you can contact us at any time.
Right to Restriction of Processing
You have the right to request the restriction of the processing of your personal data. You can contact us at any time for this purpose. The right to restriction of processing exists in the following cases: If you dispute the accuracy of your personal data stored by us, if processing is unlawful, if we no longer need the data but you need it for asserting legal claims, or if you have lodged an objection.
SSL or TLS Encryption
This site uses SSL or TLS encryption for security reasons and to protect the transmission of confidential content. You can recognize an encrypted connection by the fact that the address line of the browser changes from "http://" to "https://" and by the lock symbol in your browser line. When SSL or TLS encryption is activated, the data you transmit to us cannot be read by third parties.
Objection to Advertising Emails
The use of contact data published as part of the imprint obligation for sending unsolicited advertising and information materials is hereby objected to. The operators of these pages expressly reserve the right to take legal action in the event of unsolicited sending of advertising information, such as spam emails.
Encrypted payment transactions on this website
We process payments via Stripe (see the section on Stripe). You enter your payment data directly at Stripe via an encrypted TLS connection; we ourselves do not receive complete payment data.
4. Data Collection on This Website
Cookies
Our website uses so-called "cookies". Cookies are small data packets and do not cause any damage to your device. They are stored either temporarily for the duration of a session (session cookies) or permanently (permanent cookies) on your device.
Session cookies are automatically deleted at the end of your visit. Permanent cookies remain stored on your device until you delete them yourself or automatic deletion is carried out by your web browser.
Cookies can originate from us (first-party cookies) or from third-party companies (so-called third-party cookies). Third-party cookies enable the integration of certain services from third-party companies within websites (e.g. cookies for processing payment services). Cookies have various functions. Many cookies are technically necessary, as certain website functions would not work without them (e.g. signing in or the display of videos). Other cookies can be used to analyze user behavior or for advertising purposes. Cookies that are required to carry out the electronic communication process or to provide certain functions you have requested (e.g. for signing in) (necessary cookies) are stored on the basis of Art. 6(1)(f) GDPR, unless another legal basis is specified. The website operator has a legitimate interest in the storage of necessary cookies for the technically error-free provision of its services. If consent to the storage of cookies and comparable recognition technologies has been requested, processing is carried out exclusively on the basis of this consent (Art. 6(1)(a) GDPR and § 25(1) TDDDG or the corresponding provision of the country in which you use the website); the consent can be revoked at any time. You can set your browser so that you are informed about the setting of cookies and only allow cookies in individual cases, exclude the acceptance of cookies for certain cases or in general, and activate the automatic deletion of cookies when closing the browser. The deactivation of cookies may limit the functionality of this website. If additional cookies and services are used on this website, you can find information about them in this privacy notice.
Overview of cookies and local storage used
| Name / Identifier | Purpose | Duration | Type |
|---|
sb-*-auth-token | Authentication (login session) | 8 hours | Cookie (Supabase) |
i18n_locale | Language setting (DE/EN) | 1 year | Cookie (first-party) |
cf_clearance | Bot protection (Cloudflare Turnstile) | 30 minutes | Cookie (Cloudflare) |
__cf_bm | Bot detection (Cloudflare) | 30 minutes | Cookie (Cloudflare) |
kontiqo_consent | Stores your choice in the cookie banner (version, marketing yes or no, random identifier) so the banner does not appear on every visit. | 90 days | Cookie (first-party) |
kontiqo_attr | Origin of your visit (campaign parameters, click identifier fbc). Only with your consent. | 90 days | Cookie (first-party) |
_fbp | Meta Pixel identifier used to recognise your browser. Only with your consent. | Set by Meta (see Meta Privacy Policy) | Cookie (Meta) |
_fbc | Click identifier of a Meta ad. Only with your consent. | 90 days | Cookie (Meta) |
In addition, we use your browser's local storage and session storage (localStorage, sessionStorage) for technical markers that are required for features you use: the company you last selected (it is sent along with requests to our server so that you work in the right company), the interim state of an account connection (it is checked after you return from the connected service and then deleted), dismissed notices and display settings of the navigation. The legal basis for storing and reading this information is Sec. 25(2) no. 2 TDDDG, and for the further processing Art. 6(1)(b) GDPR.
Audience Measurement with Umami (self-hosted)
We analyse the use of our website statistically with the open-source software Umami, which we operate ourselves: the application runs at our host Vercel, the data is stored in our database at Supabase (Ireland region). We record page views, the referring page, the campaign identifier and characteristics derived from them such as country of origin, language, device type, browser and operating system. When a page is opened, our website only reports the page opened to our server and, on the first page view, the page you came from, as well as, where present, the campaign identifier from the address (utm_source, utm_medium, utm_campaign, utm_content), which shows us through which advertisement or link you came; click identifiers of advertising platforms such as fbclid are not transmitted. Secret parts of an address, such as the key of an invitation link, are removed beforehand. Nothing is stored on your device and no device property is read: no cookies, no entries in your browser's local storage, no screen size. Our server adds the language setting, the browser identifier and the IP address from the request your browser sends anyway and forwards them to Umami. Umami does not store your IP address; it derives the approximate location from it and, together with the browser identifier and a regularly changing random value, forms a shortened identifier used to group the page views of one visit. We do not draw any conclusions about your person. The legal basis is our legitimate interest in data-minimising audience measurement (Art. 6 (1) (f) GDPR). You may object to the measurement at any time on grounds relating to your particular situation (Art. 21 GDPR), for example by sending a message to info@kontiqo.io.
Meta Pixel and Conversions API (only with consent)
Only if you accept all cookies in the cookie banner do we use the Meta Pixel and the Conversions API of Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland (hereinafter Meta). The purpose is measuring and optimising our ads on Facebook and Instagram: Meta learns that a visitor came to us through an ad, which of our public pages they viewed (not sign-in, invitation, account, cancellation and withdrawal pages) and whether they signed up or paid. For this, the pixel sets the cookies _fbp and _fbc on your device. At sign-up and with every payment, our server additionally transmits your email address, your name and your user ID as SHA-256 hash values as well as the identifiers fbc (click identifier from the ad) and fbp (pixel identifier); at sign-up also your IP address and browser identifier, for a payment amount and currency. The legal basis is your consent (Section 25 (1) TDDDG, Art. 6 (1) (a) GDPR). We and Meta are joint controllers for the collection and the transmission to Meta (Art. 26 GDPR); the agreement for this is Meta's Controller Addendum (https://www.facebook.com/legal/controller_addendum). Meta is responsible for the subsequent processing; details are in Meta's Privacy Policy (https://www.facebook.com/privacy/policy). You can also exercise your rights under Art. 15 to 20 GDPR regarding the data stored by Meta directly with Meta. Meta may transfer data to the USA; Meta Platforms, Inc. is certified under the EU-U.S. Data Privacy Framework. You can withdraw your consent at any time with effect for the future: via the link Cookie settings in the footer and the choice Necessary only. After that the pixel sends nothing in this browser, and we delete the cookies _fbp, _fbc and kontiqo_attr there. If you withdraw while signed in or in the browser in which you consented, our server also transmits no further events for your account. We record your choice as proof (time, version, random identifier, IP address and browser identifier); we delete the IP address and browser identifier after 90 days, the rest of the record together with your account; records without an account after three years. On withdrawal we also delete the identifiers fbc and fbp stored with your account.
Contact Form
If you send us enquiries via the contact form, your details from the enquiry form (name, email address, subject, message) will be processed for the purpose of handling the enquiry and in case of follow-up questions. The submission is sent by email via our email service Resend (see Section 7) to our support mailbox; at the same time you receive a confirmation of receipt at the email address you provided. No additional storage in our database takes place. The contact form is also one of the ways to reach our point of contact under the Digital Services Act (see imprint); we process such messages in the same way. To protect against automated submissions we use Cloudflare Turnstile on the form (see Section 8). Processing is based on Art. 6(1)(b) GDPR if your enquiry relates to the performance of a contract; otherwise on our legitimate interest in the effective handling of enquiries addressed to us (Art. 6(1)(f) GDPR). The email correspondence remains with us until the purpose for storage no longer applies; mandatory statutory retention periods remain unaffected.
Withdrawal and Cancellation via Our Forms
Using the "Withdraw from contract" (kontiqo.io/widerruf) and "Cancel contracts here" (kontiqo.io/kuendigung) buttons, you can withdraw from or cancel your contract without signing in. We process your name, the name of the contract, your email address, a reason if you choose to give one, the language of the page and, for a cancellation, its type and the desired end date, as well as the date and time of receipt. If you are signed in, we link the declaration to your account and your subscription. The purpose is to receive your declaration, to confirm its receipt to you by email and to end the contract accordingly; if an ordinary cancellation at the next possible date is linked to your subscription, we end it automatically with our payment provider Stripe at the end of the current billing period. The legal basis is the fulfilment of our legal obligations (Art. 6(1)(c) GDPR in conjunction with Secs. 356a and 312k BGB) and, for keeping the record as evidence, our legitimate interest in defending against legal claims (Art. 6(1)(f) GDPR). Recipients are our database host Supabase, the email service Resend, through which we send the confirmation to you and a notice to our mailbox, and Stripe in the case of an automatic termination. The information is required so that we can assign and confirm your declaration; without it we cannot receive it through the form - you can, however, always withdraw or cancel by email. For the storage period see "Records of withdrawals, cancellations and waivers of the right of withdrawal" in the section on storage duration.
Reports of illegal content
Using the "Report content" form (kontiqo.io/report-content) you can report content you consider illegal. We process your name, your email address, the indication of the content, your explanation, your statement that the information is accurate and complete, the language and the time of receipt, and later our decision with reasons. If the report concerns depictions of child sexual abuse, name and email address are optional. The purpose is to review the report, to confirm its receipt and to inform you of our decision. The legal basis is compliance with our legal obligations under Art. 16 of Regulation (EU) 2022/2065 (Digital Services Act) in conjunction with Art. 6(1)(c) GDPR. Recipients are our database provider Supabase and our email service provider Resend (see Annex 2 of the DPA). If we take action against a customer's content, we inform the customer of the reasons; we only disclose your name to them where this is necessary for the review, for example in the case of an infringement of your rights. We delete the report one year after our decision, or at the latest two years after receipt if no decision is ever taken.
Customer voices
You can send us a customer voice through a form inside your customer account. We process the data you provide: your name in the form you selected (full name, first name with initial, or anonymous), optionally your role and company, your rating, your text and the date of submission. Your account email address is pre-filled; you can change or remove it. It is used only for follow-up questions and is never published. The legal basis is solely your consent (Art. 6(1)(a) GDPR), which we document together with the time and the version of the consent text. Publication only happens after a review by us and only covers the approved text, on our website and in our own social media channels (for example LinkedIn, Instagram and Facebook); any shortening does not change its meaning. Once published, the customer voice can be accessed by anyone; on social networks their operators also process it under their own terms. You may withdraw your consent at any time with effect for the future: in your customer account via the "Withdraw" button, or with a message to support@kontiqo.io. We then remove the customer voice from the website and remove posts in our own social media channels that reproduce it; we cannot recall copies spread by third parties, such as shared posts. On request we delete it entirely. As long as it has not been published yet, you can also change your text in your customer account. The data is stored until you withdraw your consent or request deletion. If you delete your customer account, we automatically delete your customer voice as well.
Inquiry by email
If you contact us by email, your inquiry including all resulting personal data (name, inquiry) will be stored and processed by us for the purpose of handling your request. We do not pass on this data without your consent. The processing of this data is based on Art. 6(1)(b) GDPR, if your inquiry is related to the fulfillment of a contract or is necessary for the implementation of pre-contractual measures. In all other cases, the processing is based on our legitimate interest in the effective processing of inquiries addressed to us (Art. 6(1)(f) GDPR) or on your consent (Art. 6(1)(a) GDPR) if this has been requested; the consent can be revoked at any time. The data sent to us via contact inquiries will remain with us until you request deletion, revoke your consent to storage, or the purpose for data storage no longer applies (e.g. after your request has been processed). Mandatory legal provisions - in particular retention periods - remain unaffected.
Registration on This Website
You can register on this website to use the service. We use the data entered for this purpose (first and last name, email address, password) only for the use of the service; the legal basis is Art. 6(1)(b) GDPR. At registration we record your acceptance of the Terms of Service with time and version and - for 90 days - IP address and browser identifier; this serves as evidence of the conclusion of the contract and is based on our legitimate interest (Art. 6(1)(f) GDPR). The data collected during registration is stored for as long as your account exists; upon account deletion it is irrevocably removed unless statutory retention obligations apply.
Origin of Your Sign-Up
If you reach our website through a link carrying campaign parameters (utm_source, utm_medium, utm_campaign, utm_term, utm_content), we note those parameters together with the page you landed on and the time. If you then register, they are stored once with your account - the first contact is what counts, later visits do not overwrite it. The sole purpose is measuring the effectiveness of our own advertising, that is, which channel people find us through. The legal basis is Art. 6 (1) (f) GDPR (legitimate interest in evaluating our own marketing activities). Without your consent, these values exist only in your browser's working memory until you register - we then set neither cookies nor local or session storage for this, and Meta's click identifier (fbclid) does not reach Meta. The data is deleted together with your account; you may object to this processing at any time under Art. 21 GDPR.
If you accepted all cookies in the cookie banner, we additionally store the values for 90 days in the cookie kontiqo_attr so that they survive a sign-up via Facebook or LinkedIn, and derive the click identifier fbc for the Conversions API from the fbclid (see Meta Pixel and Conversions API).
Sign in with LinkedIn
Instead of registering by email, you can sign in using your LinkedIn account (OpenID Connect). The provider is LinkedIn Ireland Unlimited Company, Wilton Plaza, Wilton Place, Dublin 2, Ireland. We receive from LinkedIn the profile data required to create your account (name, email address, profile picture URL, LinkedIn identifier). Processing is carried out for the performance of the contract (Art. 6 (1) (b) GDPR); the exchange between you and LinkedIn is subject to LinkedIn's privacy policy (https://www.linkedin.com/legal/privacy-policy). LinkedIn is certified under the EU-US Data Privacy Framework.
Sign in with Facebook
Instead of registering by email, you can sign in with your Facebook account. The provider is Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland. In doing so we receive from Meta the profile data required to create the account (name, email address, profile picture, Facebook identifier). The processing is carried out to perform the contract (Art. 6 (1) (b) GDPR); the transfer between you and Meta is subject to Meta's privacy policy (https://www.facebook.com/privacy/policy). Signing in with Facebook is independent of whether you connect Facebook pages or Instagram accounts for publishing.
5. LinkedIn Integration (Publishing and Insights)
Connecting Your LinkedIn Account
The core of our service is the connection to your LinkedIn account or company page via the official LinkedIn interfaces (Community Management API). The provider is LinkedIn Ireland Unlimited Company, Wilton Plaza, Wilton Place, Dublin 2, Ireland; LinkedIn is certified under the EU-US Data Privacy Framework. When connecting, we store the access tokens you authorise (AES-256 encrypted), your LinkedIn identifier and the name/email of your LinkedIn profile. The legal basis is the performance of the contract (Art. 6 (1) (b) GDPR). We document your consent to this connection with a timestamp and version; the IP address and browser identifier recorded in the process are anonymised after 90 days.
Publishing on Your Behalf
Posts, images and comments that you approve in the platform are transmitted to LinkedIn on your behalf. No automatic publishing takes place without your prior approval.
Statistics and Comments (Insights)
At your request we retrieve statistics on your own posts (impressions, reactions, follower development) as well as comments under your posts. In doing so we also process personal data of commenters (name, LinkedIn identifier, comment text). This third-party data is subject to strict retention limits imposed by LinkedIn, which we enforce automatically: name and profile details are anonymised after 24 hours, comment texts after 48 hours. Your own replies and the related statistics are retained. The legal basis is the performance of the contract with you (Art. 6 (1) (b) GDPR). We process the data of commenters as a processor on your behalf (Art. 28 GDPR, see T&C § 18); you are the controller for it. Incoming comments can, at your request, be automatically classified by sentiment and category to make replying easier; the wording of third-party comments is not used to learn your style or for your posts. If you request an AI reply suggestion, the comment text is transmitted to Anthropic for that purpose, and with full context enabled also the commenter's name.
6. AI Features
Overview and Principles
On your instruction, our service creates texts and images using AI models from external providers. For this purpose we transmit the content you enter (e.g. ideas, texts, style samples, images) to the respective provider to the extent required for the requested function. Data processing agreements are in place with all AI providers; your content is contractually not used to train AI models. AI-generated drafts are labelled as such within the application and are only published after your review and approval. The legal basis is the performance of the contract (Art. 6 (1) (b) GDPR).
Your Style Profile (Brand Voice)
So that your posts sound like you and not like generic AI, we build a style profile for your account. It draws on four sources: your answers in the setup conversation (among others your professional role, your offering, your unique value proposition, your audience, the position you hold, a formative story, your topics and taboo topics), posts you import yourself, posts you published on your connected channels without kontiqo, and texts you wrote yourself or substantially reworked in kontiqo. Suggestions you take over unchanged do not feed into the instruction to the AI model as your style; when you choose between two suggested variants, we take your choice into account for the opening and structure of future suggestions. You can trigger the analysis yourself in the settings; once at least three of your posts have been published through kontiqo and at least three such texts exist, it additionally runs automatically and is refreshed as new ones are added. This analysis, whether triggered by you or automatic, requires your account to have a plan or an active trial; after that it no longer runs. We transmit your free-text answers to the AI model as soon as you complete the setup conversation, in order to derive the profile fields from them; the derived details then feed into the instruction sent to the AI model each time you have a post created. If an answer cannot be processed automatically, we take it over unchanged into the respective profile field. We delete the raw answers from the setup conversation 90 days after the last change; the profile fields remain until you change them or delete your account. You can reset what has been learned at any time in the settings under Brand Voice. The legal basis is the performance of the contract (Art. 6 (1) (b) GDPR).
Anthropic (Text Generation and Analysis)
For text generation, style analysis (brand voice), the AI chat, the help chat, the classification of incoming comments and AI reply suggestions, the description of uploaded images and the review of generated images we use Claude by Anthropic. Our contracting party is Anthropic Ireland, Limited, 6th Floor, South Bank House, Barrow Street, Dublin 4, D04 TR29, Ireland, with which we have concluded a data processing agreement. Processing is also carried out by Anthropic PBC, 548 Market St, San Francisco, CA 94104, USA. This transfer to the USA is based on the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR); Anthropic is not certified under the EU-US Data Privacy Framework. Anthropic contractually does not use API content for model training and is certified to ISO 27001 and ISO 42001, among others.
Importing Content from Links
If you enter a link to a YouTube video or a web page, our server retrieves the content (for YouTube the title, channel name and the public transcript) so that you can create ideas and posts from it. The operator of the web page or YouTube receives the address of our server, not yours. We transmit the retrieved text to our AI provider Anthropic (see above) for text generation and for categorising the idea. With your idea we store the link, the title, the author or channel and a short excerpt. If the content contains personal data of third parties, we process it only for this purpose. The legal basis is the performance of the contract (Art. 6(1)(b) GDPR).
OpenAI (Image Generation, Speech Transcription, Embeddings, Support)
For generating post images, transcribing voice messages (e.g. from the Telegram integration or the voice recording in the web app), semantic embeddings and the classification and sentiment analysis of support requests you submit in your account we use services from OpenAI (OpenAI, L.L.C., San Francisco, USA or OpenAI Ireland Ltd for the EEA). A data processing agreement with EU Standard Contractual Clauses is in place; API content is not used for training by default and is retained for a maximum of 30 days for abuse monitoring purposes under OpenAI's contractual terms.
Google Cloud / Vertex AI (AI Image Generation)
For generating post images and avatars we use Google Vertex AI (Google Cloud EMEA Limited, Dublin, Ireland). The image instructions and, where applicable, reference images you provide are transmitted. The image model we use is only available via a global endpoint; processing may therefore also take place outside the EU. The basis is the Google Cloud data processing agreement including EU Standard Contractual Clauses. Your content is not used to train models.
Images of You (biometric-adjacent processing, Art. 9 GDPR)
Optionally, you can upload portrait photos of yourself to generate new, photorealistic images of yourself in desired scenes. As your facial features are processed in this context, we treat this feature as processing of special categories of personal data and carry it out exclusively on the basis of your explicit consent (Art. 9 (2) (a) GDPR), which you grant before first use and can revoke at any time in the settings (Art. 7 (3) GDPR; the lawfulness of processing prior to revocation remains unaffected). For generation we transmit your reference photos to Google (Vertex AI, image model) and, where applicable, to Anthropic (image description) - in each case on the basis of data processing agreements, without use for model training. The Google Cloud data processing agreement expressly covers special categories of personal data. We document the granting and revocation of consent with timestamp and version; the IP/browser details recorded in this context are anonymised after 90 days. Generated images appear in your image gallery and can be deleted by you at any time.
Provenance information in generated images
Every image our service generates with AI receives machine-readable provenance information in its metadata when it is stored (XMP following the IPTC standard): the field “Iptc4xmpExt:DigitalSourceType” with the value “trainedAlgorithmicMedia”, and “xmp:CreatorTool” with the value “kontiqo (AI-generated)”. It states that the image was generated by AI and with which tool - it contains neither your name nor your account details nor any identifier that could be traced back to you. The legal basis is our legal obligation under Article 50(2) of the AI Act (EU) 2024/1689 (Art. 6(1)(c) GDPR). If you publish such an image, this information generally travels with it and is readable by anyone who receives the file. How individual networks handle it differs and is outside our control; our measurements are published at kontiqo.io/ai-transparency. Once content is published, we cannot recall it.
Metadata in uploaded images
When you upload your own image, we strip its XMP and IPTC metadata in your browser - that is, before the file reaches our servers. Typical additional information such as GPS location, capture device or authorship fields therefore never enters our file storage. We do this to protect you: a published image should not pass this information on. One exception is cryptographically signed provenance records (Content Credentials) that an uploaded file already carries: these are retained in our storage and are passed on with the published image, as long as kontiqo does not recompute the file on publication; if we burn in the AI label or your logo, or scale the image down to the platform's limit, a new file is created without this record. Whether they reach the viewer is decided by the target platform: LinkedIn, Facebook and Instagram re-encode uploaded images and remove the record in the process (measured on 11 September 2026 on one post per platform). If such a file serves as a reference for an image that kontiqo generates, we carry its record over into our signature (see the next section) and remove the thumbnails it contains, so that no third-party image content travels along. Portrait photos are the exception: we never carry their provenance data over into an avatar's signature; it only contains the entry described in the next section. If a file declares itself as AI-generated in its metadata, we read that declaration so we can offer you the corresponding labelling.
Content Credentials (C2PA)
To images that kontiqo has generated since 7 October 2026 - post images and avatars - we apply cryptographically signed provenance marking following the C2PA standard ('Content Credentials'). kontiqo has been confirmed as conformant since 29 September 2026 and is listed on the C2PA Conforming Products List; the signing certificate was issued by SSL.com. If signing fails, for example because the timestamp service cannot be reached, the image is stored without a signature; the rest of the AI marking is unaffected. Images you have edited via Canva and files you upload yourself receive no signature. For the timestamp of the signature we send a checksum to SSL.com's timestamp service; it contains neither the image nor any information about you. For your data, the marking means the following: the manifest of a generated image lists which media went into its creation. For images generated from your portrait photographs, that is an entry with the category label 'Portrait reference', the file format, and the statement that it was an input. Deliberately NOT included are the portrait itself, a thumbnail of it, a checksum of the portrait, a file name or a storage path. The manifest therefore shows that a portrait served as a reference - but not which one. The manifest is signed, publicly readable and sits in the image file in your kontiqo library. Images generated earlier carry no signature. LinkedIn, Facebook and Instagram removed the manifest on delivery when we measured this on 11 September 2026. Whoever passes the file on passes the manifest on with it; once the file has been passed on, the manifest can no longer be recalled. The legal basis here is likewise Article 50(2) of the AI Act (Art. 6(1)(c) GDPR); the avatar feature itself additionally requires your explicit consent (see above).
7. Email Delivery and Customer Information
Transactional Emails (Resend)
For sending system emails (e.g. registration confirmation, password reset, subscription and support notifications) we use Resend (Resend, Inc., 2261 Market Street #4103, San Francisco, CA 94114, USA). Email address, name and the respective message content are processed. Resend is certified under the EU-US Data Privacy Framework; in addition, a data processing agreement with EU Standard Contractual Clauses is in place. The legal basis is the performance of the contract (Art. 6 (1) (b) GDPR).
Activation emails after registration
After you register, we send you up to five emails within the first 14 days to help you get started - for example a reminder that your style profile is still missing, or a tip about a feature you have not used yet. To decide whether and which of these emails is useful for you, we evaluate your use of the application: whether your style profile has been created, whether and how many posts you have published, whether a finished draft is sitting unpublished in your account, and which features you have already used (among others image generation, avatar, AI chat, Telegram, analytics, post import). If no content matches your usage, we send no email at all. We also store on your account which of these emails you have already received, so that none is repeated and the following limits are observed: at most one email per 72 hours, at most five within the first 30 days, and at most one per month thereafter. This does not involve any automated decision producing legal effects within the meaning of Art. 22 GDPR. The legal basis is our legitimate interest in enabling registered users to successfully start using the application (Art. 6 (1) (f) GDPR). You can object to these emails at any time: via the "Tips and Onboarding" toggle in your email settings, or via the link at the end of each of these emails. Delivery is handled by Resend, the processor named above.
Offers by email to existing customers
When you register with us and provide your email address, we inform you during registration that we also use this address for offers on our own similar services (by email only after you have purchased a paid service from us), and that you can object to this at any time without incurring any costs other than the transmission costs at basic rates. We store the time and version of this notice. You can object at any time in your settings under "Offers by email" or via the unsubscribe link in every such email. The legal basis is Art. 6(1)(f) GDPR in conjunction with § 7(3) UWG. If you switched on "Offers by email" yourself without this notice having been shown to you during registration, the emails are based on your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time by switching it off; in that case, too, we store the time and version.
8. Further Service Providers and Tools
Google Fonts (Local Hosting)
This site uses so-called Google Fonts for uniform display of fonts. The Google Fonts are installed locally. There is no connection to Google servers.
Supabase (Database, Authentication, File Storage)
We use Supabase (Supabase Pte. Ltd., 65 Chulia Street #38-02/03, OCBC Centre, Singapore 049513) for authentication, database and file storage. Your data is stored in the EU region (Ireland). We have concluded a data processing agreement with EU Standard Contractual Clauses; Supabase is SOC 2 Type II certified. Details: https://supabase.com/privacy
Sentry (Error Monitoring)
For error detection we use Sentry (Functional Software, Inc., 45 Fremont Street, 8th Floor, San Francisco, CA 94105, USA) with EU data residency (error data processed in Frankfurt). If an error occurs in your browser or on our server, we transmit technical information (browser, operating system, requested page without request parameters, error details); for a portion of page views we also transmit loading times in order to detect performance problems. Cookies and request parameters are removed before transmission and IP addresses are not stored; for signed-in users a pseudonymous user identifier (UUID) is transmitted, neither email address nor name. We do not use session recordings (session replay). Sentry is certified under the EU-US Data Privacy Framework; a data processing agreement is in place, and the EU Standard Contractual Clauses apply in addition. The legal basis is our legitimate interest in stable and secure operation (Art. 6(1)(f) GDPR).
Cloudflare Turnstile (Bot Protection)
To protect against automated attacks and spam, we use Cloudflare Turnstile (Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA) during registration, sign-in and password reset, on the contact form and on the testimonial form. The cookies 'cf_clearance' and '__cf_bm' are set. When the verification widget loads, Cloudflare technically receives the IP address and browser details; the verification is usually performed without a visible CAPTCHA. The legal basis is § 25(2) TDDDG in conjunction with Art. 6(1)(f) GDPR (legitimate interest in protection against abuse). Cloudflare is certified under the EU-US Data Privacy Framework. Details: https://www.cloudflare.com/privacypolicy/
Upstash (Caching and Job Queue)
To protect against abuse, for performance optimization and for deferred jobs, we use Upstash (Upstash, Inc., San Jose, California, USA): a serverless Redis database provided via Vercel KV, and the job queue QStash. The cache holds request counters (based on hashed IP addresses or user identifiers), post statistics for a few minutes, keywords and image descriptions derived from post texts for up to 24 hours, and dispatch and deduplication markers for up to 35 days, as well as technical mapping markers with identifiers for up to 90 days; they are then deleted automatically. Queue messages (e.g. for data exports and scheduled publishing) contain only job and user identifiers, no content. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in protection against abuse and reliable operation). We have concluded a Data Processing Agreement (DPA) with Upstash. Upstash is certified under the EU-US Data Privacy Framework; the EU Standard Contractual Clauses apply in addition. Details: https://upstash.com/trust/privacy
Hostinger (Encrypted Backup and Video Conversion)
To ensure data availability and disaster recovery, we create daily encrypted backups of all files stored in Supabase Storage (images, documents, attachments) on a dedicated server provided by Hostinger (Hostinger International Ltd., 61 Lordou Vironos Street, 6023 Larnaca, Cyprus) located in Frankfurt (EU). On the same server we convert uploaded videos into publishable formats; the working copies are deleted afterwards. Backups are secured with AES-256-CTR encryption and Poly1305 MAC (via restic). Unencrypted data is automatically deleted after backup completion. Retention periods are: 30 daily, 4 weekly, 12 monthly, and 8 yearly backups. In the event of a restore from an older backup, previously deleted personal data is immediately re-deleted. The legal basis for the backups is Art. 6(1)(f) GDPR (legitimate interest in data security and business continuity), and for the video conversion the performance of the contract (Art. 6(1)(b) GDPR). We have concluded a Data Processing Agreement (DPA) with Hostinger. Details: https://www.hostinger.com/privacy-policy
Telegram Bot (optional connection)
Optionally, you can connect our Telegram bot to your account to capture ideas via message or voice message and approve posts. The messenger provider is Telegram (Telegram FZ-LLC, Dubai, UAE); according to Telegram, data of EEA users is stored in data centres in the Netherlands, and EDPO (Avenue Huart Hamoir 71, 1030 Brussels, Belgium) is appointed as EU representative pursuant to Art. 27 GDPR. Telegram processes the messages as an independent controller under its own privacy policy. No adequacy decision of the European Commission exists for the United Arab Emirates; it therefore cannot be guaranteed that your data is protected there to an equivalent level. The transfer is based on Art. 49(1)(b) GDPR because it is necessary for the service you requested and you initiate the connection yourself. Use of the bot is voluntary; the legal basis for the processing is the performance of the contract (Art. 6(1)(b) GDPR). We document your consent to this connection with a timestamp and version; the IP address and browser identifier recorded in the process are anonymised after 90 days. Content you send to the bot is processed like input in the web application; voice messages are transmitted to OpenAI for transcription (see Section 6). The bot also sends you notices about your account, for example about new comments on your channels or about a connection that is expiring; these notices name the channel and link to the post and into the application. We do not transmit comment texts or the names of commenters via Telegram. Temporary bot input data is deleted after 4 hours.
Facebook and Instagram (optional connection)
You can optionally connect your Facebook pages and Instagram accounts to kontiqo in order to publish posts, retrieve statistics on your own posts and channels, and reply to comments under those posts. The provider is Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland. When you connect, we store an encrypted access token, your Meta user ID, the permissions you granted, and the name, ID and profile picture of the selected pages and accounts. For the statistics feature we retrieve reach and interaction figures for your own posts and channels. Comments under your posts come from third parties: we store their name, user ID and comment text only for as long as replying requires it - name and ID are removed automatically after 24 hours, comment text and AI reply suggestion after 48 hours. According to its own information, Meta also transfers data to the USA and other third countries. Meta Platforms, Inc. is entered in the Data Privacy Framework List maintained by the U.S. Department of Commerce; for transfers to organisations entered in that list, the EU Commission's adequacy decision (EU) 2023/1795 applies (as at August 2026). For transfers not covered by that decision, Meta names the EU Commission's Standard Contractual Clauses (Art. 46(2)(c) GDPR) as the basis in its published transfer terms. Use is voluntary; the legal basis is performance of the contract (Art. 6(1)(b) GDPR), and we process the data of commenters as a processor on your behalf (Art. 28 GDPR, see T&C § 18). We document your consent to this connection with a timestamp and version; the IP address and browser identifier recorded in the process are anonymised after 90 days. You can disconnect at any time in the settings; you can additionally request deletion of your data via the Facebook settings. More information: https://www.facebook.com/privacy/policy
Canva design import (optional connection)
You can optionally connect your Canva account to kontiqo in order to bring finished designs - images and videos - straight into a post, or to create a design in Canva and return afterwards. The provider is Canva Pty Ltd, 110 Kippax St, Surry Hills, NSW 2010, Australia. When you connect, we store encrypted access tokens, your Canva user ID, the display name of your Canva account and the permissions you granted. If you choose "Design new in Canva" for an image, a post image already present is transferred to Canva as source material; this does not happen when importing an existing design or when working with video. Please note that there is no adequacy decision by the EU Commission for Australia; for transfers out of the EEA, Canva uses the EU Commission's Standard Contractual Clauses (Art. 46(2)(c) GDPR). Use is voluntary; the legal basis is performance of the contract (Art. 6(1)(b) GDPR). We document your consent to this connection with a timestamp and version; the IP address and browser identifier recorded in the process are anonymised after 90 days. You can disconnect at any time in the settings - we then delete tokens, user ID and display name, and additionally revoke access at Canva. More information: https://www.canva.com/policies/privacy-policy/
Google Meet / Google Calendar (business communication)
For video appointments with customers and prospects (e.g. demos, support calls) we use Google Meet and Google Calendar. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. The appointment data you provide (name, email address, time) and the usual connection metadata for conferences are processed. These services are not embedded in our website; processing only takes place if you arrange an appointment with us. Google is certified under the EU-US Data Privacy Framework. The legal basis is Art. 6 (1) (b) GDPR (appointment coordination at your request) or Art. 6 (1) (f) GDPR (efficient business communication).
Pexels (Stock Photo Search)
To let you choose free stock photos for your posts, we use the Pexels API, a brand of Canva Germany GmbH (Pappelallee 78/79, 10437 Berlin, Germany). The search request is made server-side; this transmits our server IP to Pexels, not yours. However, the thumbnail previews of the search results are loaded directly from the Pexels image network (images.pexels.com) into your browser; in doing so, your IP address may be transmitted to Pexels. When you select a photo, we download it server-side and store it in our file storage so it can be attached to your post. The legal basis is performance of the contract (Art. 6(1)(b) GDPR) and our legitimate interest in providing suitable image content (Art. 6(1)(f) GDPR). More information: https://www.pexels.com/privacy-policy/
9. eCommerce and Payment Processing
Processing of Customer and Contract Data
We collect, process, and use personal customer and contract data for the establishment, content design, and modification of our contractual relationships. Processing is based on Art. 6(1)(b) GDPR. The collected customer data is deleted after completion of the order or termination of the business relationship and expiry of tax retention periods.
Data transmission upon contract conclusion for services and digital content
We only transmit personal data to third parties if this is necessary in the context of contract processing, for example to our payment service provider Stripe. Further transmission of data does not take place or only takes place if you have expressly consented to the transmission. Your data will not be passed on to third parties without your express consent, for example for advertising purposes. The basis for data processing is Art. 6(1)(b) GDPR, which permits the processing of data for the fulfillment of a contract or pre-contractual measures.
Payment Service Provider
All payment processing (credit card and other payment methods) is handled via Stripe. When you make a purchase, your payment data is processed by the payment service provider for the purpose of payment processing; we ourselves do not receive or store complete payment data. The use is based on Art. 6 (1) (b) GDPR (contract processing) and in the interest of a smooth and secure payment process (Art. 6 (1) (f) GDPR). When your payment account is created, we additionally transmit your IP address to Stripe. It is used solely to determine the country relevant for VAT for as long as no billing address is on file. Once you provide a billing address, it takes precedence. The legal basis is Art. 6 (1) (c) GDPR (compliance with tax obligations).
Stripe
The provider for customers within the EU is Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland (hereinafter 'Stripe'). The data transfer to the USA is based on the Standard Contractual Clauses of the EU Commission. Details can be found here: https://stripe.com/de/privacy and https://stripe.com/de/guides/general-data-protection-regulation.
Last updated: 10/21/2026