Privacy Notice

1. Controller

Controller under the GDPR for the use of the Service:
Andreas Jörg, Schulstraße 8, 87742 Apfeltrach, Germany
email: info@ajkonic.ai

Data Protection Officer: Not appointed. Please contact the Controller; if we appoint a DPO, we will publish the contact details here.

2. Purposes & Legal Bases

We process personal data to provide and improve Ajkonic, to communicate with users, to process payments (via a merchant of record), to prevent abuse/secure the Service, and to comply with legal obligations.

• Art. 6(1)(b) GDPR (contract/performance)
• Art. 6(1)(c) GDPR (legal obligations, e.g., retention)
• Art. 6(1)(f) GDPR (legitimate interests: service operation, security, fraud prevention, product improvement)
• Art. 6(1)(a) GDPR (consent), e.g., for voluntary model improvement; where optional technologies/cookies apply.

3. Categories of Data

• Account/usage data (email, profile, login/session metadata)
• Billing/transaction data (via merchant of record; e.g., order ID, amount, taxes)
• Technical data (server logs, IP address, device/browser info)
• Inputs/uploads (prompts, images, videos, settings) and generated outputs
• Support communications

4. Payments via Merchant of Record

During checkout we share required data with the merchant of record. The merchant of record acts as an independent controller for your payment data (including fraud screening, invoicing, taxes and refunds). Legal basis: Art. 6(1)(b) GDPR. We receive a subset of order data from the merchant of record (e.g., transaction ID, email) to provision credits and provide support.

5. Inputs/Outputs

We process your inputs (e.g., images, prompts) and the generated outputs to deliver the requested AI features. Use for model training or product improvement happens only with your explicit consent (opt‑in).

6. Cookies & Similar Technologies

Analytics and marketing technologies are only loaded after you have given your explicit consent; before consent is granted, no device access or data transmission to third parties occurs for these purposes.

a) Strictly Necessary Cookies

We use strictly necessary cookies and similar technologies (e.g., session, CSRF, language, login/cart cookies).

• Device access: § 25(2) TTDSG/TDDDG (strictly necessary, no consent required)
• Data processing: Art. 6(1)(f) GDPR (legitimate interest: service operation and security).

b) Analytics (PostHog)

PostHog (PostHog Inc., USA): We use PostHog as a processor (Art. 28 GDPR) on the basis of a data processing agreement (DPA). PostHog is used to collect anonymised usage statistics to improve our service (e.g., page views, click paths, session duration, device/browser information).

Data is processed exclusively on PostHog Cloud EU (AWS eu‑central‑1, Frankfurt, Germany); no third‑country transfer takes place.

Consent mode (with cookies):

Cookies/storage: First‑party cookie ph_<project‑key> (lifetime: 365 days) and localStorage entries for session ID, device ID and configuration. No third‑party cookies.

• Device access: § 25(1) TTDSG/TDDDG (consent)
• Data processing: Art. 6(1)(a) GDPR (consent)

Anonymous mode (without cookies):

If you do not consent to analytics cookies, we collect only anonymous, non‑cross‑session usage statistics. In this mode no cookies are set, no localStorage is used and no IP addresses are stored. Data is held only in your browser's working memory for the duration of a single page visit and cannot be attributed to any individual.

• § 25 TTDSG/TDDDG does not apply because no access to your device (no cookie, no localStorage) takes place.
• Data processing: Art. 6(1)(f) GDPR (legitimate interest: improving the service through anonymous usage statistics). Your right to object under Art. 21 GDPR remains unaffected.

c) Marketing Cookies (consent only)

Meta Pixel (Meta Platforms Ireland Limited, 4 Grand Canal Square, Dublin 2, Ireland): We and Meta Ireland are joint controllers pursuant to Art. 26 GDPR for the joint processing, which consists of collecting and transmitting the personal data described below to Meta Ireland. The subsequent processing by Meta Ireland does not form part of the joint processing.

Purpose: Measuring ad effectiveness, building audiences (Custom Audiences) and optimising ad delivery.

Data collected: HTTP headers (IP address, browser/device information, page location, referrer), Pixel ID, page views, interactions (e.g., button clicks), form field names (not values), and Facebook cookies.

Cookies: _fbp (first‑party, lifetime: 3 months — stores a browser ID for visit attribution) and _fbc (first‑party, session‑based — stores click IDs from ads).

International transfer: Data is transferred to Meta Platforms Inc. in the USA. Legal basis: adequacy decision under Art. 45 GDPR (EU‑US Data Privacy Framework, DPF); supplemented by EU Standard Contractual Clauses (SCCs) under Art. 46(2)(c) GDPR.

Essence of the Art. 26(2) GDPR arrangement: We and Meta Ireland have entered into a Controller Addendum that allocates GDPR obligations as follows:

• We are responsible for: providing you with the information required under Art. 13/14 GDPR, having our own legal basis for processing (your consent), correct technical implementation and configuration of the Meta Pixel, and reporting data breaches insofar as they concern our obligations.
• Meta Ireland is responsible for: enabling data subject rights under Art. 15–20 GDPR with regard to personal data stored by Meta after the joint processing, having its own legal basis for its subsequent processing, and the security of Meta products.

Further information on how Meta Ireland processes personal data, the legal bases Meta relies on, and how to exercise your data subject rights against Meta can be found in Meta's Privacy Policy.

• Device access: § 25(1) TTDSG/TDDDG (consent)
• Data processing: Art. 6(1)(a) GDPR (consent)

Google Ads conversion tracking and remarketing (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland): With your consent we load the Google Ads Google tag (gtag.js). Google acts as an independent controller for the data collected via the Google tag; the Google Ads Controller‑Controller Data Protection Terms apply.

Purpose: Measuring whether visitors who arrive via one of our Google ads go on to sign up (conversion tracking), building audiences for ads (remarketing) and optimising ad delivery.

Data collected: HTTP headers (IP address, browser/device information, page location, referrer), page views, the click ID from a Google ad (GCLID), the event of a completed sign‑up, and Google cookies. We do not send email addresses or other account data to Google (no "enhanced conversions").

Cookies: _gcl_au (first‑party, lifetime: 3 months — attributes conversions to an ad click) and cookies set by Google on its own domains (e.g., IDE on doubleclick.net, lifetime up to 13 months).

International transfer: Data may be transferred to Google LLC in the USA. Legal basis: adequacy decision under Art. 45 GDPR (EU‑US Data Privacy Framework); supplemented by EU Standard Contractual Clauses (SCCs) under Art. 46(2)(c) GDPR.

Further information can be found in Google's Privacy Policy; you can also turn off personalised ads in Google's ad settings.

• Device access: § 25(1) TTDSG/TDDDG (consent)
• Data processing: Art. 6(1)(a) GDPR (consent)

d) Embedded Content (Vimeo)

Our website embeds tutorial videos from Vimeo (Vimeo Inc., 555 West 18th Street, New York, NY 10011, USA). The embedding uses an iframe that loads content directly from Vimeo's servers.

Two‑click solution: Vimeo content is not loaded automatically. Instead of the video, a placeholder with an explanatory notice is displayed. Only when you actively click "Load Video" is a connection to Vimeo established. Loading the video may cause Vimeo to set cookies and personal data (e.g., IP address, device and browser information) to be transmitted to Vimeo in the USA.

International transfer: Data is transferred to Vimeo Inc. in the USA. Legal basis: adequacy decision under Art. 45 GDPR (EU‑US Data Privacy Framework); supplemented by EU Standard Contractual Clauses (SCCs) under Art. 46(2)(c) GDPR.

Further information can be found in Vimeo's Privacy Policy.

• Device access: § 25(1) TTDSG/TDDDG (consent via active click)
• Data processing: Art. 6(1)(a) GDPR (consent)

e) Consent Management

On your first visit a cookie banner is shown where you can accept all or individually choose analytics, the Meta pixel, and Google Ads. Before you give consent, no corresponding scripts are loaded and no cookies are set.

You can change your preferences at any time via the "Cookie Settings" link in the footer, or withdraw your consent in whole or in part (Art. 7(3) GDPR). Withdrawal takes effect for the future; the lawfulness of processing carried out before withdrawal remains unaffected. After withdrawal, the relevant cookies are removed and the scripts are deactivated.

Your cookie preferences are stored in your browser's local storage (localStorage) under the key ajkonic-consent. This entry contains only your consent decision and a timestamp — no personal data.

7. Recipients

• Processors (Art. 28 GDPR): hosting, infrastructure, support, email/ticketing, logging/monitoring—under appropriate contracts and instructions.
• PostHog Inc. (USA) as a processor (Art. 28 GDPR) for web analytics; processing on PostHog Cloud EU (Frankfurt); data processing agreement (DPA) in place. Only with consent.
• Meta Platforms Ireland Limited (Ireland) as a joint controller (Art. 26 GDPR) for the collection and transmission of data via the Meta Pixel; Controller Addendum agreed (see Section 6 c). Only with consent. Subsequent processing by Meta is under Meta's sole controllership.
• Google Ireland Limited (Ireland) as an independent controller for conversion tracking and remarketing via Google Ads (see Section 6 c). Only with consent.
• Vimeo Inc. (USA): Embedding of tutorial videos on our website. A connection to Vimeo is only established after your active click (two‑click solution). Only with consent.
• Merchant of Record as an independent controller for payments/tax/fraud; privacy notice and data subject rights will be provided to you at checkout.

8. International Transfers

Processing generally occurs in the EU/EEA.

• PostHog: Data is processed exclusively on PostHog Cloud EU (AWS eu‑central‑1, Frankfurt). No third‑country transfer takes place.
• Meta Pixel: Data is transferred to Meta Platforms Inc. in the USA. Legal basis: adequacy decision under Art. 45 GDPR (EU‑US Data Privacy Framework, DPF); supplemented by EU Standard Contractual Clauses (SCCs) under Art. 46(2)(c) GDPR.
• Google Ads: Data may be transferred to Google LLC in the USA. Legal basis: adequacy decision under Art. 45 GDPR (EU‑US Data Privacy Framework, DPF); supplemented by EU Standard Contractual Clauses (SCCs) under Art. 46(2)(c) GDPR.
• Vimeo: After your active click, data is transferred to Vimeo Inc. in the USA. Legal basis: adequacy decision under Art. 45 GDPR (EU‑US Data Privacy Framework, DPF); supplemented by EU Standard Contractual Clauses (SCCs) under Art. 46(2)(c) GDPR.

Where other third‑country transfers are necessary (e.g., support, CDN, sub‑processors), we ensure appropriate safeguards. Details available on request.

9. Storage & Deletion

We store personal data only as long as necessary or required by law:

• Account/contract data: until termination + limitation/record‑keeping obligations.
• Logs/security: short‑term (typically up to 30 days), longer if needed to investigate incidents.
• Billing/tax records: under German commercial/tax law typically 6/8/10 years depending on the document type (as of 1 Jan 2025 certain accounting documents are 8 years), counted from year‑end; longer where required by tax or supervisory procedures.
• Analytics cookies (PostHog): cookie ph_<key> 365 days; localStorage entries until deleted by you or until consent is withdrawn. On PostHog's side, per the processor's data retention policy.
• Marketing cookies (Meta): _fbp 3 months; _fbc session‑based. For Meta's subsequent storage periods, see Meta's Privacy Policy.
• Marketing cookies (Google Ads): _gcl_au 3 months; Google cookies on its own domains up to 13 months. For Google's subsequent storage periods, see Google's Privacy Policy.

Short account and data deletion instructions are also available at User Data Deletion Instructions.

10. Your Rights

• Access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18)
• Data portability (Art. 20), objection (Art. 21—especially to processing based on legitimate interests)
• Withdraw consent (Art. 7(3)) with future effect
• Lodge a complaint with a supervisory authority (Art. 77)—for example, the Bavarian DPA (BayLDA) or your local authority.

For purchases, you may also exercise rights directly with the merchant of record.

Meta Pixel: As we and Meta Ireland are joint controllers, you may exercise your rights under Art. 15–20 GDPR with regard to personal data stored by Meta after the joint processing directly against Meta Ireland. Further information: Meta's Privacy Policy.

Google Ads: As Google is an independent controller, you may also exercise your rights with regard to personal data stored by Google directly against Google. Further information: Google's Privacy Policy.

Cookie consent withdrawal: You can withdraw your consent at any time via the "Cookie Settings" link in the footer. After withdrawal, the relevant tracking scripts are deactivated and cookies are removed.

11. Source of Data from Others

We also receive personal data from the merchant of record (e.g., order/transaction data) to provide our service and support.

12. Necessity of Provision

Certain data (registration, payment/invoice data) are required for contract performance. Without them, we cannot provide the Service.

13. Automated Decision‑Making

We do not make decisions solely by automated means within the meaning of Art. 22 GDPR producing legal effects. The merchant of record may conduct automated fraud screening during checkout (see merchant of record's privacy notice).

14. Security

We implement state‑of‑the‑art technical and organisational measures to protect data against loss, misuse and unauthorised access.

15. Changes

We may update this notice where required by technical, legal or organisational changes. We will inform you appropriately of material changes.