This privacy policy informs you about the processing of personal data on our website sternehero.de and in our web app at app.sternehero.de (including agency subdomains). Our website can generally be used without providing personal data. Where personal data (e.g. name, address or email addresses) is collected, this is done on a voluntary basis wherever possible. This data will not be passed on to third parties without your express consent, unless described otherwise below.
We would like to point out that data transmission on the internet (e.g. when communicating by email) may have security gaps. Complete protection of data against access by third parties is not possible.
We hereby object to the use of contact data published as part of our legal notice obligation by third parties for sending unsolicited advertising. The operators expressly reserve the right to take legal action in the event of unsolicited advertising material being sent (e.g. spam emails).
1. Controller for Data Processing
Sternehero Owner: Tolga Doksanbir Waltershofenerstraße 9 79111 Freiburg Germany Phone: +49 7663 8672890 Email: info@sternehero.de
2. Website Hosting and Log Files (Vercel)
a) Data processing: Our website is hosted by Vercel Inc., 340 S Lemon Ave #4133, Walnut, CA 91789, USA. When you visit our website, the following data is automatically recorded in server log files: • Browser type and version • Operating system • Referrer URL • IP address • Date and time of access • Pages visited b) Legal basis: Art. 6(1)(f) GDPR (legitimate interest in the secure and stable provision of the website) c) Purpose: Ensuring the security, functionality and optimisation of the website d) Third-country transfer: Data may be transferred to the USA. A data processing agreement is in place with Vercel; transfers are based on the EU Standard Contractual Clauses (Art. 46 GDPR). e) Retention period: Generally a maximum of 7 days, after which data is deleted or anonymised
3. Web App Hosting (Hetzner)
a) Data processing: Our web app (app.sternehero.de) runs on servers operated by Hetzner Online GmbH, Industriestraße 25, 91710 Gunzenhausen, Germany. Files (e.g. uploaded documents and receipts) are stored in Hetzner Object Storage in the Falkenstein data centre (Germany). When you access the web app, the same log file data is collected as described in section 2. b) Legal basis: Art. 6(1)(b) GDPR (performance of a contract) and Art. 6(1)(f) GDPR (secure operation) c) Third-country transfer: None — processing takes place in Germany. A data processing agreement is in place with Hetzner. d) Retention period: Log files generally a maximum of 7 days; contract and account data as per section 11
4. Cookies and Consent Management
a) Data processing: We use technically necessary cookies and comparable storage technologies (e.g. localStorage) for session management, security and storing your cookie preferences. Optional cookies in the "Analytics" and "Marketing" categories are only set after you have given your consent via our cookie banner. b) Legal basis: For technically necessary cookies, Section 25(2) TDDDG in conjunction with Art. 6(1)(f) GDPR; for optional cookies, Art. 6(1)(a) GDPR in conjunction with Section 25(1) TDDDG (consent) c) Withdrawal: You can change or withdraw your consent at any time with effect for the future via the "Cookie Settings" link in the footer. d) Retention period: Your consent decision is stored locally in your browser until you change it or delete your browser data.
5. Meta Pixel and Meta Conversions API
a) Data processing: If you have consented to marketing cookies, we use the Meta Pixel provided by Meta Platforms Ireland Limited, Merrion Road, Dublin 4, Ireland ("Meta") on sternehero.de. This processes, among other things, your IP address, device information and pages visited, and sets the "_fbp" and "_fbc" cookies. In addition, events (e.g. page views, registrations) may be transmitted to Meta server-side via the Meta Conversions API — likewise only on the basis of your consent. b) Purpose: Measuring the effectiveness of our advertising (conversion tracking) and displaying interest-based advertising c) Legal basis: Art. 6(1)(a) GDPR in conjunction with Section 25(1) TDDDG (consent). For the collection and transmission of the data, we are jointly responsible with Meta under Art. 26 GDPR; further processing is Meta's sole responsibility. d) Third-country transfer: Data may be transferred to Meta Platforms, Inc. in the USA. Meta is certified under the EU-U.S. Data Privacy Framework. e) Withdrawal: At any time via the cookie settings in the footer. Further information: https://www.facebook.com/privacy/policy
6. Support Chat (Google Gemini)
a) Data processing: We offer an AI-powered support chat on our website. When you use the chat, your chat input is transmitted to Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, to generate a response (Gemini API). Please do not enter any sensitive personal data in the chat. b) Legal basis: Art. 6(1)(f) GDPR (legitimate interest in responding to enquiries efficiently); use of the chat is voluntary c) Third-country transfer: Data may be transferred to Google LLC in the USA. Google is certified under the EU-U.S. Data Privacy Framework. d) Retention period: The chat history is only kept in your browser for the duration of your session; we do not store chat histories permanently.
7. Contact and Contact Form
a) Data processing: When you contact us via the form, by phone or by email, we process your details (e.g. name, email address, phone number, content of your enquiry) in order to handle your request. We use the service Resend (Resend, Inc., San Francisco, USA) to send form and system messages. b) Legal basis: Art. 6(1)(b) GDPR (initiation or performance of a contract) and Art. 6(1)(f) GDPR (handling general enquiries) c) Third-country transfer: When emails are sent via Resend, processing in the USA is possible; this is based on the EU Standard Contractual Clauses (Art. 46 GDPR). d) Retention period: Enquiries are deleted once they have been fully processed and no statutory retention obligations apply.
8. Appointment Booking (TidyCal)
a) Data processing: For booking demo appointments, we embed the calendar service TidyCal (AppSumo, LLC, Austin, Texas, USA). The calendar is only loaded after you have actively enabled it by clicking (two-click solution). When it loads, your IP address and device information are transmitted to TidyCal and its CDN provider bunny.net (BunnyWay d.o.o., Ljubljana, Slovenia). If you make a booking, TidyCal also processes the appointment details you enter. b) Legal basis: Art. 6(1)(a) GDPR in conjunction with Section 25(1) TDDDG (consent by actively loading) and Art. 6(1)(b) GDPR for arranging the appointment c) Third-country transfer: Processing in the USA is possible; this is based on the EU Standard Contractual Clauses (Art. 46 GDPR). d) Retention period: Appointment data is deleted as soon as it is no longer required for conducting the appointment.
9. Review Analysis Tool (Google Places API)
a) Data processing: Our free review analysis tool uses the Google Places API (Google Ireland Limited). Your search input (business name/location) is transmitted to Google via our server to retrieve publicly available profile data (e.g. average rating, number of reviews). No cookies are set; your IP address is not passed on to Google, as the request is made server-side. b) Legal basis: Art. 6(1)(b) GDPR (provision of the tool you requested) and Art. 6(1)(f) GDPR c) Retention period: Search inputs are not stored permanently.
10. Fonts (Locally Hosted)
This website uses fonts (Satoshi, Cabinet Grotesk, DM Mono, Geist Mono) that are hosted locally on our own server. No connection to third-party servers (e.g. Fontshare or Google Fonts) is established when the fonts are loaded, and no personal data is transmitted to third parties in the process.
11. Web App: Registration, Account and Contract Data
a) Data processing: When you register for and use our web app, we process your account data (name, email address, password hash), company and location data, billing data, details of review reports (including your confirmation that there was no customer contact) as well as credit and transaction data. b) Purpose: Providing the self-service platform you use to submit review reports to the respective platform, billing and support c) Legal basis: Art. 6(1)(b) GDPR (performance of a contract); for statutory retention obligations, Art. 6(1)(c) GDPR d) Retention period: For the duration of the contractual relationship; beyond that only to the extent that statutory retention periods (generally 6 or 10 years under German commercial and tax law) apply.
12. Web App: Payment Processing (Stripe)
a) Data processing: Payments (credit packs, plans, subscriptions) are processed via Stripe (Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Dublin, Ireland). Stripe processes your payment data (e.g. card or account details), name, email address and billing data under its own responsibility. We ourselves do not store complete payment data. b) Legal basis: Art. 6(1)(b) GDPR (performance of a contract) c) Third-country transfer: Data may be transferred to Stripe, Inc. in the USA. Stripe is certified under the EU-U.S. Data Privacy Framework. d) Retention period: In accordance with statutory commercial and tax law retention periods
13. Web App: Usage Analytics (PostHog)
a) Data processing: In the web app, we use the analytics tool PostHog (PostHog, Inc., USA) — exclusively in the EU cloud variant with processing on servers in the European Union (Frankfurt). PostHog is only activated after you have consented to analytics cookies in the web app, and then processes pseudonymised usage data (pages visited, feature usage, device information). b) Purpose: Improving the web app and its features c) Legal basis: Art. 6(1)(a) GDPR in conjunction with Section 25(1) TDDDG (consent) d) Withdrawal: At any time via the cookie settings in the web app e) Retention period: Analytics data is only stored for as long as is necessary for evaluation.
14. Web App: AI-Powered Features (OpenAI)
a) Data processing: For AI-powered features of the web app (e.g. suggested replies to reviews, automatically generated draft replies with manual approval), we transmit the content required for this (e.g. the public review text, your company name and your instructions) to OpenAI (OpenAI Ireland Ltd., Dublin, Ireland). Under OpenAI's API terms, content transmitted via the API is not used to train the models. b) Legal basis: Art. 6(1)(b) GDPR (provision of the feature you use) c) Third-country transfer: Processing by OpenAI, L.L.C. in the USA is possible. OpenAI is certified under the EU-U.S. Data Privacy Framework. d) Retention period: We store the generated drafts in your account; OpenAI's retention periods for API data apply (generally a maximum of 30 days).
15. Web App: Google Business Profile and Google Services
a) Data processing: If you connect your Google Business Profile to the web app, this is done via a Google interface authorised by you (OAuth). We retrieve profile and review data for your location (e.g. reviews, average rating) and use the Google Places API for location search. In addition, a mailbox operated by us may be connected via the Gmail API to match confirmation emails from the platform. b) Legal basis: Art. 6(1)(b) GDPR (performance of a contract) c) Third-country transfer: The provider is Google Ireland Limited; data may be transferred to Google LLC in the USA (EU-U.S. Data Privacy Framework). d) Withdrawal: You can disconnect the integration at any time in the web app or in your Google security settings.
16. Web App: Retrieval of Public Review Data
a) Data processing: To display and update your reviews, we retrieve publicly accessible review data (e.g. review text, star rating, the reviewer's public display name, date) via technical service providers. For this purpose, we use Apify (Apify Technologies s.r.o., Prague, Czech Republic) and, where applicable, Outscraper and SerpApi (both USA) as processors. b) Purpose: Providing the core function of the web app — the overview of your reviews and the status of your reports c) Legal basis: Art. 6(1)(b) GDPR (towards you as a user) and Art. 6(1)(f) GDPR (legitimate interest with regard to information already publicly available from reviewers) d) Third-country transfer: With Outscraper and SerpApi, processing in the USA is possible; this is based on the EU Standard Contractual Clauses (Art. 46 GDPR). e) Retention period: Review data is stored for the duration of your account usage.
17. Web App: WhatsApp Notifications
a) Data processing: If you activate WhatsApp notifications, we process your mobile phone number and the notification content (e.g. status updates on your reports) via the WhatsApp Business Platform of Meta Platforms Ireland Limited and WhatsApp Ireland Limited. b) Legal basis: Art. 6(1)(a) GDPR (consent through active sign-up) c) Third-country transfer: Data may be transferred to Meta companies in the USA (EU-U.S. Data Privacy Framework). d) Withdrawal: You can deactivate the notifications at any time in the web app or unsubscribe by message; your mobile phone number will then no longer be used for this purpose.
18. Data Subject Rights
You have the following rights: • Access to stored data (Art. 15 GDPR) • Rectification of inaccurate data (Art. 16 GDPR) • Erasure of personal data (Art. 17 GDPR) • Restriction of processing (Art. 18 GDPR) • Right to data portability (Art. 20 GDPR) • Objection to processing (Art. 21 GDPR) • Withdrawal of consent (Art. 7(3) GDPR) • Complaint to the supervisory authority (Art. 77 GDPR) The competent supervisory authority is the State Commissioner for Data Protection and Freedom of Information of Baden-Württemberg. To exercise your rights, simply send an email to info@sternehero.de.
19. Data Security
We use technical and organisational measures to protect your data against manipulation, loss, destruction and unauthorised access. Data is transmitted in encrypted form via TLS (HTTPS). Our measures are continuously improved in line with technological developments.
20. Changes to this Privacy Policy
We update this privacy policy whenever the services we use or the legal situation change. The current version published here applies in each case.