Privacy Policy

The protection of your personal data is important to us. Below, in accordance with the General Data Protection Regulation (DSGVO) and the German Federal Data Protection Act (BDSG), we explain which data we process when you use Viewsup (hereinafter the "Service"), for which purposes and on which legal basis.

1. Controller

The controller responsible for data processing within the meaning of Art. 4 Nr. 7 DSGVO is:

[First name Last name], [Street and number], [ZIP] [City], Germany
Email: [Email address]

We have not appointed a data protection officer, as the legal requirements for doing so are currently not met. For all data protection matters, you can reach us at the address given above.

2. Principles and legal bases

We process personal data only to the extent necessary. The relevant legal bases are, in particular: the performance of a contract or pre-contractual measures (Art. 6 Abs. 1 lit. b DSGVO), consent (Art. 6 Abs. 1 lit. a DSGVO), compliance with legal obligations (Art. 6 Abs. 1 lit. c DSGVO) as well as the protection of our legitimate interests in a secure and functioning Service (Art. 6 Abs. 1 lit. f DSGVO).

3. Hosting and infrastructure

Our Service is hosted by Vercel Inc. (USA), which also acts as a content delivery network and as the intermediary for our AI features (AI Gateway). Our database and file storage are operated via Supabase in a region within the European Union (Frankfurt am Main, Germany). The legal basis is our legitimate interest in secure, high-performance operation (Art. 6 Abs. 1 lit. f DSGVO) as well as the performance of the contract (Art. 6 Abs. 1 lit. b DSGVO). Where necessary, we have concluded data processing agreements pursuant to Art. 28 DSGVO with these providers.

4. Server log files

When you access the Service, technical access data is processed automatically, such as the IP address (in shortened or briefly stored form), date and time, the volume of data transferred, the resource accessed as well as browser and operating system information. This data is technically necessary for the delivery and security of the Service (Art. 6 Abs. 1 lit. f DSGVO) and is not combined with other data sources.

5. Cookies and local storage

We use technically necessary cookies or local storage mechanisms insofar as they are required for operation – in particular a session cookie for authentication (see section 6) as well as short-lived settings (e.g. the state of the sidebar, storage of your cookie selection). The legal basis is § 25 Abs. 2 TDDDG in conjunction with Art. 6 Abs. 1 lit. f DSGVO. This category is always active.

Cookies and technologies that are not technically necessary (the Preferences, Statistics and Marketing categories) are used only with your consent (§ 25 Abs. 1 TDDDG, Art. 6 Abs. 1 lit. a DSGVO). We obtain this consent via our cookie banner; the corresponding services are loaded only after you have given your consent. Your consent is voluntary and can be revoked at any time with effect for the future. You can adjust your selection at any time:

6. Account, registration and sign-in

A user account is required to use the Service. Authentication is handled via Auth0 (Okta, Inc., USA), either by one-time email code or by signing in with a third-party account (e.g. Google or Twitch). In this context we process in particular your email address, a unique user identifier, sign-in and session information as well as – in the case of social login – the profile data you have released. The legal basis is the performance of the contract (Art. 6 Abs. 1 lit. b DSGVO). Session data is managed in a secure cookie.

7. Contract, profile and usage data

To provide the Service, we process and store in our EU database (Supabase) master and profile data (e.g. name, avatar, role, language setting), account settings, notifications as well as content that you create or manage within the Service. The legal basis is the performance of the contract (Art. 6 Abs. 1 lit. b DSGVO).

8. Payment processing

Paid subscriptions and credit balances (Credits) are processed via Stripe (Stripe Payments Europe, Ltd. / Stripe, Inc.). You enter your payment data (e.g. card details) directly with Stripe; we ourselves do not receive or store complete payment method data, but only billing and status data (e.g. customer identifier, subscription status, periods, quotas). The legal basis is the performance of the contract (Art. 6 Abs. 1 lit. b DSGVO) as well as compliance with retention obligations under tax and commercial law (Art. 6 Abs. 1 lit. c DSGVO).

9. AI features: chat and prompt optimization

When you use AI-powered features (chat, optimization of inputs), your inputs and the associated conversation history are transmitted server-side to our AI intermediary Vercel AI Gateway and from there to the respective model provider used – currently in particular Google (Gemini) and OpenAI (GPT), and where applicable via OpenRouter or Anthropic (Claude). The conversation history is stored in our EU database in order to provide the feature. The legal basis is the performance of the contract (Art. 6 Abs. 1 lit. b DSGVO). Please do not submit any sensitive personal data in AI inputs. The providers used may be based outside the EU (see section 12).

10. AI image generation

For image generation, the prompts you enter are transmitted to the respective image provider (fal.ai or OpenAI). The generated images and associated metadata (prompt, model, format) are stored in our storage (Supabase Storage, Cloudflare R2 or Vercel Blob) in order to provide the Service. The legal basis is the performance of the contract (Art. 6 Abs. 1 lit. b DSGVO).

11. Linking of platform accounts (YouTube, Twitch)

You can connect external channels (currently YouTube and Twitch) to your account. Authorization is carried out via an OAuth procedure; the access tokens are stored securely in the Auth0 token vault and are not stored in plain text in our database. After your authorization, we retrieve channel and statistics data from the respective platform server-side (e.g. channel information, views, watch time, revenue, videos, streams). This data is cached – in order to provide your dashboard and the analytics – as snapshots in our EU database (Supabase, Frankfurt). This processing therefore takes place server-side; the data "reaches us" and is processed by us to the extent described. The legal basis is the performance of the contract or – insofar as necessary for the specific analysis – your consent (Art. 6 Abs. 1 lit. a and b DSGVO), which you can revoke at any time by disconnecting the link. The platforms' own processing is governed by their respective privacy policies (Google/YouTube and Twitch/Amazon).

12. Transfers to third countries

Some of the services used are based in the USA or process data outside the EU. Any transfer takes place only on the basis of appropriate safeguards within the meaning of Art. 44 ff. DSGVO, in particular via a certification under the EU-US Data Privacy Framework and/or the conclusion of the EU Commission's standard contractual clauses. This concerns in particular: Vercel, Auth0, Stripe, Google, OpenAI, Anthropic, OpenRouter, fal.ai and Cloudflare.

13. Retention period

We store personal data only for as long as is necessary for the stated purposes or as required by statutory retention periods (e.g. under commercial and tax law). Account and content data is generally stored for the duration of the contractual relationship and deleted after its termination or at your request, insofar as no retention obligations prevent this.

14. Your rights

Under the DSGVO you have, in particular, the following rights:

• Access to the data stored about you (Art. 15 DSGVO)
• Rectification of inaccurate data (Art. 16 DSGVO)
• Erasure (Art. 17 DSGVO)
• Restriction of processing (Art. 18 DSGVO)
• Data portability (Art. 20 DSGVO)
• Objection to processing based on legitimate interests (Art. 21 DSGVO)
• Withdrawal of a consent given, with effect for the future (Art. 7 Abs. 3 DSGVO)

To exercise your rights, an informal message to the address given in section 1 is sufficient.

15. Right to lodge a complaint with a supervisory authority

Without prejudice to any other legal remedy, you have the right to lodge a complaint with a data protection supervisory authority (Art. 77 DSGVO), in particular in the member state of your residence or of the place of the alleged infringement.

16. Data security

We take appropriate technical and organizational measures pursuant to Art. 32 DSGVO to protect your data against loss, misuse and unauthorized access. These include in particular:

• Encrypted transmission via TLS/HTTPS
• Encryption of data at rest with our providers
• Authentication and access control via a specialized identity service (Auth0), support for secure sign-in procedures
• Data storage in an EU region (Supabase, Frankfurt)
• A permissions model based on the principle of least privilege as well as row-based access rules (Row Level Security) in the database
• Regular backups and recovery concepts
• Logging and monitoring of security-relevant events
• Processes for reporting data breaches (Art. 33/34 DSGVO)

17. Processors and services used

18. Updates and changes

We will amend this privacy policy as soon as changes to our processing or legal requirements make this necessary. The current version published on this page applies in each case.