Start for free

Privacy Policy

Last updated: October 31, 2026

1. Controller

WHITEACADEMY Birger Weiß
Owner: Birger Weiß
Zur alten Ziegelei 10a
48607 Ochtrup, Germany
Phone: +49 151 28865865
Email: [email protected]

We are not legally required to appoint a data protection officer. If you have any questions about data protection, please write to the email address above.

2. Who this policy applies to

This policy applies to visitors to our website doneforyou.io, to agencies that use our app at app.doneforyou.io, and to their employees.

With Doneforyou, agencies create job application landing pages (at jobs.mostwantedarbeitgeber.de or on a domain of their own), collect applications through them and give their clients access to an applicant portal. Doneforyou is not the controller for the data of applicants and of the agencies' clients; the respective agency or its client is. We process this data only on their behalf and on their instructions (Art. 28 GDPR, see our Data Processing Agreement, available in German). Which data is processed there and for what purpose is set out in that controller's privacy policy; it is linked on every job application landing page, and an agency's legal notice and privacy notice are shown in the footer of its client portal and onboarding form. If you are an applicant and wish to exercise your rights, please also contact that controller.

3. Hosting, database and server log files

Our website and app run on servers of Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany, in data centers in Germany. We have concluded a data processing agreement with Hetzner.

We operate our database with Supabase (Supabase, Inc.). The data is stored in a data center in the EU (Ireland, region eu-west-1), which Supabase operates on Amazon Web Services. The database holds all app data, e.g. account data, campaigns, applications and messages; files, by contrast, are stored with bunny.net (Section 11). Our server connects to the database only over encrypted connections. We have concluded a data processing agreement with Supabase. As Supabase is a US company, access from the USA cannot be ruled out (see Section 16). The legal basis is Art. 6(1)(b) GDPR, and for third-party data the agency's instructions under Art. 28 GDPR.

When you visit our pages, the server automatically processes data transmitted by your browser: IP address, date and time, requested URL, amount of data transferred, status code, referrer, and browser and operating system. This is necessary to deliver the pages and to keep operations secure, e.g. to detect attacks. To prevent abuse, we also briefly count how often logins, registrations or applications are attempted from an IP address. The legal basis is our legitimate interest in secure and stable operation (Art. 6(1)(f) GDPR). Log data is deleted automatically at regular intervals unless it is needed to investigate a specific security incident.

Fonts are hosted on our own servers. Loading our pages does not establish a connection to Google Fonts or other font providers.

4. Cloudflare

We use services of Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA:

The legal basis is our legitimate interest in a fast, secure website protected against abuse (Art. 6(1)(f) GDPR); access to your device for Turnstile is strictly necessary to protect the service you requested (Section 25(2) no. 2 TDDDG). We have a data processing agreement with Cloudflare. For transfers to the USA, see Section 16.

5. Cookies and consent

Strictly necessary cookies: When you log in to the app, we set a session cookie (dfy_session) so that you stay logged in. In the applicant portal for an agency's clients, this cookie is called dfy_kunde, in the live demo (doneforyou.io/demo) dfy_demo. These cookies can only be read by our server (HttpOnly), are only transmitted over encrypted connections, and expire after 30 days (in the live demo after two hours) or when you log out. While you connect your Meta ad account (Section 9), we additionally set the cookie dfy_meta_state for at most 15 minutes to secure the return from Facebook. They are strictly necessary for the service (Section 25(2) no. 2 TDDDG, Art. 6(1)(b) GDPR). No consent is required for them.

Services requiring consent: If you arrive via a partner’s referral link (e.g. doneforyou.io/?ref=…, possible on every page of doneforyou.io), we ask whether we may remember this referral in a cookie (dfy_ref, code and timestamp, valid for up to 400 days – the maximum browsers allow –, readable by app.doneforyou.io) so the partner receives a commission if you sign up later. Without consent, the code is only added to the sign-up links and the links to other pages of doneforyou.io so that it is kept as you click on, and nothing is stored on your device. We count the click on our server using only a hash of your IP address and the date, not the IP address itself (Art. 6(1)(f) GDPR). When you sign up, we store which partner referred you and check for self-referrals (email domain, sign-up IP, name and a Stripe fingerprint of your payment method); the partner only sees a shortened email address, your plan, payment status and their commission. Details on the partner program: partner guidelines.

On your first visit to doneforyou.io, a cookie banner asks for your consent. “Accept” allows all optional services; under “Manage options” you can allow them individually or reject them all: advertising cookies (Meta Pixel, Section 6) and the referral cookie dfy_ref described above. These services are not strictly necessary for our website; without your consent we do not load the Meta Pixel and do not set the referral cookie. We store your choice with a timestamp in your browser's local storage (localStorage, entry dfy_consent) so that the banner does not appear on every visit; after 180 days we ask again. The legal basis for the pixel and the referral cookie is your consent (Section 25(1) TDDDG, Art. 6(1)(a) GDPR); for transfers to the USA see Section 16.

You can change or withdraw your consent at any time with effect for the future: via the “Cookie settings” link in the footer of every page or the button below. If you withdraw it, the pixel no longer loads and we delete the cookies _fbp, _fbc and dfy_ref in your browser.

Cookieless audience measurement in the blog

To see which articles in our blog (doneforyou.io/blog/) are helpful, we count usage without cookies and without a consent banner. While you read an article, your browser sends short messages to our server (app.doneforyou.io) containing: the page viewed, the rough origin of the visit (only the category we derive from the referrer, e.g. “Google”, “Bing”, “AI assistant”, “social media”, “other site” or “direct” – we do not store the referring address itself), the reading depth reached in steps (25, 50, 75 and 100%) and clicks on a button such as “Start for free” together with its position in the article.

Of this, we only store a daily total per page (e.g. “12 views, 7 of them via Google, 5 clicks on the button at the end of the article”). We do not store IP addresses, browser identifiers or individual visits and do not create user profiles; nothing is stored on your device for the measurement. The server processes your IP address and browser information only briefly in memory to prevent abuse (limiting messages per IP address) and to filter out search engine robots; they are then discarded. The usual server log files are also created (Section 3).

If a link from the blog leads to registration, it contains an identifier of the article and the position (?quelle=blog-…). The registration page only reads this identifier from its address and stores nothing on your device for it. If you create an account, we store the first such identifier with your account to know which article brought you to us.

The legal basis is our legitimate interest in improving our offer and content (Art. 6(1)(f) GDPR). You can object ([email protected]); we will then remove the identifier from your account.

6. Meta Pixel on doneforyou.io

If you consent to advertising cookies in the cookie banner, we embed the Meta Pixel of Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland (“Meta”) on doneforyou.io. This lets us measure how well our ads on Facebook and Instagram perform, e.g. whether someone visits our site or clicks “Register” after clicking an ad, and lets us show ads to suitable audiences. For this we send the page view (event “PageView”) and clicks on “Sign up” or “Start for free” (event “Lead”).

In the process, your IP address, information about your browser and device, the pages viewed and the events mentioned are transmitted to Meta, and cookies (e.g. _fbp and, after an ad click, _fbc, each for up to 90 days) are set. If you are logged in to Facebook or Instagram, Meta can associate the visit with your account. We are jointly responsible with Meta for collecting and transmitting this data (Art. 26 GDPR); the corresponding agreement is available at facebook.com/legal/controller_addendum. Meta is solely responsible for any further processing. Meta may also transfer data to Meta Platforms, Inc. in the USA (see Section 16). For more information, see Meta's privacy policy: facebook.com/privacy/policy.

Note: Agencies can add their own Meta Pixel to their job application landing pages. The agency or its client is responsible for this (see Section 2).

7. Registration and customer account

To use the app, you create an account. We process your email address and password (stored only as an encrypted hash, never in plain text). Later you add your first name, last name, company name and, if you wish, a logo. We also store the time of registration, of your acceptance of the Terms and the Data Processing Agreement and of your confirmation that you are acting as a business, your last login, your plan, and your balance of AI credits including its history. We store the IP address from which you registered with your account in order to detect accounts created in bulk and self-referrals in the partner program (legitimate interest, Art. 6(1)(f) GDPR); we delete it after twelve months, at the latest together with your account.

The legal basis is the performance of our contract with you (Art. 6(1)(b) GDPR). Without this information we cannot create an account.

We send you emails that are part of the service, e.g. invitations, notifications about new applications or links to reset your password. We only send promotional newsletters with your separate consent.

Activating your account by email and SMS code

After registering, you confirm your email address via a link; only then do we activate your account (e.g. the starting balance of AI credits). On days when a particularly large number of agencies register, we additionally ask for confirmation by SMS code to prevent abuse (e.g. accounts created in bulk to obtain free credits), provided we have set up SMS sending; otherwise we activate the account manually (waiting list).

For confirmation by SMS, we process the mobile number you enter, the six-digit code (stored on our side only as a hash, valid for 10 minutes), the time of the request, the number of attempts and your IP address; we also use these to limit the number of requests per account, number and IP address. We send the SMS via seven.io (seven communications GmbH & Co. KG, Willestr. 4-6, 24103 Kiel, Germany), which receives your mobile number and the text of the SMS containing the code on our behalf and passes the SMS on to your mobile network operator. After successful confirmation, we store the mobile number in your account; each number can only be used for one account. The legal basis is our legitimate interest in preventing abuse of our service (Art. 6(1)(f) GDPR) and the performance of our contract with you (Art. 6(1)(b) GDPR). Providing a mobile number is voluntary; without it, we can only activate your account manually.

If you are a partner yourself

We process your application (channels, reach, links, target group), your acceptance of the partner guidelines with time, IP address and browser identifier (as a record), your code, clicks, attributions and commissions as well as your payout details (name, address, tax status, tax number or VAT ID, IBAN and account holder – the last two encrypted). We use them to create credit notes. The legal basis is the performance of the contract (Art. 6(1)(b) GDPR) and our obligation to retain records (Art. 6(1)(c) GDPR).

8. Use of the app

In the app, we process the content you create or upload as an agency: your clients (company, contact person, email address), campaigns, onboarding information (e.g. company details, benefits, names and quotes of employees), photos, videos and logos, generated ad copy, ad images and landing pages, applications received, and message templates and messages sent.

Insofar as your own data and the performance of our contract are concerned, the legal basis is Art. 6(1)(b) GDPR. We process personal data of your clients, their employees and applicants as a processor on your instructions (Art. 28 GDPR, see Data Processing Agreement).

Access by our support team

If you ask us for help (e.g. via a ticket or email) or if it is necessary for operating the service or fixing an error, we can view your dashboard the way you see it. Only the owner and persons authorised by the owner who are bound to confidentiality can open this support view, after signing in with a second factor. It is read-only – nothing can be changed, sent, bought or generated by the AI –, ends after 30 minutes at the latest and is logged with the person, account, start time and duration. The legal basis is Art. 6(1)(b) GDPR, and for third-party data the processing agreement under Art. 28 GDPR (Section 4 of the Data Processing Agreement).

Help chat “Ask Doneforyou”

In the dashboard, you can ask our help chat questions about using Doneforyou. The answer is generated by Anthropic's AI (Section 10) from our help articles; for this, we transmit your question, the matching help articles and the last questions and answers of the same conversation. The help chat has no access to your clients, campaigns or applications – please do not include personal data of third parties in your questions. We store the question, answer, help articles used, time and your rating (“helpful”) with your account in order to continue conversations, limit the number of questions and turn questions our help does not yet answer into new help articles. Questions and answers are deleted automatically after twelve months, at the latest together with your account. The legal basis is Art. 6(1)(b) GDPR and our legitimate interest in improving our help (Art. 6(1)(f) GDPR).

Live demo

At doneforyou.io/demo you can try Doneforyou without an account. The live demo runs separately from the app with its own database and sample data; what you enter there is not saved and not sent. For the duration of the demo, we set the session cookie dfy_demo (Section 5). To prevent abuse, we briefly count how often the demo is started from an IP address and show a Cloudflare Turnstile security check after many starts (Section 4). The legal basis is our legitimate interest in demonstrating our offer and protecting it against abuse (Art. 6(1)(f) GDPR).

Connecting a Meta ad account and running ads (Ads tab)

In the Ads tab (“Doneforyou Ads”), you can connect your own Meta ad account and Facebook Page to Doneforyou and run job ads on Facebook and Instagram. Which data we receive from Meta for this, what we use it for, how long we keep it and how you can have it deleted is described in detail in Section 9. A description of the feature is available at doneforyou.io/en/meta.

WhatsApp per client

From the Pro plan onward, you can book a WhatsApp number that we provide for each client. You use it to chat with applicants in the panel; your client can read along in the applicant portal and write messages if you allow it. We use two providers for this:

Your own data: To book and bill the number, we process the booked number, the client it is assigned to, the status and term of the subscription (payment via Stripe, Section 13), and the number of template messages sent and the AI credits used for them. We set up the number in a separate area at SendSeven for your client and register it in our WhatsApp Business account with Meta; we use your client's company name as the display name. When the number is activated, we inform you by email. The legal basis is Art. 6(1)(b) GDPR.

Data of applicants and your clients in the chats (phone number, WhatsApp profile name, messages, images, PDFs, delivery status, who wrote a message) is processed by us as a processor on your instructions (Data Processing Agreement, Annex 2). We store messages, previews and files encrypted (AES-256-GCM). Meta processes certain data (e.g. usage data and metadata) under its own responsibility in accordance with the WhatsApp Business terms. Meta may transfer data to the USA (Section 16). The first message to an applicant is only sent if they have consented to messages by SMS and WhatsApp (see “Applicant consent to SMS and WhatsApp”); if the applicant writes first, replies are allowed, but not after a withdrawal. More information: sendseven.com/de/datenschutz and whatsapp.com/legal/business-policy.

Text messages (SMS) to applicants

Agencies can send applicants short text messages about their application (e.g. confirmation of receipt, call-back, invitation). For this purpose, we transmit the mobile number, the message text and the company's short name as sender to SendSeven (SendSeven GmbH, Werner-Haas-Straße 8, 86153 Augsburg, Germany), which delivers the SMS through its service provider seven.io (seven communications GmbH & Co. KG, Willestr. 4-6, 24103 Kiel, Germany). SMS are only sent to applicants who have consented to messages by SMS and WhatsApp (see below) and have not withdrawn their consent. It is not possible to reply to the SMS. Applicants who no longer wish to receive SMS can contact the agency or the company they applied to; the agency then adds them to a block list or records the withdrawal, and they receive no further SMS. The legal basis towards the applicant is their consent (Art. 6(1)(a) GDPR); we process this data as the agency's processor (Data Processing Agreement). We store the content and time of each SMS in the application's message history until the agency deletes the application, the client or its account. More information: sendseven.com/de/datenschutz.

On the application page, applicants use a mandatory checkbox only to confirm that they have read the company's privacy notice. Whether the company may also contact them by SMS and WhatsApp is decided with a separate, voluntary checkbox. With the application we store whether consent was given, the wording shown including its version, and the time. The agency can record consent given otherwise (e.g. in writing) and a withdrawal; we store the time and who recorded it. Without consent or after a withdrawal, neither SMS nor WhatsApp messages are sent to the applicant; emails about the application still are. We process this data as the agency's processor (Data Processing Agreement) and delete it together with the application.

Automatic deletion of applicants

Agencies set after how many months without activity (receipt, status change, note, message) applications are deleted automatically: after 3, 6, 12 or 24 months, with six months preset; the agency can also switch automatic deletion off. 14 days before deletion, the agency receives an email with the first name, initial of the last name and campaign of the applicants concerned and can keep individual applications. The application is deleted with its answers, notes, CV, message history, WhatsApp chats and emails including attachments. We carry out the deletion once a day as a processor on the agency's instructions (Data Processing Agreement, Section 11).

Agencies provide a legal notice and a privacy notice for their client portal and onboarding form as a link or text; without an entry, we generate a default text from their billing details (company, address, email address, VAT ID). We store this information with the agency's account and display it publicly in the footer of these pages (Art. 6(1)(b) GDPR).

AI assistants (MCP server)

You can connect Doneforyou to an AI assistant such as Claude (Anthropic) or ChatGPT (OpenAI) via our MCP server (app.doneforyou.io/mcp) and control your account by chat, e.g. create clients and campaigns, start AI generation or look up applications. You grant the connection yourself: the assistant redirects you to sign in to Doneforyou (OAuth), where you confirm which permissions it receives; the assistant does not receive your password. Whatever the assistant reads – such as campaigns, texts of the application page or applications (name, contact details, answers, status, notes; no CVs or other documents) – we transmit to the provider of the assistant. You choose and connect the assistant yourself. The provider is responsible for the conversation with the assistant (your input, its answers) and for the data it receives from us, in accordance with your contract with it and its privacy policy; we only receive the calls to our tools, not the course of the conversation. For data of your clients and of applicants, we act as your processor on your instructions (Data Processing Agreement § 2(10)).

For each connection we store the name of the assistant, the permissions granted and the times of use, the access keys only as a hash, and for each call the tool used, time, duration, result, AI credits used, the IP address of the request and the information passed in shortened form. Before storing, we make unrecognisable: fields for names, email addresses and phone numbers as well as search terms, free texts (e.g. messages, notes, tickets, legal texts, additional campaign information) and, for applications, all texts; in the other information (e.g. company name, job title) we replace email addresses and phone numbers. The purpose is secure operation (preventing abuse, troubleshooting) and improving the interface. If you ask the assistant to report a problem to us, we create a ticket and attach the latest calls of this conversation in the same unrecognisable form. The legal basis is the performance of the contract (Art. 6(1)(b) GDPR) and our legitimate interest in a secure, working service (Art. 6(1)(f) GDPR). You can disconnect at any time under Settings → MCP server.

Importing funnels via link

You can have an existing funnel or another page read via its link in order to use it in a campaign or save it as a private copy in the “Inspiration” area. For this, our server opens the page in a headless browser, clicks through the steps like a visitor (a form is never submitted) and captures texts, images, fonts, structure and screenshots. Anthropic's AI (Section 10) then builds the page in Doneforyou; we store images and fonts with bunny.net (Section 11). If the funnel contains personal data, such as names or photos of employees or details in the imprint, these are also imported. You decide which pages to import and confirm before taking a funnel over into a campaign that you are entitled to do so; we process the content on your behalf (Art. 28 GDPR). The legal basis for our processing is Art. 6(1)(b) GDPR.

We store your confirmation as evidence: the wording of the checkbox, the time, the email address of your account, the funnel's URL, IP address, browser identifier and what resulted from the import (e.g. the campaign). If you confirm via a connected AI assistant (MCP server), we record this and the connection; the IP address is then that of the assistant's provider. This record cannot be changed afterwards; it is retained even if you delete the import, the campaign or your account, and is deleted after ten years (the longest limitation period for claims arising from legal infringements). The purpose is to be able to prove who confirmed the rights in the event of third-party claims. The legal basis is our legitimate interest in establishing and defending legal claims (Art. 6(1)(f) GDPR, Art. 17(3)(e) GDPR).

Taking over applicants from other tools (applicant migration)

You can take over applicants from an export file of another tool (e.g. Excel or CSV) into a campaign. We process the data in the file (e.g. names, contact details, answers, status, application date) and, if you wish, download linked CVs (PDF and Word only); we store the documents at bunny.net (Section 11). We keep the uploaded file only until the takeover is complete and delete drafts that were not taken over after two days at the latest. You can completely undo a takeover within seven days. Only the names of the stages from the old tool (e.g. “phone interview”) may be transmitted to Anthropic (Section 10) to map them to our statuses – no applicant data. We process the applicant data as a processor on your instructions (Art. 28 GDPR, Data Processing Agreement).

Before the takeover, you confirm that you are allowed to transfer the data. We store this confirmation as a record in the same way as for funnel imports (wording, time, email address of your account, file name, IP address, browser identifier; ten years, unalterable; see “Importing funnels via link”).

Chrome extension and Inspiration

With our browser extension “Doneforyou – Anzeigen speichern” for Google Chrome, you can save ads from the public Meta Ad Library (facebook.com/ads/library) to the “Inspiration” area of your Doneforyou account.

Saved ads may contain personal data of third parties, e.g. an advertiser's name or people shown in images. This data is publicly available in the Ad Library. You decide which ads to save; we process them on your behalf (Art. 28 GDPR). The legal basis for providing the extension and processing your account data is Art. 6(1)(b) GDPR; access to your browser's local storage is strictly necessary for the function you requested (Section 25(2) no. 2 TDDDG).

9. Data received from Meta/Facebook

This section applies when you connect your own Meta ad account and Facebook Page to Doneforyou in the Ads tab (“Doneforyou Ads”). The connection uses “Facebook Login for Business” of Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland (“Meta”), as a business integration. A Meta Business portfolio is required. You sign in directly with Meta and decide there which ad accounts and Pages Doneforyou may use. For this, Meta usually issues Doneforyou an access token for a system user of your Business portfolio. We do not receive your Facebook password; we never ask for your Facebook password or any other Meta login credentials. A description of the feature and the permissions requested is available at doneforyou.io/en/meta.

Data we receive from Meta and store

For location targeting, we also query Meta's location search.

Data we send to Meta

When you publish a campaign, we create it in your ad account. For this, we transmit the campaign settings (name, daily budget, run time, locations and radius, age range), the ad images and ad copy you selected, the link to the job application landing page, the DSA information and, where applicable, the Meta Pixel ID stored there. Ad images may show photos of your clients' employees. We always create job ads in the special ad category Employment. We do not send applicant data to Meta.

Purpose and legal basis

We use data from Meta solely to create and manage ads in your ad account on your behalf and to show you status and metrics in Doneforyou. We do not share or sell this data, do not use it for our own advertising and do not use it to train AI models. We do not transmit data received from Meta to AI services (Section 10).

The legal basis is the performance of our contract with you (Art. 6(1)(b) GDPR), and for third-party data (e.g. photos of employees) your instructions under Art. 28 GDPR. The technical log is based on our legitimate interest in stable and secure operation of the interface (Art. 6(1)(f) GDPR).

The ads run in your ad account and are billed directly by Meta. Meta is responsible for delivering the ads and for processing the data of the people who see or click them, under the terms you have agreed with Meta; Doneforyou does not receive this data. Meta may transfer data to Meta Platforms, Inc. in the USA (Section 16). More information: facebook.com/privacy/policy.

Retention and deletion

We delete data received through the Meta platform as soon as it is no longer needed for the purpose stated, and whenever Meta requests it (Section 3.d of the Meta Platform Terms). In detail:

How to have your Meta data deleted

  1. In Doneforyou, click “Disconnect” (“Trennen”) in the Ads tab (or under Settings → Connections → Meta ad account). If you like, we pause all running ads first.
  2. In Facebook, go to Settings & privacy → Settings → Business integrations (or “Apps and websites”), click “Remove” next to Doneforyou and request deletion of your data there.
  3. Email [email protected] from or stating the email address of your Doneforyou account. We complete the deletion within 30 days and confirm it by email.
  4. Delete your Doneforyou account under Settings → Delete account.

Detailed instructions are available at doneforyou.io/en/data-deletion.

10. AI services

Doneforyou creates ad copy, landing pages, image ideas and ad images using artificial intelligence. For this, we transmit the necessary information to the following providers:

We do not transmit applicant data to these providers – except for the AI summary in the email inbox if you switch it on. According to their own statements, both providers do not use data transmitted via their interfaces (API) to train their models and store it only for a limited time, e.g. to detect abuse. We have data processing agreements with both providers. The legal basis is Art. 6(1)(b) GDPR, and for third-party data your instructions under Art. 28 GDPR. For transfers to the USA, see Section 16.

11. File storage

We store and distribute uploaded and generated files (photos, videos, logos, ad images and – encrypted – applicant documents such as CVs, attachments to support requests and images, PDFs and attachments from WhatsApp chats and the email inbox) through the content delivery network of bunny.net (BunnyWay d.o.o., Cesta komandanta Staneta 4A, 1215 Medvode, Slovenia) so that they load quickly. When a file is requested, bunny.net processes your IP address and technical data of your browser. We have a data processing agreement with bunny.net. The legal basis is Art. 6(1)(b) and (f) GDPR.

12. Sending emails and email inbox

We send the app's emails (e.g. invitations, notifications, automated messages to applicants on behalf of the agency) through Cloudflare's email service (Section 4). In the process, the recipient address, sender name, subject and content of the email are transmitted to Cloudflare. The legal basis is Art. 6(1)(b) GDPR or the agency's instructions under Art. 28 GDPR.

Replies from applicants (email inbox): Emails to applicants carry a separate reply address per application (e.g. bewerbung+…@antwort.doneforyou.io). When an applicant replies, Cloudflare Email Routing receives the email and forwards it, encrypted and signed, to our server. We store sender, recipient, subject, text (HTML only as plain text), the results of the sender checks (SPF, DKIM, DMARC) and attachments of permitted file types (PDF, Word, JPG, PNG, HEIC); texts and attachments are stored encrypted (AES-256-GCM). A CV is filed with the application. The agency reads and answers the emails in its dashboard; its client only sees and answers them in the client portal if the agency allows it, and receives a copy by email if the agency turns this on. If the agency switches on the AI summary, we send the applicant's name, subject, text and file names of the email to Anthropic (Section 10) and store a short summary as a note on the application. If the agency uses its own sender domain, we send its emails to applicants via Amazon Simple Email Service (Amazon Web Services EMEA SARL, Luxembourg, region Frankfurt). We process this data as the agency's processor (Art. 28 GDPR). To prevent abuse, we automatically check incoming emails for spam characteristics and limit the number of emails per sender; the intake log (sender, recipient, size, result) is deleted after 30 days (Art. 6(1)(f) GDPR). Emails stay until the agency deletes the application, the client or its account; emails not assigned to an application are deleted after 180 days, suspected spam after 30 days.

Sending via the customer's own mail server: If an agency has set up its own mail server, we send emails to applicants through that server using the agency's sender address. The operator of that mail server processes the email (recipient, subject, text) on behalf of the agency. Replies from applicants still go to the reply address in the inbox. If the mail server does not accept an email, we send it ourselves as described above. We store the access data for the mail server encrypted (AES-256-GCM).

13. Payments via Stripe, orders and records

You pay for paid plans and additional credits via Stripe Payments Europe, Limited, 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland (“Stripe”). When ordering and when changing your payment method, you enter your payment details (e.g. card number, IBAN) in a Stripe input field embedded in our app; they go directly to Stripe, and we do not receive complete card or account details. When this input field loads, Stripe receives technical data from your browser (e.g. IP address), also to prevent fraud. For SEPA direct debit, Stripe stores the mandate. You can also change individual settings (e.g. the email address for invoices) on a Stripe page (customer portal). Stripe also calculates VAT and issues the invoices. Stripe sends us your name, email address, billing address, VAT ID where applicable, payment method (e.g. the last four digits of a card), amount and payment status. Stripe also uses data under its own responsibility to prevent fraud and comply with legal obligations. Stripe may transfer data to Stripe, Inc. in the USA (Section 16). More information: stripe.com/privacy.

The legal basis is the performance of the contract (Art. 6(1)(b) GDPR) and our legal obligation to retain invoices (Art. 6(1)(c) GDPR).

Orders and records

For orders in the app (plan, plan change, credits, WhatsApp number), we store the following as proof of the conclusion of the contract and of your consents: your account (user ID, email address), company and billing address, the order (order number, product, term, price, Stripe identifiers), the wording of each declaration you confirmed with the time it was ticked and the time the order was submitted, the version of the Terms, the Data Processing Agreement and the Privacy Policy (date and checksum of the text), your IP address in shortened form (for IPv4 without the last block, for IPv6 only the first three blocks) and a non-reversible checksum (HMAC) of the full IP address, the browser identifier (user agent), the browser language and a checksum of your session. We do not store the full IP address for this purpose. From this we create the order confirmation and a record of your consents as PDFs, which you receive by email and can access in the app.

The legal basis is Art. 6(1)(b) GDPR (contract) and Art. 6(1)(f) GDPR (our legitimate interest in proving the conclusion of the contract and your consents and in defending legal claims). We store the records so that they cannot be changed; each entry is linked to the previous one by a checksum so that later changes would be detected. We keep them for ten years (longest limitation period, § 199(3) German Civil Code) and then delete them. If your account is deleted earlier, the records remain, without a link to the account, until this period expires.

To be able to prove that the records have not been changed afterwards, we have a checksum (hash) of all records signed daily by an independent time-stamping authority (FreeTSA, freetsa.org). Only this checksum is transmitted, no personal data.

14. Contact by email or phone

If you contact us, we process your information to answer your inquiry. The legal basis is Art. 6(1)(b) GDPR if your inquiry relates to a contract, otherwise our legitimate interest in answering it (Art. 6(1)(f) GDPR).

Cancellation via “Cancel contract”

If you cancel via doneforyou.io/kuendigen or in the app, we process your account's email address, the requested cancellation date, a reason you may optionally provide, the time of receipt and confirmation, and your IP address and browser identifier. When you cancel via the website, we send a confirmation link to the account's email address (only if an account with this address exists), forward the cancellation to our payment provider Stripe after confirmation, send you a confirmation by email and notify our administrators. To prevent abuse, we use Cloudflare Turnstile there (see the section on Cloudflare). The purpose is to execute and document your cancellation. The legal basis is Art. 6(1)(b) GDPR and our legitimate interest in being able to document cancellations and prevent abuse (Art. 6(1)(f) GDPR).

Contacting agencies (sales)

We contact agencies that could become customers of Doneforyou by phone or email. For this we process business information collected from publicly available sources, in particular business directories (e.g. agenturmarkt.de), the agency’s website and legal notice, and the commercial register: company, address, website, business phone number and email address, names of managing directors and contact persons, industry, and our notes on calls and emails sent (time, outcome, follow-up). The data is stored in our database (Section 3); emails are sent via Cloudflare (Section 12). The purpose is to initiate a business relationship. The legal basis is our legitimate interest in acquiring new customers (Art. 6(1)(f) GDPR, Recital 47).

You can object to this use at any time (Art. 21(2) GDPR), e.g. during a call or by email to [email protected]. We will then delete your data and keep only a blocking note (company, phone number and email address) so that we do not contact you again. If no business relationship results, we delete the data no later than two years after the last contact.

15. Improving Doneforyou

Under our Terms, we may use content that agencies create or upload in Doneforyou to improve Doneforyou (e.g. the quality of the generated texts and images) and to show it as examples. We never use applicant data for this. We remove or anonymize other personal data (e.g. names, contact details or recognizable people in photos) beforehand. Insofar as personal data is affected at all, the legal basis is our legitimate interest in developing our service (Art. 6(1)(f) GDPR). You can object to this at any time by emailing [email protected].

16. Transfers to third countries

Some of the providers mentioned (Cloudflare, Supabase, Anthropic, OpenAI, Meta including WhatsApp, Stripe, Amazon Web Services) are based in the USA or belong to US companies, so data may be transferred to the USA. The European Commission has adopted an adequacy decision for the USA (EU-US Data Privacy Framework), which applies to certified companies. Where a provider is not certified, we base the transfer on the European Commission's Standard Contractual Clauses (Art. 46(2)(c) GDPR).

17. Retention periods

We store personal data only for as long as necessary for the respective purpose:

18. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to withdraw consent with effect for the future (Art. 7(3)). To exercise these rights, write to us at [email protected].

Right to object: Where we process data on the basis of our legitimate interest (Art. 6(1)(f) GDPR), you may object at any time on grounds relating to your particular situation (Art. 21 GDPR).

You also have the right to lodge a complaint with a data protection supervisory authority, e.g. the authority responsible for us: Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen, Kavalleriestraße 2–4, 40213 Düsseldorf, Germany, ldi.nrw.de.

19. Other information

We do not make decisions based solely on automated processing that produce legal effects concerning you (Art. 22 GDPR). The classification of applications as a “match” based on the answers in the application form is defined by the agency; it serves only as an aid for selection by humans.

We update this Privacy Policy when our service or the legal situation changes. The version published here applies. In case of discrepancies, the German version prevails.