Privacy policy

This policy explains, pursuant to Art. 13 GDPR, which personal data we process when you visit feedfoundry.app, create an account, use FeedFoundry or take out a subscription, for what purpose and on which legal basis.

For content that customers enter into their workspace, such as details about their own customers, the respective customer is responsible. We process that content on their behalf under the data processing agreement. If you want to know what a customer has stored about you in FeedFoundry, please contact that customer.

No data protection officer is appointed because the conditions of Art. 37 GDPR are not met.

The website and the app are operated and delivered by Vercel Inc. (USA); server-side functions run in the Frankfurt region. When a page is requested, Vercel automatically processes the technically necessary connection data: IP address, date and time, requested address, amount of data transferred, status code, referrer and user agent. This is necessary to deliver the page and serves to fend off attacks and to debug errors. The data is not combined with other sources. Vercel is bound as a processor under Art. 28 GDPR. The legal basis is Art. 6 (1) (f) GDPR, the legitimate interest in secure and uninterrupted operation.

So that we can detect and fix errors in the app, our servers send technical error reports to Sentry, operated by Functional Software, Inc. (USA). The data is stored in Sentry's EU region in Germany. An error report contains the type of error and its message, the affected place in the program code, the pattern of the requested page and the time. We do not transmit request data such as IP address, cookies, headers and form contents, or details about users. Before sending, we replace recognisable email addresses, identifiers of accounts, projects and payments, links and credentials in error messages. In individual cases an error message may still contain a name, for example the name of a project or a website. Sentry is bound as a processor under Art. 28 GDPR. The legal basis is Art. 6 (1) (f) GDPR, the legitimate interest in secure and error-free operation. Error reports are deleted after 90 days at the latest.

Visitors who are not signed in get no cookies on the public pages. There is no audience measurement, no tracking pixel, no ad network and no embedded third-party content. Fonts are served from this domain.

When you sign in, your browser stores a session cookie so that you stay signed in. It holds your Supabase Auth session and may be renewed on any page request, including public pages. It is deleted when you sign out and expires after 400 days at the latest.

When you delete a workspace, your browser keeps a key in local storage with which you can retrieve the deletion record later.

Both are strictly necessary for the service you request; no consent is required for them (§ 165 (3) TKG 2021, Austrian Telecommunications Act). The legal basis for the processing is Art. 6 (1) (b) GDPR.

For an account we process your email address, an account identifier, the times of registration and sign-in and your confirmation of our legal texts (document, version, time, whether at registration or in the app). If you are invited to a workspace or invite someone, we process the invited person's email address, the role and the status of the invitation. All members of a workspace see who is a member and with which role; only owners and administrators see the members' email addresses.

Supabase operates account, sign-in and database for us as a processor; the data is stored in the EU region Frankfurt. The legal basis is Art. 6 (1) (b) GDPR, the performance of the user contract.

To prevent abuse we count requests for sign-in links per email address and per IP address. Only a hash formed with a secret key is stored, not the address itself. A counter covers a one-hour window. We delete old counters gradually during later requests; there is no fixed deletion period yet for counters that are no longer used. The legal basis is Art. 6 (1) (f) GDPR, the legitimate interest in a secure service.

Confirmation and sign-in links are sent by Supabase Auth by email. We use the same channel to send order confirmations and acknowledgements of a withdrawal. This processes your email address, the content of the email and delivery details. The legal basis is Art. 6 (1) (b) GDPR; for order confirmations and acknowledgements we are legally required to send, Art. 6 (1) (c) GDPR.

Email delivery: To send emails, such as sign-in links and notifications, we use Lettermint B.V., Willemsvaart 16 B, 8019 AB Zwolle, Netherlands, as a processor. Lettermint processes and stores this data exclusively in the European Union. The basis is a data processing agreement under Art. 28 GDPR.

At registration and sign-in we protect the form with Cloudflare Turnstile by Cloudflare, Inc. (USA). Your browser loads a script from Cloudflare for this; Cloudflare processes your IP address and technical details about browser and device to tell people apart from automated requests. Supabase Auth checks the result. The legal basis is Art. 6 (1) (f) GDPR, the legitimate interest in protection against automated sign-ups.

In your workspace we store what you and your members enter or have generated: projects, sources, answers, brand profile, Growth Dossier, campaigns and posts, plus who created, changed or approved what.

When you start a dossier run or a Content Job, we send the content needed for it to OpenRouter, Inc. (USA). We decide which model a function uses; currently these are models by Anthropic. OpenRouter forwards the request to the model provider or one of its hosting partners. The models are currently run by Anthropic, PBC (USA), Amazon Web Services (Amazon Bedrock) or Google Cloud (Vertex AI). With every request we require that the content is neither stored nor used for training. To check a post, the rendered graphic may also be transmitted. The text in the graphic is not set by the AI but by our server from fixed templates.

AI results are suggestions. You review and decide; there is no automated decision within the meaning of Art. 22 GDPR. The legal basis is Art. 6 (1) (b) GDPR.

When you take out a subscription, Stripe Payments Europe, Limited (Ireland) processes the payment. Stripe processes name, email address, billing address, payment method and payment transactions; we do not receive full card numbers or bank details. We store the Stripe customer and subscription identifiers and the subscription status. The legal basis is Art. 6 (1) (b) GDPR, and for keeping invoices Art. 6 (1) (c) GDPR.

Stripe is itself responsible for fraud prevention and its own legal obligations; Stripe's privacy policy applies to that.

If you write to us, we process your email address, your name and the content of your message in order to reply. The legal basis is Art. 6 (1) (b) GDPR where a contract or its preparation is concerned, otherwise Art. 6 (1) (f) GDPR, the legitimate interest in answering enquiries. The mailbox is run on Google Workspace by Google Ireland Limited (Ireland).

• The hosting provider keeps server logs only as long as operational security and debugging require and deletes them automatically afterwards.
• Error reports are deleted at Sentry after 90 days at the latest.
• We keep account data and the confirmations of the legal texts until your account is deleted.
• We keep workspace content until the workspace is deleted. After the trial or subscription ends, it remains exportable and deletable. A deletion record without content is kept afterwards.
• Database backups are overwritten in line with their retention cycle.
• We keep invoices and accounting records for seven years (§ 132 BAO, Austrian Federal Fiscal Code).
• We keep email enquiries until your request is settled; if a business relationship results, correspondence is kept for seven years under § 132 BAO.
• We keep withdrawal and cancellation notices, including their acknowledgement of receipt, until the case is settled and then for seven years from the end of that calendar year (§ 132 BAO). If no contract can be matched, we keep them for three years (§ 1486 ABGB, Austrian Civil Code). After that we remove names, email addresses and free text.

The owner of a workspace can export its data and delete the workspace. As long as the app does not yet offer one of these paths, we handle it on request by email. We delete your account on request by email; your confirmations of the legal texts are deleted with it.

These service providers process personal data for us. There are no other recipients unless we are legally obliged to disclose data.

Vercel Inc. (USA)

Hosting and server functions, Frankfurt region. Third country: Data Privacy Framework, supplemented by EU standard contractual clauses.

Functional Software, Inc. (Sentry, USA)

Server error reports, stored in the EU region. Third country: Data Privacy Framework, supplemented by EU standard contractual clauses.

Supabase Pte. Ltd. (Singapore)

Account, sign-in and database, Frankfurt region. Third country: EU standard contractual clauses.

Lettermint B.V. (Netherlands)

Sending emails. Processed and stored exclusively in the EU.

Cloudflare, Inc. (USA)

Security check at registration and sign-in. Third country: Data Privacy Framework, supplemented by EU standard contractual clauses.

OpenRouter, Inc. (USA)

Forwarding AI requests. Third country: EU standard contractual clauses.

Anthropic, PBC (USA)

Running the Anthropic models when OpenRouter routes the request to Anthropic. Third country: EU standard contractual clauses.

Amazon Web Services, Inc. (USA)

Running the Anthropic models on Amazon Bedrock when OpenRouter routes the request there. Third country: Data Privacy Framework, supplemented by EU standard contractual clauses.

Google LLC (USA)

Running the Anthropic models on Google Cloud Vertex AI when OpenRouter routes the request there. Third country: Data Privacy Framework, supplemented by EU standard contractual clauses.

Google Ireland Limited (Ireland)

Google Workspace, mailbox office@gotzendorfer.at for email enquiries. Transfer to Google LLC (USA): Data Privacy Framework, supplemented by EU standard contractual clauses.

Stripe Payments Europe, Limited (Ireland)

Payment and invoices for the subscription. Transfer to Stripe, Inc. (USA): Data Privacy Framework, supplemented by EU standard contractual clauses.

Transfers to third countries. Recipients based outside the EU, or with access from there, may process data outside the EU. The basis is stated for each recipient: the European Commission's adequacy decision for the Data Privacy Framework where the recipient is certified, otherwise the EU standard contractual clauses (Art. 46 (2) (c) GDPR).

You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection (Art. 21 GDPR), in particular to processing based on Art. 6 (1) (f) GDPR. There is no automated decision-making, including profiling.

For data protection requests, write to office@gotzendorfer.at

If you believe that the processing of your data infringes the GDPR, you can lodge a complaint with the supervisory authority:

If a processing activity or a service provider is added, we extend this policy beforehand. We inform account holders of material changes by email.