Privacy notice
Status: 12 September 2026 – draft for legal review
1. Controller
Daniel Mörbitz, trading as confacAI
Seebacher Straße 66, 67098 Bad Dürkheim, Germany
Email: daniel@confacAI.com
[TO REVIEW: Legal designation after business registration; name a data protection officer only if appointed.]
2. Website access and server logs
When the website is accessed, the server processes technically necessary information: IP address, date and time, requested address, status code, data volume transferred, browser identifier and previously visited page where transmitted. Processing serves delivery, security and error analysis.
Legal basis: [TO REVIEW, normally Art. 6(1)(f) GDPR.]
Retention: [ENTER: Actual server-log period.]
Hosting provider: [ENTER: Name, registered office, DPA and region.]
3. Account and authentication
For a customer account we process name or display name, email address, company information where provided, password hash, registration and sign-in timestamps, and account settings. Passwords are not stored in plain text.
Purpose: Providing and securing the account, communication and contract performance.
Legal basis: [TO REVIEW: Art. 6(1)(b) GDPR; where relevant Art. 6(1)(f) GDPR for security.]
Retention: [ENTER: Contract period, deletion process and statutory exceptions.]
4. Productions, uploads and AI services
When customers start a feature, we process the entered text, briefs, channel details, uploaded images, audio and video files, as well as generated results, status data and error logs. Where necessary for the selected feature, content is sent to specialised technical providers, for example for language processing, image or video generation, transcription, translation or analysis.
Purpose: Performing the commissioned production and providing the result.
Legal basis: [TO REVIEW: Art. 6(1)(b) GDPR; separately describe role and legal basis for B2B processing on behalf.]
Recipients: [ADD COMPLETE PROVIDER LIST, registered office, purpose, DPA/SCC or other third-country transfer mechanism.]
Retention: [ENTER: Production, result, upload and backup periods.]
Customers should not enter third-party personal data or confidential content where they cannot justify its disclosure to the providers required for the feature.
5. Social-media connections
Customers may voluntarily connect accounts with YouTube, Facebook, Instagram, LinkedIn and TikTok. Sign-in and authorisation take place with the respective platform provider. confacAI receives no password for these platform accounts.
Depending on authorisation and platform, we process account or channel ID, display name, profile-image URL, page/channel information, granted permissions, access and refresh data, and encrypted stored tokens. The data is used to associate the connected account, provide expressly authorised features and operate the connection securely.
The connection can be removed in the Creator profile. Revoking app authorisation at the platform provider may additionally be necessary.
Legal basis: [TO REVIEW: Contract performance and/or consent.]
Recipients: Google, Meta, LinkedIn and TikTok only where the customer initiates the respective connection.
Retention: Until disconnection or account deletion, subject to backups and legal duties. [TECHNICAL REVIEW.]
6. Email and support
We process email address, message content, technical delivery data and support history to provide account confirmations, contract information, invoices and requested support.
Provider: [ENTER: Email and support provider, registered office and DPA.]
Legal basis: [TO REVIEW: Art. 6(1)(b) or (f) GDPR.]
Retention: [ENTER.]
7. Payments and invoices
For paid offers we process order, invoice and payment-status data. Payment data is transmitted to the payment provider only as necessary for payment.
Provider: [ENTER: Payment provider, data categories, registered office and privacy link.]
Legal basis: Contract performance and statutory retention duties.
Retention: [ENTER: Tax retention and technical implementation.]
8. Cookies, local storage and analytics
[TECHNICAL REVIEW.] After sign-in, the portal stores technically necessary session data and display settings in the browser. Analytics, marketing or third-party cookies are used only if actually activated and covered by this notice and, where applicable, the consent mechanism.
9. Data-subject rights
Subject to statutory requirements, data subjects have rights of access, rectification, erasure, restriction, portability, objection and withdrawal of consent for the future. Requests may be sent to daniel@confacAI.com. They also have the right to lodge a complaint with a supervisory authority.
Competent authority: [TO REVIEW: State Commissioner for Data Protection and Freedom of Information Rhineland-Palatinate; enter current contact details.]
10. Automated decisions and changes
[TO REVIEW: Whether profiling or automated decisions within the meaning of Art. 22 GDPR occur.] This notice will be updated if processing, providers or features change.