Controller (Art. 4 Nr. 7 DSGVO): Some Tech Work UG (haftungsbeschränkt), Hans-Böckler-Str. 76, 65199 Wiesbaden, Germany. Contact privacy@goals.ac. No external data protection officer is appointed (Art. 37 DSGVO is not triggered at our current size). Supervisory authority: Der Hessische Beauftragte für Datenschutz und Informationsfreiheit. This policy describes the product as shipped. It is not a signed AVV. Request an AVV at /dpa.
Legal bases (Art. 6 DSGVO)
- Art. 6 Abs. 1 b, contract: account, generation, publish, billing.
- Art. 6 Abs. 1 c, legal duty: tax invoices, VAT.
- Art. 6 Abs. 1 f, legitimate interest: security, abuse prevention, essential session cookies (see TDDDG § 25 Abs. 2).
1. Information we collect
Account details (name, email, password hash or Google account id, optional avatar URL, TOTP secret if you enable MFA). Organization and project data (sites, brand profiles, goals, briefs, drafts, publish records). CMS and analytics credentials you connect (WordPress, Ghost, webhooks, Google Search Console, GA4), stored encrypted. SEO chat messages and agent run traces for the in-product chat. Usage metrics (token counts, model, estimated cost) without full prompt dumps in the usage ledger. Technical data (IP, user agent, timestamps) for security and rate limits.
2. How we use it
To generate, review, and publish content you request; to authenticate sessions; to enforce plan quotas and credits; to show usage; to operate autopilot jobs; and to secure the service. We do not sell personal data. We do not use your content to train third-party foundation models beyond what the provider requires to fulfil that API call.
3. AI processing
Generation can be routed to Google Gemini, AWS Bedrock, OpenAI, Anthropic, OpenRouter, Groq, NVIDIA, or Ollama, depending on org settings and BYOK keys. Relevant brand, keyword, and sample text is sent to the selected provider to produce a response. Platform-key traffic is billed to us and counted against your plan. BYOK traffic uses your key and is governed by your contract with that provider. A current list is on /subprocessors.
4. Credentials
Third-party secrets (AI keys, CMS passwords, OAuth tokens) are encrypted at rest with AES-256-GCM. They are decrypted in memory only to serve a request. Rotating the platform encryption secret makes existing ciphertext unreadable; that is an ops procedure, not an in-product toggle.
5. Cookies and sessions
We use essential cookies only: an HttpOnly session cookie (Auth.js / Edge Mesh JWT) and a client-side active-project cookie to remember which site you last opened. No advertising or third-party analytics cookies. Details: /cookies.
6. Hosting and location
Production API and database run on Cloudflare Workers and D1. We do not pin an EU D1 location in application config. Treat storage as Cloudflare's network unless we confirm an EU pin in writing. Transfers outside the EEA rely on Cloudflare's and each AI provider's SCCs / DPF where they publish them. Local development may use PostgreSQL.
7. Retention and deletion
We keep account and content data while the account is active. You can export a JSON package of your user, projects, and org memberships from the product (GET /api/auth/me/export) or by emailing privacy@goals.ac. You can delete your account in settings if you are the only member of your organization; if others remain, remove them first. Deletion removes your user, owned projects and their content, encrypted credentials, companies, and sessions. Billing records required by tax law may be retained.
8. Your rights
GDPR rights (access, rectification, erasure, restriction, portability, objection) and the right to lodge a complaint with a supervisory authority (Art. 77), in Hesse typically HBDI. Email privacy@goals.ac or use in-product export. A processor agreement is not clickwrap; see /dpa.