Privacy Policy

1. Data Controller

The party responsible for data processing is OM Power Up Business LLC, Albuquerque, USA. Within the EU, Trafevo is operated by Goolux GmbH, Rathenow, Germany, which also acts as the representative pursuant to Art. 27 GDPR.
Contact: info@trafevo.com or info@goolux24.com

2. Account and Sign-in

To use Trafevo we create an account. We process your email address and a password you set. The purpose is to provide and secure your access.
Legal basis: Art. 6(1)(b) GDPR (performance of a contract).
Provider: Supabase (database hosting and authentication, EU/Frankfurt region). For sign-in we use a strictly necessary session cookie, which does not require consent.

3. Purchase and Subscription

Purchase and billing are handled via Digistore24. We receive the information required to create your account and manage your subscription (e.g. email address, order and plan data). The payment processing itself takes place at Digistore24.
Legal basis: Art. 6(1)(b) GDPR.
Provider: Digistore24 GmbH, Germany. Please also note the privacy information of Digistore24.

4. Connecting Pinterest

When you connect your Pinterest account, we store the required access tokens in encrypted form so we can create and publish pins on your behalf. Only content you have approved beforehand is published.
Legal basis: Art. 6(1)(b) GDPR.
Provider: Pinterest (USA).

5. AI-Generated Text

To create pin titles and descriptions, the information you provide (e.g. target URL, offer description) is transmitted to an AI service.
Legal basis: Art. 6(1)(b) GDPR.
Provider: OpenAI (USA). According to the provider, data submitted via the API is not used to train the models. The transfer is based on the EU Standard Contractual Clauses.

6. Images and Media

Images you upload or generate are stored so they are available for your pins.
Legal basis: Art. 6(1)(b) GDPR.
Provider: Cloudflare R2 (object storage).

7. Transactional Emails

We send functional emails, for example for account activation and password resets.
Legal basis: Art. 6(1)(b) GDPR.
Provider: Resend (USA).

8. Hosting and Server Logs

When our pages are accessed, technically necessary data such as IP address, browser type and access time are processed to ensure operation and security.
Legal basis: Art. 6(1)(f) GDPR (legitimate interest in secure operation).
Provider: Vercel (USA).

9. Cookies

We currently use only strictly necessary cookies (a session cookie for sign-in). We do not use analytics or marketing cookies.

10. Recipients and Processors

- Supabase: database and authentication (EU)
- Digistore24: purchase and payment processing (Germany)
- Pinterest: connection and publishing (USA)
- OpenAI: AI text generation (USA)
- Cloudflare: image storage (USA/EU)
- Resend: email delivery (USA)
- Vercel: hosting (USA)
We do not sell your personal data.

11. International Data Transfers

Where data is transferred to providers outside the EEA, this is done on the basis of the EU Standard Contractual Clauses or equivalent safeguards.

12. Retention Period

We store your data for as long as your account or subscription is active. After cancellation we delete the data after a reasonable period, unless statutory retention obligations (e.g. tax and commercial law) apply.

13. Your Rights

You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection (Art. 21). You also have the right to lodge a complaint with a data protection supervisory authority.
To exercise your rights, a message to info@trafevo.com or info@goolux24.com is sufficient.

14. Data Security

We use encrypted connections (TLS), encrypt sensitive access data and restrict access through technical and organisational measures.

15. Changes to this Policy

We may update this privacy policy. The current version is always available on this page.