Privacy Policy

1. Controller

The controller responsible for data processing on this website and in the Octara platform within the meaning of the EU General Data Protection Regulation (GDPR) and the German Federal Data Protection Act (BDSG) is:

2. What data we collect

We process the following categories of personal data:

• Account data: name, email address, and password (stored as a hash via Supabase Auth). If you sign in with Google, we receive your name and email address from Google.
• Profile data: user type, role, and onboarding answers you provide
• Project and content data: the websites, keywords, competitors, brand information and content you add to Octara, and the results we generate from them
• Connected-account data: if you connect Google Search Console or Google Ads, we store the access tokens you authorise and retrieve the performance data of the properties you select. If you connect a WordPress site, we store the credentials you provide in encrypted form.
• Billing data: plan, billing address, VAT ID and payment status. Card and bank details are handled exclusively by our payment provider Stripe and are never stored on our systems.
• Usage and measurement data: pages visited, campaign parameters, features used and actions such as sign-up or purchase — cookieless for all visitors, and with cookies, Hotjar and the OpenAI pixel only with your consent (see section 4)
• Technical data: IP address, browser type, device type, operating system and request time, which are processed in server logs when you access the platform
• Communication data: messages you send us by email or through the in-app feedback form (including your account ID and the page you were on)

Octara is intended for business customers. Providing the account, project and billing data is necessary to conclude and perform the contract; without it we cannot provide the Service.

3. Purposes and legal bases

• Providing the platform, account management, billing and support — Art. 6(1)(b) GDPR (performance of a contract or pre-contractual steps).
• Transactional emails (e.g. welcome email, crawl reports, payment notices, weekly digest) — Art. 6(1)(b) GDPR where they are part of the Service, otherwise Art. 6(1)(f) GDPR (our legitimate interest in keeping you informed about your account).
• Marketing emails (product news, tips and offers) — only if you opted in, Art. 6(1)(a) GDPR and § 7 (2) UWG (your consent). We use a double opt-in: you confirm via a link we email you. We store the time of your request and confirmation and the wording you agreed to, to be able to prove your consent. You can withdraw at any time with effect for the future — via the unsubscribe link in every marketing email or in your account settings.
• Security, abuse prevention, error monitoring, server logs and handling feedback — Art. 6(1)(f) GDPR (our legitimate interest in a secure and stable service).
• Measuring the use of our website and the success of our ads — cookieless measurement via Google Consent Mode: Art. 6(1)(f) GDPR (our legitimate interest); Google Analytics cookies, Hotjar, the OpenAI conversion pixel and Google's advertising use: Art. 6(1)(a) GDPR and § 25 (1) TDDDG (your consent). See section 4.
• Compliance with tax and commercial-law obligations (e.g. invoices, bookkeeping) — Art. 6(1)(c) GDPR in conjunction with § 147 AO and § 257 HGB.

4. Cookies, local storage and measurement

Strictly necessary. We use cookies that are technically required to provide the platform you request — in particular the session cookies that keep you signed in and a cookie that remembers your active project — and we store your cookie choice in your browser's local storage (octara_cookie_consent, until you clear it). These do not require consent (§ 25 (2) No. 2 TDDDG).

4.1 Google Tag Manager and Google Consent Mode (all visitors)

On every visit we load Google Tag Manager, a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”), which we use to manage the measurement tools described in this section. Google Tag Manager itself does not set cookies. We use Google Consent Mode v2: until you accept in our cookie banner — and if you reject — all consent signals (analytics_storage, ad_storage, ad_user_data, ad_personalization) are set to “denied”. In that state:

• Google Analytics sets and reads no cookies, but sends cookieless measurement pings to Google. They contain the page address (including campaign parameters such as utm_source), the referring page, the time, the consent status and technical information about your browser and device (e.g. language, screen resolution, operating system). Your IP address is transmitted for technical reasons; according to Google, Google Analytics uses it only to derive an approximate location and does not store it. Google uses these pings to create aggregated and modelled statistics; they are not used to build a profile of you.
• Ad click identifiers are removed from requests to Google (ads data redaction). If you arrived via an ad, the click information may instead be carried in the URL from page to page on our website (URL passthrough), so that it can be taken into account if you consent later.
• Hotjar and the OpenAI pixel (see 4.2) are not loaded.

Google processes this data on our behalf under a data processing agreement (Art. 28 GDPR). Legal basis: Art. 6(1)(f) GDPR — our legitimate interest in measuring the reach and use of our website and the success of our campaigns without cookies or identifiers stored on your device. You can object to this processing at any time (Art. 21 GDPR, see section 8), e.g. by email to us; you can also prevent it with a browser setting or content blocker that blocks googletagmanager.com.

4.2 Analytics and advertising measurement — only with your consent

If you click “Accept all”, the consent signals are set to “granted” and we additionally use:

• Google Analytics 4 with cookies (Google, address above): to recognise returning visitors and understand how our website and platform are used, including events such as sign-up, completed onboarding, trial start and purchase (with plan, value and currency). Google acts as our processor. Because you also grant the advertising signals, Google may use this data in its own responsibility for ad measurement and personalisation; see Google's privacy policy. Data may be transferred to Google LLC, USA, which is certified under the EU–US Data Privacy Framework.
• Hotjar (Hotjar Ltd., Malta, part of the Contentsquare group): to analyse how visitors use our pages through heatmaps and session recordings (e.g. mouse movements, clicks, scrolling, the pages viewed, device and browser information and a shortened IP address). Hotjar acts as our processor.
• OpenAI conversion measurement for ChatGPT ads (OpenAI Ireland Limited, 1st Floor, The Liffey Trust Centre, 117–126 Sheriff Street Upper, Dublin 1, D01 YC43, Ireland): we advertise in ChatGPT and use OpenAI's measurement pixel to find out whether these ads lead to sign-ups, trial starts and purchases. The pixel sends OpenAI the event type (and for purchases the value and currency), the page address, a browser identifier, the ad click identifier if you arrived via a ChatGPT ad, browser and device information and your IP address. OpenAI uses this to attribute conversions to ads and to report aggregated results to us. We and OpenAI are jointly responsible for collecting this data on our website and transmitting it to OpenAI (Art. 26 GDPR); OpenAI is solely responsible for its further processing, see OpenAI's privacy policy. Data may be transferred to OpenAI OpCo, LLC, USA (see section 6).

These tools store the following on your device:

• _ga, _ga_<ID> — Google Analytics, distinguishes visitors and sessions, up to 2 years
• _cs_id, _cs_c — Hotjar/Contentsquare, visitor identifier and consent status, 13 months; _cs_s — session, 30 minutes
• __obref — OpenAI pixel, browser identifier, 1 year; __oppref — ad click identifier, only if you arrived via a ChatGPT ad; oaiq_cs:<ID> (session storage) — until you close the tab

Legal basis: your consent under Art. 6(1)(a) GDPR and § 25 (1) TDDDG. Consent is voluntary; rejecting has no effect on your use of Octara. You can withdraw or change it at any time with effect for the future — as easily as you gave it — via the button below, the “Cookie settings” link in the footer or your account settings. When you withdraw, we delete the cookies listed above from your browser. Withdrawing consent does not affect the lawfulness of processing before withdrawal.

Change cookie settings

5. Recipients and service providers

We use the following service providers, who process personal data on our behalf under data processing agreements (Art. 28 GDPR) or as independent controllers where indicated:

• Supabase (database, authentication, file storage) — AWS EU infrastructure
• Vercel Inc. (hosting and deployment; processes IP addresses and request data in server logs) — servers in the EU/USA
• Stripe Payments Europe Ltd., Ireland, and Stripe, Inc., USA (payment processing, invoicing and tax calculation; Stripe acts as an independent controller for payment-fraud and regulatory purposes)
• Resend (transactional email delivery, contact list and marketing email delivery, unsubscribe management) — USA, processes email addresses, names, subscription preferences and email content
• Anthropic and OpenAI (AI content and image generation, AI-visibility analysis) — USA, process the content and prompts you submit
• DataForSEO and Bright Data (search-result, keyword and AI-answer data) — process the keywords, domains and prompts of your projects
• Google (Search Console API, Google Ads API, PageSpeed Insights API, Google Sign-In) — used only for data and accounts you connect or requests you trigger
• Google Analytics, Hotjar and OpenAI (ChatGPT ads measurement) — see section 4 for their roles, the data involved and the legal basis
• Discord and comparable messaging tools (internal notification of in-app feedback and technical errors) — feedback you submit, including your account ID (not your email address) and the page you were on, is forwarded to an internal channel

When you view competitor results in the dashboard, your browser loads small website icons (favicons) from Google's favicon service, which transmits your IP address and the requested domain to Google. If you press play on the demo video on our homepage, the video is loaded from YouTube (privacy-enhanced mode, youtube-nocookie.com) and YouTube receives your IP address; the video is not loaded before you click.

We do not sell personal data.

6. Transfers to third countries

Some of the providers above are located in, or process data in, the USA. Where this is the case, the transfer is based on an adequacy decision of the European Commission (EU–US Data Privacy Framework, where the provider is certified) or on the EU Standard Contractual Clauses (Art. 46 GDPR), supplemented by additional safeguards where necessary. You can request a copy of the safeguards using the contact details in section 1.

7. Data retention

We retain your account and project data for as long as your account is active. If you delete your account, we delete your personal data within 30 days, unless we are required to retain it by law. Invoices and accounting records are retained for the periods required by German tax and commercial law (up to ten years, § 147 AO, § 257 HGB). Server logs are kept for a short period necessary for security and error analysis. Google Analytics data is retained according to our retention setting in Google Analytics (at most 14 months); Hotjar data according to our retention settings in Hotjar; OpenAI retains conversion data in accordance with its own policies. Cookies set by these tools expire as listed in section 4 or are deleted when you withdraw consent. Your cookie choice is stored in your browser until you clear it.

8. Your rights

Under the GDPR, you have the following rights:

• Right of access (Art. 15) — request a copy of your personal data
• Right to rectification (Art. 16) — correct inaccurate data
• Right to erasure (Art. 17) — request deletion of your data
• Right to restriction (Art. 18) — limit how we process your data
• Right to data portability (Art. 20) — receive your data in a structured, machine-readable format
• Right to withdraw consent (Art. 7(3)) — at any time, without affecting prior processing

Right to object (Art. 21 GDPR): You have the right to object at any time, on grounds relating to your particular situation, to processing of your personal data that is based on Art. 6(1)(f) GDPR (legitimate interests). We will then stop the processing unless we can demonstrate compelling legitimate grounds that override your interests, or the processing serves the establishment, exercise or defence of legal claims.

To exercise any of these rights, contact us at hello@mail.octara.app. You can also delete your account yourself in the account settings.

9. Right to lodge a complaint

You have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), in particular in the EU member state of your habitual residence, place of work or place of the alleged infringement. The supervisory authority responsible for us is:

10. Automated decision-making

We do not use automated decision-making, including profiling, that produces legal effects concerning you or similarly significantly affects you (Art. 22 GDPR). AI features of Octara generate suggestions that you review and apply yourself.

11. Changes to this policy

We may update this Privacy Policy from time to time, for example when we introduce new features or providers. We will notify you of significant changes by email or via a notice on the platform. The date at the top of this page indicates when the policy was last revised.

12. Contact

For any privacy-related questions, please contact us at hello@mail.octara.app.