Loading...
Loading...
Last updated: October 28, 2026
How we process personal data on blog-maker.com and blog-maker.de. GDPR compliant.
Controller for data processing is Digital Mind Agency Ltd., Evagora Pallikaridi 38, 8010 Paphos, Cyprus, registered in the Cypriot company registry under HE 428155. Represented by Oliver Albrecht. General contact: hello@blog-maker.com. Data protection officer: not designated. Data protection contact: Oliver Albrecht, Digital Mind Agency Ltd., email privacy@blog-maker.com.
We process only the data necessary to operate the service. On registration we store your name, email address, and a hashed password (bcrypt). If you arrive via a campaign link (utm parameters such as source, medium and campaign), we store these origin details with your account to evaluate the success of our advertising (legitimate interest, Art. 6(1)(f) GDPR); on a purchase they are also passed to Stripe as metadata, and they are deleted with the account. On creating a brand we store domain, brand voice texts, and WordPress connection data (we store the app-password encrypted at field level with AES-256-GCM). For article generation we store topics, outlines, pipeline outputs, and final content. If you use Stripe Checkout we forward name, email, and customer ID to Stripe; we only store the Stripe customer ID locally. If you use the withdrawal form, we process the contract, your name and email address and, if you provide them, the order date, postal address and declaration date. We transmit the details to ourselves by email and send you a confirmation with a reference at your email address; delivering the confirmation can fail technically, in which case the result page shows you the reference. After submitting, you can save the confirmation as a file locally in your browser; nothing is transmitted to us when you do. If sending the confirmation fails, we receive an internal notice with the reference and contract details, but without your name and address. Section 7 describes which records we keep about a withdrawal.
We set technically necessary cookies for login session, locale (de/en), and A/B variant persistence. These are permitted without consent (Art. 6(1)(f) GDPR, legitimate interest). Optional analytics and marketing services load only after your active consent via the cookie banner (Basic mode: before you choose, no analytics or marketing script is loaded and no connection to the providers is made). For the Google services we use Google Consent Mode v2: the default state is 'denied' (analytics_storage, ad_storage, ad_user_data, ad_personalization), and signals are only set to 'granted' after your consent. In the banner you can allow or decline each service individually (e.g. only Google Analytics but no Meta Pixel).
Only with your active, per-service consent do we use: (1) Google Analytics 4 (provider Google LLC, USA; measurement ID G-ED583SQNZQ; reach measurement and page views with anonymized IP, anonymize_ip enabled; Consent Mode v2). (2) Meta Pixel (Meta Platforms Ireland Ltd.; conversion tracking and retargeting for Facebook/Instagram ads; the pixel has no Consent Mode pathway and is therefore hard-blocked in code until you consent to Meta; if you complete a subscription, we also send your email address to Meta as a one-way SHA-256 hash, never in plain text, so Meta can better attribute the subscription to the ad that led to it, Advanced Matching. In addition to the browser Pixel, we also send certain events server-side via the Meta Conversions API, so they still reach Meta even with an ad blocker or Safari's tracking protection active, with the same signals as the browser Pixel of the matching event: for page views and for watching a podcast video episode (first playback start and a full watch-through, if the episode has a hosted video), your browser's own cookie value (fbc/fbp), IP address, and user agent in plain text, no email hash; for the start and completion of a subscription, additionally the same hashed email address described above. Each server-side event carries the same event id as its browser-Pixel counterpart, so Meta does not count both as separate events). (3) Google Ads (Google LLC, USA; remarketing lists and conversion tracking; only active if configured). (4) Microsoft Clarity (Microsoft Ireland Operations Ltd.; heatmaps and session recordings to analyze user behavior; like the Meta Pixel it has no Consent Mode pathway and is therefore hard-blocked in code until you consent; only active if configured). For these services data is transferred to the USA; the transfer relies on the providers' EU-US Data Privacy Framework certification and, where that certification lapses, on Standard Contractual Clauses (SCC). We are jointly responsible with Meta Platforms Ireland Limited (Art. 26 GDPR) for collecting data via the Meta Pixel and the Conversions API; Meta provides the essential terms of the arrangement at facebook.com/legal/controller_addendum. Meta alone is responsible for any further processing by Meta, see Meta's privacy policy. Microsoft processes the Clarity data as an independent controller, see Microsoft's privacy statement. Your choice takes effect immediately and is documented (hashed IP and user agent, no plain-text storage, Art. 7 GDPR). You can revoke any consent per service at any time via 'Cookie Settings' in the footer or the privacy control at the bottom left; on revocation we remove the scripts, browser globals, and cookies that were set. Marketing emails: if you give the marketing consent at registration or switch it on in the settings (Art. 6(1)(a) GDPR) and your email address is confirmed, we transmit to KlickTipp (Klick-Tipp Limited, United Kingdom) your email address, your account ID, your language, your plan, a link to your next step in the app and a personal appointment booking link (which contains your email address and a random identifier). We also transmit status markers about your progress (account created, brand created, first article ready, first article published, paid plan, call booked). KlickTipp uses them to send onboarding, tips and offer emails that match your progress. Before transmitting data to KlickTipp we check your unsubscribe status there; if you unsubscribed at KlickTipp, we also withdraw your marketing consent with us. If you delete your account, we clear these details at KlickTipp, mark the entry as deleted and unsubscribe it. A data processing agreement is in place with KlickTipp; the transfer to the United Kingdom relies on the EU Commission adequacy decision. You can withdraw the consent at any time in the settings, which stops any new marketing emails and unsubscribes your entry at KlickTipp. If the unsubscribe fails technically on their side, we retry it automatically; you can also unsubscribe at any time via the unsubscribe link in each of these emails (or on request to privacy@blog-maker.com, in which case we have it deleted there).
Necessary for the service: Anthropic PBC (USA, AI article generation via Claude API). Per Anthropic Commercial Terms, API inputs are NOT used to train models by default (source: privacy.claude.com 'Is my data used for model training'). Standard Contractual Clauses (SCC) are auto-incorporated in the Anthropic Commercial DPA. Data is processed and stored in the USA. The commercial Anthropic API generally provides backend deletion within 30 days; contract variations, features with longer storage, legal requirements and abuse controls may differ. For flagged violations, Anthropic states up to two years for content and seven years for safety scores; certain Covered Models have separate safety rules. Perplexity AI, Inc. (USA, AI-powered web research with source citations, used automatically for topic and competitor research at article generation time). A planned extension would additionally let you optionally use Perplexity when manually enriching an article in the editor with extra context; this feature is not yet active. Once it launches, the context text entered there is sent to Perplexity so it can research facts with citations for it; third-party personal data should not be entered there. Perplexity's Data Processing Addendum is automatically incorporated by reference into the Perplexity API Terms of Service (source: perplexity.ai/hub/legal/dpa), including Standard Contractual Clauses (SCC) for the transfer to the USA; no separate signature is required. DataForSEO OÜ (Estonia, EU entity, company registration no. 14502291; SEO and keyword data for the keyword cluster feature, which lets you pull related keywords and search volume for a search term you enter). When you use this feature, the search term you enter (together with language and target country) is sent to DataForSEO; no brand, domain or account data is sent. Personal names should not be entered there. Per its own privacy policy, DataForSEO deletes stored data after 365 days. For transfers to third countries, DataForSEO uses Standard Contractual Clauses (SCC) or relies on adequacy decisions per its own privacy policy. The DPA is automatically incorporated by reference into DataForSEO's Privacy Policy (source: dataforseo.com/privacy-policy); no separate signature is required. Google Cloud EMEA Limited (Ireland, contracting party for the paid Gemini API; image generation via the Gemini API, Gemini Image models a.k.a. Nano Banana). When an article image is generated, we send the image prompt (derived from the article topic, image description and your brand's image guidelines) to Google; for place-specific motifs we additionally send publicly available reference photos (for example from Wikimedia Commons) as image input. When you edit an existing article image, we additionally send the current article image and your editing instruction to Google. The legal basis is performance of the contract (Art. 6(1)(b) GDPR); the purpose is generating the article images you request. Under the Gemini API Terms, Google does not use prompts and responses to improve its products when the service is used as a paid service (Paid Services); Google logs prompts and responses for a limited period solely to detect violations of its Prohibited Use Policy and for legally required disclosures (source: ai.google.dev/gemini-api/terms, effective March 23, 2026). Google states 55 days for prompts, context and outputs; for EEA use, Gemini's terms apply these Paid Services data rules even to free quota, and this does not promise a separate retention period specifically for uploaded images. For transfers to third countries the Google Data Processing Addendum applies, which provides for Standard Contractual Clauses (SCC) where no other transfer mechanism is available (source: business.safety.google/processorterms, version 10 of May 7, 2026). Even though the contracting party is a company in Ireland, processing may take place at Google's affiliates and subprocessors in the United States and other countries. Please do not enter third-party personal data in image descriptions. Stripe Payments Europe Ltd. (Ireland; payment processing; transfer to the USA based on the Data Privacy Framework and Standard Contractual Clauses; for fraud prevention and its own legal obligations Stripe is an independent controller). Plesk mail server (EU, transactional mail). ElevenLabs (Eleven Labs Inc., USA; speech output and transcription for the podcast feature; transfer based on the Data Privacy Framework and Standard Contractual Clauses; we have excluded the use of the data for model training). Bunny.net (BunnyWay d.o.o., Slovenia; hosting and delivery of podcast audio and video; when you play it, your browser connects directly to the Bunny server and your IP address is transmitted; after a switch to a plan without video delivery a video stays offline for 30 days and is deleted after a further 60 days). Calendly (Calendly LLC, USA; booking of consultation appointments; transfer based on the Data Privacy Framework and Standard Contractual Clauses). Web push: if you enable push notifications, we store the address of your browser's push service (Google, Mozilla, Apple or Microsoft), its keys, your account association and, where recognizable, only the browser family and major version (for example "Chrome 120") instead of the full user agent. We send notifications through that service, for example when an article generation, quality check, rewrite or translation has finished; they can contain the topic of your article. If you switch it off with us, we delete the entry for the address immediately. If you switch it off only in your browser settings, we usually delete the entry once the push service reports the address as expired on a later delivery; when your account is deleted, we remove all your push entries. Google sign-in and Search Console (Google LLC, USA or Google Ireland Limited): when you sign in with Google or connect your Search Console, we receive only the data you authorize (sign-in: name, email address; Search Console: performance data of your site for display and analysis in Blog-Maker). We store the refresh token of the Search Console connection encrypted; when you disconnect, we delete it on our side and request its revocation at Google. If your Google account is linked to your Blog-Maker account, we also store the identifier of the Google account; it is removed when your account is deleted. We do not store the tokens Google issues. If you sign in with Google and a Blog-Maker account with the same email address already exists, we first store the Google details (identifier of the Google account, email address, name and address of the profile picture; we do not store the tokens Google issues) in a linking request until you confirm the link with the password of your existing account. The request is valid for ten minutes and cannot be used afterwards. We automatically delete expired requests, as a rule within 24 hours; we remove them earlier when you confirm the link, try again with the same email address or your account is deleted. When you confirm, we transfer the identifier to your account and, if none is stored there yet, the address of the Google profile picture. Blog-Maker's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Google is an independent controller for this processing, see Google's privacy policy.
When you upload an image for an article, we check, orient and convert it to WebP without embedded metadata; the received original bytes are not stored permanently, we only store the cleaned version. This upload alone does not transmit the image to an AI provider. Access to unpublished images is protected to you alone; public delivery starts only once you decide to publish. We do not use your uploaded images for other customers' articles. For every upload we keep a provenance log: account, brand and article association, checksum, time, displayed text version and language, technical file details, origin, and deletion/publication status. Checksums and identifiers may be personal data; the log supports traceability and, where necessary, legal defence, and does not prove your image rights. It contains no IP address, user agent or original filename. We delete a log entry no earlier than 1 January of the fourth year after the year of recording (example: recorded in 2026, deleted no earlier than 1 January 2030); blocked entries remain for as long as the block lasts. AI providers only come into play when you separately request it: for an image description we transmit the image to Anthropic (Claude API); for AI editing we transmit it together with your editing instruction to Google (Gemini API). If you request both together, we disclose both steps before your request. A description alone does not change the image; results actually edited with AI receive an appropriate label. The AI action performed, the model, and, where applicable, the prompt are added to the provenance log. Details on how Anthropic and Google process data for these image features are in section 5 above. You may request removal of an image. Removing it from the current article alone does not automatically delete lawfully retained version references or copies on your own website; those copies must be removed there separately. We inform you about the scope of blocking or deletion within Blog-Maker; we cannot retrieve copies already downloaded. You can report possible infringements affecting uploaded or image-generated content through the linked reporting mechanism or hello@blog-maker.com; please provide the precise location and reason where possible. We assess every notice, acknowledge receipt where contact details are provided, and communicate our decision and available remedies; measures are targeted, not triggered merely by submitting a notice. The rights of people shown remain unaffected. Where we process personal log data on the basis of legitimate interests, you may object on grounds relating to your particular situation. We will assess whether compelling legitimate grounds or the establishment, exercise or defence of legal claims justify continued processing. Contact us at privacy@blog-maker.com.
If you connect an external application to your account (for example Claude via MCP), we store your authorization with the account and application identifiers, the permissions you granted and the access and refresh tokens issued. We also create an entry for the authorization in the action log (section 7): time, identifiers, permissions and an IP address truncated to its network prefix (IPv4 /24, IPv6 /48), without a browser identifier. In the dashboard under Settings, Connections you can see your active connections and revoke each one; when you do, we delete the authorization and all associated tokens, so the application can no longer access your account. The log entry remains until the end of its period in section 7. We remove expired entries of this connection data automatically, and when your account is deleted we also delete your authorizations and tokens.
When a customer publishes articles with Blog-Maker, Blog-Maker inserts a page-view counter: on WordPress and myLandingpage.ai targets with the myLandingpage.ai child theme as well as on FunnelExpert the counter runs on all plans. On other targets, we insert a counter pixel into the article on paid plans without the backlink discount. On Blog-Maker's own blog we do not use this counter; the services from section 4 apply there. For each view the counter records the page URL, the referrer where the counter supplies it, the country code (where it is sent as a header, unverified), the device category and the time. An embedded podcast player can additionally count playback start and playback progress (25, 50, 75 percent and end) on WordPress and myLandingpage.ai targets (child theme or the Blog-Maker podcast player plugin). The counter sets no cookies, uses no local storage in the browser and creates no device fingerprint. The IP address is not stored in the database; it is only processed in memory for a few minutes to limit abusive requests. The device category is derived from the browser identifier, which itself is not stored. The respective customer sees the counter data in their dashboard; apart from the customer, only the operator of Blog-Maker accesses it, as part of support and technical operations (maintenance, backup; for support access see section 6a). The staff of our host Dawico has technical administrative access to the server; access to the counter data is not intended for that staff (see section 6). Blog-Maker does not analyse it for its own purposes. For this counter data we act as the customer's processor under Art. 28 GDPR; the customer, as operator of the website, is the controller and determines the legal basis; it is often its legitimate interest in measuring the reach of its content (Art. 6(1)(f) GDPR), and whether consent is needed in its case is for the customer to check. As a visitor, you can best exercise your rights with the operator of the respective website; we forward requests to them. We are the controller for the short-term processing of the IP address in memory to protect against abusive requests and for the server log, in which our web server sees the IP address and browser identifier when the counter is requested (see section 6). As a rule, this log also contains the requested address including the details about the page passed along, and is deleted after about 14 days. The counter data is deleted 12 months after the view, earlier if the article is finally deleted or the customer account is deleted; database backups contain it for up to about eight more weeks. A data processing agreement under Art. 28(3) GDPR applies to the counter data. The counter is initially off for every brand. The customer switches it on in the brand settings; the agreement is shown at that point, and the counter is switched on only after its acceptance. We send the agreement and a confirmation of the acceptance by email. Without acceptance the counter does not count; the account itself can be used right away. For accounts created through a partner, the customer cannot accept the agreement themselves for now; the counter stays off for them. If the customer switches the counter off, we store no further calls; the counter data stored until then is deleted as described above 12 months after the respective view, and the customer can receive the export beforehand on request. Deletion runs in batches and can be delayed by a few days. Counter data stored before this agreement was introduced and without acceptance is not used any further; we keep it for up to 12 months after the respective view and then delete it; for this we are the controller on the basis of our legitimate interest (Art. 6(1)(f) GDPR), and you can contact privacy@blog-maker.com directly with requests. The customer can export their counter data in the dashboard per brand as a CSV or JSON file; for very large volumes (more than 50,000 rows on a single day) we send the export on request to privacy@blog-maker.com. The customer can switch the counter off in the brand settings; from then on no views are stored in the counter database; the server log keeps recording when the counter is called, as long as it is embedded, and the IP address is still processed in working memory for a few minutes (section 6).
Server infrastructure: Dawico Deutschland GmbH (dawico.de), certified to ISO 27001. Dawico's data centres are located in Berlin and Frankfurt am Main, and the servers can move between the two locations. Data Processing Agreement (DPA) under Art. 28 GDPR is in place. PostgreSQL 16 database. We back up the database daily (14 daily and 8 weekly backups, so up to about eight weeks). When our pages are requested, our web servers log technically necessary access data (IP address, time, requested address, status code, amount of data transferred, referrer and browser identifier) as well as error messages, which can also contain IP addresses, in order to keep the service secure and detect abuse (legitimate interest, Art. 6(1)(f) GDPR). The same applies to the log of our server firewall, which blocks suspicious requests. When the page-view counter is called (section 5c) we also process the IP address in memory for a few minutes to limit abusive requests, and do not keep it there permanently (legitimate interest, Art. 6(1)(f) GDPR). The server logs are archived daily and deleted after about 14 days, the firewall log after about 7 days. We do not run a web statistics service that stores IP addresses. Individual transfers to the providers named in sections 4 and 5 also take place outside the EU, in particular API calls to Anthropic, Perplexity, Google (image generation), DataForSEO, ElevenLabs (podcast) and Calendly. For our use of Anthropic there is currently no EU processing region; processing takes place in the USA, safeguarded by Standard Contractual Clauses (SCC). Podcast audio and video are hosted by BunnyWay d.o.o. (Bunny.net, Slovenia, EU).
For support, authorized Blog-Maker administrators can switch into your account (impersonation). They then see the data you see in your account and can generate, regenerate, refine, translate and publish articles and products on your behalf and edit and delete content and change connection details (for example publishing targets or the Search Console connection). The start of a support session is logged; if logging fails, no switch takes place. We also log an explicit end of the session. A support session ends on its own after one hour at the latest; this creates no separate end entry. During the session we log the actions named above (generating, regenerating, refining, translating, publishing, changing connection details) with identifiers of the article, product, newsletter or brand, without content and without credentials. What is logged is the attempt: an entry does not confirm that the action succeeded. Viewing data, and editing and deleting content within a support session, is not logged individually; direct inspection of an article or a brand in the admin area and a data export for your account are logged. In addition, support administrators can access brands, including the analytics, through an access grant issued internally by Blog-Maker (access grant for customer brands), without switching into your account: read-only or, depending on the grant, also with edit rights (generating, changing and deleting content and publishing or withdrawing via targets already set up; credentials and target management excluded). We record the issuing of such a grant in the administration log; later use of the grant is not logged individually there. We also log other administrative changes made in the admin area, with the time, the acting administrator account, the action, the affected account or object identifiers and action-related details, as a rule with the administrator's IP address and user agent. Customers are identified there by identifiers instead of their email address; detected email addresses are removed from the additional details before storage. Section 7 states when these logs are deleted.
We delete account data when your account is deleted; it can remain in our database backups for up to about eight weeks and is removed there by regular overwriting. Articles and brand data are deleted by the user actively. For each article we additionally keep earlier versions in its revision history: up to 20 versions created before a change (for example before an AI-assisted rewrite, a regeneration or restoring an earlier version), and separately up to 10 automatic snapshots created when changes to an article are saved, for example in the editor. Once the respective maximum is reached, we delete the oldest version of the same kind automatically and irrevocably when a new version is created. We keep payment, invoice and accounting data for as long as the legal provisions that apply to us require: six years after the end of the relevant tax year (Companies Law Cap. 113 Art. 141 and Assessment and Collection of Taxes Law 4/1978, Cyprus). Consent records are stored in the database. They contain the time, the choice, the text version, the source, a session identifier, for signed-in users the account association and a country code; IP address and user agent are stored only as hash values, not in plain text. This covers the cookie choice, the acceptance of the terms and the decision on marketing emails at registration, and the confirmation of the waiver of the right of withdrawal at purchase (with plan and billing cycle). A record is kept until the end of the third calendar year after it was recorded (a 2026 record is deleted no earlier than January 1, 2030); the automatic cleanup runs daily in bounded batches, so a backlog can delay deletion. While your account exists, your latest per-service cookie decision linked to your account (that is, one recorded while you were signed in) and your latest registration record of acceptance of the terms are kept regardless of age. If you delete your account, we remove the account association of these records; the records themselves follow the calendar period. Logs of administrative actions (with the IP address and browser identifier of the acting administrators; for events you trigger yourself, such as an OAuth consent, with a shortened IP address and no browser identifier) are deleted after 12 months. The log also names the email address of the acting administrator; it remains there after the deletion of that administrator account until the entry is deleted after 12 months. Withdrawal declarations (name, contact details, contract) are kept as evidence until the end of the third calendar year after the withdrawal and deleted afterwards. When you withdraw via the withdrawal form, we additionally create a log row with a reference number, a hashed IP address, a hashed user agent and the country code (hash values, without name and email address); it is deleted after the same period. We keep the proof that a customer accepted the counter processor agreement (contract version, time and way of acceptance, plus a pseudonymous reference (hash of the old account ID, attributable with that ID)) for six years after the account is deleted, detached from the account, to be able to defend legal claims connected with the agreement (Art. 6(1)(f) GDPR).
You have the right to: access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), objection (Art. 21), data portability (Art. 20). Send an email to privacy@blog-maker.com. We respond within 30 days. You can also file a complaint with the relevant supervisory authority (in Cyprus: Office of the Commissioner for Personal Data Protection, https://www.dataprotection.gov.cy).
Encrypted connection (TLS 1.3, HSTS), password hashing (bcrypt cost 12), brand credentials encrypted with AES-256-GCM and cryptographically bound to the brand and target, review of the security of our systems when needed. In the event of a personal data breach: If it concerns data for which we are the controller (for example your account, your payment data or server logs), we notify the competent supervisory authority without undue delay and, where feasible, within 72 hours, unless the breach is unlikely to result in a risk to individuals. If the breach is likely to result in a high risk to you, we inform you without undue delay. If it concerns data we process for you as a processor (for example the page view counter on your sites), we inform you without undue delay; as the controller, you then decide whether and how to notify the supervisory authority and your visitors, and we support you in doing so.
We update this policy when features or processors change. Last change: October 28, 2026 (section 7: number of stored article versions corrected, up to 20 versions before changes and up to 10 automatic snapshots instead of 4). Before that October 27, 2026 (section 4: effect of withdrawing marketing consent reworded, no new marketing emails instead of no new invitations). Before that October 26, 2026 (section 4: details transmitted to KlickTipp for the onboarding sequence, unsubscribe status check and account deletion flow added). Before that October 17, 2026 (section 2: statement on the encryption of the app-password clarified, it is encrypted at field level, no statement on disk encryption). Before that October 16, 2026 (section 1 extended with the data protection contact, contact for data subject rights is privacy@ (sections 4, 5a and 8); section 5a extended with the deletion period of the provenance log; section 5c on the page-view counter on customer websites added, Blog-Maker acts as processor for it, with a data processing agreement, switching the counter on only after acceptance of the agreement (opt-in), rules for partner accounts and deletion periods for the counter data; section 6: ISO 27001 and data centres in Berlin and Frankfurt am Main (servers can move), the statements on ISO 50001, ISO 9001, data remaining in Germany and database encryption removed, transfers also outside the EU, short-term processing of the IP address when the counter is called added; section 6a extended with access grants for customer brands; section 7: proof of acceptance of the agreement kept six years after account deletion; section 9: data breaches in the processor case added, security review when needed instead of regular audits, no fixed cycle of security reviews promised; answer on the article counter in the FAQ adjusted). Before that October 15, 2026 (section 9 on data breaches aligned with Art. 33 and 34 GDPR). Before that, October 8, 2026 (Google tokens are no longer stored when linking a Google account; the contracting party for Gemini image generation is Google Cloud EMEA Limited, section 5). Before that, October 7, 2026 (email address of the acting administrator in the administration log, storage when linking a Google account with automatic deletion of expired requests and server logs with a deletion period added, sections 5, 6 and 7). Before that, October 6, 2026 (withdrawing the marketing consent now also unsubscribes you at KlickTipp; withdrawal log row with hashed IP added, provider list extended with KlickTipp, ElevenLabs, Bunny.net, Calendly, web push and Google sign-in and Search Console, Sentry removed, retention periods and transfer bases clarified). Also on October 6, 2026 (details on consent records and their retention, the withdrawal form, support access and the administration log, push notifications, connections of external applications and the Google tokens added, sections 2, 5, 5b, 6a and 7). Before that, September 21, 2026 (added section 5a on uploaded images and the provenance log). Before that, September 19, 2026 (Google Gemini added as data processor for image generation). Before that, September 18, 2026 (keyword cluster feature with DataForSEO as data processor is available, details on transmitted data and retention added; origin details from campaign links at registration added). We inform you by email or in the dashboard about material changes.