Privacy Policy

This is an English translation of our privacy policy. The German version at /datenschutz is legally binding.

This privacy policy applies to the website uncoverflow.com, to contact requests and the Platform Check, to the accounts of our customers and their users, and to the performance of our contracts. Where we process data of visitors to our customers' websites, we act as a processor under Art. 28 GDPR — in the agency case as a sub-processor of the commissioned agency. The controller is then the respective customer or its end customer, and that party's privacy policy applies (see section 6).

1. Controller

The controller within the meaning of data protection law is:

Thilo Beier
uncoverflow
Uerdinger Str. 630
47800 Krefeld, Germany
Email: info@uncoverflow.com

uncoverflow is run as a sole proprietorship. Because fewer than 20 people are regularly engaged in the automated processing of personal data and no special categories of data within the meaning of Art. 9 GDPR are processed, there is no obligation to appoint a data protection officer under § 38 BDSG. Please send data protection requests to info@uncoverflow.com.

2. Hosting and server logs

This website and the service are hosted by netcup GmbH, Daimlerstraße 25, 76185 Karlsruhe, Germany; operation runs in the Nuremberg data centre (certified to ISO/IEC 27001). Storage and processing take place on servers in Germany. We additionally keep encrypted backups in a data centre in the Netherlands; for AI-assisted analyses we mainly transfer aggregated figures and users' inputs to a provider in the USA (section 8).

When this website and the service are accessed, we automatically record in server logs:

• IP address, truncated (IPv4 to the /24 network, IPv6 to the first 32 bits) — in the access log before storage, in the error log by the following day at the latest
• Date and time of the request
• Requested address; secrets in addresses (e.g. personal report links) are redacted
• Browser and operating system (user agent)
• Referring page

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in secure provision). Retention: web server logs are deleted automatically after 15 days; system and application logs (without full IP addresses) after 90 days.

To protect against overload and abuse, we count requests to our forms and interfaces per IP address. For this purpose the IP address is held in a cache for at most one minute and then deleted automatically. For technical reasons such an entry may be contained in a nightly, encrypted backup of this cache; these backups are deleted after 14 days. The legal basis is again Art. 6(1)(f) GDPR.

3. Your rights

Withdrawing consent

You can withdraw any consent you have given at any time with effect for the future. The lawfulness of processing carried out before the withdrawal remains unaffected.

Access, rectification, erasure, restriction, data portability

Within the statutory provisions you have the right to free access to your stored personal data, its origin and recipients and the purpose of processing, to rectification or erasure of this data, to restriction of processing, and to receive data that we process automatically on the basis of your consent or to perform a contract in a common, machine-readable format (Art. 15 to 20 GDPR).

Right to object (Art. 21 GDPR)

You have the right to object at any time, on grounds relating to your particular situation, to processing based on Art. 6(1)(f) GDPR. On this website this concerns in particular the server logs and audience measurement (sections 2 and 4). Please send your objection by email to info@uncoverflow.com.

Visitors to our customers' websites address their objection to the respective customer as controller. If the customer implements the objection with us, we permanently block the person concerned from any further transfer to advertising and analytics systems (section 6).

Right to lodge a complaint with a supervisory authority

In the event of breaches of the GDPR you have the right to lodge a complaint with a supervisory authority. The authority responsible for us is:

Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen
Postfach 20 04 44, 40102 Düsseldorf, Germany
www.ldi.nrw.de

4. Data collected on this website

Audience measurement without cookies

The public pages of this website set no cookies and store no identifiers on your device; a cookie banner is therefore not required. For simple audience measurement we use our own software in cookieless mode: page views are sent to our own server with a short-lived random identifier generated anew for each page view. There is no recognition across page views, no profiling, no advertising pixels and no disclosure to third parties; from the IP address we only derive the country, and the address itself is not stored. The only access to your device is reading an opt-out marker that you can set yourself via ?sst_optout=1 (§ 25(2) no. 2 TDDDG). Legal basis: Art. 6(1)(f) GDPR (legitimate interest in statistical analysis).

Contact (form and email)

If you contact us via the contact or analysis request form or by email, we process the data you provide (name, email address and — where provided — website, industry, budget range and message text) to handle your request and for follow-up questions. The details are stored on our server in Germany; the notification to us is sent as an email via our mailing provider (section 8). To ward off automated submissions, the form uses an invisible check field, without cookies and without third-party services. In addition we store the IP address and your browser's user agent in order to detect abusive submissions (Art. 6(1)(f) GDPR); we delete these two items after 30 days. We delete the request itself 12 months after receipt; if a contract results from it, the periods in section 9 apply to the contract documents.

Legal basis: Art. 6(1)(b) GDPR (pre-contractual measures) or Art. 6(1)(f) GDPR (legitimate interest).

Free Platform Check

If you use the Platform Check, we process the website address you enter and — only if you provide it voluntarily — your email address. Our server opens the address with an automated browser; in doing so it connects to the checked website and the services it embeds. Your own data is not transferred, and we block reports to advertising and analytics platforms during the check. We store the result together with the address on our server in Germany. It can be accessed via a link that cannot be guessed and is deleted automatically after 90 days. If the same address is checked again within 24 hours, we show the existing result; it contains no information about you.

We use the email address solely to send you an assessment of the result or to contact you about it. For this we receive an internal notification with the checked address and the link to the result, which we treat like a contact request. In the database the email address is deleted together with the result after 90 days.

To limit abuse we count checks per internet connection. Your IP address is not stored in plain text for this, only as a hash value (IPv6 addresses first truncated to the network range) in a cache that deletes the entry automatically after one hour; in its encrypted backups for at most 14 days.

Legal basis: Art. 6(1)(b) GDPR (performing the check you requested) or Art. 6(1)(f) GDPR (prevention of abuse).

Fonts — self-hosted

The font “Inter” is delivered from our own server. No connections to third parties are made when it loads.

5. Customer account, contract and payment

Order and conclusion of contract

When you place an order, we process the details of your company and of the person ordering (company, address, VAT ID or commercial register number, name, email address, website, any partner code used to attribute a referral) as well as your declarations — acceptance of the terms, the data processing agreement and instructions — with time, document version and checksum. As proof of the conclusion of the contract we also store the IP address and user agent at the time of ordering. We have a VAT ID you provide confirmed via the European Commission's VIES interface. Legal basis: Art. 6(1)(b) and (c) GDPR.

Payment processing

We invoice our fees via Stripe Payments Europe, Ltd., The One Building, 1 Grand Canal Street Lower, Dublin 2, Ireland. We transfer to Stripe the company, address, VAT ID, email address of the invoice recipients, the chosen plan and any partner code; you enter payment data (card or bank details) directly with Stripe, and it does not reach us. Legal basis: Art. 6(1)(b) GDPR (performance of contract) and (c) (tax obligations). Stripe processes payment data partly under its own responsibility (including fraud prevention and legal obligations) and also in the USA on the basis of standard contractual clauses; the Stripe privacy policy applies.

Customer account and admin area

For our customers' users we process name, email address, role, assigned projects, sign-in times and — for each sign-in and session — IP address and user agent, plus a log of administrative actions with IP address (e.g. changing settings, granting or withdrawing instructions, approving budget changes). Sign-in works via a one-time link to the stored email address; there are no passwords. In the admin area we set technically necessary cookies (sign-in session, 30 days; chosen language, 1 year; last selected project, 30 days) and store display settings in the browser's local storage (§ 25(2) no. 2 TDDDG). Legal basis: Art. 6(1)(b) GDPR; for sign-in data and the action log Art. 6(1)(f) GDPR (traceability and security). Retention: for the duration of the contract; expired sessions and links 30 days; the action log three years, entries that prove an instruction and the instruction log itself according to the periods for contract documents in section 9.

Report and chat links

Customers can share reports and an AI chat with third parties via personal links. When such a link is opened we process the technical data needed for delivery (section 2); the link itself is redacted in the logs. Questions asked via the chat link are treated like chat inputs (section 8, Anthropic).

Connected Google services and YouTube API Services

When you connect Google services in your customer account — Google Ads, Google Analytics, Search Console, Google Business Profile, Merchant Center, Data Manager or YouTube — we access the data of those accounts through Google's APIs with your permission: reports and metrics (e.g. ad costs, clicks, search queries, channel statistics), account settings, and the upload of conversions recorded by your tracking (section 6). We make changes to these accounts only within your instructions, i.e. after approval in the individual case or under contractually agreed rules.

For YouTube we use the YouTube API Services. We read your channel analytics (views, watch time, subscribers, traffic sources). If you choose “Allow editing”, we also read the title, description and tags of your videos and update them, but only after you have explicitly confirmed a proposal. On your behalf we also upload finished videos, including thumbnail and captions, to your channel, always as non-public at first (private or unlisted). A video becomes public only when a person approves that single video. We never delete videos and never comment. By using these features you agree to the YouTube Terms of Service; the Google Privacy Policy also applies.

Storage: We store the access tokens encrypted, together with the identifiers of the connected accounts and a log of changes. We delete video texts from YouTube and chat answers containing YouTube data after 30 days at the latest.

Use and sharing: We use data from Google APIs only to provide the features of your customer account. We do not sell it, do not use it for advertising and do not use it to train AI models. For the AI features (chat, proposals) we transfer the content required in each case to Anthropic (sections 7 and 8), which does not use it for training either. People at uncoverflow see this data only where it is necessary for the agreed service or your request, where you have consented, or where it is required for security or by law. uncoverflow's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Revoking access: You can disconnect YouTube at any time in the settings with “Disconnect YouTube”; we then revoke the access at Google and delete your YouTube data immediately. You can also remove access for all Google services in your Google account at myaccount.google.com/permissions; we then delete YouTube data after 30 days at the latest. Please send questions and complaints to info@uncoverflow.com. Legal basis: Art. 6(1)(b) GDPR.

6. uncoverflow as a tracking provider on customer websites

uncoverflow is a server-side tracking service used on our customers' websites and in their shop, telephony and calendar systems. If you visit a website that uses uncoverflow, the following applies:

• Controller for the processing is the respective customer (see its privacy policy) — in the agency case its end customer. uncoverflow acts as a processor under Art. 28 GDPR on the basis of a data processing agreement that the customer concludes during the order process and receives with the confirmation. The technical and organisational measures are its Annex III; the providers we use are listed in the list of sub-processors (German).
• Pseudonymisation: email addresses, phone numbers and names that reach us via our customers' websites are hashed with SHA-256 immediately on receipt and stored only in that form. Exceptions are postal code, city, region and country from orders: we store these in plain text because Google requires them unencrypted for address matching. If a customer has connected email marketing systems, we transfer the email address there in plain text; for this it is held only temporarily in the transfer queue (on failures up to six hours, in encrypted backups of the cache at most 14 days) and is not stored in the database. The hash is a pseudonymisation: it protects the plain text in our systems but does not make the data anonymous. Advertising platforms that know the same address can match the hash to their user accounts — this is exactly why it is transferred, on our customer's instruction.
• IP address: is not stored in the measurement and session data. We derive the country from it and pass it on — only with marketing consent or on the customer's documented instruction — to target systems that require it for matching.
• Recipients: we forward data exclusively to the systems that our customer has selected and connected with its own credentials (e.g. Google Ads, Google Analytics, Meta, Microsoft Advertising, TikTok, LinkedIn, Snapchat, Pinterest, email marketing systems). Whether forwarding requires consent or — for example for orders, calls and appointment bookings from our customer's systems — is based on another legal basis is determined by our customer as controller and described in its privacy policy. Every such instruction is logged with us with time, person and wording.
• Objection: if a person objects to the disclosure of their data, the customer implements this with us; the person is then permanently blocked from any further transfer to advertising and analytics systems — with all devices assigned to them and also against transfers from backend systems.
• Tenant separation: each customer has an isolated tenant. Personal or pseudonymous data of different customers is not combined. Only anonymised figures without any link to persons or customers are combined.
• Processing locations: servers in Germany; encrypted backups in the Netherlands; AI analyses in the USA (section 8).

7. AI-assisted analyses

For the data chat, the weekly report, analysis notes and ad drafts we mainly transfer aggregated figures, campaign and product names and users' questions and inputs to Anthropic (section 8). Contact details of our customers' end customers are never included in plain text; email addresses of account users from ad-account diagnostics are masked before transfer. Anthropic does not use the data to train AI models. For our customers' data this happens only on the customer's documented instruction (instruction no. 7 of the data processing agreement), which it can withdraw at any time. We delete AI chat histories 180 days after the last message and shared chat answers after 90 days.

8. Service providers

We use the following service providers, who act on our behalf (Art. 28 GDPR):

• netcup GmbH, Daimlerstraße 25, 76185 Karlsruhe, Germany — hosting, data centre in Nuremberg (Germany).
• Backblaze, Inc., 201 Baldwin Ave, San Mateo, CA 94401, USA — storage of encrypted backups in the EU-Central region (Amsterdam). The data is encrypted with AES-256 before transfer; only we hold the key. Basis for any third-country reference: standard contractual clauses in Backblaze's data processing agreement; according to its own statement Backblaze is certified under the EU-US Data Privacy Framework.
• Brevo SAS (formerly Sendinblue SAS), 7 rue de Madrid, 75008 Paris, France — sending of sign-in, system, alert and report emails and of the notifications from the contact form and Platform Check. Email address, name and content of the email are processed; data is held in the EU, access by the US company under Brevo's data processing agreement (standard contractual clauses).
• Anthropic Ireland, Limited, 6th Floor, South Bank House, Barrow Street, Dublin 4, Ireland, with processing by Anthropic, PBC, San Francisco, USA — AI analyses (section 7) and translation of the user interface. Basis of the transfer to the USA: standard contractual clauses in Anthropic's data processing agreement (Anthropic does not rely on the Data Privacy Framework). No use for training; deletion at Anthropic under its terms for API use, usually within 30 days.

Stripe (section 5) is partly a controller itself for payment processing and is therefore not listed here. The versioned list with change log that applies to customer data is available at /legal/unterauftragsverarbeiter (German).

9. Retention and deletion

We store personal data only as long as necessary for the purposes for which it was collected or as required by law.

• Web server logs: 15 days; system and application logs 90 days (section 2).
• Request counter (overload protection): IP address at most one minute, in encrypted backups of the cache at most 14 days.
• Contact requests: IP address and user agent 30 days; the request 12 months after the last correspondence.
• Platform Check: result, checked address and a voluntarily provided email address 90 days; the hash of the IP address one hour.
• Customer account: for the duration of the contract; expired sessions and sign-in links 30 days; action log three years.
• Connected Google services: access tokens until disconnection or end of contract; video texts from YouTube and chat answers containing YouTube data at most 30 days.
• Contract and billing documents (including proof of contract and instructions): according to commercial and tax law — business letters 6 years, accounting vouchers (e.g. invoices) 8 years, books and annual financial statements 10 years (§ 257 HGB, § 147 AO), each from the end of the calendar year.
• Tracking data on customer websites: according to the periods agreed in the data processing agreement. Default: events after 14 months (425 days), session data 90 days after the last activity, call data after 14 months, booking data after 24 months. After the end of the contract all of the customer's data is deleted once the retrieval period has expired.
• Backups: encrypted; database in regular operation at most 35 days, cache 14 days. Backups are not cleaned separately but expire.

10. SSL/TLS encryption

This site and the service use TLS encryption. You can recognise an encrypted connection by “https://” in the address bar and the lock icon in your browser.

11. Updates to this privacy policy

This privacy policy was last updated on 24 October 2026. Changes to our website and service or to legal or regulatory requirements may make it necessary to amend it. The current version is always available at /privacy (English) and /datenschutz (German, binding).