Privacy policy

1. Controller

Martin Müller
Sole proprietorship (Einzelunternehmen)
Buttmannstraße 7A
13357 Berlin
Germany

Phone: +49 30 274 968 48
Email: info@aicompare.ninja

2. Hosting, delivery and server logs

We operate the website with Cloudflare Pages and Cloudflare Workers. Cloudflare KV stores customer and advertising data; Cloudflare D1 stores the advertising event data described below. The provider is Cloudflare, Inc. and its affiliates. On each request Cloudflare processes technically necessary connection and log data. These may include the IP address, date and time, requested URL, HTTP method and status, data volume, referrer, browser, operating system, device information, and a country signal derived from the connection.

The processing is necessary to deliver pages and API functions, defend against attacks, investigate errors, and keep the service stable. The legal basis is Art. 6(1)(f) GDPR. Art. 6(1)(b) GDPR also applies to customer accounts, advertising bookings, and billing. See the Cloudflare Privacy Policy for more information.

3. Country detection and pricing market

To display suitable pricing markets, Cloudflare provides a country-level signal from the network connection. Our market API returns only the two-letter country code and a broad pricing market such as the euro area, United States, Brazil, Japan, South Korea, Switzerland, United Kingdom, or global to the browser. We do not determine a precise location or store the detected pricing market in our own user profile. Ordinary server logs remain unaffected.

Visitors can change the region themselves. The choice is stored under vergleich-ki-price-market-v1 in the browser's localStorage until it is reset to “Automatic” or deleted in the browser. The legal basis for processing the country signal is Art. 6(1)(f) GDPR. Local storage of the expressly chosen region is necessary for the requested pricing feature and is permitted by § 25(2) no. 2 TDDDG.

4. Device storage and consent

Technically necessary storage is used for the expressly selected pricing region, the privacy decision, and, after signing in to an advertising account, the essential session cookie. These purposes are separate from optional audience measurement.

Optional analytics, including the labelled-slot statistics described in section 7, remain blocked worldwide until express consent. Page language or a country signal never enables them. A saved rejection, withdrawal, and an enabled Global Privacy Control signal are always honoured. Global Privacy Control blocks optional services even if consent was previously given.

The decision is stored under vergleich-ki-consent-v1 only in this browser's localStorage. Consent is valid for no more than 180 days. An express rejection or withdrawal remains until the user changes it. If the consent schema or providers change, an earlier grant becomes invalid while a rejection remains effective. The decision has no server-side user identifier. Choices can be changed at any time through “Privacy settings”. The legal bases for optional analytics are Art. 6(1)(a) GDPR and § 25(1) TDDDG. Storage of the choice itself is necessary to implement the expressly stated request under § 25(2) no. 2 TDDDG.

5. Cloudflare Web Analytics

We use Cloudflare Web Analytics for cookieless audience and performance measurement. According to Cloudflare, its beacon collects page-view and performance data through the Performance API. Data sent may include page and path, referrer host and path, country, browser, operating system, device type, navigation type, and performance metrics. It sets no cookies, does not use localStorage for recognition, and creates no cross-device visitor profile. Cloudflare states that this service does not collect or use visitors' personal data. Cloudflare nevertheless processes the connection data required to retrieve the beacon.

The beacon is loaded only after you consent. Our purpose is to improve the website technically and editorially. The legal bases are Art. 6(1)(a) GDPR and § 25(1) TDDDG. See the Cloudflare Web Analytics documentation for how the service works.

6. Optional analytics, including Google Analytics 4

Additional analytics services are loaded only if they are set up in our public analytics configuration with a provider and identifier. The consent script dynamically loads active optional providers under the rules in section 4. No optional analytics script is hidden or statically embedded. Google Analytics 4 is currently set up.

We use Google Analytics 4 after your consent. The contracting entity in the European Economic Area is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google LLC and affiliates may act as further recipients or subprocessors and process the page path, referrer, time, approximate location, browser, device, operating-system, interaction and session data. Our direct configuration sends no URL query string or fragment, does not enable advertising, and sends no ad-personalization signals. The cookies _ga and _ga_<identifier> may be set for recognition. Google Analytics 4 loads only on www.aicompare.ninja. vergleich-ki.de and www.vergleich-ki.de redirect there permanently and create no separate measurement partition or consent. The calculator in the iframe does not load Google Analytics. Another provider may be activated only after the configuration and this policy have been updated.

The legal bases are Art. 6(1)(a) GDPR and § 25(1) TDDDG. Consent can be withdrawn at any time through Privacy settings. Google explains its processing in the Google Privacy Policy and its GA4 data collection information.

After analytics consent, our own first-party statistics measure how catalog search, results, categories, filters, comparisons, tool pages, and provider or affiliate links are used. They also record active time and the highest scroll level reached on each page. Live search remains local in the browser for calculating results. An analytics event is created only after a search has displayed results unchanged for at least 800 milliseconds or has been submitted. We do not collect individual keystrokes, mouse coordinates, or form input.

Before storage, search text is limited and normalized on the server. Input that resembles an email address, URL, telephone number, long identifier, or sensitive personal information is stored as withheld. An exact search term appears in the private dashboard only when it came from at least three different pseudonymous sessions in the selected period. Google Analytics receives only a derived search intent such as a catalog category, never the raw text entered. Individual pseudonymous paths are kept for no more than 30 days. Statistics needed longer remain for no more than 400 days as daily aggregates without a session identifier.

7. Partner recommendations and paused ad placements

The catalogue shows partner or affiliate recommendations labelled as advertising, either as banners or provider links, but we do not operate a display ad network. They remain clearly separate from editorial tool comparisons. Only when clicked does the browser contact the provider or an intermediary partner network. Those parties may process connection data and use cookies or similar technologies under their own rules. We may receive remuneration if a contract results. Providing the links relies on Art. 6(1)(f) GDPR, our interest in information and financing the service.

A self-service product for paid placements is publicly paused. No booked ads are delivered, and no impressions or clicks are measured for them. Related measurement code remains in the system but does not start. If that product is offered publicly again, paid placements would be clearly labelled as advertising, and measurement would start only after a separate consent.

We measure our own labelled placements, including affiliate recommendations, only after analytics consent. Delivery at render time, at least 50 percent viewability, and clicks are recorded separately. We also record placement, campaign, creative and variant identifiers, time, page path without a query string, coarse country, referrer host, coarse browser and device type, and the classes likely_human, known_bot, or unknown. These classes are coarse technical assessments and not proof of a person. Analytics use no CAPTCHA and do not ask visitors to confirm they are human. A measurement failure never blocks the affiliate link. A random session identifier remains in sessionStorage for no more than 30 minutes after consent. Cloudflare D1 deletes raw events after 90 days. An HMAC-signed copy is sent with product id vergleich-ki and only the host www.aicompare.ninja to our private Studiomood Intelligence system, where it is kept for no more than 400 days. No names, email addresses, raw IP addresses, full user agents, identity profiles, or demographic inferences are stored. Non-personal click references can attribute placement, campaign, creative, and variant to a later reported transaction where the partner programme supports this. There is no ad personalization. The legal bases are Art. 6(1)(a) GDPR and § 25(1) TDDDG.

To protect the tracking endpoint, we use HMAC to derive a truncated pseudonymous key from the IP address transmitted by Cloudflare. The raw IP address is neither stored nor forwarded. The key and event identifiers remain only in the bounded memory of one Worker isolate: the rate window lasts 60 seconds, duplicate detection no more than ten minutes, and memory has a hard limit. A new isolate starts without this short-lived state. This protection performs no Workers KV operations. The legal basis is Art. 6(1)(f) GDPR, our legitimate interest in limiting abuse and costs.

8. Advertising account, ads, and essential session cookie

When an advertising account is registered, we process the name or company, email address, a salted password hash, creation date, and ad identifiers assigned to the account in Cloudflare KV. We also store the confirmation and its time that the booking is made as an entrepreneur or business customer under § 14 BGB. The plain-text password is not stored. For an ad we process its title, optional short text, destination URL, placement, duration, status, and creation, activation, expiry, and, where applicable, cancellation times.

After registration or login we set the vki_ad_session cookie for no more than 14 days. It contains a signed session record with the account identifier and expiry, is HttpOnly, Secure, and SameSite=Lax, and is deleted on logout. The cookie is essential for login and the dashboard and is not used for audience measurement. The legal basis is Art. 6(1)(b) GDPR; device storage is necessary under § 25(2) no. 2 TDDDG.

9. Stripe Checkout and billing

We use Stripe Checkout and the Stripe customer portal for paid advertising placements. When a checkout begins, we send Stripe in particular the advertiser's email address, price and duration, and ad, customer, and placement identifiers. On Stripe's pages, Stripe processes the contact, billing, payment, device, and transaction data entered there. Depending on the transaction, we receive and store checkout, customer, and subscription identifiers, payment status, and webhook events. We do not receive complete card or bank details.

The processing supports contract formation, payment, subscription management, fraud prevention, and statutory accounting or evidence duties. The legal bases are Art. 6(1)(b), (c), and (f) GDPR. Stripe may act as a controller for its own regulatory, security, and fraud-prevention purposes. See the Stripe Privacy Center for details.

10. Embedded cost calculator

The home page embeds the API cost calculator in an iframe from aicompare-ninja.twoem.workers.dev. This creates a direct connection to a separately delivered Cloudflare Worker. The technically necessary connection data described in section 2 and the language and embed-mode parameters are processed. The quantity values entered are currently calculated only in the embedded browser state and are not assigned by us to a user account. The calculator sends only its display height to the parent page. The embedded calculator does not load optional analytics. A direct visit to aicompare-ninja.twoem.workers.dev outside the iframe may load Google Analytics 4 after consent. The legal basis is Art. 6(1)(f) GDPR, our interest in providing the comparison calculator.

11. Email, contact forms, local search, and external and affiliate links

If you email us or use the “Contact” and “Submit an AI” forms, we process sender name, sender address, recipient address, time, subject or form fields, content, and technically necessary transmission data to handle the request and keep necessary evidence. Listings are not published automatically; we review them manually. The legal basis is Art. 6(1)(b) GDPR for pre-contractual or contractual messages and otherwise Art. 6(1)(f) GDPR.

To limit spam and abuse we use Cloudflare Turnstile. Cloudflare may process technical connection data and a security token. Turnstile usually runs without a puzzle; only higher risk may trigger an extra check. The legal basis is Art. 6(1)(f) GDPR. See the Cloudflare Privacy Policy.

The AI catalog search filters the provided catalog data locally in the browser; the search text is not sent to our search API for this purpose. Links to providers may be external links or affiliate links labelled as advertising. They are native recommendations in the catalogue, not banners from a display ad network. Only when clicked does the browser contact the provider or an intermediary affiliate network. Those parties may process connection data and use cookies or similar technologies under their own rules. We may receive remuneration if a contract results. Providing the links relies on Art. 6(1)(f) GDPR, our interest in information and financing the service.

12. Recipients and transfers to third countries

Recipients of personal data are, only where required for the relevant purpose: Cloudflare as infrastructure, database, and Turnstile provider; Stripe and participating payment providers; an optional analytics provider named in Privacy settings, if any; technical email providers (currently Resend for form notifications); destination providers or affiliate networks after a click; and authorities or courts where disclosure is legally required. Advertisers see only the aggregated statistics described in section 7. The advertiser's legal name is displayed publicly with the ad content as intended. We do not sell or rent personal data to list brokers.

Cloudflare, Stripe, optional Google, and other recipients selected by the user may process data outside the European Economic Area. Where we are responsible for such a transfer, we rely on an adequacy decision, including a valid EU-US Data Privacy Framework certification, or appropriate safeguards such as the European Commission's Standard Contractual Clauses. Residual risks of access by public authorities in the recipient country cannot be completely excluded. Destination sites and affiliate networks also apply their own notices.

13. Retention

We keep personal data only for as long as needed for the relevant purpose or a statutory duty. It is then deleted or aggregated so that a person can no longer be identified. The following criteria apply:

• The essential session cookie expires after no more than 14 days; logout deletes it earlier.
• Consents to analytics are valid for no more than 180 days. A rejection or withdrawal remains locally until it is changed or browser data are deleted. A manual pricing region remains until it is reset or browser data are deleted.
• Account, ad, and contract data remain for the duration of the account and business relationship and afterwards for statutory retention, billing, and potential legal claims. Data no longer required are deleted.
• Each advertising-dashboard request deletes raw advertising events older than 90 days. After a period without dashboard access, deletion therefore occurs on the first subsequent operation. Reports needed for longer are kept only in aggregated form.
• Emails are deleted after the request is complete unless a contract, evidence requirement, or statutory retention duty continues.
• The duration of technical Cloudflare logs, Stripe data, and optional analytics data additionally follows the necessary configuration, our contracts, and the providers' legal obligations.

14. Your rights, objection, and automated decisions

Subject to the statutory conditions, you have the rights of access under Art. 15 GDPR, rectification under Art. 16, erasure under Art. 17, restriction under Art. 18, portability under Art. 20, and objection under Art. 21. You may withdraw consent under Art. 7(3) at any time for the future. In particular, you may object to processing based on Art. 6(1)(f) GDPR on grounds relating to your particular situation. Contact info@aicompare.ninja. We may request suitable information to verify identity before disclosure.

Under Art. 77 GDPR you may complain to a supervisory authority, including the Berlin Commissioner for Data Protection and Freedom of Information, Alt-Moabit 59-61, 10555 Berlin, Germany.

We do not make a solely automated decision under Art. 22 GDPR that produces legal effects concerning you or similarly significantly affects you. Catalog search and pricing market only determine which information is displayed. Stripe may use automated systems for payment and fraud checks under its own responsibility; Stripe's notices apply.

15. Requirement to provide data and changes

You do not have to actively provide data merely to visit the site, although technical connection data are required for delivery. Selecting a pricing region and optional analytics are voluntary. An advertising account requires a name or company, email address, and password. A booking requires the stated ad, contract, and payment data; without them the account, ad, or payment cannot be provided. For email, at least a reachable sender address and the information needed to handle the request are necessary.

We update this policy when features, providers, or the law change. A material change to optional analytics invalidates an earlier consent and may require a new choice. The date above identifies the current version.