Privacy

Controller within the meaning of the General Data Protection Regulation (GDPR):

fewofy | Nolte Nußbaum Digital GbR
Panoramastr. 82, 73207 Plochingen, Germany
Email: hallo@fewofy.de

Authorised partners: Daniel Nolte, Felix Nußbaum.

We process personal data only within the scope of statutory provisions — in particular GDPR and the German Federal Data Protection Act (BDSG). This statement describes which data we process when, for what purpose, and what rights you have.

This website is hosted by Vercel Inc., 340 S Lemon Ave #4133, Walnut, CA 91789, USA. Vercel acts as data processor within the meaning of Art. 28 GDPR. Technically necessary data (e.g. IP address, user agent, timestamp) is processed on every page request. Data is processed in the USA; Vercel offers EU hosting regions which we use where technically feasible. A Data Processing Addendum including EU Standard Contractual Clauses is in place.

Legal basis: Art. 6 (1) lit. f GDPR (legitimate interest).

On each request the following are automatically transmitted: IP address, date and time, transferred data volume, referrer URL, and user agent. This data is kept for at most 30 days and is used solely for security (attack detection) and technical stability.

Legal basis: Art. 6 (1) lit. f GDPR.

We do not use tracking cookies or marketing cookies. Audience measurement (section 6) works without cookies and only runs with your consent. The only technically necessary items are:

• Cookie consent storage(Local Storage, key fw-consent-v2) — stores your decision from the cookie banner (version, time, statistics yes/no) so the banner doesn't reappear on every visit. Not transmitted to servers.
• Language detection— Next.js shows the English variant based on the URL path (/en/...); no cookies involved.

The banner's “Settings” view lists which services your consent controls. Currently that is only the audience measurement described in section 6. If services are added, we will ask again.

You can change your preferences at any time via the "Cookie settings" link in the footer or by clearing cookies in your browser.

With your consent in the cookie banner (“Allow statistics”) we count page views to see which content is read. Without consent nothing is measured and no request is sent. We process:

• the requested path (without parameters), time and calendar day
• country of origin, derived from the IP address (two-letter country code)
• the page language and, on the first page view, the host of the referring page
• a pseudonymous visitor key: a hash of IP address and browser identifier that changes daily, computed with a secret key on our server

The IP address and browser identifier themselves are not stored; they cannot be derived from the hash, and there is no recognition across days. No cookies and no third-party services are used. The data is kept in our database at Supabase Inc. in an EU region (processor under Art. 28 GDPR) and is only evaluated in aggregated form.

Storage duration: raw events for 13 months, then automatic deletion.

Withdrawal: at any time via “Cookie settings” in the footer, with effect for the future (Art. 7 (3) GDPR).

Legal basis: Art. 6 (1) lit. a GDPR (consent) in conjunction with § 25 (1) TDDDG.

When you reach us via the contact form on /en/contact or by email, we process the data you provide (name, email address, optionally subject and message) to handle your request. This data is stored in our email inbox and project tools.

Legal basis: Art. 6 (1) lit. b GDPR (pre-contractual measure) and lit. f (legitimate interest in efficient communication).

Storage duration: as long as necessary to handle the request, at most until expiry of statutory retention obligations (typically 6 years under HGB / 10 years under AO).

Bot protection: When you submit the form, Vercel BotID (Vercel Inc., USA) checks that the request comes from a browser rather than an automated program. The browser runs a small verification script only at that moment and sends the result along. Device analysis (“Deep Analysis”) is not enabled; no behavioural data is stored. We also limit the number of requests per IP address (one-hour counter in our database). Legal basis: § 25 (2) no. 2 TDDDG, Art. 6 (1) lit. f GDPR (protection against spam and abuse).

When you book a consultation slot on /en/contact, the booking data (chosen date and time, name, email, optionally topic and note) is sent to our email inbox. You receive a confirmation email with the meeting link. Bot protection and rate limiting work as described for the contact form (section 7).

Legal basis: Art. 6 (1) lit. b GDPR. Bot protection and rate limiting: § 25 (2) no. 2 TDDDG, Art. 6 (1) lit. f GDPR.

Some service detail pages contain interactive demos (in particular AI copywriting and voice agents). When you actively trigger a demo:

• Text generator demo:your inputs are forwarded to our server and from there to the API of Anthropic, PBC, 548 Market St, PMB 90375, San Francisco, CA 94104, USA, which runs the language model. Anthropic acts as data processor; a Data Processing Addendum including EU Standard Contractual Clauses is in place. Inputs are not used for training.
• Voice agent demo:on our website you can talk live to a demo agent using your microphone. The conversation only starts after your click and your confirmation and is limited to two minutes. Your voice input and the transcript are transmitted to ElevenLabs Inc., New York, USA, which performs speech recognition, response generation and speech output. ElevenLabs processes the data as data processor; the transfer to the USA relies on EU Standard Contractual Clauses. No audio recordings of your conversation are stored. ElevenLabs stores the transcript for operating the demo and preventing abuse for up to 30 days; after that it is deleted automatically. When the conversation starts, your browser calls our server interface; your IP address is briefly processed for abuse prevention (rate limit). In addition, static example calls are available as audio; playing them does not collect any further data.

Legal basis: Art. 6 (1) lit. f GDPR (legitimate interest in product demonstration). For the live demo additionally Art. 6 (1) lit. a GDPR (consent by starting the demo).

We link to external sites (e.g. Smoobu, Wix Studio, Einblick Digital). We have no influence on their privacy practices; please consult their privacy policies.

We share data only with:

• Hosting provider and bot protection (Vercel) — see sections 3 and 7
• Database provider (Supabase, EU region) for customer accounts, bookings and audience measurement — see section 6
• API provider for AI demos (Anthropic) — see section 9
• where applicable, our tax adviser and accounting provider within the scope of statutory retention obligations
• courts and authorities when legally required

Automated decision-making within the meaning of Art. 22 GDPR does not take place.

We store personal data only as long as necessary for the respective purpose or as required by statutory retention obligations. Afterwards the data is deleted or anonymised.

You have the right to:

• access your stored dataArt. 15 GDPR
• rectification of inaccurate dataArt. 16 GDPR
• erasure ("right to be forgotten")Art. 17 GDPR
• restriction of processingArt. 18 GDPR
• data portabilityArt. 20 GDPR
• object to processingArt. 21 GDPR
• withdraw consent given with effect for the futureArt. 7 (3) GDPR

Send requests informally by email to hallo@fewofy.de.

You have the right to lodge a complaint with a data protection supervisory authority. Competent authority for our location:

Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg
Lautenschlagerstraße 20, 70173 Stuttgart, Germany
www.baden-wuerttemberg.datenschutz.de

We use TLS encryption (HTTPS) for the entire site. Transfers between browser and server are protected against eavesdropping. Internally we limit access to personal data to the minimum necessary.

We approach holiday-rental businesses (hosts, property managers, agencies) about our services. For this we keep a database of business contacts. The data comes from publicly accessible sources, usually the imprint and contact page of the respective website.

• company or property name, website, region
• name of the contact person, business email address and phone number
• details about the business (number of units, booking software in use, state of the website) and our assessment of whether our services fit
• history of the outreach (calls, letters, appointments, notes)

Linking website actions: Links we send during outreach may contain an identifier. If you request an appointment or submit the contact form via such a link, we link the request to your contact record in order to handle it. Page visits via such a link and starting the voice demo are linked only if you allowed “Statistics” in the cookie banner.

Storage duration: until you object, at the latest 24 months after the last contact. If a contract is concluded, the periods in section 7 apply.

Objection: You can object to the use of your data for direct outreach at any time (Art. 21 (2) GDPR), informally to the email address given in section 1. We will then delete the contact or block it from further outreach.

Legal basis: Art. 6 (1) lit. f GDPR (legitimate interest in direct marketing to business customers, recital 47); linking requests Art. 6 (1) lit. b GDPR; linking visits and the demo Art. 6 (1) lit. a GDPR. The outreach itself is governed by § 7 UWG.

We update this privacy policy when our data processing activities change materially. The current version is always available on this page.