Privacy Policy

1. Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) for the processing of data on this website and in the Advinq application is:

CorpCon Solutions GmbH
Steinhofweg 98 · 69123 Heidelberg · Germany
Represented by the managing director Maximilian Kallenbach
E-mail: support@advinq.app · Phone: +49 6221 3214970

Advinq is a product of CorpCon Solutions GmbH. No data protection officer has been appointed.

2. Legal bases of processing

We process personal data only on the basis of the statutory provisions. Depending on the processing, we rely on:

• Art. 6(1)(a) GDPR – your consent, for example when you submit the contact form.
• Art. 6(1)(b) GDPR – performance of a contract or pre-contractual measures, for example when you use Advinq or request a demo.
• Art. 6(1)(c) GDPR – compliance with legal obligations, for example retention periods under commercial and tax law.
• Art. 6(1)(f) GDPR – our legitimate interest in the secure and uninterrupted operation of the website and the application.

3. Visiting this website

Hosting

This website is hosted by IONOS SE, Elgendorfer Straße 57, 56410 Montabaur, Germany. The server location is Frankfurt am Main, Germany. IONOS processes the data as our processor (Art. 28 GDPR).

Server log files

When you visit this website, the hosting provider automatically stores information transmitted by your browser in server log files: the page accessed and the time of access, the amount of data transferred and a notice of successful retrieval, the browser type and version, the operating system, the previously visited page if transmitted, and your IP address. We do not combine this data with other data sources. The processing is based on Art. 6(1)(f) GDPR – we have a legitimate interest in the technically error-free presentation and the security of our website.

Fonts and video

This website uses the fonts Fraunces, Inter and Inter Tight. The font files and the product video are delivered from our own server. No connection to third-party servers is established and your IP address is not transmitted to third parties.

No cookies, no analytics

This website does not set cookies and does not use analytics, marketing or tracking services such as Google Analytics or the Meta Pixel. No usage profiles are created and no third-party content, such as YouTube videos or maps, is embedded. A consent banner is therefore not required. Should such services be used in the future, this will only happen with your prior consent pursuant to Section 25(1) TDDDG in conjunction with Art. 6(1)(a) GDPR; this policy will then be supplemented.

4. Contacting us and contact form

If you request a demo or a quote by e-mail, phone or via the contact form, we process the information you provide: name, company, e-mail address, phone number if given, and your selections in the form (request, company size, most important channel, preferred date).

The processing is based on your consent pursuant to Art. 6(1)(a) GDPR and – if your request is aimed at concluding a contract – on Art. 6(1)(b) GDPR. The form can only be submitted with your explicit consent (checkbox). You can withdraw your consent at any time with effect for the future, for example by e-mail to support@advinq.app; the lawfulness of the processing carried out until the withdrawal remains unaffected. For requests by e-mail or phone that are not aimed at a contract, we rely on Art. 6(1)(f) GDPR; our legitimate interest is answering your request. We need the information marked as mandatory to process your request; without it the form cannot be submitted.

The contact form transmits your information via our server at IONOS in two ways: by e-mail to our mailbox kontakt@corpconsolutions.de, which is hosted by IONOS in Germany, and via an encrypted, signed connection (HTTPS) to our own administration system. That system runs at Hetzner Online GmbH in Nuremberg, Germany; your request is stored there and a task to process it is created. No external form service is used. To ward off automated submissions, the form technically checks whether it was filled in by a human – without cookies and without third-party services. Your data is not passed on to third parties unless this is necessary to process your request or we are legally obliged to do so.

5. Using the Advinq application

Advinq is an application for businesses in which an AI-supported marketing team plans, creates and – after approval by the customer – publishes content. The application and its database run on servers of IONOS SE in Frankfurt am Main, Germany, where your data is stored. Backups are stored at Hetzner Online GmbH in Nuremberg, Germany.

What data we process

• Account data: name, business e-mail address, company, role and login data, plus the key of your two-factor login (encrypted) and your recovery codes (only as a check value, not in plain text).
• Billing data: billing address, VAT ID and payments received.
• Content: information from your company profile (in Advinq “Fundament”, e.g. offers, target groups, tone of voice), templates, images, videos, campaigns, calendar and approvals, as well as your conversations with the marketing coach in Advinq.
• Connected channels: access tokens and identifiers of the accounts you connect (see section 6).
• Newsletter recipients and contacts: contact data you store yourself for your newsletters, and names and contact data of contact persons you record in Advinq.
• Usage and log data: login times, IP address (e.g. to protect against too many login attempts), actions in the application, technical error logs.

If your company invites you as a user, we receive your name and e-mail address from your company.

If you connect your own WordPress website, Advinq transmits approved posts to that website. On request, Advinq sends e-mails via a mail server specified by you. For licence checks, Advinq transmits an installation identifier, the product identifier and the version number to our own licence server; this contains no personal data.

Purpose and legal basis

We process this data to provide the application and to perform the contract with your company, and for secure operation, for example to detect misuse (Art. 6(1)(f) GDPR). The legal basis is Art. 6(1)(b) GDPR where you yourself are our contractual partner. Otherwise – for example if you act as an employee or invited user of a customer – the legal basis is Art. 6(1)(f) GDPR; our legitimate interest is to provide the functions of Advinq commissioned by your company.

Role as processor

Where you process personal data of third parties in Advinq – for example newsletter recipients, persons in your posts or persons in videos you upload – you are responsible for it and we process this data on your behalf. For this we conclude a data processing agreement with you pursuant to Art. 28 GDPR.

Obligation to provide data, no automated decisions

To use Advinq we need the account data; without it we cannot set up an account. All other information is voluntary. No automated decision-making within the meaning of Art. 22 GDPR that produces legal effects concerning you takes place; AI suggestions are only used after your approval.

Logging in to the application

Logging in requires, for all accounts, a code from an authenticator app in addition to the password (two-factor login); for emergencies you receive single-use recovery codes. For the login, Advinq stores a technically necessary session identifier in your browser (Section 25(2) no. 2 TDDDG). A session ends when you log out, at the latest after twelve hours. If you select “Remember device” when logging in, Advinq additionally stores an identifier for 30 days so that no code is requested on this device; it becomes invalid when you change your password or your second factor is reset. We do not use analytics or advertising cookies.

Separate areas

Each company works in its own area, separated from other customers. Only what you have approved is published.

6. Connecting Facebook and Instagram

In Advinq you can connect your Facebook Page and the Instagram account linked to it so that Advinq publishes the posts you have approved there – immediately or at the scheduled time – and shows you the results. The connection is made by logging in with Facebook (“Connect Facebook & Instagram”); in the login dialog you choose yourself which Page Advinq may use. In doing so, we receive the following data from Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland (“Meta”) via its interface (Graph API):

• the access tokens for your Facebook account and for the selected Page,
• ID, name and profile picture of the Page, and ID, username and profile picture of the Instagram account linked to the Page,
• the permissions you have granted and their validity,
• statistics of your Page, your Instagram account and the posts published via Advinq, such as reach, views, interactions and the number of followers.

We do not receive the content of private messages, the text of comments or data about your followers.

Purpose and legal basis

We use this data exclusively to publish your approved posts on your behalf and to show you in Advinq the publication status including a link to the post, as well as the statistics. As in section 5, the legal basis is Art. 6(1)(b) GDPR where you yourself are our contractual partner. Otherwise – for example if you act as an employee or invited user of a customer – the legal basis is Art. 6(1)(f) GDPR; our legitimate interest is to provide the functions of Advinq commissioned by your company. We do not transfer data from Facebook and Instagram to AI services, do not pass it on to third parties and do not use it for advertising.

Storage

We store the access tokens encrypted on our servers in Germany (see section 5) and do not write them to logs. Advinq checks the connection once a day. We keep statistics of your Page and your Instagram account for at most 90 days, and statistics of a post for at most 90 days after its publication; after that they are deleted automatically.

Existing connections via our publishing component

If you connected your accounts before the direct connection was available, the connection and publishing continue to run via a component on our own server in Germany, where the access token is also stored. Advinq does not retrieve statistics via this route. Otherwise this section applies accordingly.

Disconnecting and deletion

• In Advinq under “Facebook & Instagram” → “Disconnect”: Advinq then immediately deletes the access tokens, the Page and account data and the retrieved statistics, and revokes the permission at Meta. The posts you created in Advinq remain in your Advinq account. Connections via our publishing component are disconnected under “Connections”.
• In Facebook under “Settings & privacy → Settings → Apps and websites” (for business apps under “Business integrations”), remove the Advinq app; the labels may differ depending on the Facebook version. Meta informs us of this, and we automatically delete the data from the direct connection.
• Via the request to delete your data on Facebook: you receive a confirmation code and a link where you can see the status of the deletion.

Further ways to have your data deleted by us are described under Data deletion. Meta is independently responsible for the processing on the platforms themselves; see the Meta Privacy Policy.

7. Use of AI services

To create texts, images, videos and voice recordings, Advinq transfers the necessary content – for example your instructions, your questions to the marketing coach, details from your company profile and draft texts – to AI services of specialised providers (see sections 9 and 10). Before the transfer, Advinq automatically replaces recognisable e-mail addresses, phone numbers, IBANs, dates, street addresses and postcodes in the texts with placeholders; person names are additionally detected by recognition software running on our own server. Reference images, such as your logo or a photo, are transferred unchanged. Complete removal of personal data cannot be technically guaranteed; therefore only enter personal data in your company profile that is necessary for your content.

Posts created with AI are labelled as AI-generated in the description text.

Automatic video editing. If you upload your own video and have clips cut from it, Advinq transfers the audio track to ElevenLabs to convert spoken content into text with timestamps (transcription), and frames or a reduced version of the video together with the transcript to Google (Gemini) to select suitable scenes. Voices and images of persons who can be seen or heard in the video are processed as well. Replacing data with placeholders as described in paragraph 1 is technically not possible for audio and images. Cutting, subtitles and the finished video are produced by Advinq on our own servers in Germany. We delete uploaded videos and intermediate results 30 days after upload; approved clips together with your other content (section 11). Persons are not recognised or identified by their face or voice.

8. Sending e-mails from the application

We send system e-mails from Advinq, such as invitations and confirmation links, via the e-mail service Brevo (based in the EU). Newsletters and mass e-mails that you send to your recipients with Advinq are sent via the route set up for your company: Brevo or a mail server specified by you. This involves processing the recipient address, the recipient's name and the content of the e-mail; Brevo also reports delivery errors and unsubscriptions to us so that we no longer write to these addresses. Newsletters are only sent to recipients with confirmed consent (double opt-in).

9. Recipients and processors

Only persons and bodies that need your data to fulfil the purposes mentioned have access to it. Service providers who process personal data on our behalf do so on the basis of a data processing agreement pursuant to Art. 28 GDPR or the data processing terms of the respective provider. We use the following service providers:

Provider	Purpose	Location
IONOS SE, Montabaur	Hosting of website and application, database, e-mail mailbox	Germany (Frankfurt am Main)
Hetzner Online GmbH, Gunzenhausen	Backups; administration system that receives contact requests	Germany (Nuremberg)
Brevo	Sending e-mails	EU
Anthropic	Creating and reviewing texts	USA
Google (Gemini, Veo)	Creating images and videos, on request texts; scene selection in video editing	USA
ElevenLabs	Voice recordings for videos; transcription in video editing	USA

When publishing on Facebook and Instagram, Meta is not a processor but an independent controller (see section 6).

10. Transfers to third countries

We store your data in Germany. For the AI-based creation of texts, images, videos and voice recordings we use providers based in the USA. The content required for the respective function is transferred to the USA:

Provider	Based in	Purpose and data transferred
Anthropic	USA	Creating and reviewing texts. Transferred are your instructions, your conversations with the marketing coach, details from your company profile and draft texts, together with a pseudonymous identifier of your company.
Google (Gemini)	USA	Creating images, on request also texts. Transferred are image descriptions and, if you select one, a reference image such as your logo or a photo.
Google (Veo)	USA	Creating short videos. Transferred are the script and the texts of the video.
ElevenLabs	USA	Voice recordings for videos. Transferred is the spoken text.
Google (Gemini)	USA	Scene selection in automatic video editing. Transferred are frames or a reduced version of your video and the transcript, including persons recognisable in them.
ElevenLabs	USA	Transcription in automatic video editing. Transferred is the audio track of your video, including the voices in it.

For the USA there is the European Commission's adequacy decision on the EU-US Data Privacy Framework. Where a provider is certified under it, the transfer is based on that decision (Art. 45 GDPR); otherwise on the EU standard contractual clauses (Art. 46(2)(c) GDPR). The processing itself is governed by section 5: Art. 6(1)(b) GDPR where you yourself are our contractual partner. Otherwise – for example if you act as an employee or invited user of a customer – the legal basis is Art. 6(1)(f) GDPR; our legitimate interest is to provide the functions of Advinq commissioned by your company. On request we will provide you with a copy of the appropriate safeguards.

By default Advinq creates texts with Anthropic; images, videos, voice recordings and automatic video editing are only transferred if you use these functions. Whether and for how long the providers store transferred content depends on their contractual terms. This website itself does not transfer any data to third countries.

11. Retention

We process personal data only for as long as is necessary for the respective purpose.

• Website: our hosting provider keeps server log files only as long as necessary for secure operation.
• Requests: we store requests via the contact form or by e-mail – in the mailbox and in our administration system – for as long as necessary to process them and for any resulting business relationship; we then delete them unless statutory retention obligations apply.
• Application: after the end of the contract you can still read and export your content for 30 days (after extraordinary termination export only); access is then blocked for 60 days, after which we delete account data and content unless statutory retention obligations apply. We keep backups and technical logs for as long as necessary for secure operation and recovery; the data is removed there as the backups expire in the regular cycle.
• Retention obligations: the statutory retention periods under commercial and tax law (Section 257 HGB, Section 147 AO; six, eight or ten years depending on the document) remain unaffected.

12. Your rights

With regard to the personal data concerning you, you have the following rights against us:

• Access – Art. 15: you can request information on whether and which data we process about you.
• Rectification – Art. 16: you can request the correction of inaccurate data or the completion of your data.
• Erasure – Art. 17: you can request the deletion of your data unless retention obligations apply (see Data deletion).
• Restriction – Art. 18: you can request the restriction of the processing of your data.
• Data portability – Art. 20: you can receive your data in a structured, commonly used and machine-readable format.
• Withdrawal – Art. 7(3): you can withdraw consent at any time with effect for the future.

Right to object

Right to object pursuant to Art. 21 GDPR: where we process data on the basis of Art. 6(1)(f) GDPR, you can object at any time on grounds relating to your particular situation. We will then no longer process your data unless we can demonstrate compelling legitimate grounds that override your interests, or the processing serves the establishment, exercise or defence of legal claims.

To exercise your rights, an informal message to support@advinq.app is sufficient.

13. Right to lodge a complaint with a supervisory authority

Without prejudice to any other remedy, you have the right to lodge a complaint with a data protection supervisory authority, in particular in the member state of your habitual residence, place of work or place of the alleged infringement. The authority responsible for our registered office is:

Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg (State Commissioner for Data Protection and Freedom of Information Baden-Württemberg)
Lautenschlagerstraße 20 · 70173 Stuttgart · Germany
www.baden-wuerttemberg.datenschutz.de

14. Data security

The website and the application use TLS encryption. Logging in to Advinq is protected by a second factor for all accounts. You can recognise an encrypted connection by the address bar of your browser beginning with “https://”. In addition, we take appropriate technical and organisational measures pursuant to Art. 32 GDPR to protect your data against loss, destruction, manipulation and unauthorised access, and adapt them to technical developments.

15. Changes to this policy

We adapt this privacy policy as soon as changes to the website, the application or the underlying legal situation make this necessary. The version published here applies. In case of doubt, the German version prevails.

Last updated: November 2026