Privacy Policy

Controller

The controller under Art. 4(7) GDPR is:
Aleksandar Perisic (solo operator, no legal entity)
Waldspielplatz 3, 82319 Starnberg, Germany
Email: hello@aeo-explorer.de
Web: aleksandarperisic.com

No Data Protection Officer is appointed; as a solo operator, none is required (Art. 37 GDPR, §38 BDSG).

What we process and why

Account data — name and email for passwordless magic-link sign-in. Legal basis: Art. 6(1)(b) GDPR (contract).
Session cookie — keeps you signed in. Art. 6(1)(b).
Technical access data — when you load the site, our hosting provider (Vercel) processes the data technically required to deliver pages, including your IP address. Art. 6(1)(f) (legitimate interest in operating and securing the site).
Workspace content — tracked prompts, competitor names, chat threads, notes. Art. 6(1)(b).
AI engine answers — stored verbatim with provenance so your visibility history stays auditable. Art. 6(1)(b).
Usage metering — tokens and cost per workspace, to enforce limits and show you spend. Art. 6(1)(b) and 6(1)(f) (abuse prevention). You can object to the Art. 6(1)(f) processing (Art. 21).
Your AI provider API keys — encrypted at rest (AES-256-GCM), decrypted server-side only, never sent to your browser. Art. 6(1)(b); security measures per Art. 32.
Launch-list emails— used only to announce the launch. Your address is delivered to the operator's inbox and you receive a confirmation email. Art. 6(1)(a) (consent), withdrawable at any time with effect for the future (Art. 7(3)).

We run no analytics, no tracking, no ads.

Cookies

One strictly necessary session cookie. Because it is required to provide the service you requested, no consent banner is needed (§25 Abs. 2 Nr. 2 TDDDG). Nothing else is set.

AI providers (bring your own key)

When you run a scan or use chat, your prompts — including any workspace content they contain — are sent to the AI provider you selected: OpenRouter, OpenAI, Anthropic, Google, Perplexity, or xAI. By default this happens with your own API key, i.e. under your own agreement with that provider. The provider processes that data under its own privacy policy and terms, including any retention or training practices, and is not acting as our processor — please review the policy of the provider you use.

The read-only showcase workspace is the exception: it runs on the operator's keys. Legal basis for that processing: Art. 6(1)(f) (legitimate interest in demonstrating the product).

Service providers (processors)

We use the following processors to run the service: Vercel (hosting and functions), Turso (database), Upstash (Redis, rate limiting), Resend (transactional email), and Cloudflare R2 (report exports). Stripe will be added when payments launch; it is not active today. The current list lives at /legal/subprocessors.

International transfers

Some of these providers process data in the United States. Their published data-processing terms state that such transfers rely on EU Standard Contractual Clauses (Art. 46(2)(c) GDPR) and/or certification under the EU–US Data Privacy Framework (adequacy decision, Art. 45 GDPR). We rely on those published commitments; we have not independently audited them.

When you use your own API key with an AI provider, any international transfer happens under your own agreement with that provider, not under safeguards we put in place.

Retention and deletion

Deleting your account or a workspace schedules erasure with a 30-day recoverable grace period, which you can cancel; after the grace period the data is erased. An immediate erasure option is available and confirmed via a link emailed to you. You can export your data in-app at any time.

Launch-list emails are kept only until the launch announcement has been sent or you withdraw consent, whichever comes first.

Your rights

You have the rights of access, rectification, erasure, restriction, data portability, and objection (Art. 15–21 GDPR). Where processing is based on consent, you can withdraw it at any time without affecting the lawfulness of processing before the withdrawal (Art. 7(3)). Contact hello@aeo-explorer.de.

You may also lodge a complaint with a supervisory authority (Art. 77 GDPR) — in the EU member state of your habitual residence, your place of work, or the place of the alleged infringement.

Automated decision-making

We do not use automated decision-making or profiling within the meaning of Art. 22 GDPR.

Changes

We will update this page when our processing changes and note the effective date below. Material changes to how your data is used will be announced in the product.

Effective date: set at commercial launch (public beta since August 2026).

What we process and why

Account data — name and email for passwordless magic-link sign-in. Legal basis: Art. 6(1)(b) GDPR (contract).

Session cookie — keeps you signed in. Art. 6(1)(b).

Technical access data — when you load the site, our hosting provider (Vercel) processes the data technically required to deliver pages, including your IP address. Art. 6(1)(f) (legitimate interest in operating and securing the site).

Workspace content — tracked prompts, competitor names, chat threads, notes. Art. 6(1)(b).

AI engine answers — stored verbatim with provenance so your visibility history stays auditable. Art. 6(1)(b).

Usage metering — tokens and cost per workspace, to enforce limits and show you spend. Art. 6(1)(b) and 6(1)(f) (abuse prevention). You can object to the Art. 6(1)(f) processing (Art. 21).

Your AI provider API keys — encrypted at rest (AES-256-GCM), decrypted server-side only, never sent to your browser. Art. 6(1)(b); security measures per Art. 32.

Launch-list emails— used only to announce the launch. Your address is delivered to the operator's inbox and you receive a confirmation email. Art. 6(1)(a) (consent), withdrawable at any time with effect for the future (Art. 7(3)).