Privacy Policy & GDPR Information

1. Controller

Controller within the meaning of the General Data Protection Regulation (GDPR) is:

This website is jointly operated by two legally independent companies. Both act as joint controllers within the meaning of Art. 26 GDPR.

If you have any questions about data protection, you can reach us at the email address above.

2. Data Collection on this Website

What data is collected?

When visiting this website, the following data is automatically collected:

• IP address (anonymized)
• Date and time of the request
• Time zone difference to Greenwich Mean Time (GMT)
• Content of the request (specific page)
• Access status/HTTP status code
• Amount of data transferred
• Referrer URL (previously visited page)
• Browser and browser version
• Operating system

Legal Basis

Processing is based on Art. 6 (1) (f) GDPR. Our legitimate interest lies in ensuring trouble-free operation of our website and improving our services.

Storage Duration

Server log files are automatically deleted after 30 days.

3. Hosting and Content Delivery Network (CDN)

Dedicated Server (Hetzner Online GmbH)

This website runs on a dedicated server of Hetzner Online GmbH (Industriestr. 25, 91710 Gunzenhausen, Germany) in data centers located in Germany. Deployment is handled by a self-hosted Coolify instance on the same server. Server administration and responsibility lie with us.

Hosting at Hetzner does <strong>not</strong> involve any transfer of personal data to third countries. However, due to the use of Cloudflare as CDN, data may be routed through US servers (see Cloudflare section below).

Legal basis: Art. 6 (1) (f) GDPR (legitimate interest in secure and fast website delivery).

More information: Hetzner Privacy Policy

Content Delivery Network (Cloudflare)

To accelerate page delivery and protect against DDoS attacks, we use Cloudflare as a Content Delivery Network (CDN) and DNS provider. All HTTP requests to our website are routed through Cloudflare's global network.

Processed Data

Cloudflare necessarily processes the following data:

• User's IP address
• Requested URL and HTTP headers
• Time of access
• Amount of data transferred
• Referrer and user agent

Cloudflare is based in the USA (Cloudflare Inc., 101 Townsend St, San Francisco, CA 94107). Data transfer is based on the EU-US Data Privacy Framework (adequacy decision) and additionally through EU Standard Contractual Clauses (SCCs).

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in the security and fast delivery of the website).

More information: Cloudflare Privacy Policy

4. Database and Backend (Supabase)

For storing and processing data, we use Supabase, an open-source backend-as-a-service platform.

Processed Data

The following data is stored in Supabase:

• Contact form inquiries (name, email, message)
• Blog content and comments
• User accounts (if registered): email, encrypted password
• CRM data for business contacts

Server Location

Our Supabase instance is hosted in the EU region (Frankfurt, Germany) to meet GDPR requirements.

Security

Supabase uses encryption both in transit (TLS/SSL) and at rest (AES-256). Passwords are hashed with bcrypt.

Legal basis: Art. 6 (1) (b) GDPR (contract fulfillment) and Art. 6 (1) (f) GDPR (legitimate interest).

More information: Supabase Privacy Policy

5. Cookies

Our website uses cookies. Cookies are small text files stored on your device that save certain settings and data.

Types of Cookies

Change cookie settings

You can change your cookie settings at any time via the "Cookie Settings" link in the footer of this website or withdraw your consent.

Legal basis: Art. 6 (1) (a) GDPR (consent) for optional cookies; Art. 6 (1) (f) GDPR for technically necessary cookies.

6. Embedded Content (Third Parties)

Our website embeds content from third-party providers. These integrations may result in providers setting cookies or collecting your IP address.

Figma

Legal basis: Art. 6 (1) (a) GDPR (consent). Embedding only occurs if you have agreed to functional cookies.

7. Contact Form and Email Contact

When you contact us via contact form or email, your information will be stored for processing the inquiry and for possible follow-up questions.

Collected Data

• Name
• Email address
• Message content
• Time of inquiry
• IP address (for spam prevention)

Storage Duration

Data will be deleted as soon as it is no longer necessary for the purpose of its collection. For personal data from contact forms, this is the case when the respective conversation has ended.

Legal basis: Art. 6 (1) (b) GDPR (pre-contractual measures) and Art. 6 (1) (f) GDPR (legitimate interest in answering inquiries).

8. AI & Machine Learning

We use Artificial Intelligence (AI) to provide you with automated SEO analyses, recommendations, and reports. Data is transmitted to the following AI service providers:

Processed Data

• Website URLs entered by you
• Publicly accessible content of analyzed websites (HTML structure, meta tags, headings, text)
• Generated analysis results and recommendations

API Usage Logging

For quality assurance and billing, we log the use of AI services. Stored data includes: user ID, provider used, model, number of tokens, and cost. The prompts and responses themselves are not permanently stored.

Third Country Transfer

Both Google Gemini (Google LLC, USA) and the fallback providers Anthropic (USA) and Groq (USA) transfer data to the United States. The transfer is based on the EU-US Data Privacy Framework (EU Commission adequacy decision of 10 July 2023) with EU Standard Contractual Clauses (Decision 2021/914) as additional safeguard. The DPF certification status of individual providers can be checked at dataprivacyframework.gov.

Transparency Notice (EU AI Act)

AI-generated content is clearly labeled in our analysis reports. No automated individual decisions within the meaning of Art. 22 GDPR are made — the AI serves exclusively as an analysis and recommendation tool.

Legal basis: Art. 6 (1) (b) GDPR (contract fulfillment) and Art. 6 (1) (f) GDPR (legitimate interest in providing accurate analyses).

Storage duration: API usage logs are deleted after 90 days. Analysis results are stored for 2 hours (free) or 30 days (premium).

8a. External SEO and Security Data Sources

For the website analysis, SEO and security features we use the following external APIs. With each request, URL parameters, domain names where applicable and technical request data are transmitted to the respective provider. Personal data of our users is — unless stated otherwise — not transmitted.

8b. Google API Services for Data Enrichment

For our Website Analyzer and SEO features we use the following additional Google Cloud APIs (in addition to Google Search Console, Google Analytics Data API and Google Ads API documented above):

• Google Cloud Vision API — image analysis of screenshots during on-page audits
• Google Places API / Google Maps Platform (server-side) — location validation and local SEO features
• Google Custom Search JSON API — programmatic web search for keyword research and backlink discovery
• Google Safe Browsing API — security checks for analyzed domains
• Google Knowledge Graph Search API — entity recognition for backlink quality scoring
• Google CrUX API (Chrome User Experience Report) — Core Web Vitals data from real users

Provider

Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. For intra-European services represented by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

Purpose

Automated data enrichment and technical analysis of web pages evaluated through the Website Analyzer.

Data categories

Domain names and URLs entered by the user, technical request metadata (request-side IP address, our server's user agent). For the Vision API additionally server-generated screenshots of the analyzed pages. No account data of our registered users.

Legal basis

Art. 6 (1) (f) GDPR (legitimate interest in providing the analysis feature). For logged-in users additionally Art. 6 (1) (b) GDPR (contract performance).

International transfer

USA — based on the EU-US Data Privacy Framework (Google LLC is DPF-certified) with EU Standard Contractual Clauses (Decision 2021/914) as additional safeguard.

8c. SearXNG (self-hosted meta search engine)

We run our own instance of the open-source meta search engine SearXNG on our infrastructure in Germany (Hetzner Online GmbH, Falkenstein / Nuremberg data centre). SearXNG aggregates results from public search engines without establishing a direct connection between our users and those search engines.

Purpose

Anonymised SERP data collection for internal SEO research, backlink discovery and link-building features.

Data processing

Queries are processed server-side on our own infrastructure. No personal data of our users is transmitted to external search engines; queries are sent from our server IP and contain no user identifiers.

International transfer

None. Server location Germany.

Legal basis: Art. 6 (1) (f) GDPR (legitimate interest in providing the analysis feature).

9. Website Analysis & Crawling

Our Website Analyzer examines websites entered by you to perform SEO audits, WCAG accessibility checks, and backlink analyses.

How it Works

We use automated methods (web crawling via BeautifulSoup and httpx) to analyze publicly accessible web pages. Only freely available information is collected — no login-protected areas or non-public content is accessed.

Collected Data

• URLs entered by you
• Publicly accessible HTML content (meta tags, headings, links, text)
• Sitemap structures and robots.txt rules
• HTTP status codes and response times
• Accessibility attributes (ARIA, alt texts, contrast ratios)

No Personal Data of Third Parties

Only publicly accessible, technical information from the analyzed websites is collected. Personal data appearing on the analyzed websites is neither extracted nor stored.

PDF Report Generation

For premium analyses, we generate PDF reports using Playwright/Chromium. The generation takes place entirely on our server — no data is transmitted to third parties.

Legal basis: Art. 6 (1) (b) GDPR (contract fulfillment) and Art. 6 (1) (f) GDPR (legitimate interest in providing the analysis service).

Storage duration: Analysis cache 2 hours (free) or 30 days (premium). URLs and analysis results are automatically deleted upon expiration.

10. Payment Processing (Revolut)

For payment of our premium analysis services, we use the payment service provider Revolut.

Payment Service Provider

Data Transmitted to Revolut

• Payment amount (€3.99)
• Email address (if provided)
• Order description (shortened URL of the analyzed website)

Actual payment data (credit card number, bank details, etc.) is processed exclusively by Revolut as an independent controller. We have no access to this sensitive payment information.

Data Stored by Us

• Revolut order ID (for payment assignment)
• IP address (at the time of the order)
• Email address (if provided)
• Payment status and timestamp
• License status and validity period (30 days)

Third Country Transfer

Revolut Bank UAB is based in Lithuania (EU). However, Revolut may transfer your data to companies outside the EEA as part of payment processing. Revolut has implemented appropriate safeguards in accordance with GDPR requirements.

Legal basis: Art. 6 (1) (b) GDPR (contract fulfillment — payment processing is necessary to provide the service you requested).

Storage duration: Payment data (order ID, status) is stored for up to 10 years in accordance with commercial and tax law retention obligations. License data is deleted 30 days after expiration.

Revolut Privacy Notice

10a. Appointment Booking via Microsoft Bookings

You can book appointments (e.g. consultations) via our booking widget. The technical basis is Microsoft Bookings / Microsoft Graph API. The booked slot is written to our Microsoft 365 / Outlook calendar and a Microsoft Teams meeting link is generated.

Data collected

• Name
• Email address
• Phone number (optional)
• Topic / inquiry (optional)
• Requested time slot (date, time, timezone)
• IP address, timestamp of booking

Recipient / Processor

Legal basis: Art. 6(1)(b) GDPR (preparation and performance of a contract or pre-contractual measure on request).

Retention: Data is deleted when no longer needed, subject to statutory retention obligations (up to 10 years for contract documents under German commercial / tax law).

More: Microsoft Privacy Statement

10b. Lead Capture, Newsletter Sign-up & Premium PDF Delivery

We collect email addresses in two places on our website: (1) in the Website Analyzer to deliver the full SEO report as a PDF and (2) in the newsletter sign-up in the sidebar of our blog posts for regular practical tips on SEO, GEO and web development. Both flows use a strict double opt-in mechanism: after entering your address we send a confirmation email; only after you click the confirmation link are you added to our newsletter list — and in the analyzer flow the PDF is dispatched as well.

Data collected

• Email address (mandatory)
• Name (optional, analyzer flow only)
• Phone number (optional, analyzer flow only)
• Analyzed URL and score (analyzer flow only, technical context)
• Premium key (analyzer flow only, to match the PDF report)
• Sign-up source (e.g. "analyzer-loader" or "blog-sidebar")
• Confirmation token, sign-up & confirmation timestamps
• IP address (technical, for anti-spam)

Storage & Processors

Lead data is stored in our own database on Supabase (EU region Frankfurt). For confirmation/report emails and newsletter management we use Brevo (Sendinblue SAS); for individual workflows (e.g. internal notifications, booking) we also use Microsoft 365 SMTP via Microsoft Ireland Operations Limited. Confirmed newsletter sign-ups are transferred to a dedicated Brevo contact list with the sign-up source ("analyzer-loader" or "blog-sidebar") stored as an attribute.

Legal basis: Art. 6(1)(b) GDPR (pre-contractual delivery of the requested PDF report in the analyzer flow) and Art. 6(1)(a) GDPR (consent for newsletter via double opt-in, both in the analyzer flow and in the blog sidebar sign-up).

Withdrawal: You can withdraw your newsletter consent at any time via the unsubscribe link in every email or by writing to info@the-freelancer-marketing.de. Withdrawal has effect for the future only.

Retention:Unconfirmed leads are deleted after 30 days. Confirmed newsletter subscribers are stored until they unsubscribe. Dispatch logs (e.g. "PDF sent on ...") are kept for up to 3 years as evidence.

More: Brevo Privacy Policy

11. Your Rights under GDPR

You have the following rights regarding your personal data:

• Right of Access: You can request information about your personal data stored with us (Art. 15 GDPR).
• Right to Rectification: You can request the correction of inaccurate data (Art. 16 GDPR).
• Right to Erasure: You can request the deletion of your data, provided there are no legal retention obligations (Art. 17 GDPR).
• Right to Restriction: You can request the restriction of processing (Art. 18 GDPR).
• Right to Data Portability: You can receive your data in a structured format (Art. 20 GDPR).
• Right to Object: You can object to processing if it is based on Art. 6 (1) (f) GDPR (Art. 21 GDPR).

12. SSL/TLS Encryption

This website uses SSL/TLS encryption for security reasons and to protect the transmission of confidential content. You can recognize an encrypted connection by the address bar of the browser changing from "http://" to "https://" and by the lock symbol in your browser line.

When SSL/TLS encryption is activated, the data you transmit to us cannot be read by third parties.

13. Storage Duration

We only store your personal data for as long as is necessary for the respective purposes or as required by legal retention periods.

14. Changes to this Privacy Policy

We reserve the right to adapt this privacy policy to ensure it always complies with current legal requirements or to implement changes to our services.

The new privacy policy will apply to your next visit. We recommend that you read this privacy policy regularly.