Privacy Policy

This privacy policy describes how we process personal data on our website appconfector.de, in the management area (mein.appconfector.de) and in our business relationship with our customers.

For the apps that our customers operate with AppConfector, the respective customer is the controller. Each of these apps has its own privacy policy. There we process the data of app users only on behalf of the customer, under the Data Processing Addendum (DPA).

1. Controller and contact

Jungherz GmbH
Duvenkamp 21
46282 Dorsten
Germany

Managing director: Marcel Karas
Phone: +49 (0) 2362 / 98 38 190
E-mail: kontakt@appconfector.de

Please send questions about data protection and requests regarding your rights to datenschutz@appconfector.de.

2. The essentials in brief

• Our servers are located at netcup GmbH in a data centre in Nuremberg, Germany. We send e-mails via our own mail server and handle support requests with our own system. Both also run on servers of netcup GmbH.
• The website and the management area use no analytics or advertising services and no cookies for tracking purposes. We do not measure whether you open our e-mails or click links in them.
• Content from other providers, such as videos or appointment booking, only loads when you click on it.
• We do not sell data.
• We use service providers outside the EU only where necessary. Section 13 lists them together with the basis of the transfer.

3. Visiting the website and the management area

3.1 Server logs

With every request, our servers store the IP address, date and time, the requested address, the referring page (referrer), information about the browser and operating system (user agent), the status code and the amount of data transferred. We need this data to deliver the pages, to fend off attacks and to find errors. The legal basis is our legitimate interest in secure operation (Art. 6(1)(f) GDPR). The logs are deleted after 14 days.

3.2 Cookies and browser storage

We only use cookies and browser storage that are strictly necessary for the functions you use (Section 25(2) no. 2 TDDDG). No consent is required for this. Further processing is based on Art. 6(1)(b) and (f) GDPR.

If you allow your browser to do so, it stores your login details in its own password manager. We have no access to it.

3.3 Support widget

The website and the management area load our support widget from auxdesk.io, our own system (section 7). As long as you do not write to us, it only receives the technical connection data. If you write to us, we process your message, your name, your e-mail address, attachments and the page on which you wrote. If you write from the management area, the widget also transmits the address of your app, your package and the status of your trial with the message, so that we can help without asking back. The legal basis is Art. 6(1)(b) GDPR, for requests without a contract Art. 6(1)(f) GDPR.

3.4 Videos only after a click

In help and blog articles and on individual pages, we show videos from YouTube (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland) and Vimeo (Vimeo.com, Inc., 330 West 34th Street, 10th Floor, New York, NY 10001, USA). Instead of the video, you first see a placeholder. Only when you click "Load video" does your browser load the player: YouTube via youtube-nocookie.com, Vimeo with the "Do Not Track" setting. The provider then receives your IP address and technical data of your browser and may set cookies. Google and Vimeo also process data in the USA (EU-U.S. Data Privacy Framework).

The legal basis is your consent given by the click (Section 25(1) TDDDG, Art. 6(1)(a) GDPR). It only applies to the individual video on the page you opened. The next time you open the page, the placeholder appears again.

3.5 Push notifications from the management area

If you turn on push notifications in the management area, for example for new orders, enquiries or form submissions, your browser registers a receiving address with its push service. We store this address, the occasions you chose and the type of device (browser and operating system) with your customer account. For each notification we send a message to your browser's push service, which delivers it to your device. The content is encrypted; the push service only sees the receiving address, the time and the size.

Which push service this is depends on your browser: Firebase Cloud Messaging from Google for Chrome and other Chromium browsers, the Apple Push Notification service for Safari, the Mozilla Push Service for Firefox and the Windows Push Notification Services from Microsoft for Edge.

The legal basis is your consent (Art. 6(1)(a) GDPR). You can withdraw it at any time, under Account › Push notifications or in the settings of your browser. If you turn the notifications off or the push service reports the address as invalid, we delete the receiving address.

4. Registration and login

When you register, we create a customer account and your first app. For this we process your e-mail address and your password or the information from the provider you log in with, as well as your language, the selected package and, if you came via a partner, the partner's ID. We do not store your password in plain text. The legal basis is Art. 6(1)(b) GDPR.

Login via other providers: You can log in with an account at Google (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland), Facebook (Meta Platforms Ireland Limited, Merrion Road, Dublin 4, Ireland), Apple (Apple Distribution International Ltd., Hollyhill Industrial Estate, Hollyhill, Cork, Ireland) or Microsoft (Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland). We then receive your e-mail address, your name and your identifier at that provider. The provider learns that you log in with us. We keep the provider's access key only in the session. After login, we pass the details to your browser in the fragment of the address (after the # sign) so that it can save the login. This part of the address is not transmitted to our server.

Logins to the management area are recorded as an event: time, browser identifier and referring page, without IP address. We use them for security and for the statistics of your account (Art. 6(1)(f) GDPR). Section 12 states how long we keep them.

Start with AI

Under “Start with AI” (mein.appconfector.de/start, also via the input field on our website), you describe your business and an AI builds an app from it. For this we process your description, optionally the industry and the main purposes of the app, the address of your website if you provide one, your e-mail address, your language and, if you came via a partner, the partner's ID. What you enter on our website reaches this page in the part of the address after the # sign. This part is not transmitted to our server; we only receive your details when you submit the form.

With the form, you confirm that you act for this business or with its permission, and you agree to our terms and conditions. We store both with the time and keep them as proof as long as your account exists. A security check with ALTCHA protects the form against automated requests: your browser solves a small computing task that it receives from our server and that our server verifies. No data goes to third parties and no cookies are created. We also limit the starts per e-mail address, per IP address and per day, and check whether the domain of your address can receive e-mails. For these limits we do not store your IP address, only a check value (hash) formed with a secret key, which changes every day, and a check value of your e-mail address.

We then send you an e-mail with a link that is valid for seven days. The e-mail does not repeat your description. As with every e-mail, we record the IP address that triggered the sending and delete it after seven days. If you do not confirm your address, neither an account nor an app is created, and we delete the details of the start after seven days. We delete the e-mail itself after 30 days.

Only when you choose “Build now” on the page behind the link do we create your customer account with your e-mail address and your language and start the build. Until then, we do not transmit your details to any of the services named below. A new account is then logged in; you set its password later. If your address already has an account with a password, you log in first and the app is added to that account. If you are logged in to the management area, you start without an e-mail and without the security check.

Language models running in a data centre in the EU (Amazon Web Services, Frankfurt am Main) carry out the build. We send them your description, the industry, the main purposes and the address of your website via the EU endpoint of Requesty; your e-mail address is not part of the request. The pictures of the app are generated by the image model of OpenAI in the USA from picture descriptions that the AI writes for this. They too are sent via the EU endpoint of Requesty. OpenAI may store these descriptions for a limited time to detect abuse. The content is not used for training. If the AI puts an address into your app, we convert it into coordinates via Google (section 5, addresses and maps).

If you provide a website, the AI takes from it what it learns about your business, such as services, opening hours, contact details and the details of the imprint. Firecrawl (SideGuide Technologies, Inc., USA) retrieves the texts of the pages for us, with Tavily (AlphaAI Technologies Inc., USA) as a fallback. Via Tavily, the AI can also search the web for your business. These services receive the address of the page and the search terms the AI chooses, such as the name of your business, but neither your e-mail address nor your IP address. Our own servers capture the look of your website: they open the home page in a browser, take a picture of its upper part and load the logo, so that the app matches your appearance. In doing so, they only connect to publicly reachable addresses. Only the language model receives the picture and the logo. At most, we take the preview image that your home page specifies for sharing on social networks into the app as its header picture. Without a website, the AI reads nothing on the web.

During the build, the page shows you the progress and the app as it takes shape. The app can already be reached at its address; we keep search engines out until you have booked a package and confirmed your imprint. When the app is ready, you receive an e-mail and, on devices on which you have allowed push notifications from the management area, a notification (section 3.5). If the build fails, you receive an e-mail through which you can have the app created anew. With “Create anew”, the AI builds the app once more from your details. With “Refine”, you give it one sentence for changes; it reads nothing on the web for this. After the first completed build, we inform our team about your app, for a new account as with any registration (section 5, customer care). You test your app free of charge for 20 days. After that, sections 5, 6 and 8 apply to the account, the app, payments and e-mails.

We delete the details of the start seven days after the form was submitted if you do not confirm your address, otherwise seven days after “Build now” or the last “Create anew”. Your description and what the AI took from it and from your website then remain with your app as its content and the history of its creation until the app is deleted. We keep the course of the build with the answers of the models and the pages retrieved for 30 days after the build ends. If the build fails for good, we delete the unfinished app and an account newly created for it after five days.

The legal basis is Art. 6(1)(b) GDPR, because you request the draft and thereby register with us. We base the security check, the limits and the confirmation that you act for the business on our legitimate interest in protecting the service against misuse and businesses against apps in their name (Art. 6(1)(f) GDPR). If your description or your website contains details about other persons, such as the names of employees, we process them for your app on your behalf from “Build now” onwards (DPA).

5. Customer account, contract and billing

For the contract, we process company, contact person, address, e-mail address, phone number, VAT identification number, booked packages, terms, invoices, payment status and our correspondence with you. The legal basis is Art. 6(1)(b) GDPR, for the retention of invoices Art. 6(1)(c) GDPR in conjunction with Section 257 HGB and Section 147 AO.

• Customer care: For each new app, we create an entry in our customer overview in Notion (e-mail address, address of the app, partner ID) and open a welcome ticket in our support system (additionally package, company, type of login and, if your link contained it, the page you came from). Notion Labs, Inc. processes the data in the USA. The legal basis is our legitimate interest in personal customer care (Art. 6(1)(f) GDPR).
• Internal notifications: For registrations, purchases and incidents, our system sends the team a short message via the Pushover service (Pushover, LLC, USA). It contains, for example, a customer number or the address of an app. We make e-mail addresses and phone numbers unrecognisable beforehand. The legal basis is Art. 6(1)(f) GDPR.
• Letters: If necessary, we send invoices and payment reminders by post via LetterXpress (A&O Fischer GmbH & Co. KG, Maybachstraße 9, 21423 Winsen (Luhe), Germany). For this, LetterXpress receives the document with your address.
• Debt collection: If a due claim remains unpaid despite a reminder, we instruct mediaFinanz GmbH, Weiße Breite 5, 49084 Osnabrück, Germany. It receives company, name, address, e-mail address, phone number and the details of the claim. The legal basis is Art. 6(1)(b) and (f) GDPR.
• Apps in the app stores: For a store app, we upload a build package to VoltBuilder (NSB Corporation, 71 Hill Crescent, Toronto, Canada). It contains app name, app identifier, the address of the app, icons and certificates, but no content and no user data. An adequacy decision of the EU Commission exists for Canada.
• Domains: If we register a domain for you, we pass your details as holder to the registrar OVH SAS (2 rue Kellermann, 59100 Roubaix, France) and to the responsible registry, such as DENIC eG. Depending on the domain extension, holder data is publicly accessible.
• Addresses and maps: Some address fields in the management area suggest places via Google Maps Platform (Google Ireland Limited). The script only loads when such a field appears. Google then receives your IP address and the characters you type. Addresses that you store in a component of your app, such as the Contact component, are converted into coordinates via Google so that the app can show a map. The legal basis is Art. 6(1)(b) GDPR.

6. Payments

We process payments via Stripe (Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland). We transmit your e-mail address, your name, your customer number and the app concerned to Stripe. You enter your billing address and means of payment directly with Stripe. We do not receive card data or bank details. Stripe also processes payment data as a controller in its own right, for example for fraud prevention and legal obligations. Data may be transferred to Stripe, Inc. in the USA (EU-U.S. Data Privacy Framework). The legal basis is Art. 6(1)(b) GDPR.

Older contracts still run via Digistore24 (Digistore24 GmbH, St.-Godehard-Straße 32, 31139 Hildesheim, Germany). There, Digistore24 is the contracting party for the payment and transmits the order and payment data to us.

Partner program: Partners receive their commissions via an account at Stripe (Stripe Connect). Stripe itself verifies the partner's identity. We transmit the e-mail address and the partner ID. If a new customer comes via a partner's link, we assign them to that partner if they register during the same visit. For this we use the session (section 3.2), not a separate cookie.

7. Support

We handle requests by e-mail and via the support widget with Auxdesk, our own system on servers of netcup GmbH. We store the tickets in Notion (Notion Labs, Inc., 2300 Harrison Street, San Francisco, CA 94110, USA): subject, name, e-mail address, message text, attachments and the classification of the request.

An AI classifies each request by topic and urgency and suggests a reply. For this, the request is sent via the EU endpoint of Requesty to a language model that runs in a data centre in the EU. The content is not used for training. A human always decides on the reply.

The legal basis is Art. 6(1)(b) GDPR, for requests without a contract our legitimate interest in answering them (Art. 6(1)(f) GDPR).

8. E-mails

• E-mails about the contract: We send confirmations, invoices, reminders and security notices because they are part of the contract (Art. 6(1)(b) GDPR).
• Product information: As a customer, we inform you by e-mail about news and offers relating to our own services (Section 7(3) UWG, Art. 6(1)(f) GDPR). You can object to this at any time via the link in each of these e-mails or by e-mail to us. This incurs only the transmission costs according to the basic rates. After an objection, your address is placed on a block list so that you no longer receive product information.
• Survey: A few days after you create an app, we ask for your opinion by e-mail. The link leads to a form at Google Forms (Google Ireland Limited). Participation is voluntary. Google processes your answers for us, also in the USA (EU-U.S. Data Privacy Framework).
• Sending: All e-mails are sent via our own mail server at netcup GmbH. It logs recipient, time and delivery status. We place addresses that are permanently unreachable or report e-mails as spam on a block list.
• No measurement: Our e-mails contain neither tracking pixels nor redirected links. So we cannot see whether you opened an e-mail or clicked a link.

9. Appointment booking

For calls and demonstrations we use TidyCal (Sumo Group Inc., 1305 E. 6th St #3, Austin, TX 78702, USA). The calendar only loads when you click the booking button. TidyCal then receives your IP address and your entries: name, e-mail address, the selected appointment and your notes. The legal basis for loading is your consent given by the click (Section 25(1) TDDDG, Art. 6(1)(a) GDPR). For the booking itself, it is Art. 6(1)(b) GDPR, because you arrange an appointment with us. TidyCal processes the data in the USA. The transfer is necessary so that we can arrange the appointment you requested (Art. 49(1)(b) GDPR). Without a certification of the provider, no adequacy decision applies to the USA; the level of protection may be lower than in the EU.

10. Translations

We use DeepL for translations (DeepL SE, Maarweg 165, 50825 Cologne, Germany). This covers the texts of our website and the management area, our help and blog articles, search terms in the media library and searches in our help that you enter in a language other than German. We store these translations without reference to your person so that the same query does not have to be translated again. The legal basis is our legitimate interest in a multilingual offering (Art. 6(1)(f) GDPR). We translate content of your app on your behalf (DPA).

11. Media library and AI functions

• Image search: In the media library, you search for photos at Pexels (Canva Germany GmbH, Pappelallee 78/79, 10437 Berlin, Germany) and for icons and images at Magnific (Magnific AI, S.L.U., Calle Molina Lario 13, 29015 Málaga, Spain). The search runs via our server. We first translate German search terms with DeepL. Your browser loads the preview images directly from the providers' servers, which receive your IP address. Our server fetches an image that you take over.
• Image editing: If you have an image upscaled or its background removed, we send it to Magnific.
• AI when creating apps: If we create an app for you with AI, we process your details and the content of your website on your behalf. Annex 2 of the DPA lists the services used. Section 4 describes what happens when you start via “Start with AI”.
• AI tools in the management area: With “Improve text” in the content editor, we send the selected text and the chosen action via the EU endpoint of Requesty to a language model that runs in a data centre in the EU (Amazon Web Services, Frankfurt am Main). With “Create image” in the media library, we send your description via the same endpoint to the image model of OpenAI in the USA and store the image in the media library of your app. OpenAI may store the description for a limited time to detect abuse. The content is not used for training. Only you take a suggestion over. For the monthly quota we store, per call, the app, time, function, model, number of tokens and cost, without the text or the description. Where content of your app concerns persons, we process it on your behalf (Annex 2 of the DPA).

The legal basis is Art. 6(1)(b) GDPR.

12. Retention

We store personal data for as long as necessary for the respective purpose. After that, we delete it unless there is a legal obligation to retain it.

13. Recipients and transfers to third countries

We only pass on data to the service providers named in this policy, and only to the extent necessary for the respective purpose. Service providers acting on our behalf are bound under Art. 28 GDPR. Authorities only receive data if we are legally obliged to provide it.

For transfers to countries outside the EU and the EEA, we rely on an adequacy decision of the EU Commission (Art. 45 GDPR). For the USA, it applies to companies certified under the EU-U.S. Data Privacy Framework. Otherwise, we rely on standard contractual clauses of the EU Commission (Art. 46(2)(c) GDPR) or, in individual cases, on Art. 49 GDPR. You can obtain a copy of the standard contractual clauses on request.

14. Your rights

You have the right of access to your data (Art. 15 GDPR), to rectification (Art. 16), to erasure (Art. 17), to restriction of processing (Art. 18) and to data portability (Art. 20). You can withdraw consent at any time with effect for the future (Art. 7(3) GDPR). To do so, write to datenschutz@appconfector.de.

You can lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is the Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen, Kavalleriestraße 2–4, 40213 Düsseldorf, Germany.

Right to object

Where we process data on the basis of a legitimate interest (Art. 6(1)(f) GDPR), you can object at any time on grounds relating to your particular situation (Art. 21(1) GDPR). You can object to the use of your data for product information and other direct marketing at any time without giving reasons (Art. 21(2) GDPR). An informal note to datenschutz@appconfector.de is sufficient.

15. Further information

• Obligation to provide data: For registration and the contract, we need the details marked as mandatory. Without them, we cannot conclude a contract. All other details are voluntary.
• No automated decisions: We do not make decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you (Art. 22 GDPR). The AI classification in support does not decide anything either.
• Changes: We adapt this privacy policy when our services or the legal situation change. The version on this page applies.