Sample text for layout purposes – replace with reviewed legal texts before launch.
1 Controller
[Company name], [Address], email: [datenschutz@…]. You can reach a data protection officer at […] – if one has been appointed.
2 What data we use
Account: name, email address, optionally a password. Order: billing details and the domain to be audited. Usage: sign-in times and devices for session management – for each signed-in device we store the browser/operating system, a shortened IP address (last block removed) and the sign-in and last activity time, so that you can sign out individual devices under “Sign-in & security”. The entries are deleted when the session expires or you sign out.
3 Audit of your website
We retrieve publicly accessible pages of the specified domain – just like a search engine. We do not sign in and do not read any protected areas. We obtain search results and metrics via [data provider].
4 Payment via Stripe
Payment details are entered directly with and processed by Stripe Payments Europe Ltd. We only see the payment method, the last four digits and the payment status.
5 Emails & sign-in links
We process your email address for sign-in links, order confirmations, invoices and the “Your report is ready” notification. Emails are sent via [email service provider]. Sign-in links are only valid for a short time and can only be used once. We only send marketing emails with your consent.
6 AI services
For the texts of the report we use language models [on our own servers / via provider …]. In doing so, content from your website is processed, but no payment data.
7 Cookies & partner attribution
Necessary cookies keep you signed in and store your cookie choice and language. If you arrive via a partner link, we store the partner code for [30 days] – only with your consent. You can withdraw your consent at any time in the cookie settings. Independently of this, we count visits via partner links: only one counter per partner and day is stored – no IP address and nothing that can be linked to you; your browser merely remembers until the tab is closed that the visit has already been counted.
8 Storage period
We store account data for as long as your account exists. We retain invoices for [10 years] due to statutory obligations. We delete audits and reports together with your account or earlier on request. Server logs are deleted after [… days].
9 Your rights
You have the right of access, rectification, erasure, restriction of processing, data portability and objection. You can withdraw any consent you have given at any time with effect for the future. To do so, write to us at [datenschutz@…]. You can delete your account yourself at any time.
10 Right to lodge a complaint
You can lodge a complaint with a data protection supervisory authority, for example the authority responsible for us: [Name and address of the supervisory authority].