This privacy policy informs you about the processing of personal data on our website sternehero.de and in our web app at app.sternehero.de (including agency subdomains). Our website can generally be used without providing personal data. Where personal data (e.g. name, address or email addresses) is collected, this is done on a voluntary basis wherever possible. This data will not be passed on to third parties without your express consent, unless described otherwise below.
We would like to point out that data transmission on the internet (e.g. when communicating by email) may have security gaps. Complete protection of data against access by third parties is not possible.
We hereby object to the use of contact data published as part of our legal notice obligation by third parties for sending unsolicited advertising. The operators expressly reserve the right to take legal action in the event of unsolicited advertising material being sent (e.g. spam emails).
1. Controller for Data Processing
Sternehero
Owner: Tolga Doksanbir
Waltershofenerstraße 9
79111 Freiburg
Germany
Phone: +49 7663 8672890
Email: info@sternehero.de
2. Website Hosting and Log Files (Vercel)
a) Data processing: Our website is hosted by Vercel Inc., 340 S Lemon Ave #4133, Walnut, CA 91789, USA. When you visit our website, the following data is automatically recorded in server log files:
- Browser type and version
- Operating system
- Referrer URL
- IP address
- Date and time of access
- Pages visited
b) Legal basis: Art. 6(1)(f) GDPR (legitimate interest in the secure and stable provision of the website)
c) Purpose: Ensuring the security, functionality and optimisation of the website
d) Third-country transfer: Data may be transferred to the USA. A data processing agreement is in place with Vercel; transfers are based on the EU Standard Contractual Clauses (Art. 46 GDPR).
e) Retention period: Generally a maximum of 7 days, after which data is deleted or anonymised
3. Web App Hosting (Hetzner)
a) Data processing: Our web app (app.sternehero.de) runs on servers operated by Hetzner Online GmbH, Industriestraße 25, 91710 Gunzenhausen, Germany. Files (e.g. uploaded documents and receipts) are stored in Hetzner Object Storage in the Falkenstein data centre (Germany). When you access the web app, the same log file data is collected as described in section 2.
b) Legal basis: Art. 6(1)(b) GDPR (performance of a contract) and Art. 6(1)(f) GDPR (secure operation)
c) Third-country transfer: None — processing takes place in Germany. A data processing agreement is in place with Hetzner.
d) Retention period: Log files generally a maximum of 7 days; contract and account data as per section 11
4. Cookies and Consent Management
a) Data processing: We use technically necessary cookies and comparable storage technologies (e.g. localStorage) for session management, security and storing your cookie preferences. Optional cookies in the "Marketing" category are only set after you have given your consent via our cookie banner. Our cookieless website statistics described in section 19 do not require consent and therefore do not appear in the cookie banner.
b) Legal basis: For technically necessary cookies, Section 25(2) TDDDG in conjunction with Art. 6(1)(f) GDPR; for optional cookies, Art. 6(1)(a) GDPR in conjunction with Section 25(1) TDDDG (consent)
c) Withdrawal: You can change or withdraw your consent at any time with effect for the future via the "Cookie Settings" link in the footer.
d) Retention period: Your consent decision is stored locally in your browser until you change it or delete your browser data.
5. Meta Pixel and Meta Conversions API
a) Data processing: If you have consented to marketing cookies, we use the Meta Pixel provided by Meta Platforms Ireland Limited, Merrion Road, Dublin 4, Ireland ("Meta") on sternehero.de. This processes, among other things, your IP address, device information and pages visited, and sets the "_fbp" and "_fbc" cookies. In addition, events (e.g. page views, registrations) may be transmitted to Meta server-side via the Meta Conversions API — likewise only on the basis of your consent.
b) Purpose: Measuring the effectiveness of our advertising (conversion tracking) and displaying interest-based advertising
c) Legal basis: Art. 6(1)(a) GDPR in conjunction with Section 25(1) TDDDG (consent). For the collection and transmission of the data, we are jointly responsible with Meta under Art. 26 GDPR; further processing is Meta's sole responsibility.
d) Third-country transfer: Data may be transferred to Meta Platforms, Inc. in the USA. Meta is certified under the EU-U.S. Data Privacy Framework.
e) Withdrawal: At any time via the cookie settings in the footer. Further information: https://www.facebook.com/privacy/policy
6. Support Chat (Google Gemini)
a) Data processing: We offer an AI-powered support chat on our website. When you use the chat, your chat input is transmitted to Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, to generate a response (Gemini API). Please do not enter any sensitive personal data in the chat.
b) Legal basis: Art. 6(1)(f) GDPR (legitimate interest in responding to enquiries efficiently); use of the chat is voluntary
c) Third-country transfer: Data may be transferred to Google LLC in the USA. Google is certified under the EU-U.S. Data Privacy Framework.
d) Retention period: The chat history is only kept in your browser for the duration of your session; we do not store chat histories permanently.
7. Contact and Contact Form
a) Data processing: When you contact us via the form, by phone or by email, we process your details (e.g. name, email address, phone number, content of your enquiry) in order to handle your request. We use the service Resend (Resend, Inc., San Francisco, USA) to send form and system messages.
b) Legal basis: Art. 6(1)(b) GDPR (initiation or performance of a contract) and Art. 6(1)(f) GDPR (handling general enquiries)
c) Third-country transfer: When emails are sent via Resend, processing in the USA is possible; this is based on the EU Standard Contractual Clauses (Art. 46 GDPR).
d) Retention period: Enquiries are deleted once they have been fully processed and no statutory retention obligations apply.
8. Appointment Booking (TidyCal)
a) Data processing: For booking demo appointments, we embed the calendar service TidyCal (AppSumo, LLC, Austin, Texas, USA). The calendar is only loaded after you have actively enabled it by clicking (two-click solution). When it loads, your IP address and device information are transmitted to TidyCal and its CDN provider bunny.net (BunnyWay d.o.o., Ljubljana, Slovenia). If you make a booking, TidyCal also processes the appointment details you enter.
b) Legal basis: Art. 6(1)(a) GDPR in conjunction with Section 25(1) TDDDG (consent by actively loading) and Art. 6(1)(b) GDPR for arranging the appointment
c) Third-country transfer: Processing in the USA is possible; this is based on the EU Standard Contractual Clauses (Art. 46 GDPR).
d) Retention period: Appointment data is deleted as soon as it is no longer required for conducting the appointment.
9. Review Analysis Tool (Google Places API)
a) Data processing: Our free review analysis tool uses the Google Places API (Google Ireland Limited). Your search input (business name/location) is transmitted to Google via our server to retrieve publicly available profile data (e.g. average rating, number of reviews). No cookies are set; your IP address is not passed on to Google, as the request is made server-side.
b) Legal basis: Art. 6(1)(b) GDPR (provision of the tool you requested) and Art. 6(1)(f) GDPR
c) Retention period: Search inputs are not stored permanently.
10. Fonts (Locally Hosted)
This website uses fonts (Satoshi, Cabinet Grotesk, DM Mono, Geist Mono) that are hosted locally on our own server. No connection to third-party servers (e.g. Fontshare or Google Fonts) is established when the fonts are loaded, and no personal data is transmitted to third parties in the process.
11. Web App: Registration, Account and Contract Data
a) Data processing: When you register for and use our web app, we process your account data (name, email address, password hash), company and location data, billing data, details of review reports (including your confirmation that there was no customer contact) as well as credit and transaction data.
b) Purpose: Providing the self-service platform you use to submit review reports to the respective platform, billing and support
c) Legal basis: Art. 6(1)(b) GDPR (performance of a contract); for statutory retention obligations, Art. 6(1)(c) GDPR
d) Retention period: For the duration of the contractual relationship; beyond that only to the extent that statutory retention periods (generally 6 or 10 years under German commercial and tax law) apply.
12. Web App: Payment Processing (Stripe)
a) Data processing: Payments (credit packs, plans, subscriptions) are processed via Stripe (Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Dublin, Ireland). Stripe processes your payment data (e.g. card or account details), name, email address and billing data under its own responsibility. We ourselves do not store complete payment data.
b) Legal basis: Art. 6(1)(b) GDPR (performance of a contract)
c) Third-country transfer: Data may be transferred to Stripe, Inc. in the USA. Stripe is certified under the EU-U.S. Data Privacy Framework.
d) Retention period: In accordance with statutory commercial and tax law retention periods
13. Web App: Usage Analytics (PostHog)
a) Data processing: In the web app, we use the analytics tool PostHog (PostHog, Inc., USA) — exclusively in the EU cloud variant with processing on servers in the European Union (Frankfurt). PostHog is only activated after you have consented to analytics cookies in the web app, and then processes pseudonymised usage data (pages visited, feature usage, device information).
b) Purpose: Improving the web app and its features
c) Legal basis: Art. 6(1)(a) GDPR in conjunction with Section 25(1) TDDDG (consent)
d) Withdrawal: At any time via the cookie settings in the web app
e) Retention period: Analytics data is only stored for as long as is necessary for evaluation.
14. Web App: AI-Powered Features (OpenAI)
a) Data processing: For AI-powered features of the web app (e.g. suggested replies to reviews, automatically generated draft replies with manual approval), we transmit the content required for this (e.g. the public review text, your company name and your instructions) to OpenAI (OpenAI Ireland Limited, Dublin, Ireland). Under OpenAI's API terms, content transmitted via the API is not used to train the models.
b) Legal basis: Art. 6(1)(b) GDPR (provision of the feature you use)
c) Third-country transfer: Processing by OpenAI, L.L.C. in the USA is possible. OpenAI is certified under the EU-U.S. Data Privacy Framework.
d) Retention period: We store the generated drafts in your account; OpenAI's retention periods for API data apply (generally a maximum of 30 days).
15. Web App: Google Business Profile and Google Services
a) Data processing: If you connect your Google Business Profile to the web app, this is done via a Google interface authorised by you (OAuth). We retrieve profile and review data for your location (e.g. reviews, average rating) and use the Google Places API for location search. In addition, a mailbox operated by us may be connected via the Gmail API to match confirmation emails from the platform.
b) Legal basis: Art. 6(1)(b) GDPR (performance of a contract)
c) Third-country transfer: The provider is Google Ireland Limited; data may be transferred to Google LLC in the USA (EU-U.S. Data Privacy Framework).
d) Withdrawal: You can disconnect the integration at any time in the web app or in your Google security settings.
16. Web App: Retrieval of Public Review Data
a) Data processing: To display and update your reviews, we retrieve publicly accessible review data (e.g. review text, star rating, the reviewer's public display name, date) via technical service providers. For this purpose, we use Apify (Apify Technologies s.r.o., Prague, Czech Republic) and, where applicable, Outscraper and SerpApi (both USA) as processors.
b) Purpose: Providing the core function of the web app — the overview of your reviews and the status of your reports
c) Legal basis: Art. 6(1)(b) GDPR (towards you as a user) and Art. 6(1)(f) GDPR (legitimate interest with regard to information already publicly available from reviewers)
d) Third-country transfer: With Outscraper and SerpApi, processing in the USA is possible; this is based on the EU Standard Contractual Clauses (Art. 46 GDPR).
e) Retention period: Review data is stored for the duration of your account usage.
17. Web App: WhatsApp Assistant
a) Data processing: If you connect your WhatsApp number in the web app, you can message our assistant via WhatsApp, for example to view your reviews, prepare and confirm reports, check the status of your reports or buy credits. You also receive a weekly overview. For this purpose, we process your mobile phone number, the content of the messages in both directions (including voice messages), the delivery status of the messages and the related data of your account. The messages are transmitted via the WhatsApp Business Platform of Meta Platforms Ireland Limited and WhatsApp Ireland Limited.
b) AI processing: To answer your messages, we transmit them to OpenAI (see section 14). For this purpose, OpenAI converts voice messages into text. The assistant only prepares reports; a report is only submitted once you expressly confirm it.
c) Chat log: To handle support requests, to keep reports and purchases traceable and for quality assurance, we store a history of the messages. Only authorised Sternehero staff have access to it.
d) Legal basis: Art. 6(1)(a) GDPR for activating the WhatsApp channel (consent through active sign-up); Art. 6(1)(b) GDPR for answering your requests and carrying out the actions you confirm; Art. 6(1)(f) GDPR for the chat log (legitimate interest in support, evidence and quality assurance).
e) Third-country transfer: Data may be transferred to Meta companies or to OpenAI, L.L.C. in the USA. Both companies are certified under the EU-U.S. Data Privacy Framework.
f) Storage period: The chat log and message contents are deleted automatically after 90 days. We keep the confirmation of a report, including your assurance that there was no customer contact, as evidence together with the report. If your account is deleted, the data is deleted unless statutory retention obligations apply.
g) Withdrawal and objection: You can disconnect the WhatsApp channel at any time in the web app or unsubscribe by sending "STOP"; your mobile phone number will then no longer be used for this purpose. You can object to the storage of the chat log under Art. 21 GDPR; an email to info@sternehero.de is sufficient.
18. Conversion Measurement with Advertising Partners (Google Ads, ChatGPT Ads)
a) Data processing: We run search ads on Google Ads and ads within ChatGPT (OpenAI Ads). To measure the success of these ads, we process the following data:
- Click reference: If you click one of our ads, the respective advertising partner appends a pseudonymous click reference to the address of the page you are forwarded to (with Google the parameters “gclid”, “wbraid” and “gbraid”, with OpenAI the parameter “oppref”). If you subsequently register in our web app, we store this click reference together with the campaign parameters of the address you accessed (UTM parameters) in your account.
- Feedback to the advertising partner: If a measurable event occurs (registration or purchase), we transmit this event to the respective advertising partner server-side. Only the click reference, the type of event (registration or purchase), the time of the event and, for purchases, the net amount are transmitted. Names, email addresses, IP addresses or other direct identifiers are not transmitted. The recipients are Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (offline conversion import into Google Ads) and OpenAI Ireland Limited, 1st Floor, The Liffey Trust Centre, 117-126 Sheriff Street Upper, Dublin 1, Ireland (Conversions API for ChatGPT Ads). The advertising partners also process the transmitted event data under their own responsibility.
This processing takes place entirely on our servers. We do not use cookies for conversion measurement. Neither the Google tag (gtag.js) nor a pixel or any other script from OpenAI is embedded on our pages. There is no access to your device and no information is stored on or read from your device.
b) Purpose: Measurement, optimisation and billing of our advertising campaigns
c) Legal basis: Art. 6(1)(f) GDPR (legitimate interest in measuring and billing our advertising campaigns). As no information is stored on or read from your device for this measurement, consent under Section 25(1) TDDDG is not required.
d) Third-country transfer: Data may be transferred to Google LLC or OpenAI, L.L.C. in the USA. Both companies are certified under the EU-U.S. Data Privacy Framework.
e) Retention period: The click reference and campaign parameters are stored in your account for the duration of the contractual relationship; beyond that only to the extent that statutory retention periods apply. The retention periods of the advertising partners apply to the event data stored by them.
f) Objection: You may object to this processing at any time under Art. 21 GDPR on grounds relating to your particular situation. An email to info@sternehero.de is sufficient. We will then delete the click reference stored in your account and will not transmit any further events relating to your account to the advertising partners. Further information on data processing by the advertising partners: https://policies.google.com/privacy and https://openai.com/policies/eu-privacy-policy/
19. Website Usage Analytics (Vercel Web Analytics)
a) Data processing: We use Vercel Web Analytics provided by Vercel Inc., 340 S Lemon Ave #4133, Walnut, CA 91789, USA, on sternehero.de. The following information is recorded with each page view:
- Time of the page view as well as the address accessed and the corresponding page type
- Referring page (referrer) and query parameters of the address accessed (e.g. UTM campaign parameters)
- Approximate origin at country, region and city level
- Device type, operating system and browser, each with version
Vercel Web Analytics does not set cookies and does not store any identifiers on your device, nor does it read any information from your device. Several page views are assigned to one visit via a hash generated from the request, which is discarded after 24 hours. Your IP address is not stored. You are not recognised across several days or across other websites, and no profiling takes place. We remove the advertising partners' click references referred to in section 18 (“gclid”, “wbraid”, “gbraid”, “oppref”) before transmission; they do not reach Vercel.
b) Purpose: Evaluating website usage and improving our content and offerings
c) Legal basis: Art. 6(1)(f) GDPR (legitimate interest in a statistical evaluation of website usage). As no information is stored on or read from your device for this measurement, consent under Section 25(1) TDDDG is not required. For the same reason, our cookie banner does not offer a separate option for this evaluation.
d) Third-country transfer: Processing in the USA is possible. A data processing agreement is in place with Vercel; the transfer takes place on the basis of the EU standard contractual clauses (Art. 46 GDPR).
e) Retention period: The assignment of a visit is discarded after 24 hours. Vercel stores the aggregated statistics in accordance with the periods applicable to our plan.
f) Objection: You may object to this processing at any time under Art. 21 GDPR on grounds relating to your particular situation. An email to info@sternehero.de is sufficient. Further information on processing by Vercel: https://vercel.com/docs/analytics/privacy-policy
20. Data Subject Rights
You have the following rights:
- Access to stored data (Art. 15 GDPR)
- Rectification of inaccurate data (Art. 16 GDPR)
- Erasure of personal data (Art. 17 GDPR)
- Restriction of processing (Art. 18 GDPR)
- Right to data portability (Art. 20 GDPR)
- Objection to processing (Art. 21 GDPR)
- Withdrawal of consent (Art. 7(3) GDPR)
- Complaint to the supervisory authority (Art. 77 GDPR)
The competent supervisory authority is the State Commissioner for Data Protection and Freedom of Information of Baden-Württemberg. To exercise your rights, simply send an email to info@sternehero.de.
21. Data Security
We use technical and organisational measures to protect your data against manipulation, loss, destruction and unauthorised access. Data is transmitted in encrypted form via TLS (HTTPS). Our measures are continuously improved in line with technological developments.
22. Changes to this Privacy Policy
We update this privacy policy whenever the services we use or the legal situation change. The current version published here applies in each case.