Privacy Policy

Last updated: October 4, 2026 · Deutsche Fassung

Convenience translation, the German version prevails. This English text is provided for your convenience. Only the German version (Datenschutzerklärung) is legally binding. In case of any discrepancy, the German version applies.

We take the protection of your personal data seriously and treat it confidentially and in accordance with the statutory data protection regulations (GDPR, German Federal Data Protection Act BDSG) and this privacy policy. As a rule, our website and our services can be used without providing personal data. Where personal data is collected on our pages or in the service, this is always done on a voluntary basis as far as possible and only to the extent necessary to provide the service.

1. Controller

The controller for data processing within the meaning of the GDPR is:

Vestamedia UG (haftungsbeschränkt)
Erkrather Straße 365 B
40231 Düsseldorf, Germany
Email: datenschutz@vestamedia.app
Authorized representative: Lasse Jansen

2. Data protection officer

[Where there is an obligation to appoint one under Art. 37 GDPR / section 38 BDSG, enter the name and contact of the data protection officer here. Appointment is recommended for systematic profiling (health score, AI memory).]
Provisional contact for data protection requests: datenschutz@vestamedia.app

3. General information on data processing

3.1 Scope of processing

As a matter of principle, we collect and use personal data of our users only to the extent necessary to provide a functional website as well as our content and services. Any further processing only takes place with consent or where there is a legitimate interest and the interests of the data subject do not override it.

3.2 Legal bases

• Art. 6(1)(a) GDPR where consent has been obtained
• Art. 6(1)(b) GDPR for the performance of a contract and pre-contractual measures
• Art. 6(1)(c) GDPR for compliance with legal obligations
• Art. 6(1)(f) GDPR to protect legitimate interests

4. Data collected when you visit our website

4.1 Server log files

When you access our website, our hosting provider automatically collects the following data in so-called server log files:

• Anonymized IP address (last octet removed)
• Date and time of the request
• File accessed and amount of data transferred
• Referrer URL
• Browser, operating system and language setting

This data is not combined with other data sources. It is stored for 30 days. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in stable, secure operation).

4.2 Cookies

We only use technically necessary cookies that are required to operate the site:

• vesta_session: session cookie for signed-in users (HttpOnly, Secure, SameSite=Strict). Lifetime 14 days with sliding refresh.
• csrf_token: protection against cross-site request forgery when submitting forms. Lifetime 14 days.
• vesta_oauth_state and vesta_apple_state: only during a sign-in with Google or Apple, protection against injected sign-ins. Lifetime 5 minutes.

These cookies do not require consent under section 25(2) no. 2 of the German TDDDG. We do not use tracking or marketing cookies.

4.2a Audience measurement (Umami, self-hosted)

For statistical analysis of the use of our website we use the open-source software Umami. Umami runs entirely on our own server in Germany; no data is transferred to third parties. Measurement takes place without cookies and without cross-device identifiers. We record pages viewed, referrer, browser type, device category and country of origin; the IP address is not stored. The data is not combined with personal data. The legal basis is our legitimate interest in analyzing and improving our offering (Art. 6(1)(f) GDPR).

4.3 Lead and request form

If you use the lead or contact form, we process the data you enter (name, email, phone, business name, industry, Instagram handle) to handle your request and to prepare a possible contractual relationship. The legal basis is Art. 6(1)(b) GDPR. Where you consent to receiving an individual analysis report, processing is additionally based on Art. 6(1)(a) GDPR.

5. Data collected when you use the Vestamedia service

As soon as you create an account and use our service, we process the following categories of data:

5.1 Master data

• Name, email, phone/WhatsApp number
• Business name, industry, address, VAT ID where applicable
• Password as a bcrypt hash (we never store plain text)

Legal basis: Art. 6(1)(b) GDPR (performance of contract).

5.2 Content data

• Texts, photos and videos you send us via WhatsApp or SMS
• History of your conversation with Vestamedia's AI assistant
• OAuth connection data for your social media accounts (tokens are held on our behalf by our publishing service provider Upload-Post, see section 6.2)
• Feedback from the platforms on posts published through Vestamedia

Legal basis: Art. 6(1)(b) GDPR. The contents of your conversation are stored encrypted in our database (column encryption using PostgreSQL pgcrypto).

5.3 Derived data / profiling

To improve the service, our system automatically creates derived data about your usage:

• Sentiment values of your messages (positive/neutral/negative)
• Health score of your account (activity, feedback from the platforms, response behavior)
• Style preferences and "memory" entries for personalizing suggestions

We base this processing on Art. 6(1)(b) GDPR (performance of contract). There is no automated decision-making with legal effect within the meaning of Art. 22 GDPR. Posts are published automatically; you see every post in the chat and can have it changed or removed at any time. You make changes to your contract yourself in your account.

6. Services and processors used

To provide our service we use the external service providers listed below. We have concluded data processing agreements pursuant to Art. 28 GDPR with all of them, insofar as processing on our behalf takes place.

6.1 Anthropic: Claude (AI processing)

Provider: Anthropic, PBC, 548 Market St, PMB 90375, San Francisco, CA 94104, USA.

Purpose: We use the AI model "Claude" for the automated classification of incoming messages, to generate post texts and image descriptions, to analyze images for suitability and to create individual analysis reports in the lead funnel.

Data processed: Contents of your messages, image descriptions, business name and industry, insofar as necessary for the task. We do not send payment data or passwords.

Legal basis: Art. 6(1)(b) GDPR (performance of contract).

Third-country transfer: USA. We base the transfer on the EU Standard Contractual Clauses (Modules 2 and 3) pursuant to Art. 46(2)(c) GDPR, which are contained in the Data Processing Addendum with Anthropic. Anthropic processes API content in accordance with its Commercial Terms; it is not used to train models. More information: privacy.claude.com.

6.2 Upload-Post: social media publishing

Provider: Upload-Post (upload-post.com). [Operating company, address and country of registration will be added with the data processing agreement.]

Purpose: On our behalf, Upload-Post publishes your posts on the platforms you have connected: Meta (Instagram, Facebook), TikTok and Google Business Profile. Upload-Post acts as the technical bridge between Vestamedia and the respective platform APIs. You connect your social media accounts through the platforms' official sign-in pages; neither we nor Upload-Post receive your passwords.

Data processed: OAuth tokens of your connected social media accounts, profile identifiers, post content (images, videos, texts) at the time of publication, status feedback from the platforms.

Legal basis: Art. 6(1)(b) GDPR (performance of contract).

Platforms to which Upload-Post forwards data on your behalf: Meta Platforms Ireland Limited (Instagram, Facebook), TikTok Technology Limited, Google Ireland Limited (Google Business Profile). As soon as you connect an account there, data is transferred to the respective platform, whose own privacy policies apply in addition.

Third-country transfer: Insofar as Upload-Post processes data outside the EU/EEA, the transfer is based on the EU Standard Contractual Clauses pursuant to Art. 46(2)(c) GDPR or an adequacy decision, where applicable.

6.3 Twilio: messaging (WhatsApp & SMS)

Provider: Twilio Ireland Limited, 78 Sir John Rogerson's Quay, Dublin 2, D02 R296, Ireland (for data processing of EU/EEA users). Parent company: Twilio Inc., 101 Spear Street, 5th Floor, San Francisco, CA 94105, USA.

Purpose: Twilio acts as Business Solution Provider (BSP) for the WhatsApp Business API and as a service provider for sending and receiving SMS. Incoming messages are delivered to Vestamedia via Twilio; Vestamedia sends outgoing replies and notifications via Twilio to you and, in the Complete plan, to your guests.

Data processed: Mobile numbers (E.164 format), message contents (text, images, videos, voice messages where applicable), sending and delivery timestamps, delivery status, sender and recipient IDs.

Legal basis: Art. 6(1)(b) GDPR (performance of contract): communication with you and your guests across channels is a core function of Vestamedia.

Third-country transfer: Processing is carried out primarily by Twilio Ireland Limited within the EU. Insofar as data is transferred to the US parent company, we base this on the EU Standard Contractual Clauses pursuant to Art. 46(2)(c) GDPR or the EU-US Data Privacy Framework, where applicable. More information: twilio.com/legal/privacy.

6.4 Google: sign-in with a Google account (optional)

Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, D04 E5W5, Ireland.

Purpose: Optional sign-in to your Vestamedia account with your Google account (OpenID Connect). If you use the "Sign in with Google" button, we redirect you to the Google sign-in page; Google confirms your identity and sends us the data listed below. Without clicking the button, no processing takes place. Signing in with Google does not create a new account; it only works for existing accounts with the same email address.

Data processed: Google account ID (stable identifier), verified email address, first name, profile picture URL where applicable. We do not receive passwords or any content of your Google account.

Legal basis: Art. 6(1)(b) GDPR (performance of contract, provision of the sign-in) or Art. 6(1)(a) GDPR (consent by actively choosing the Google sign-in button).

Third-country transfer: Data processing is carried out primarily by Google Ireland Limited within the EU. Insofar as data is transferred to the US parent company Google LLC, we base this on the EU Standard Contractual Clauses pursuant to Art. 46(2)(c) GDPR or the EU-US Data Privacy Framework, where applicable. More information: policies.google.com/privacy.

6.5 Stripe: payment processing

Provider: Stripe Payments Europe, Limited, 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland.

Purpose: Processing your payment and managing the recurring billing of your Vestamedia plan. Stripe is independently responsible for payment-specific data processing; we transfer the master data required for billing (name, email, address) to Stripe as a processor within the scope of our contractual relationship.

Data processed: Name, email, billing address, Stripe customer ID and Stripe subscription ID. We do not receive or store credit card data; it is processed exclusively between you and Stripe.

Legal basis: Art. 6(1)(b) GDPR (performance of contract) and Art. 6(1)(c) GDPR (statutory retention obligations).

Third-country transfer: Processing takes place primarily in the EU (Dublin, Ireland). Insofar as data is transferred to the USA, we base this on the EU Standard Contractual Clauses. More information: stripe.com/privacy.

6.6 Hetzner: hosting

Provider: Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany.

Purpose: Provision of the server and database infrastructure on which the Vestamedia application, our customers' websites and our audience measurement (Umami) run. The servers are located in the EU.

Legal basis: Art. 6(1)(f) GDPR. A data processing agreement pursuant to Art. 28 GDPR is in place with the hosting provider.

6.7 Resend: sending emails

Provider: Resend, Inc., USA (see resend.com/legal/privacy-policy).

Purpose: Sending our emails to you, such as the welcome email, setup reminders, password reset links and one-time links to your account, and, in the Complete plan, emails to your guests.

Data processed: Email address, name, content of the email, delivery and sending status.

Legal basis: Art. 6(1)(b) GDPR (performance of contract).

Third-country transfer: USA. The transfer is based on the EU Standard Contractual Clauses pursuant to Art. 46(2)(c) GDPR or the EU-US Data Privacy Framework, where applicable.

6.8 Apple: Sign in with Apple (optional)

Provider: Apple Distribution International Ltd., Hollyhill Industrial Estate, Hollyhill, Cork, Ireland.

Purpose: Optional sign-in to your Vestamedia account with your Apple ID ("Sign in with Apple"). Without clicking the button, no processing takes place. Signing in with Apple does not create a new account.

Data processed: Apple identifier (stable identifier of your Apple ID for Vestamedia), email address (on request an address relayed by Apple), your first name the first time. We do not receive passwords.

Legal basis: Art. 6(1)(b) GDPR (provision of the sign-in) or Art. 6(1)(a) GDPR (actively choosing the button).

Third-country transfer: Insofar as data is transferred to the US parent company Apple Inc., this is based on the EU Standard Contractual Clauses or the EU-US Data Privacy Framework. More information: apple.com/legal/privacy.

7. Transfers to third countries

Insofar as personal data is transferred to a country outside the EU/EEA (Anthropic in the USA, Resend in the USA, and where applicable Upload-Post, Twilio, Google, Apple and Stripe when transferring to their US parent companies), this takes place exclusively on one of the following bases:

• EU Standard Contractual Clauses (Art. 46(2)(c) GDPR)
• Adequacy decision of the EU Commission, where available (e.g. EU-US Data Privacy Framework)
• Explicit consent of the data subject (Art. 49(1)(a) GDPR), where required

In addition, we take technical safeguards such as column encryption of sensitive content before transfer.

8. Storage period and deletion concept

We store personal data only for as long as necessary for the respective purpose or as required by statutory retention periods. Specifically:

• Master data: for the duration of the contractual relationship and 30 days thereafter
• Conversation history: 24 months, then automatic deletion
• Content sent by the assistant: 12 months
• Sentiment and health score history: 12 months
• Images and videos: for the duration of provision in the account, then a 30-day grace period
• Server logs: 30 days
• One-time links to your account: valid for 72 hours, deleted 30 days after expiry
• Webhook logs: 90 days
• Invoices and accounting records: 10 years (section 147 German Fiscal Code AO, section 257 German Commercial Code HGB)
• Audit logs of administrative actions: 7 years

Automatic deletion runs daily. When the contractual relationship ends, content data is deleted completely within 30 days, unless covered by statutory retention periods.

9. Notice on the use of artificial intelligence

In the chat you are answered by Vestamedia's AI assistant. It is an automated system based on the language model "Claude" by Anthropic, PBC (see section 6.1), not a natural person. We point this out explicitly in the first message (transparency obligation under Art. 50 of the EU AI Act). Our team keeps an eye on things regularly. You can request a human contact at any time by writing "human" (German: "Mensch") or "support" in the chat, or by writing to us at support@vestamedia.app.

10. Security measures (TOMs)

We take appropriate technical and organizational measures pursuant to Art. 32 GDPR, in particular:

• Transport encryption via TLS for every data transfer
• Column encryption of sensitive content in the database (PostgreSQL pgcrypto)
• Password hashing with bcrypt
• Protection against brute-force attacks by automatic lockout after failed sign-in attempts
• Strict separation of customer data
• Logging of administrative access (audit log)
• Regular backups with encrypted storage

11. Rights of the data subject

You have the following rights at any time:

• Access to the data stored about you (Art. 15 GDPR)
• Rectification of inaccurate data (Art. 16 GDPR)
• Erasure of your data, unless a statutory retention obligation applies (Art. 17 GDPR)
• Restriction of processing (Art. 18 GDPR)
• Data portability in a structured format (Art. 20 GDPR). You can download your data as a JSON file in your account yourself at any time.
• Objection to processing (Art. 21 GDPR)
• Withdrawal of consent with effect for the future (Art. 7(3) GDPR)
• Complaint to a data protection supervisory authority (Art. 77 GDPR). The authority responsible is the one for your usual place of residence; for our registered office in North Rhine-Westphalia this is the State Commissioner for Data Protection and Freedom of Information North Rhine-Westphalia (LDI NRW), Kavalleriestraße 2–4, 40213 Düsseldorf, Germany.

To exercise your rights, an informal message to datenschutz@vestamedia.app is sufficient. You can also request the deletion of your data in your account; a person on our team reviews the request and completes it within 30 days. We respond within the statutory period of one month.

12. Changes to this privacy policy

We reserve the right to adapt this privacy policy if legal or technical conditions change or if we introduce new processing operations or processors. We announce significant changes by email or in the chat. The current version is always available on this page.