Privacy Policy

This privacy policy informs you about which personal data we process when you visit our website www.evoar-social.app and when you use the EVOAR Social application at my.evoar-social.app. It fulfills the information obligations under Art. 13 and 14 of the General Data Protection Regulation (GDPR).

1. Controller

The controller within the meaning of Art. 4(7) GDPR is:

Marvin Mischler
Mischler Webdesign
Am Steingarten 8
68169 Mannheim
Germany

Phone: +49 163 2792141
Email: hello@evoar.de

We have not appointed a data protection officer because the requirements of Art. 37 GDPR and Section 38 BDSG are not met. If you have any questions about data protection, please contact hello@evoar.de.

2. Our role: controller and processor

EVOAR Social is software for businesses. We act in two roles:

• As a controller, we process the data of visitors to our website, the data of prospects and customers, and the account, login, billing and usage data of people who sign in to EVOAR Social. This privacy policy applies to these processing activities.
• As a processor (Art. 28 GDPR), we process the content that our customers create in EVOAR Social: company information, personal profiles, knowledge sources, drafts, posts, media, comments and metrics. The respective customer company is responsible for this data. If you have been set up as a person in a customer account and have questions about your data, please contact that company first. We support our customers in responding.

3. Legal bases

We process personal data on the following legal bases:

• Art. 6(1)(a) GDPR – your consent.
• Art. 6(1)(b) GDPR – performance of a contract with you or pre-contractual measures taken at your request.
• Art. 6(1)(c) GDPR – compliance with legal obligations, such as retention obligations under commercial and tax law.
• Art. 6(1)(f) GDPR – safeguarding our legitimate interests or those of third parties, unless your interests override them. We state the relevant interests for each processing activity.

Section 25 of the Telecommunications Digital Services Data Protection Act (TDDDG) additionally applies to storing information on your device and accessing it. We only use storage that is strictly necessary for the service you have expressly requested (Section 25(2) No. 2 TDDDG). No consent is required for this.

4. Hosting

The website and the application run on a cloud server operated by Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany. The server is located in a data center in Nuremberg. The database, uploaded files and backups are also stored there. Hetzner processes the data on our behalf; we have concluded a data processing agreement with Hetzner pursuant to Art. 28 GDPR. Hosting does not involve any transfer to third countries.

The website www.evoar-social.app is maintained with our own content management system, EVOAR CMS, and is likewise delivered from servers of Hetzner Online GmbH in Germany. [[PRÜFEN: Standort des Servers von EVOAR CMS, falls nicht Nürnberg]]

The legal basis is Art. 6(1)(b) GDPR insofar as you use EVOAR Social, and otherwise Art. 6(1)(f) GDPR. Our legitimate interest lies in providing our services securely and reliably.

5. Server log files

Each time you access our website and the application, our web server automatically processes information transmitted by your browser:

• IP address
• Date and time of the request
• Requested address (URL) and HTTP method
• HTTP status code and amount of data transferred
• Referrer URL (the previously visited page), if transmitted
• Browser type, browser version and operating system (user agent)

This data is technically necessary to deliver the pages and serves the stability and security of the system, for example to defend against attacks and analyze errors. The legal basis is Art. 6(1)(f) GDPR. Log files are deleted after 14 days. Data that must be retained longer for evidentiary purposes is exempt from deletion until the respective incident has been finally resolved.

6. Our website (www.evoar-social.app)

6.1 Cookies, analytics and third-party content

Our website does not set any cookies of its own accord, uses no marketing tools and embeds no third-party content. Fonts and graphics are loaded from our own server. No connection to third-party servers is established when you visit the website.

6.2 Contact form, email and phone

If you submit our contact form, we store your details in our EVOAR CMS system on our servers in Germany and are notified of the request by email [[PRÜFEN: Versanddienst der Benachrichtigungs-E-Mails]]. If you contact us via the form, by email or by phone, we process your details (such as name, email address, phone number, company and the content of your request) to handle your inquiry. The legal basis is Art. 6(1)(b) GDPR if your request relates to a contract or a demo, and otherwise Art. 6(1)(f) GDPR; our legitimate interest lies in answering your request.

We delete your request once it has been fully handled and no follow-up questions are expected, at the latest after three years. Statutory retention obligations, for example for business correspondence, remain unaffected.

6.3 Links to the application

The "Login" and "Try for free" buttons lead to the application at my.evoar-social.app. The following sections apply to the application.

7. The EVOAR Social application (my.evoar-social.app)

7.1 Cookies and local storage

The application only sets technically necessary cookies and uses your browser's local storage for convenience features. No analytics, advertising or tracking cookies are used.

The legal basis for storing data on your device is Section 25 (2) No. 2 TDDDG, and for any further processing Art. 6 (1) lit. b GDPR.

If you enable browser notifications, the application also registers a service worker (see Section 17).

7.2 Trial period, order and registration

You first choose a plan and complete your order through our payment service provider Stripe (see Section 9). There you provide your email address, billing address, payment details and, optionally, your VAT identification number. You then create your account. In doing so, we process:

• Company name
• Your name
• Your email address
• Your password (we store only an Argon2id hash, not the password itself)
• The selected plan and the number of seats

A username is generated from your email address. For your account, we also store your role, account status, the time of your last login and the time of your last password change.

If an administrator at your company invites you to a team, we process the email address and name they provide in order to send you the invitation. Invitations are valid for seven days.

The legal basis is Art. 6 (1) lit. b GDPR. If you are invited by your employer, it is Art. 6 (1) lit. f GDPR; the legitimate interest is to enable the customer to collaborate within a team.

7.3 Login and security

Each time you log in, we store the IP address and your browser's identifier (user agent) with your session. This allows you to see in your settings where you are logged in and to end sessions.

To protect against password guessing, we limit login attempts per IP address and per user account. For this purpose, we store the IP address (shortened to the /64 prefix for IPv6) and the username, together with a counter, for a maximum of 24 hours.

If you log in from a new device, we store the browser and operating system of that device as well as the time of first and last use, without the IP address. We then notify you about the login. This notification includes the IP address from which the login was made, so that you can recognize an unauthorized login.

The legal basis is Art. 6 (1) lit. b GDPR and Art. 6 (1) lit. f GDPR; our legitimate interest lies in protecting your account and our systems from unauthorized access (cf. Art. 32 GDPR).

7.4 Login with Google or LinkedIn

Instead of using a password, you can also log in via Google or LinkedIn, provided you have linked them in your account. A new account is not created this way. You are redirected to a page of the respective provider and log in there. The provider then sends us your identifier with the provider, your email address, whether it has been verified, and your name. We store the identifier, the email address and the time of last use. We do not store the provider's access keys for the login.

• Google: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google may transfer data to Google LLC in the USA; Google LLC is certified under the EU-US Data Privacy Framework (adequacy decision, Art. 45 GDPR). Privacy policy: https://policies.google.com/privacy
• LinkedIn: LinkedIn Ireland Unlimited Company, Wilton Plaza, Wilton Place, Dublin 2, Ireland. LinkedIn may transfer data to LinkedIn Corporation in the USA; LinkedIn is certified under the EU-US Data Privacy Framework. Privacy policy: https://www.linkedin.com/legal/privacy-policy

The legal basis is Art. 6 (1) lit. b GDPR. Use is voluntary; you can log in with your username and password at any time.

8. Customer content and data processing on behalf of the customer

What you create in EVOAR Social, we store for your company: company profile, strategy and content pillars, personal profiles (for example name, position, career history, expertise, viewpoints and writing style), knowledge sources, ideas, drafts, posts, comments, approvals, calendar data, uploaded images, videos, audio files and documents, as well as metrics.

This processing is carried out on behalf of the customer on the basis of a data processing agreement pursuant to Art. 28 GDPR. The customer company is the controller. Please do not enter special categories of personal data (Art. 9 GDPR), such as health data, into the application unless this is necessary for your content.

9. Payment processing with Stripe

We handle ordering, subscriptions, invoicing and payment through Stripe. The provider for customers in the European Economic Area is Stripe Payments Europe, Limited, 1 Grand Canal Street Lower, Grand Canal Dock, Dublin 2, Ireland. Stripe processes your email address, your name, your billing address, your VAT identification number (if provided), payment data (such as card details or bank account details), your IP address and subscription details.

We do not receive payment data such as card numbers. From Stripe, we receive the customer identifier, the subscription status, the type of payment method in abbreviated form (for example card type and the last four digits) and invoice data, which we display to you in the application.

Stripe is itself responsible for part of the processing, in particular for fraud prevention and for meeting financial regulatory obligations. Stripe may transfer data to Stripe, Inc. in the USA; Stripe is certified under the EU-US Data Privacy Framework. Privacy policy: https://stripe.com/de/privacy

The legal basis is Art. 6 (1) lit. b GDPR and, for the retention of invoices, Art. 6 (1) lit. c GDPR in conjunction with Section 147 of the German Fiscal Code (AO) and Section 257 of the German Commercial Code (HGB).

10. AI features via OpenRouter

For the AI features of EVOAR Social (including strategy, ideas, posts, editor, writing profile, comment suggestions, graphic texts and analytics), we transmit your inputs and the context required for them to OpenRouter, Inc., 169 Madison Avenue, New York, NY 10016, USA. OpenRouter forwards the requests to the provider of the respective language model and returns its response to us.

What data is transmitted: Depending on the feature, this includes your input as well as the company profile, strategy, content from the knowledge base, the profile of the person you are writing for (such as name, position, career history, expertise, viewpoints and writing profile), previous posts, comments and images. OpenRouter also receives the address of our application as a technical sender. Your IP address is not transmitted.

Which model providers are used: We currently use models from Anthropic PBC (USA) for texts and analyses, models from Google LLC (USA) for audio transcription (see Section 11) and models from Perplexity AI, Inc. (USA) for trend research (see Section 12).

Purpose and legal basis: The transmission is necessary to provide the AI features you request. Where your own data as a user is concerned, the legal basis is Art. 6 (1) lit. b GDPR; for customer content, we act on behalf of the customer (Section 8), and OpenRouter is our sub-processor in this respect.

Transfer to third countries: OpenRouter and the model providers are based in the USA. We base the transfer to OpenRouter on the EU Commission's Standard Contractual Clauses (Art. 46 (2) lit. c GDPR). OpenRouter's privacy policy: https://openrouter.ai/privacy

Logging: For each AI request, we store the transmitted text, the response, the model used, the user who triggered it, as well as token usage and costs in our database. We use this for error analysis, traceability, billing of quotas and abuse detection (Art. 6 (1) lit. b and f GDPR). We delete the content of these logs after 90 days; usage and cost data without content are retained for the duration of the contract.

No automated decisions: The AI makes suggestions. You decide what gets published. You explicitly accept suggestions in the editor; they do not automatically overwrite your texts.

11. Audio and video transcription

When you upload an audio or video file, such as a podcast, we split the audio track into segments on our server and transmit them via OpenRouter to a Google LLC language model, together with a list of company, product and personal names (for correct spelling). We delete the audio file and the segments after successful transcription. If transcription fails, the file remains in your media library until you delete it. The transcript remains stored in your account as a knowledge source until you delete it.

The recording may contain the voices and statements of other people. Please only upload recordings if you are authorized to do so. Legal basis and transfer to third countries as in Section 10.

12. Trend Radar

For the Trend Radar, we query public sources for current topics: Google News, Reddit, Hacker News (via Algolia search), Polymarket and GitHub. In doing so, we transmit only search terms and a general identifier of our application, no personal data.

In addition, we use a Perplexity AI, Inc. model via OpenRouter for research. So that the results fit the person, we transmit, in addition to the search terms, the name and position of the person being researched, as well as the industry. Legal basis and transfer to third countries as in Section 10.

13. Import from websites and documents

You can import websites and documents (PDF, DOCX) into the knowledge base. When importing a website, our server retrieves the address you provide; the operator of that website sees the IP address of our server, not yours. We store the extracted text as a knowledge source in the customer account (Section 8).

14. Connecting with LinkedIn

You can connect your personal LinkedIn profile to EVOAR Social to publish posts immediately or at a scheduled time, like and comment on your team's posts, and retrieve metrics for your posts. The connection is made via LinkedIn's login procedure (OAuth); we do not receive your LinkedIn password.

What we store: Your LinkedIn identifier, your display name, the address of your profile picture, the permissions granted, their expiry time and the access keys. The access keys are stored encrypted with AES-256-GCM.

What we transmit to LinkedIn: the posts, images, reactions and comments that you publish.

What we retrieve from LinkedIn: for posts you have published via EVOAR Social, metrics such as impressions, members reached, reactions, comments, reposts, saves, link clicks, new followers and profile views, as well as your follower count. These are aggregate figures; we do not retrieve data on individual LinkedIn members who interact with your posts.

Profile pictures: Profile pictures of LinkedIn accounts are loaded in the application directly from LinkedIn's servers. In doing so, LinkedIn receives your IP address and the information that the image was retrieved, but not the address of the page you are on.

The provider is LinkedIn Ireland Unlimited Company (for its address and transfers to third countries, see section 7.4). LinkedIn's privacy policy also applies to publishing on LinkedIn. The legal basis is Art. 6(1)(b) GDPR. You can disconnect the connection in EVOAR Social at any time and revoke the authorization in your LinkedIn settings.

Instagram and WhatsApp are not technically connected: EVOAR Social schedules this content and reminds you to publish it, but you publish it yourself.

15. Approval links for external reviewers

Customers can have a post reviewed outside the application via an approval link. The link cannot be found publicly (it is excluded from search engines), is valid for 7, 14 or 30 days depending on the setting, and can be revoked at any time. The approval page displays the company, the person's name and position, and the post with its media. We count the number of times the link is opened.

If you submit feedback as an external reviewer, we store the name you provided, your decision and your message with the post. To protect against misuse, we limit the number of feedback submissions and store your IP address for this purpose for a maximum of 24 hours. Your browser remembers your name in local storage (section 7.1).

This processing is carried out on behalf of the customer who asked you to review the post (section 8). Your feedback remains stored with the post for as long as the customer does not delete it.

16. Link tracking

16.1 Short links in posts

Customers can use short links from EVOAR Social in their posts to measure how often a link is clicked. If, as a reader of a post, you click on such a link, our server redirects you to the destination address. In doing so, we only store the time of the click and the name of the website you came from (for example linkedin.com). We do not store your IP address, browser or location for this click. We append a random click ID to the destination address (parameter evoar_cid). The processing of your IP address in the server log file is governed by section 5.

16.2 Conversion measurement on our customers' websites

Customers can embed an EVOAR Social script on their own website that stores the click ID in your browser's local storage for 30 days and reports events such as a sign-up or a purchase (event, value, currency and order number) to us. The operator of the respective website is responsible for this; they must inform you and, where required under Section 25(1) TDDDG, obtain your consent. We process this data on their behalf. To protect against misuse, your IP address is stored in a counter for a maximum of 24 hours.

17. Notifications

17.1 Email

We send emails regarding registration, invitations, the security of your account (for example, when you log in from a new device) and, depending on your settings, notifications and summaries about approvals, comments, publications and metrics. You define the scope under Settings → Notifications; notifications about failed publications and new devices are always active for security reasons.

To send these emails, we use Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (Google Workspace), which processes the data on our behalf. Google may transfer data to Google LLC in the USA; Google LLC is certified under the EU-US Data Privacy Framework (adequacy decision, Art. 45 GDPR).

The legal basis is Art. 6(1)(b) GDPR, and for security notifications additionally Art. 6(1)(f) GDPR.

17.2 Notifications in the application

Notifications are also displayed in the application. We delete them after 90 days.

17.3 Browser notifications (Web Push)

If you enable browser notifications, we store the push address that your browser generates for this purpose, the associated keys and your browser's identifier. The notification (title, short text and link) is delivered in encrypted form via the push service of your browser vendor, such as Google (Chrome), Mozilla (Firefox) or Apple (Safari). These services may use servers outside the EU. Undelivered notifications expire after 24 hours. Enabling them is voluntary; you can revoke this at any time in the application or in your browser. When you log out, we delete the push address of that device.

The legal basis is Art. 6(1)(a) GDPR in conjunction with Section 25(1) TDDDG.

18. Connection with Claude (MCP)

You can connect EVOAR Social with Claude by Anthropic (claude.ai, Claude Desktop or Claude Code). You set up the connection yourself and grant it via a login procedure (OAuth) or a personal access token. We store access keys exclusively as a hash value; access keys are valid for one hour, refresh keys for 30 days, and personal tokens for the duration you choose.

Once the connection is established, Claude retrieves data from your EVOAR account at your instruction (such as companies, people, posts, knowledge base, calendar and metrics) and can create or edit posts, ideas and comments. Data is transmitted to Anthropic at your initiative and under your own contract with Anthropic; Anthropic's privacy policy applies to processing by Anthropic (https://www.anthropic.com/legal/privacy). You can disconnect the connection at any time under Settings → Claude (MCP). The legal basis is Art. 6(1)(b) GDPR.

19. Recipients

We only share personal data to the extent described in this policy, where you have given your consent, or where we are legally obliged to do so. Recipients are:

• Hetzner Online GmbH (hosting, Germany)
• Stripe (payment processing, Ireland/USA)
• OpenRouter, Inc. and the model providers Anthropic PBC, Google LLC and Perplexity AI, Inc. (AI features, USA)
• Google Ireland Limited (email delivery via Google Workspace, Ireland/USA)
• Google and LinkedIn, if you use login or connection via these services
• the push services of your browser vendor, if you enable browser notifications
• within a customer account, the other members of your team within the scope of their permissions
• Tax advisors and authorities, to the extent required by law

20. Transfers to third countries

Some of the recipients mentioned are located in the USA or may transfer data there. For companies certified under the EU-US Data Privacy Framework, there is an adequacy decision by the European Commission for the USA (Art. 45 GDPR). Where this is not the case, we base the transfer on the European Commission's standard contractual clauses (Art. 46(2)(c) GDPR). You can request a copy of the safeguards at hello@evoar.de.

21. Retention period

We store personal data only for as long as is necessary for the respective purpose or as statutory retention obligations apply. In detail:

If customers delete individual content, people or team members, we remove them from the active data immediately and from the backups when those are deleted on their regular schedule.

22. Your rights

Within the framework of the statutory requirements, you have the following rights:

• Access to the data we have stored about you (Art. 15 GDPR)
• Rectification of inaccurate data (Art. 16 GDPR)
• Erasure (Art. 17 GDPR)
• Restriction of processing (Art. 18 GDPR)
• Data portability (Art. 20 GDPR)
• Withdrawal of consent with effect for the future (Art. 7(3) GDPR)
• Objection to processing (Art. 21 GDPR, see below)

To do so, please contact hello@evoar.de.

Widerspruchsrecht nach Art. 21 DSGVO: Soweit wir Ihre Daten auf Grundlage von Art. 6 Abs. 1 lit. f DSGVO verarbeiten, können Sie aus Gründen, die sich aus Ihrer besonderen Situation ergeben, jederzeit Widerspruch gegen die Verarbeitung einlegen. Wir verarbeiten Ihre Daten dann nicht mehr, es sei denn, wir können zwingende schutzwürdige Gründe nachweisen, die Ihre Interessen, Rechte und Freiheiten überwiegen, oder die Verarbeitung dient der Geltendmachung, Ausübung oder Verteidigung von Rechtsansprüchen.

You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is the State Commissioner for Data Protection and Freedom of Information of Baden-Württemberg (Landesbeauftragter für den Datenschutz und die Informationsfreiheit Baden-Württemberg), Lautenschlagerstraße 20, 70173 Stuttgart, Germany.

23. Obligation to provide data

To use EVOAR Social, the information marked as mandatory fields during ordering and registration is required. Without it, we cannot enter into a contract with you. All other information is voluntary. You do not have to provide any personal data to visit our website; the processing of log data (Section 5) is technically necessary.

24. Data security

The website and the application can only be accessed via an encrypted connection (TLS). We store passwords only as Argon2id hashes, session and access keys only as hashes, and credentials for connected services in encrypted form. Uploaded files are not publicly accessible and are delivered only via short-lived, signed links after authorization has been verified. Customer data is kept separate from one another.

25. Changes to this privacy policy

We will update this privacy policy whenever our services or the legal situation change. The version published here at any given time applies.