Privacy Policy

This English text is a convenience translation. The legally binding version is the German one at brandzaps.ai/datenschutz/; in the event of any discrepancy, the German wording prevails.

1) Introduction, scope and controller's contact details

1.1 We appreciate your interest. Below we inform you about how we handle your personal data. Personal data is any data that can be used to identify you personally.

1.2 This policy covers two separate offerings:

• the website at https://brandzaps.ai - sections 2 to 5,
• the BrandZaps application at https://app.brandzaps.ai, accessible only after registration - sections 6 to 13.

The processing involved differs considerably between the two. Which section applies to you depends on which of the two offerings you use.

1.3 The controller within the meaning of the General Data Protection Regulation (GDPR) is Cyber Sour UG (haftungsbeschränkt), Zerbster Str. 9, 04129 Leipzig, Germany, phone: +49 341 30 67 88 38, e-mail: info@cyber-sour.com. The controller is the natural or legal person who, alone or jointly with others, determines the purposes and means of the processing of personal data.

1.4 Both offerings are delivered exclusively over an encrypted connection (SSL/TLS), recognisable by "https://" and the padlock symbol in the address bar.

Part A - The website brandzaps.ai

2) Visiting the website

For purely informational use, we only collect the data that your browser transmits to the server (server log files):

• page accessed,
• date and time of access,
• amount of data transferred,
• referring source,
• browser used and its version,
• operating system used,
• IP address.

This processing is carried out pursuant to Art. 6(1)(f) GDPR on the basis of our legitimate interest in the stability and security of the website. The data is not passed on or otherwise used; we reserve the right to review the logs retrospectively where there are concrete indications of unlawful use. The logs are deleted after 90 days.

3) Hosting

The website, as well as the automation instance described in section 5, is operated by lima-city, a service of TrafficPlex GmbH, Konsul-Smidt-Str. 90, 28217 Bremen, Germany. The servers are located in Germany. A data processing agreement is in place with the provider. No content delivery network is used upstream.

4) Cookies and storage on your device

4.1 Technically necessary cookies of the hosting provider. When any page is accessed, the server sets two cookies named _lcp and _lcp3. They serve to detect and prevent spam and automated access by our hosting provider lima-city and cannot be disabled without compromising the secure operation of the website. They are therefore strictly necessary for providing the service you have expressly requested, within the meaning of section 25(2) no. 2 TDDDG; consent is not required for them. The legal basis for any resulting processing of personal data is Art. 6(1)(f) GDPR on the basis of our legitimate interest in protecting our website from misuse.

4.2 Cookies requiring consent. Cookies and comparable technologies are used for the analytics and marketing services described in section 5. These are set exclusively if you have agreed to them in the consent dialog.

4.3 Storage in your browser by us. Our website itself does not set any cookie. It stores the following in your browser's local storage:

These values never leave your device and are not transmitted to us. The legal basis for storing your consent decision is Art. 6(1)(c) GDPR - we are legally obliged to be able to demonstrate consent given and withheld.

4.4 Consent dialog. The dialog is built in-house; no external provider is involved. A rejection is stored for exactly as long as a consent. You can change your decision at any time via the cookie settings.

5) Analytics, marketing and waitlist

All processing described in sections 5.1 to 5.4 - in particular the setting of cookies and the reading of information on your device - takes place exclusively on the basis of your express consent pursuant to Art. 6(1)(a) GDPR. Without your consent, none of it takes place at all. You can withdraw your consent at any time with effect for the future by deactivating the respective service in the consent dialog.

5.1 Google Tag Manager. Provider: Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland. Tag Manager bundles the control of the services used behind a single interface. It does not itself store information on your device and performs no analysis of its own; however, your IP address is transmitted to Google when a page is accessed. Transfer to Google LLC servers in the USA is possible.

5.2 Google Analytics 4. Provider: Google Ireland Limited (address as above). The service lets us analyse your use of our website. Among other things, it collects pages accessed, time on page, origin of the visit and your IP address, which Google truncates by the last digits so that it can no longer directly identify you. The information is transmitted to and processed on Google's servers; transfer to Google LLC servers in the USA is possible. Google uses this information on our behalf to evaluate your usage and compile reports on website activity. The collected data is deleted after two months.

5.3 Microsoft Clarity. Provider: Microsoft Corporation, One Microsoft Way, Redmond, WA 98052-6399, USA. Using cookies and comparable technologies, the service collects pseudonymised visitor data, including IP address and browser information, and derives your usage behaviour from it. This includes, among other things, movement-pattern analysis (heatmaps), time on page, and interactions such as scrolling, clicks and mouse movements. Pseudonymisation generally rules out direct identification of you; the data is not combined with clear-text data collected elsewhere.

5.4 Meta Pixel. Provider: Meta Platforms Ireland Limited, 4 Grand Canal Square, Dublin 2, Ireland. The service lets us measure the effectiveness of our advertisements on Facebook and Instagram and show matching ads to visitors of our website there. Among other things, it records whether you reached our website after clicking an advertisement and what actions you take on it. The data collected is anonymous to us; however, Meta may attribute it to the respective user profile and use it for its own advertising purposes. Transfer to Meta Platforms, Inc. servers in the USA is possible.

5.5 Waitlist. You can join a waitlist on the website. We collect your first name and e-mail address; we do not request any further information. We additionally transmit the language of the page visited and the location where you opened the form, in order to assign your sign-up to the correct list.

The sign-up is processed through our own automation instance, operated by lima-city in Germany, and passed to Brevo GmbH, Köpenicker Str. 126, 10179 Berlin, Germany. Brevo sends the confirmation e-mail and manages the list. We use the double opt-in procedure: your sign-up only takes effect once you confirm it via the link in the confirmation e-mail.

The legal basis is your consent pursuant to Art. 6(1)(a) GDPR. You can withdraw it at any time with effect for the future - via the unsubscribe link in every e-mail, or by writing to us. Your address is then removed from the list without undue delay.

When processing your sign-up, your IP address is stored, alongside your first name and e-mail address, in the execution data of our automation instance. This execution data is deleted after 90 days.

A data processing agreement is in place with Brevo.

5.6 Data transfers to the USA. Google, Microsoft and Meta have all joined the EU-US Data Privacy Framework, which, on the basis of an adequacy decision of the European Commission, ensures compliance with the European level of data protection.

Data processing agreements are in place with the providers named above.

Part B - The application app.brandzaps.ai

BrandZaps is a tool that lets you measure and improve your brand's visibility in search engines and in AI answer systems. To do so, you connect your own Google and Bing accounts to BrandZaps.

The application uses no analytics and no advertising services. It loads no third-party scripts; this is technically enforced. The application contains no Google Analytics, no tag manager, no advertising pixels, no maps, no push notifications and no mobile app.

6) Registration and user account

6.1 An account is required to use the application. We collect your first name, last name, e-mail address and password, as well as your acceptance of the privacy policy and general terms and conditions, together with the time of acceptance. The password is stored exclusively as a cryptographic hash value, never in plain text.

Registration uses the double opt-in procedure: it is only complete once you have confirmed your e-mail address via the link we send you.

The legal basis is Art. 6(1)(b) GDPR (performance of the usage agreement).

6.2 Two-factor authentication. You can additionally secure your account with an authenticator app. In doing so, we store the associated secret key and recovery codes. The legal basis is Art. 6(1)(f) GDPR on the basis of our legitimate interest in account security.

6.3 Notification settings. You decide, for each type of notification, whether you want to receive it. These settings belong to your account.

7) Signing in with Google

You can alternatively sign in with your Google account. The provider is Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland; transfer to Google LLC in the USA is possible.

Google transmits to us exclusively your Google user ID, your first and last name, your e-mail address and the address of your profile picture. We do not request any further information - in particular no address, no date of birth and no gender.

We use this data exclusively to create and match your BrandZaps account. No data is transferred from BrandZaps to your Google account.

The legal basis is your consent pursuant to Art. 6(1)(a) GDPR, which you give by signing in via Google, as well as Art. 6(1)(b) GDPR for the subsequent administration of your account. You can withdraw your consent at any time with effect for the future.

For data transfers to the USA, the provider has joined the EU-US Data Privacy Framework. Further information: https://business.safety.google/intl/de/privacy/

8) Data from your connected accounts

This section describes the data that BrandZaps retrieves on your behalf from your own accounts. You decide individually, for each source, whether and with which account to connect it, and then choose which property or location we may read. Every connection can be disconnected individually again.

8.1 Google Search Console. Access is restricted to read-only access. We retrieve the list of your verified properties, as well as search performance for the last 90 days - search queries, pages accessed, country and device type, with the metrics clicks, impressions, position and click-through rate. The search queries form the basis for keyword research and topic modelling for your project.

8.2 Google Analytics 4. Access is restricted to read-only access. We retrieve the list of your properties, as well as a report for the last 90 days by date and page path, with the metrics active users, sessions, page views and conversions. We expressly do not retrieve user-related identifiers, demographic or geographic characteristics, or individual profiles. We display these aggregated figures to you in your project so you can judge whether a change had an effect.

8.3 Google Business Profile. We retrieve your accounts and locations, as well as the daily figures for website clicks, call clicks and direction requests. We only read; we change nothing on your profile. Google does not offer a read-only scope for these interfaces; the only available permission scope is called business.manage and technically also includes write access, which we do not exercise.

8.4 Bing Webmaster Tools. Provider: Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland. We retrieve the list of your sites, as well as clicks and impressions for the last 90 days. Access is read-only.

8.5 Legal basis, storage and protection. The legal basis for the retrieval is Art. 6(1)(b) GDPR - evaluating this data is the contractually owed service - as well as the consent you have given to the respective provider.

We store access and refresh tokens encrypted; the key is kept separately from the database. The retrieved data is held, assigned to your project, in our database. Separation between different customers is additionally enforced in the database itself, not solely in the application.

8.6 Compliance with the Google API Services User Data Policy. BrandZaps' use and transfer of information received from Google APIs complies with the Google API Services User Data Policy, including the Limited Use requirements:

BrandZaps' use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

In particular, this data is not used for advertising, not sold, not passed on to data brokers, and not used to train or improve general-purpose AI language models.

9) Processing by AI providers

To evaluate your project and measure your visibility in AI answer systems, we use language models from external providers. This involves transmitting content from your project - in particular content from your website, your business profile, and the search queries referred to in section 8.1. Login credentials, passwords and payment data are not transmitted.

The following are used:

9.1 No training on your data. We have agreed with OpenAI that submitted content is not retained ("Zero Data Retention"). For all providers used, any use of the submitted content to train or improve their models is excluded.

9.2 Transfer to the People's Republic of China. No adequacy decision of the European Commission pursuant to Art. 45 GDPR exists for the People's Republic of China. We therefore base the transfer to the aforementioned providers on Standard Contractual Clauses of the European Commission pursuant to Art. 46(2)(c) GDPR, supplemented by an assessment of the legal situation in the recipient country and additional safeguards.

We expressly point out that a level of protection equivalent to that of the European Union is not guaranteed in every respect in the People's Republic of China. In particular, state authorities may have far-reaching access rights to personal data, and enforcing data subject rights may be more difficult. We therefore transmit only the content required for measurement - brand and topic terms, as well as publicly available information about your company. Contact details, login credentials and data from your connected accounts under section 8 are not transmitted to these providers.

The legal basis for the processing is Art. 6(1)(b) GDPR; measuring visibility through commonly used AI answer systems is the contractually owed service.

9.3 The legal basis for the remaining processing described in section 9 is Art. 6(1)(b) GDPR.

10) Other recipients within the application

10.1 Brevo GmbH, Köpenicker Str. 126, 10179 Berlin, Germany, sends every e-mail generated by the application - registration confirmation, password reset, invitations and notifications. Your e-mail address and name are transmitted.

10.2 Hosting. The application and its database are operated by lima-city (TrafficPlex GmbH, Konsul-Smidt-Str. 90, 28217 Bremen, Germany) on servers in Germany.

10.3 Payment processing. For paid subscriptions we use Stripe Payments Europe Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland. The information required for payment processing is transmitted to Stripe - name, e-mail address, billing address, payment method, amount and currency. Payment data such as full card numbers is processed exclusively by Stripe and never reaches our systems. The legal basis is Art. 6(1)(b) GDPR. Further information: https://stripe.com/de/privacy

A data processing agreement is in place with all providers named above.

11) Backups and access

Backups of the database are created and retained for 90 days: at our hosting provider lima-city, as well as additionally on Cyber Sour UG's own systems (network storage and encrypted storage media) in Germany.

Following deletion, data may therefore still be contained in backups for up to 90 days. It is no longer used there and is permanently removed once that period expires.

Access to production data is restricted exclusively to the two managing directors of Cyber Sour UG.

12) Deleting your account and your data

12.1 You can disconnect any individual data source. Access and refresh tokens, as well as the selected resource, are deleted immediately.

12.2 You can delete your account in the account settings. Deletion takes effect immediately; your projects and the data retrieved for them are removed. The retention period for backups under section 11 applies.

12.3 Independently of this, you can request deletion informally at any time - by e-mail to help@brandzaps.ai or to the address given in section 1.3.

12.4 Statutory retention obligations, in particular under commercial and tax law, remain unaffected. Affected data is restricted for the duration of the retention period and deleted thereafter.

13) Support and contact

You can reach us via the form in the application, the form on the website, or by e-mail to help@brandzaps.ai or support@brandzaps.ai. We process the information submitted exclusively to handle your enquiry.

The legal basis is Art. 6(1)(f) GDPR (legitimate interest in responding to your enquiry); where your enquiry aims at concluding a contract, additionally Art. 6(1)(b) GDPR. Your data is deleted once your enquiry has been conclusively resolved and no statutory retention obligations preclude this.

Part C - Common provisions

14) Duration of storage

The storage period is determined by the applicable legal basis, the purpose of processing and, where relevant, the statutory retention period.

• Data based on consent (Art. 6(1)(a) GDPR) is stored until you withdraw your consent.
• Data for the performance of a contract (Art. 6(1)(b) GDPR) is stored for the duration of the usage relationship, and beyond that only to the extent statutory retention obligations exist.
• Data based on a legitimate interest (Art. 6(1)(f) GDPR) is stored until you object, unless compelling legitimate grounds override your interest.
• Server and application logs: 90 days.
• Backups: 90 days, see section 11.
• Google Analytics 4 (website): two months, see section 5.2.

Beyond this, we delete stored personal data as soon as it is no longer required for the purposes for which it was collected.

15) Your rights

Applicable data protection law grants you the following rights against us:

• Right of access pursuant to Art. 15 GDPR - in particular regarding the data processed, the purposes, the recipients, the intended storage period and the origin of the data;
• Right to rectification pursuant to Art. 16 GDPR;
• Right to erasure pursuant to Art. 17 GDPR;
• Right to restriction of processing pursuant to Art. 18 GDPR;
• Right to notification pursuant to Art. 19 GDPR;
• Right to data portability pursuant to Art. 20 GDPR;
• Right to withdraw consent given pursuant to Art. 7(3) GDPR - the lawfulness of processing carried out before the withdrawal remains unaffected;
• Right to lodge a complaint with a supervisory authority pursuant to Art. 77 GDPR, in particular in the Member State of your habitual residence, place of work, or of the alleged infringement.

16) Right to object

Where we process your personal data on the basis of a legitimate interest, you have the right to object at any time, on grounds relating to your particular situation, to that processing with effect for the future.

If you exercise your right to object, we will stop processing the affected data. We reserve the right to continue processing if we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or if the processing serves to assert, exercise or defend legal claims.

Where your personal data is processed for the purpose of direct marketing, you have the right to object to that processing at any time. If you exercise this right, we will stop processing for this purpose without undue delay.

Please address your objection informally to the contact details given in section 1.3.

Back to home · Legal notice · Terms · Cookie settings