Privacy Policy

1. Privacy at a Glance

General Information

The following information provides a simple overview of what happens to your personal data when you visit this website. Personal data is any data that can be used to personally identify you.

Data Collection on This Website

Data processing on this website is carried out by the website operator. Your data is collected in part by you providing it to us (e.g. by filling out the contact form). Other data is automatically collected or collected with your consent when you visit the website by our IT systems. This is primarily technical data (e.g. internet browser, operating system or time of page access).

What Do We Use Your Data For?

Some of the data is collected to ensure the error-free provision of the website. Other data may be used to analyze your user behavior, for contract processing or to answer inquiries.

What Rights Do You Have Regarding Your Data?

You have the right at any time to obtain free information about the origin, recipient and purpose of your stored personal data. You also have the right to request the correction or deletion of this data. If you have given consent to data processing, you can revoke this consent at any time for the future. You also have the right, under certain circumstances, to request the restriction of the processing of your personal data as well as the right to lodge a complaint with a supervisory authority.

2. Hosting

We host the contents of our website with mittwald CM Service GmbH & Co. KG (Königsberger Straße 4-6, 32339 Espelkamp, Germany). Our mailboxes for receiving and answering inquiries from this website are hosted there as well. The personal data collected on this website is stored on the host’s servers. This may include IP addresses, contact requests, meta and communication data, contract data, contact details, names, website accesses and other data generated via a website. Processing at the host takes place within the EU. Some of our own applications (for example reach analytics and customer management) run on servers of Hetzner Online GmbH in Germany (see section 4). The domain bytebrise.com is registered with Namecheap (Namecheap, Inc., 4600 East Washington Street, Suite 305, Phoenix, AZ 85034, USA); registration data may be transferred to the USA in the process, based on the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR).

The use of the host is for the purpose of fulfilling contracts with our potential and existing customers (Art. 6 para. 1 lit. b GDPR) and in the interest of secure, fast and efficient provision of our online services by a professional provider (Art. 6 para. 1 lit. f GDPR). The host processes your data only on our instructions and to fulfill its service obligations.

Content Delivery Network (Cloudflare)

This website uses the content delivery network and security infrastructure of Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA ("Cloudflare"). Cloudflare acts as a reverse proxy between your browser and our hosting server: all requests to our domain pass through Cloudflare’s edge servers. In doing so, technical connection data (IP address, user agent, requested URL, HTTP status code, timestamp) is processed.

Cloudflare does not set any cookies on this website because Bot Fight Mode and Web Analytics are disabled. In the event of network errors, the browser transmits anonymized error reports to cloudflare.com via the NEL standard (Network Error Logging), solely to ensure availability.

The legal basis is Art. 6 para. 1 lit. f GDPR (legitimate interest in fast, secure and resilient delivery of the website as well as protection against DDoS and bot attacks). Cloudflare is certified under the EU-US Data Privacy Framework; a data processing agreement (Art. 28 GDPR) including EU standard contractual clauses is in place. Details: cloudflare.com/privacypolicy.

We do not deliver individual web pages on subdomains of bytebrise.com, for example facette.bytebrise.com, from the hosting server but directly via Cloudflare: the page runs on Cloudflare Workers and its files are stored in Cloudflare R2 storage (Cloudflare, Inc., USA). Here too, Cloudflare processes the technical connection data named above (IP address, user agent, requested URL, HTTP status code, timestamp). Legal basis, certification and data processing agreement apply as described above.

Data Backups

We create daily backups of the systems we operate ourselves. These are encrypted before transfer and then kept in three mutually independent locations: Cloudflare R2 (Cloudflare, Inc., USA), Backblaze B2 (Backblaze, Inc., San Mateo, California, USA) and Google Cloud Storage (Google Cloud EMEA Limited, Dublin, Ireland; data centre Frankfurt am Main). The decryption keys remain exclusively with us, so the providers cannot access the contents of the backups. The legal basis is Art. 6 para. 1 lit. f GDPR (legitimate interest in recoverable, resilient operation). Transfers to the USA are based on the EU Standard Contractual Clauses (Art. 46 para. 2 lit. c GDPR).

3. General Information and Mandatory Disclosures

Data Protection

The operators of these pages take the protection of your personal data very seriously. We treat your personal data confidentially and in accordance with statutory data protection regulations and this privacy policy. Please note that data transmission over the Internet may have security vulnerabilities.

Responsible Entity

Jakob Serfözö
Balduin-Helm-Straße 71b
82256 Fürstenfeldbruck
Phone: +49 8141 5098988
Email: hello@bytebrise.com

Storage Duration

Unless a more specific storage period has been stated within this privacy policy, your personal data will remain with us until the purpose for data processing no longer applies. If you assert a legitimate request for deletion or revoke consent for data processing, your data will be deleted unless we have other legally permissible reasons for storing your personal data.

Legal Basis

The processing of personal data is based on:

• Art. 6 para. 1 lit. a GDPR: consent
• Art. 6 para. 1 lit. b GDPR: contract or pre-contractual measures
• Art. 6 para. 1 lit. c GDPR: legal obligation
• Art. 6 para. 1 lit. f GDPR: legitimate interest

SSL / TLS Encryption

This site uses SSL or TLS encryption for security reasons and to protect the transmission of confidential content. You can recognize an encrypted connection by the fact that the address line of the browser changes from "http://" to "https://" and by the lock icon in your browser bar.

Objection to Promotional Emails

The use of contact data published as part of the imprint obligation for sending unsolicited advertising and information materials is hereby objected to. The operators of these pages expressly reserve the right to take legal action in the event of unsolicited promotional information, such as spam emails.

4. Data Collection on This Website

Cookies and Local Storage

This website itself sets no identifying cookies and no third-party trackers. One exception applies to the Meta pixel (see section 5): if you select "Okay, helps us improve" in the banner, it sets the cookies _fbp and, where applicable, _fbc. With the Google Ads tag (see section 5), the cookie _gcl_au is set after "Okay, helps us improve", and Google may set further cookies on the domains google.com and doubleclick.net. The same applies to the OpenAI measurement pixel (see section 5): it is only loaded after "Okay, helps us improve" and then sets the cookies __oaiq_consent and __obref on bytebrise.com as well as the technical cookies __cf_bm and _cfuvid of the infrastructure provider Cloudflare on the domains bzr.openai.com and bzrcdn.openai.com. A further exception, until 30 September 2026, was the cookie bb-ab (see below). Otherwise, storage in your browser takes place exclusively via localStorage/sessionStorage for the following purposes:

• Language preference (bb_lang, localStorage): stores the chosen language (DE/EN) for future visits.
• Consent status (bb_consent_v1, localStorage): remembers your choice from the privacy banner (allow statistics / essential only).
• Light/dark choice (bb_theme and bb_theme_win, localStorage): only set if you use the light/dark switch. It stores your choice, which then applies permanently until you switch again; the time window is stored as well. Without a choice the time of day decides.
• Origin for printed links (bb-print-attrib, sessionStorage): if you reach the site via a printed QR link, your browser remembers the medium, campaign and source of that link for the duration of the session. It is deleted when the tab is closed.
• Limit on error reports (bb:err-rate, sessionStorage): counts how many error reports (see below) were sent within a short time and limits their number. Deleted when the tab is closed.
• Referral code (bb_ref and bb_ref_t, localStorage): only set if you reach our site via a referral link (with the URL parameter ?ref=) and have consented to statistics. Storage period 30 days. Purpose: crediting the referrer with your sign-up as a completed referral (see the Referral Program section on the homepage). You can delete this value at any time by clearing the domain's local storage in your browser. Legal basis: Art. 6 para. 1 lit. a GDPR (consent via the banner).
• A/B test identifier (bb_gb_anon, localStorage): only set if you choose "Allow statistics". A random identifier that lets a test of the main button on the German home page (GrowthBook, via our server gb-api.bytebrise.com) assign you to the same variant on every visit. You can delete the value at any time in your browser's developer tools.

Until 30 September 2026, a Cloudflare function (worker) set a cookie bb-ab with the value a or b when you opened bytebrise.com (lifetime 30 days, Secure, SameSite=Lax). This cookie was not technically necessary and delivered no different content; its value was only reported, where present, as an evaluation attribute to our cookieless Matomo (see below). Since 30 September 2026 we no longer set it. Cookies already set expire after 30 days at the latest; you can also delete them at any time in your browser settings.

Spam Protection for Forms (Cloudflare Turnstile)

Our forms are protected by Cloudflare Turnstile, a service of Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA. Turnstile checks in the background whether an entry comes from a human or from a program. For this purpose a script from challenges.cloudflare.com is loaded, and your IP address and technical characteristics of your browser are transmitted to Cloudflare. As a rule, you do not have to solve a visible puzzle.

The purpose is to ward off automated mass requests. We use the service because advertising was sent in large volumes through our contact form, which our previous technical protection measures could not stop. The legal basis is Art. 6 para. 1 lit. f GDPR; our legitimate interest lies in protecting our forms from abuse. Consent is not required for this, as the service serves the security of the form and without it no inquiry could be accepted. Cloudflare is certified under the EU-US Data Privacy Framework. Further information in Cloudflare’s privacy policy.

You can delete all entries at any time in your browser's developer tools. You can reset your choice from the privacy banner by removing bb_consent_v1 from localStorage; the banner will reappear the next time you load the page.

We also collect anonymous interaction data to make the site easier to understand: which sections were seen (scroll depth per section), where visitors leave the page (exit point) and rough click areas (normalised, page-relative coordinates with no personal reference). These events contain a daily-rotating hash instead of a persistent identifier, the URL path and a device class (mobile, tablet or desktop), but no cookies and no storage on your device (no localStorage). Processed on our own server (crm.bytebrise.com, Hetzner Germany), no third party. Do Not Track: if your browser sends a DNT header, collection is automatically disabled. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in understanding site usage); no consent banner is required for this because we neither use cookies nor access device storage, so the scope of § 25(1) TDDDG is not opened in the first place. Whether consent is required depends on the actual access to information on your device and the purpose of processing; forgoing cookies alone does not answer this question. Retention: raw data for 60 days, then only anonymous monthly aggregates.

Error reports

If a script error occurs in your browser, the page sends an error report to our web server (error-report.php). We store the error message, file, line, stack excerpt, requested address, browser identifier (user agent) and time, no IP address. Purpose: finding and fixing errors. Legal basis: Art. 6 para. 1 lit. f GDPR (legitimate interest in a working website). The reports are stored on the web server at mittwald and deleted automatically after 30 days.

Matomo (Self-Hosted, Cookieless)

In addition to the anonymous interaction data, we use Matomo, an open-source analytics software that we operate on our own servers (Hetzner, Falkenstein, Germany). Third-party providers: none. External data transfer: none.

Cookieless: Matomo sets no cookies on this website (configuration disableCookies). Recognition is session-based via a short-lived heuristic hash (IP + user-agent tag, generated server-side, max. 30 min).

IP anonymisation: The last two octets of your IP address are discarded before any processing (configuration ipAddressMaskLength = 2). The full IP is never stored.

Do Not Track: If your browser sends a DNT header (Do-Not-Track), Matomo is automatically deactivated and no tracking takes place.

Data collected: page view, referrer, approximate location (country/region derived from the anonymised IP), screen resolution, browser/OS type. No personal profiles, no cross-site tracking, no fingerprinting across websites (enable_fingerprinting_across_websites = 0).

Legal basis: Art. 6 para. 1 lit. f GDPR (legitimate interest in measuring reach). A consent banner for Matomo is not required, as we forgo any access to cookies/local storage (§ 25(2) No. 2 TDDDG) and anonymise IP addresses before processing. Whether consent is required depends on the actual access to information on your device and the purpose of processing; forgoing cookies alone does not answer this question.

Storage period: raw data 90 days, aggregated statistics permanently. Objection: You can object to the collection at any time by enabling the DNT header in your browser (Settings → Privacy → "Send Do Not Track requests").

Manufacturer: InnoCraft Ltd, 7 Waterloo Quay PO625, 6140 Wellington, New Zealand. A self-hosted instance runs on bytebrise.com; no data is transferred to InnoCraft.

Limiting Repeated Submissions

To limit repeated submissions (contact form, interview form, accessibility scan, appointment booking), our server briefly creates a counter file. Your IP address is used for this as a hash value in the file name; the file contains only the times of your most recent submissions. Because such a hash value of an IP address can be reversed if the method is known, we treat it as personal data. The file is deleted once the counting period has expired (10 minutes to 24 hours depending on the form); this happens the next time the respective form is called, and until then the file may remain. The legal basis is Art. 6 para. 1 lit. f GDPR (legitimate interest in protecting the forms from misuse). More on appointment booking in section 7.

Contact Form

If you send us inquiries via the contact form, your details from the inquiry form, including the contact data you provided there, will be stored by us for the purpose of processing the inquiry and in case of follow-up questions. We process the details to handle your inquiry. Service providers named for hosting and communication may be technically involved. This does not involve using your inquiry for additional marketing.

The processing of this data is based on Art. 6 para. 1 lit. b GDPR if your request is related to the fulfillment of a contract or is necessary for the implementation of pre-contractual measures. In all other cases, the processing is based on our legitimate interest in the effective processing of inquiries addressed to us (Art. 6 para. 1 lit. f GDPR) or on your consent (Art. 6 para. 1 lit. a GDPR) if this has been requested. The data you enter in the contact form will remain with us until you request deletion, revoke your consent to storage, or the purpose for data storage no longer applies. Mandatory statutory provisions remain unaffected.

Inquiry by Email or Phone

If you contact us by email or telephone, your inquiry including all resulting personal data (name, inquiry) will be stored and processed by us for the purpose of processing your request. We process the details to handle your inquiry. Service providers named for hosting and communication may be technically involved. This does not involve using your inquiry for additional marketing. Legal bases are Art. 6 para. 1 lit. b, f and, if applicable, a GDPR.

5. Embedded services and tools

What we do NOT embed

This website avoids most classic third-party integrations:

• Fonts: We host all typefaces (Manrope and Dystopian, plus Syne on the error page) on our own server. No connection is made to Google Fonts or any other font CDN.
• Maps: No Google Maps, OpenStreetMap, or other mapping service is embedded.
• Third-party analytics: No Google Analytics, no Hotjar, no Plausible. Instead, anonymous interaction data on our own server and self-hosted Matomo (see section 4), both in Germany.
• Social media plugins: No like buttons, Twitter widgets, or comparable social plugins other than the Meta pixel described below. Links to our profiles (LinkedIn, Facebook) are plain links without any tracking component.
• Ad networks: No ad serving and no profiling for advertising purposes on this website. Exception: we use Google Ads conversion tracking to measure the effect of our own ads (the related script only loads after your consent, details below).

What We Embed (Complete List)

• Cloudflare (CDN, reverse proxy, DDoS protection): Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA. When you access a page, your IP address is temporarily transmitted to Cloudflare so that content can be delivered quickly (legal basis Art. 6 para. 1 lit. f GDPR). Privacy policy: cloudflare.com/privacypolicy
• Cloudflare Turnstile (spam protection for forms, see section 4): Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA. When you open a page with a form, a script from challenges.cloudflare.com is loaded; your IP address and technical browser characteristics are transmitted to Cloudflare (legal basis Art. 6 para. 1 lit. f GDPR). Privacy policy: cloudflare.com/privacypolicy
• websitecarbon.com (CO2 footprint badge in the footer): just a linked reference, NO script is embedded. The third-party page only loads when you click the link. No data transfer happens in the background.
• crm.bytebrise.com (our own server in Germany, Hetzner): When you enter a URL on /quick-check.html and click “Check”, the URL (and, if you provide it and consent, your email address) is transmitted to our server, which retrieves and analyses the page. See section 12.
• matomo.bytebrise.com (self-hosted Matomo analytics): see section 4. Server in Germany (Hetzner, Falkenstein). Cookieless, IP anonymized before processing, DNT respected. No data transfer to third parties.
• Google Ads conversion tracking (gtag.js, conversion ID AW-18125103490): Provider Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Measures whether a website visit via one of our Google Ads ads led to a contact. The Google Ads script only loads once you select "Okay, helps us improve" in the cookie banner (legal basis Art. 6 para. 1 lit. a GDPR, consent); before your decision no connection to Google is made, and neither cookies nor any data (including cookieless pings) are transmitted to Google. After your consent, the browser loads gtag.js from googletagmanager.com and communicates with Google servers (including googleads.g.doubleclick.net, ad.doubleclick.net, www.google.com); in particular the page visited, your IP address and technical characteristics of your browser are transmitted. The cookie _gcl_au (storage period 90 days) is set on bytebrise.com, together with the entry _gcl_ls in localStorage; on the domain doubleclick.net, Google may set further cookies (e.g. test_cookie, IDE). We additionally use Google Consent Mode v2 so that Google correctly respects your consent choice. Your consent can be withdrawn at any time via the "Cookie settings" link in the footer. Processing in the USA cannot be ruled out; Google LLC is certified under the EU-US Data Privacy Framework. Provider’s privacy policy: policies.google.com/privacy
• Meta Ads Pixel + Conversions API (Meta Pixel ID 2115831946000676): Provider Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland. Measures whether a website visit via one of our Meta ads (Facebook/Instagram) led to a contact. Unlike the Google Ads tag described above, Meta has no cookieless mode: the pixel only loads once you select "Okay, helps us improve" in the banner (legal basis Art. 6 para. 1 lit. a GDPR, consent). It then sets the cookie _fbp and, if you click an ad, _fbc. In addition, upon a successful contact we transmit a server-side Conversions API event with a SHA-256-hashed email address or phone number as a matching key, again only with your consent. Processing in the USA cannot be ruled out; Meta Platforms Ireland is certified under the EU-US Data Privacy Framework. You can withdraw your consent at any time via the "Cookie settings" link in the footer. Provider’s privacy policy: facebook.com/privacy/policy
• OpenAI ads measurement pixel (oaiq, pixel ID DbA5kNwTxyGtnt8jkDnM49): provider OpenAI Ireland Limited, 1st Floor, The Liffey Trust Centre, 117-126 Sheriff Street Upper, Dublin 1, D01 YC43, Ireland. Measures whether a visit to the website via one of our ads on OpenAI led to an inquiry. The script from bzrcdn.openai.com is only loaded once you select "Okay, helps us improve" in the banner (legal basis Art. 6 para. 1 lit. a GDPR, consent); before your decision there is no connection to OpenAI. After your consent, the script transfers in particular the page visited, your IP address and technical characteristics of your browser to bzr.openai.com; in addition, the browser retrieves a configuration file from bzrcdn.openai.com. The cookies __oaiq_consent (storage period 30 days) and __obref (storage period 365 days) are set on bytebrise.com, the technical cookies __cf_bm (storage period 30 minutes) and _cfuvid (session cookie) of the infrastructure provider Cloudflare on the domains bzr.openai.com and bzrcdn.openai.com, and the entries oaiq_consent (localStorage) and oaiq_cs (sessionStorage) are stored. Processing in the USA cannot be ruled out. You can withdraw your consent at any time via the "Cookie settings" link in the footer. Provider’s privacy policy: openai.com/policies/privacy-policy
• Resend (Plus Five Five, Inc., 2261 Market Street #5039, San Francisco, CA 94114, USA): technical dispatch of confirmation and notification emails from forms and bookings. The transfer to the USA is based on the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR); Resend is additionally certified under the EU-US Data Privacy Framework.

When a page is loaded normally, your IP address is transmitted to Cloudflare and to our own web server (Art. 6 para. 1 lit. f GDPR, legitimate interest). The Google Ads script described above only loads after your express consent ("Okay, helps us improve"); without that consent no connection to Google is made and no cookies are set.

6. Your Rights

You have the following rights with respect to us:

• Access (Art. 15 GDPR) to the personal data stored about you
• Rectification (Art. 16 GDPR) of inaccurate or incomplete data
• Erasure (Art. 17 GDPR) of your personal data
• Restriction of processing (Art. 18 GDPR)
• Data portability (Art. 20 GDPR) in a machine-readable format
• Objection (Art. 21 GDPR) to the processing of your data

To exercise these rights, please contact: hello@bytebrise.com

You also have the right to lodge a complaint with a data protection supervisory authority about the processing of your personal data by us.

7. Online Appointment Booking

You can book an appointment with us online in two ways: through a personal invitation link (/t/…) for a phone call, or through the public booking link for the website check (/termin?check=1) for an on-site appointment at your business. For this we process the data you enter in the booking form:

• Name
• Email address (for the booking confirmation)
• Phone number (with the invitation link for the call-back at the booked time, with the website check for queries and appointment changes)
• with the invitation link: your request / topic
• the preferred time slot
• with the website check: name and place of your business as the meeting point (the full address only if you provide it)
• technical: the time of booking. We do not store your IP address with the booking; it is used only for the security check and to limit booking attempts (see “Protection against misuse”)

Legal basis: The booking, the appointment confirmation, the conduct of the appointment and a follow-up quote are based on Art. 6 para. 1 lit. b GDPR (pre-contractual measures at your request). The processing of your IP address and the security check are based on Art. 6 para. 1 lit. f GDPR; our legitimate interest is protecting the booking calendar from automated and abusive bookings. We need the mandatory fields to arrange the appointment. Without them online booking is not possible; you can then reach us by email or phone.

Purpose: Arranging and conducting the initial phone consultation or the on-site website check, confirming the appointment by email (with a calendar file in .ics format), internal notification, preparing the appointment and, if you wish, a quote afterwards. We count the booking as an event in our cookieless Matomo (section 4); with your consent in the banner also as a conversion in Google Ads (section 5).

Storage period: If no order results, we delete your booking data no later than three months after our last contact with you. If an order is placed, we continue to process the data to perform the contract and keep it within the statutory retention periods.

Storage location and transfer: The booking is first stored on our web server at mittwald (section 2) in a file that cannot be accessed from outside. Our customer management system (CRM) fetches it from there every five minutes over an encrypted connection. We operate the CRM on our own server in Germany (Hetzner, section 2); access is password-protected and limited to us. We transfer name, email address, phone number, appointment and topic or business and place into the CRM, not the IP address. After the transfer we delete the entry from the web server the next time the booking page is called. We send the confirmation email and the internal notification through the mittwald mail server.

Invitation link and booking link: The invitation link contains a cryptographically signed token with an expiry date. It can be invalidated by expiry of its validity period or at your request. The booking link for the website check can be used without an invitation.

Protection against misuse: For the website check, Cloudflare Turnstile checks before submission whether the booking comes from a human (provider, data transfer to the USA and certification: see section 4 “Spam Protection for Forms”). The check script from challenges.cloudflare.com is only loaded when the booking form appears. For confirmation, our server sends the check result together with your IP address to Cloudflare. We also limit the number of booking attempts per connection: at most five in ten minutes and, for the website check, at most three in 24 hours. For this we store on our web server a hash value of your IP address (for IPv6, of your connection's network range) with the times of the attempts, without names and without form data. We delete these entries automatically once the last attempt is more than 24 hours old; deletion takes place at the next booking attempt on our website. The legal basis is Art. 6 para. 1 lit. f GDPR, and for Turnstile's access to your device § 25 para. 2 no. 2 TDDDG.

No appointment-booking service providers: We do not use external appointment-booking services (for example Calendly or Cal.com); booking runs through our own systems. Only the providers named are involved: mittwald (hosting and email), Hetzner (CRM server) and Cloudflare (delivery and security check).

8. Business Outreach and Lead Processing

As part of our business development we research publicly available information about companies that might be interested in our services (e.g. company name, address, phone, website URL, contact persons publicly listed on the company website). We store this information in an internal customer management system (CRM) that we operate on our own server in Germany (Hetzner, see the Hosting section). Access is password-protected and limited to us.

Legal basis: Art. 6 para. 1 lit. f GDPR. Our legitimate interest is acquiring new business customers through targeted outreach. Only business contact data is processed, no data from private contexts.

Preview drafts: In individual cases we create a non-binding website draft for illustration purposes that uses publicly available content from the company website (company name, logo, texts, images). The draft is stored under a non-indexed address (/preview/{slug}/), blocked for search engines (robots.txt, X-Robots-Tag: noindex) and shared exclusively with the company concerned via a link. It does not imply any existing business relationship.

Objection and deletion: You can object to the processing of your business data for outreach purposes at any time, informally, at hello@bytebrise.com. We will then delete the data from the CRM without delay and remove any preview draft within three working days.

Storage period: Outreach data is deleted no later than three months after the last communication if no business relationship is established. Preview drafts are removed from the server by the same time at the latest. If a contract is concluded, the data is transferred to our customer records.

9. Newsletter

You can subscribe to a newsletter on our blog. For this we process your email address as well as the time and IP address of the registration and confirmation. Registration uses the double-opt-in procedure: you first receive a confirmation email, and you are only subscribed once you click the confirmation link.

Legal basis: Art. 6 para. 1 lit. a GDPR (consent). Logging of the double-opt-in is based on Art. 6 para. 1 lit. f GDPR in order to be able to prove the registration.

Processing and dispatch: Subscribers are managed via self-hosted newsletter software (Listmonk) on our server in Germany (Hetzner, see the Hosting section). For the technical dispatch of the emails we use Brevo (Brevo GmbH, formerly Sendinblue GmbH, Köpenicker Str. 126, 10179 Berlin) as a processor; a data processing agreement is in place with Brevo.

Withdrawal and storage period: You can unsubscribe from the newsletter at any time via the unsubscribe link in every email or informally by message to hello@bytebrise.com. After unsubscribing we delete your data from the mailing list; we retain the log data of the previous consent for evidence purposes.

10. Payment Processing via Stripe

For billing paid services (e.g. monthly subscriptions, AI add-ons and payments via the customer portal) we use the payment service provider Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland ("Stripe").

When you make a payment via Stripe, the data required for this is transmitted to Stripe: name, email address, billing address, payment details (e.g. card number or IBAN), amount, currency and time of the transaction. You enter your payment details directly into Stripe’s payment forms; complete card data never reaches our systems. We only receive a confirmation of the payment from Stripe along with the details needed for invoicing.

Legal basis: Art. 6 para. 1 lit. b GDPR (performance of a contract or pre-contractual measures). Where Stripe processes data for its own purposes such as fraud prevention, Stripe is itself responsible for that processing under data protection law.

Third-country transfer: Stripe may transfer data to affiliated companies in the USA (Stripe, Inc.). This is based on the EU standard contractual clauses (Art. 46 para. 2 lit. c GDPR); Stripe is also certified under the EU-US Data Privacy Framework.

Storage duration: We retain payment and invoicing data within the statutory retention periods (Section 147 AO, Section 257 HGB). Details on data processing by Stripe: stripe.com/privacy.

11. AI-Assisted Text Features (Anthropic)

For the optional AI add-ons Humanize (revision of your own texts) and AI Copywriter (creation of blog texts, see Terms of Use) we use AI models from Anthropic (Anthropic, PBC, San Francisco, California, USA).

When you use one of these tools, the texts you enter are transmitted to Anthropic via an API for processing. Other data from your account (name, email address, payment details) is not sent along. Please do not enter any particularly sensitive data or third-party secrets into the tools (see Terms of Use).

Anthropic processes the input on our behalf and according to our instructions; a data processing agreement (Art. 28 GDPR) is in place. According to the provider’s terms for API use, your input is not used to train the AI models.

Legal basis: Art. 6 para. 1 lit. b GDPR (performance of the contract for the booked add-on).

Third-country transfer: Processing may take place on servers in the USA. This is based on the EU standard contractual clauses (Art. 46 para. 2 lit. c GDPR). Details: anthropic.com/legal/privacy.

12. Free Website Audit

On quick-check.html and free-audit.php we offer a free automated website check. We crawl the URL you provide (up to 20 pages) and evaluate technical factors, content quality and meta data. The checked URL itself is not personal data about you unless it happens to contain your name.

Email address (optional): Only if you voluntarily provide your email and consent to the processing via checkbox do we send you the full audit report as a PDF and create a lead record in our internal CRM (company domain, email, audit score). Without consent you only see the result directly on the page; no email is stored.

Legal basis: Art. 6 para. 1 lit. a GDPR (consent via checkbox) for the email processing and PDF delivery; Art. 6 para. 1 lit. f GDPR (legitimate interest in technically performing the check) for the URL analysis itself. The PDF is sent technically via Brevo (Sendinblue GmbH, Köpenicker Str. 126, 10179 Berlin) as a data processor, see section 9 (Newsletter).

Storage duration: The lead record (incl. audit score) is deleted at the latest 90 days after the request, unless it leads to a further business relationship. The generated PDF itself is not stored permanently; it is only kept briefly for delivery and then automatically removed.

Objection and deletion: You can object to this processing at any time, informally, at hello@bytebrise.com; we will then delete the lead record without delay.

13. AI Chatbot (Knowledge Assistant)

On selected pages we offer an AI-powered chat assistant (visible in the bottom right as a speech-bubble icon). The assistant answers questions based on the public content of this website (services, blog, FAQ) and runs on a server we operate ourselves in Germany (Hetzner Online GmbH, Industriestraße 25, 91710 Gunzenhausen; data centre in Germany).

Data processed: Your chat messages are transmitted for processing to the AI model of the provider Anthropic (Anthropic, PBC, San Francisco, California, USA) (see section 11 on third-country transfer and data processing agreements; the same conditions apply). Your IP address is not stored for the chat, not even as a hash. To limit abuse, the server counts requests per IP address only briefly in working memory (at most until the end of the day or a restart); it is not saved in the database with the conversations. The conversation history is stored on our server to enable multi-part conversations and to monitor the quality of responses.

Voluntary contact details: If, during the conversation, you voluntarily express interest in personal contact and provide your name and email address, the assistant may store this information as an inquiry in our internal CRM so that we can get back to you (compare section 8). This only happens when interest is explicitly expressed, never automatically or without a recognisable reason.

Legal basis: Art. 6 para. 1 lit. f GDPR (legitimate interest in a user-friendly, direct answering of questions) for the chat itself. If you share contact details in the chat to handle your inquiry, we use them for this purpose. This does not constitute an additional consent to marketing.

Third-country transfer: As described in section 11, the processing of the chat messages themselves may take place on servers in the USA (Anthropic). This is based on the EU standard contractual clauses (Art. 46 para. 2 lit. c GDPR). Details: anthropic.com/legal/privacy. The conversation history itself is stored on our own server in the EU. As with all systems we operate ourselves, we additionally create encrypted backup copies of it; details (provider, encryption, legal basis) can be found in section 2 under “Data Backups”.

Storage period: Conversation histories are automatically deleted no later than 90 days after the last message.

Objection: You can close the chat at any time without giving reasons; this results in no disadvantage to you. For a contact request stored during the conversation, section 8 (Objection and Deletion) applies.

14. Phone AI Agent (sipgate)

For telephone availability we use an AI-powered phone assistant. It answers incoming calls, records your request and, where needed, arranges an appointment or a call-back from us.

Service used: The assistant runs on the telephony platform of sipgate GmbH, Düsseldorf. sipgate processes the data as a processor on our behalf and according to our instructions; a data processing agreement (Art. 28 GDPR) is in place. Processing takes place in the EU.

Data processed: Your phone number, the content of the call as a transcript, and an automatically generated summary of the call. In addition, we process the details mentioned during the call, such as name, request and desired appointment time.

Notice of digital assistance: At the start of every call we let you know that you are speaking with a digital assistant. If you do not want this, you can hang up at any time and reach us instead by email at hello@bytebrise.com or request a call-back via the contact form.

Legal basis: Art. 6 para. 1 lit. b GDPR, insofar as the call serves to arrange an appointment or initiate a contract; otherwise Art. 6 para. 1 lit. f GDPR (legitimate interest in prompt telephone availability).

Storage period: With the provider sipgate, transcripts are retained for up to 30 days. In our own systems we automatically delete the raw transcript data after 90 days. For appointment and contact data taken over from the call, the storage periods of sections 7 (Online Appointment Booking) and 8 (Business Outreach and Lead Processing) apply.

Your rights: For access, rectification, erasure and the further rights of data subjects, section 6 applies.

15. Lead Magnets (Checklists and Guides)

Download via Forms and Exit Popups

On selected pages (e.g. ai-visibility-guide.html) and via exit popups on our landing pages, we offer free checklists and guides as PDFs for download. If you enter your email address in the form, we transmit it, together with an identifier for the requested content and an identifier for the page via which you accessed the form, in encrypted form to our customer management system (CRM), which we operate on our own server in Germany (crm.bytebrise.com, Hetzner, see the Hosting section).

Purpose and legal basis: The processing serves the one-time delivery of the PDF you requested by email as well as the management of the resulting lead. The legal basis is Art. 6 para. 1 lit. b GDPR (fulfilment of your request to have the content sent to you).

Storage period and deletion: Your data remains in the CRM until you object to the processing. Deletion follows the same process as described in section 8: informally by email to hello@bytebrise.com, deletion without delay.

Contact Sync with Brevo

For some of our existing lead magnets, the email address you provided is additionally transferred via an automated connection into our contact list with the email service provider Brevo (see section 9) in order to manage the contact centrally there. Not every lead magnet uses this sync. The legal basis is our legitimate interest in an organised, central management of contacts (Art. 6 para. 1 lit. f GDPR). A data processing agreement is in place with Brevo (see section 9).

16. Email Series "AI Visibility for Trade Businesses"

In addition to the one-time guide (see section 15), we offer on selected pages the option to sign up for a four-part information series on the topic of AI visibility for trade businesses. Registration takes place exclusively via a separate, explicit consent checkbox.

Legal basis: Art. 6 para. 1 lit. a GDPR (your consent). As with the newsletter (section 9), we complete registration using the double-opt-in procedure: you first receive a confirmation email, and you are only registered for the series once you click the confirmation link. The logging of registration and confirmation is based on Art. 6 para. 1 lit. f GDPR, in order to be able to prove consent.

Management and dispatch: Registrations are managed, as with the newsletter, via our self-hosted newsletter software (Listmonk) on our own server in Germany (see section 9). For the technical dispatch of the individual series emails we also use Brevo (see section 9) as a processor.

Withdrawal and storage period: You can unsubscribe from the series at any time via the unsubscribe link (one-click) in every email or informally by message to hello@bytebrise.com. After you unsubscribe, you will receive no further series emails. We log registration, confirmation and unsubscription for evidence purposes; we delete the remaining data from the active distribution list after unsubscription.

17. Origin Identification in Demo Templates (Install Ping)

Our free demo templates, offer previews and website kits contain a lightweight script that sends a one-time notification to our server only when the template is accessed on a third-party domain (i.e. not on bytebrise.com or a subdomain thereof). This origin identification helps us detect when a copied template is put live without a licence or completed purchase.

Data transmitted: When accessed on a third-party domain, the script transmits, via navigator.sendBeacon, only the hostname of the calling page, an identifier for the template used, a version string and the time of the call to install.bytebrise.com.

What explicitly does not happen: The script sets no cookies and does not access local storage (local storage, session storage or similar) on your device, nor does it store anything there. No visitor identification takes place, no referrer is recorded, and no user agent is stored. Whether consent is required depends on the actual access to information on your device and the purpose of processing; forgoing cookies alone does not answer this question.

IP address: During the technically required connection setup, our upstream service provider Cloudflare briefly processes the IP address (see section 2, Content Delivery Network). We ourselves do not store the IP address anywhere.

Legal basis: Art. 6 para. 1 lit. f GDPR (legitimate interest in protecting our copyright and usage rights to the templates).

Frequency and storage period: At most one notification per hostname is counted per day (deduplication); multiple calls to the same domain on the same day do not trigger a further transmission. We delete the stored hostname entries after 24 months at the latest.

Our own domains: On bytebrise.com and all our subdomains the script is technically present but does not trigger a notification: before every transmission it checks whether the calling hostname belongs to bytebrise.com, and aborts in that case.

18. bytebrise GO (Processing on Behalf of the Customer)

bytebrise GO is our app for businesses (see bytebrise GO). When a business uses GO, bytebrise processes the data of its customers and employees on behalf of that business under Art. 28 GDPR. The business remains the controller. The details are set out in a data processing agreement that we conclude with the business before the contract starts (template: DPA). For the account, login and device of app users, the app's privacy policy applies. If you only visit this website, no processing for GO is triggered.

Where the data is stored: GO data is stored on a server of Hetzner Online GmbH in Germany. Emails sent from GO, such as login codes and invitations, are sent by mittwald CM Service GmbH & Co. KG in Espelkamp.

AI features: For AI suggestions, such as draft replies, the texts needed for this are sent to Anthropic (Anthropic, PBC, San Francisco, USA). The connection runs through an interface at Cloudflare, also USA. The basis is the EU Commission's standard contractual clauses (Art. 46 para. 2 lit. c GDPR). Under Anthropic's commercial terms, this content is not used to train its models. We cannot promise processing exclusively within the EU.

Approval and labelling: An AI suggestion is not sent to the business's customers without the business's approval. Automatic sending can only be set per channel and only if the business turns it on.

Recipients and evidence: We tell the business in writing before the contract starts which further recipients GO adds, for example Apple for notifications on the iPhone. We inform in advance about new sub-processors. bytebrise is not certified, and we do not promise certificates.

Your rights as a data subject: If your data is held in a business's GO, for example because you made an enquiry or called them, please contact that business. We pass requests on to it. In general, the rights in section 6 apply.

19. Last Updated

25.10.2026