Privacy Policy
Last Updated: Juli 2026
Privacy by Design
AIActify sets no cookies, tracks no visitors and builds no profiles. To build a customer website's content inventory, our snippet transmits, per detected element, the page address without its query string and a text excerpt of up to 200 characters — that is, the publicly visible content that is to be labelled. Account, checkout, login and admin areas, hidden elements and form fields are never read.
Data Controller
Christian Lechner (Sole Trader) Allitzstraße 25 / Via Alliz 25 39023 Laas/Lasa (BZ), South Tyrol, Italy VAT ID: IT 03341620213 Email: info@aiactify.eu
Types of Data Processed
• Master data (names, addresses of customers) • Contact data (email, phone) • Contract data (subject matter, duration) • Usage data (dashboard access) • Payment data (via Stripe)
Data from customer websites
We deliberately word this section precisely rather than reassuringly. Earlier versions claimed that no visitor data was transmitted at all; that was not accurate. Our snippet runs on our customers' public pages. To build the content inventory, it transmits, per detected element: the page address without its query string (only a few page-identifying parameters such as "p" or "lang" are kept), a technical fingerprint, a CSS selector and a text excerpt of up to 200 characters. That excerpt is the content to be labelled — the visible text of a public page. If a public page contains personal data (an imprint, for example), it may appear in the excerpt; for this processing we act as our customer's data processor. Not transmitted: account, checkout, cart, login, profile and admin areas (skipped entirely), hidden elements, form fields and dialogs, anything a visitor types, and cookies or visitor identifiers. The snippet sets no cookies and performs no tracking. Script monitoring (Art. 5) reports script URLs only, never request bodies.
Hosting, Data Processors & Security
We use the following data processors (per Art. 28 GDPR): • Vercel Inc. (USA) – Web application hosting Region: Frankfurt (fra1), EU DPA: https://vercel.com/legal/dpa Legal basis: EU-US Data Privacy Framework • Supabase Inc. (USA) – Database (PostgreSQL) Region: eu-central-1 (Frankfurt), EU DPA: https://supabase.com/legal/dpa Legal basis: EU-US Data Privacy Framework + SCCs • Stripe Inc. (USA/Ireland) – Payment processing EU processing via Stripe Payments Europe Ltd., Dublin DPA: https://stripe.com/legal/dpa Legal basis: EU-US Data Privacy Framework • Resend Inc. (USA) – Transactional emails DPA: https://resend.com/legal/dpa Legal basis: EU-US Data Privacy Framework + SCCs Security measures: • TLS 1.3 encryption for all data transfers • Password hashing with bcrypt • API key hashing with SHA-256 • AES-256 encryption for stored data • Regular security audits
Google Ads conversion measurement (aiactify.eu only)
On our marketing website aiactify.eu we use Google Ads conversion measurement (Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland) with Consent Mode v2. The consent state defaults to "denied": without your consent, no cookies are set and no advertising identifiers are stored; Google only receives cookieless, aggregated pings for conversion modelling, in the course of which your IP address is technically transmitted to Google. Legal basis: legitimate interest (Art. 6(1)(f) GDPR) in privacy-preserving, cookieless measurement of our advertising campaigns. NO advertising or analytics measurement takes place in the customer dashboard (app.aiactify.eu) or through our snippet on customer websites.
Your Rights
You have the right to: • Access your stored data • Rectification of incorrect data • Deletion of your data • Restriction of processing • Data portability • Object to processing
Retention & Deletion
• Server logs: 7 days • Customer data: Contract duration + legal retention periods • Audit logs: Trial 30 days rolling; paid plans for the entire contract term, readable for another 90 days after cancellation, then archived • After contract end: Deletion within 30 days Self-service: You can delete your account yourself at any time in the dashboard (Settings → Profile → Delete account permanently). This irreversibly removes all websites, content items, rules, API keys and audit logs and cancels any active subscription (Art. 17 GDPR).
Contact
For privacy inquiries please contact: Christian Lechner Allitzstraße 25, 39023 Laas (BZ), Italy Email: info@aiactify.eu