Privacy policy

1. Controller

Martin Müller
Buttmannstraße 7A
13357 Berlin
Germany
Email: info@aicompare.ninja

2. Hosting and server logs

The website, calculator.aicompare.ninja and the redirect from vergleich-ki.de are delivered by Cloudflare, Inc. (USA) as our processor. Each request, including requests for badges, calculators and cards embedded on other websites, involves processing of the IP address, time, requested address, referrer and browser and device details. The purpose is to deliver the content, to prevent attacks and abuse and to analyse errors. To prevent abuse we derive pseudonymous values from the IP address and, where applicable, the email address and keep them for no more than 24 hours. For regional price display your browser reads the country that Cloudflare derives from the connection; it is not stored. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is secure and working operation. The data are deleted once they are no longer needed for these purposes.

3. Consent and storage in your browser

We store your choice in the cookie settings in your browser's local storage (Section 25(2) no. 2 TDDDG). We load the services in Sections 4 and 5 and external content (Section 7) only with your consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG). Consent is valid for no more than 180 days. You can withdraw it at any time with effect for the future via “Cookie settings” in the footer; this does not affect the lawfulness of processing before withdrawal. We do not act on “Do Not Track” browser signals.

4. Cloudflare Web Analytics

With your consent we measure reach and loading times with Cloudflare Web Analytics (Cloudflare, Inc., USA, processor). We process the page address, referrer, country, browser, operating system, device type, performance values and connection data. Reports are available for up to six months.

5. Google Analytics 4 and our own statistics

With your consent we use Google Analytics 4 from Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (processor; sub-processors include Google LLC, USA). We process page views, interactions (such as clicks on vendor and advertising links, submitting a form without its content, copying an embed code), referrer, time, approximate location, device, browser and operating system data and an identifier stored in a cookie. The cookies last no more than 180 days and the data are kept for 14 months.

With the same consent we keep our own statistics on search, clicks and ad placements (delivery, visibility, click). We process random event, search and session identifiers, time, page path, language, referring website, approximate country, device and browser category and catalog categories, tools and filters, but no search text. When you click an advertising link, a random click identifier may be passed to the partner programme so that a commission can be attributed. We use a processor for the analysis. Session identifiers last 30 minutes. We delete search data after no more than 366 days, ad placement events at Cloudflare after 90 days and other events after no more than 400 days.

After withdrawal we delete the statistics data linked to your consent and ask Google to delete the GA4 data. For this purpose and to block late measurements we keep a pseudonymous identifier until no more than 30 days after the consent would have expired (Art. 6(1)(c) and (f) GDPR).

6. Express review and payment via Stripe

Express review

When you book an Express review we process name, email address, company name, country of establishment, billing address, VAT ID, the confirmation that you act as a business, your acceptance of the Express terms (time, version) and status, amount and identifiers of payment, invoice, credit note and refund. Payment, invoicing and tax calculation are handled by Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Dublin 2, Ireland. Stripe is our processor for invoicing and tax calculation and an independent controller for payment processing, fraud prevention and its own legal obligations.

We check a VAT ID from another EU member state before payment via the European Commission's VAT Information Exchange System (VIES). We transmit it together with our own VAT ID and store the result with date, consultation number and the company name and address reported.

The legal bases are Art. 6(1)(b) GDPR (contract), (c) (tax obligations under Sections 14, 14b, 18a and 18e UStG and Section 147 AO) and (f) (fraud prevention). We keep invoices and accounting records for 8 years and other tax-relevant documents for up to 10 years (Section 147 AO, Section 14b UStG). We delete the other booking data 12 months after the booking.

7. External content

Directory badges on “Listed on”

We load the original badge of the following directories directly from their server only with your consent to “External content”: Outclimbed. The directory receives your IP address and browser details and processes them as an independent controller, possibly in a third country without an adequate level of data protection where your rights may not be enforceable. The legal basis is Art. 6(1)(a) GDPR and Section 25(1) TDDDG, and for the transfer to a third country Art. 49(1)(a) GDPR.

8. Contact, listing requests and newsletter

When you write to us by email or through the “Contact” and “Submit an AI” forms, we process your details (name, email address, content, time) to handle your request. The legal basis is Art. 6(1)(b) GDPR where a contract or its preparation is concerned, otherwise Art. 6(1)(f) GDPR; our legitimate interest is answering requests and reviewing tool suggestions. We store form messages at Cloudflare for no more than 90 days after the last processing step. We also store tool suggestions in a private repository at GitHub, Inc. (USA) for editorial review for as long as this is necessary. We delete emails once the request is closed unless a retention obligation applies.

Contacting providers

Controller: see Section 1. Purpose: requesting permission to use logos and documenting the reply. Legal basis: Art. 6(1)(f) GDPR; the legitimate interest is displaying logos lawfully and proving the permission. Categories of data: business email address, name of the contact person, content of the correspondence. Source: publicly accessible company websites. Recipients: email service providers as processors; for recipients and transfers to third countries see Section 9. Storage period: three years from the end of the year in which the correspondence took place (Sections 195, 199 BGB). You can object to the processing under Art. 21 GDPR; your rights are set out in Section 11.

Newsletter and price alerts

For the newsletter and price alerts we process your email address, language, any tools you chose and where you signed up, and, as proof of consent, the time and IP address of signup and confirmation and the version of the consent text (double opt-in). The legal basis for sending is your consent (Art. 6(1)(a) GDPR), for the proof Art. 6(1)(c) GDPR in conjunction with Art. 7(1) GDPR. Emails are sent through an email service provider acting as our processor. We also store these signup details in encrypted form in our own database at Cloudflare (processor) for the same purpose, so that we can manage signups independently of the email provider; here too the legal basis is your consent (Art. 6(1)(a) GDPR). Unconfirmed signups are deleted there after 30 days, and the entry is deleted when you unsubscribe. Only if you give separate consent (a separate, optional checkbox; you can sign up without it) do we measure whether and when you open the emails and which links you click, and link this to your email address. This uses a tracking pixel and links redirected via the email provider; the time, the link clicked, the IP address and browser and device details are processed. The purpose is to align the newsletter with recipients' interests. The legal basis is Art. 6(1)(a) GDPR and Section 25(1) TDDDG. You can withdraw your consent at any time via the unsubscribe link in every email or by email to info@aicompare.ninja. We keep the data until you unsubscribe. After that your address stays on a suppression list and we keep the proof of consent for up to three years from the end of the year of unsubscription (Art. 6(1)(c) and (f), Art. 17(3)(e) GDPR).

9. Recipients and transfers to third countries

Recipients are the parties named above, email service providers for receiving and sending emails and form notifications (processors) and authorities where we are legally obliged. Cloudflare, Google, Stripe, GitHub and email service providers may process data in the USA. For recipients certified under the EU-US Data Privacy Framework the basis is the European Commission's adequacy decision (Art. 45 GDPR), otherwise the European Commission's standard contractual clauses (Art. 46(2)(c) GDPR). You can obtain a copy of the safeguards via info@aicompare.ninja.

10. Retention

Where no period is stated above, we delete data once they are no longer needed for the purpose and no statutory retention obligation applies.

11. Your rights

Under Articles 15 to 18 and 20 GDPR you have the right of access, rectification, erasure, restriction of processing and data portability. You can withdraw consent at any time with effect for the future (Art. 7(3) GDPR). You can lodge a complaint with a data protection supervisory authority (Art. 77 GDPR).

Right to object (Art. 21 GDPR): Where we process data on the basis of Art. 6(1)(f) GDPR, you can object at any time on grounds relating to your particular situation. Write to info@aicompare.ninja.

12. Obligation to provide data

You are not obliged to provide us with data. Without the details marked as required we cannot handle a request, a tool suggestion, a newsletter signup or an Express booking. The contract and billing details are required for an Express booking.

We publish changes to this policy on this page.