The site operator's details are not filled in yet (LEGAL_NAME, LEGAL_ADDRESS, LEGAL_EMAIL in the server settings). A German website must not go public without them.

DATENSCHUTZ

Privacy policy

Last updated: November 2026. This policy explains which personal data [HUB] AEO processes, why, and what rights you have under the GDPR (DSGVO).

1. Who is responsible

The operator named in the legal notice.

2. Hosting and server logs

This site is hosted by OVHcloud (OVH SAS, 2 rue Kellermann, 59100 Roubaix, France). The server is located in Singapore. When you open a page, the server briefly records technical data: IP address, time, page requested, browser type and referring page. This is needed to deliver the site and keep it secure (Art. 6(1)(f) GDPR). Web server logs are deleted after 14 days; application logs are rotated automatically. Because the server is outside the EU, the transfer is based on the EU Standard Contractual Clauses in our data processing agreement with the host (Art. 46(2)(c) GDPR).

3. Cookies and local storage

We use two technically necessary cookies: a session cookie that protects forms against misuse and keeps you signed in, and one that remembers the language you chose (German or English). Your browser also remembers the last audit you ran (local storage) so the score card can show it again. Neither is used for tracking or advertising, and we use no analytics or advertising cookies, so no consent banner is needed (§ 25(2) TDDDG).

4. Free website audits

When you enter a website address, we read that website's public pages and store the address and the result. To enforce the free daily limit we store a one-way hash of your IP address, not the address itself (Art. 6(1)(f) GDPR). Audits are kept until you or we delete them.

5. Client accounts

If you create an account we store your email address, a securely hashed password, your audits and, for clients, the business facts you enter in the Toolkit. We use them to provide the service you signed up for (Art. 6(1)(b) GDPR). This includes emails telling you when a re-audit finds a change; you can turn them off in the portal at any time. Password-reset emails are sent only when you ask for one. You can ask us to delete your account at any time.

5a. WordPress plugin

If you use the [HUB] plugin on your WordPress site, it uses your connection key to fetch the approved fixes (structured data, llms.txt, robots.txt rules) from our server. We store when it last fetched them and the address of the site that fetched them, to show you the connection status in the Toolkit (Art. 6(1)(b) GDPR). The plugin does not send any data about your site's visitors.

6. Contact form and email

When you contact us we store your name, email, business, website and message to answer your enquiry and, if you become a client, to prepare the offer (Art. 6(1)(b) GDPR). Enquiries are deleted when they are settled, unless we have to keep them for tax or commercial law (up to 10 years for business letters).

7. Fonts

Fonts are served from our own server. Your browser does not connect to Google or any other font provider.

8. Your rights

Access to the data we hold about you (Art. 15), correction (Art. 16), deletion (Art. 17), restriction (Art. 18) and data portability (Art. 20).
Objection to processing based on legitimate interests (Art. 21).
Complaint to a data protection supervisory authority (Art. 77), for example the authority in the German state where you live.

To use these rights, email us.