DE Start free

Privacy policy

Last updated: 21 October 2026

This is an English translation for your convenience. The German version (Datenschutzerklärung) is legally binding.

This privacy policy explains the type, scope and purpose of the processing of personal data (hereinafter "data") in the course of providing our services and within our online offering and the websites, functions and content connected to it, as well as external online presences such as our social media profiles (hereinafter together "online offering"). It applies to the website www.99takes.com, to the application at run.99takes.com, to reports at read.99takes.com and to the use of 99takes in Claude. For the terms used, such as "processing" or "controller", we refer to the definitions in Art. 4 of the General Data Protection Regulation (GDPR).

Controller

Tappla UG (haftungsbeschränkt)
Dürerweg 31
88212 Ravensburg, Germany
Managing director: Robert Blessing
Email: [email protected]

Types of data processed

  • Master data (e.g. personal master data, names or addresses).
  • Contact data (e.g. email, telephone numbers).
  • Content data (e.g. text input, photographs, videos).
  • Usage data (e.g. websites visited, interest in content, access times).
  • Meta and communication data (e.g. device information, IP addresses).
  • Contract and payment data (e.g. plan, bookings, billing address).

Categories of data subjects

Visitors and users of the online offering, customers with an account, people invited to reports, and people whose public posts are quoted as evidence in research (hereinafter we also refer to the data subjects collectively as "users").

Purpose of processing

  • Providing the online offering, its functions and content.
  • Answering contact requests and communicating with users.
  • Security measures.
  • Reach measurement and, with consent, measurement of advertising.

Definitions

"Personal data" means any information relating to an identified or identifiable natural person (hereinafter "data subject"); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier (e.g. a cookie) or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.

"Processing" means any operation or set of operations performed on personal data, whether or not by automated means. The term is broad and covers practically any handling of data.

"Pseudonymisation" means the processing of personal data in such a manner that the personal data can no longer be attributed to a specific data subject without the use of additional information, provided that such additional information is kept separately and is subject to technical and organisational measures to ensure that the personal data are not attributed to an identified or identifiable natural person.

"Profiling" means any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to a natural person, in particular to analyse or predict aspects concerning that natural person's performance at work, economic situation, health, personal preferences, interests, reliability, behaviour, location or movements.

"Controller" means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data.

"Processor" means a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller.

Legal bases

In accordance with Art. 13 GDPR, we inform you of the legal bases of our data processing. For users within the scope of the GDPR, i.e. the EU and the EEA, the following applies unless the legal basis is stated in this privacy policy:

  • The legal basis for obtaining consent is Art. 6(1)(a) and Art. 7 GDPR;
  • The legal basis for processing to provide our services, carry out contractual measures and answer enquiries is Art. 6(1)(b) GDPR;
  • The legal basis for processing to comply with our legal obligations is Art. 6(1)(c) GDPR;
  • Where processing of personal data is necessary to protect the vital interests of the data subject or another natural person, Art. 6(1)(d) GDPR is the legal basis.
  • The legal basis for processing necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller is Art. 6(1)(e) GDPR.
  • The legal basis for processing to protect our legitimate interests is Art. 6(1)(f) GDPR.
  • Processing of data for purposes other than those for which they were collected is governed by Art. 6(4) GDPR.
  • Processing of special categories of data (pursuant to Art. 9(1) GDPR) is governed by Art. 9(2) GDPR.

Security measures

In accordance with the legal requirements, and taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of processing as well as the varying likelihood and severity of the risk to the rights and freedoms of natural persons, we take appropriate technical and organisational measures to ensure a level of protection appropriate to the risk.

These measures include in particular safeguarding the confidentiality, integrity and availability of data by controlling physical access to the data, as well as access to, input, transfer and separation of the data and securing their availability. The website is delivered encrypted (HTTPS). We have also set up procedures that ensure data subjects can exercise their rights, that data is deleted and that we respond to threats to the data. Furthermore, we take the protection of personal data into account when developing or selecting hardware, software and processes, in line with the principles of data protection by design and by default.

Cooperation with processors, joint controllers and third parties

If, in the course of our processing, we disclose data to other persons and companies (processors, joint controllers or third parties), transfer it to them or otherwise grant them access to the data, we do so only on the basis of a legal permission (e.g. if a transfer of data to third parties, such as payment service providers, is necessary to perform a contract), if users have consented, if a legal obligation requires it, or on the basis of our legitimate interests (e.g. when using agents, web hosts, etc.).

Transfers to third countries

If we process data in a third country (i.e. outside the European Union (EU), the European Economic Area (EEA) or the Swiss Confederation), or if this happens in the course of using third-party services or disclosing or transferring data to other persons or companies, this only takes place if it is necessary to fulfil our (pre-)contractual obligations, on the basis of your consent, due to a legal obligation or on the basis of our legitimate interests. Subject to express consent or a transfer required by contract, we process data, or have it processed, only in third countries with a recognised level of data protection, which according to the adequacy decision of the EU Commission of 10 July 2023 includes US companies certified under the EU-US Data Privacy Framework, or on the basis of special safeguards such as contractual obligations through the so-called standard contractual clauses of the EU Commission, certifications or binding corporate rules (Art. 44 to 49 GDPR, information page of the EU Commission).

Rights of data subjects

Right of access: You have the right to obtain confirmation as to whether data concerning you is being processed, and to access this data as well as further information and a copy of the data in accordance with the legal requirements.

Right to rectification: In accordance with the legal requirements, you have the right to request that data concerning you be completed or that incorrect data concerning you be corrected.

Right to erasure and restriction of processing: In accordance with the legal requirements, you have the right to request that data concerning you be erased without undue delay or, alternatively, that the processing of the data be restricted.

Right to data portability: You have the right to receive data concerning you that you have provided to us in a structured, commonly used and machine-readable format, or to request its transfer to another controller, in accordance with the legal requirements.

Complaint to a supervisory authority: In accordance with the legal requirements, you also have the right to lodge a complaint with a supervisory authority. The authority responsible for us is the State Commissioner for Data Protection and Freedom of Information of Baden-Württemberg (https://www.baden-wuerttemberg.datenschutz.de/).

Automated decisions: There is no automated decision-making, including profiling, within the meaning of Art. 22 GDPR.

Right to withdraw consent

You have the right to withdraw any consent you have given with effect for the future.

Right to object

Right to object: You have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data concerning you that is based on Art. 6(1)(e) or (f) GDPR; this also applies to profiling based on these provisions. If personal data concerning you is processed for direct marketing purposes, you have the right to object at any time to processing of personal data concerning you for such marketing; this also applies to profiling to the extent that it is related to such direct marketing.

Cookies and right to object to direct marketing

"Cookies" are small files stored on users' computers. Different information can be stored in cookies. A cookie primarily serves to store information about a user (or the device on which the cookie is stored) during or after their visit to an online offering. Temporary cookies, or "session cookies" or "transient cookies", are cookies that are deleted after a user leaves an online offering and closes their browser. Such a cookie may store, for example, the contents of a shopping cart in an online shop or a login status. "Permanent" or "persistent" cookies remain stored even after the browser is closed. For example, the login status can be saved if users visit again after several days. Such a cookie may also store users' interests used for reach measurement or marketing purposes. "Third-party cookies" are cookies offered by providers other than the controller operating the online offering (otherwise, if they are only the controller's cookies, they are called "first-party cookies").

We may use temporary and permanent cookies and explain this in this privacy policy.

If we ask users for consent to the use of cookies (e.g. as part of a cookie consent), the legal basis for this processing is Art. 6(1)(a) GDPR. Otherwise, users' personal cookies are processed as explained below in this privacy policy on the basis of our legitimate interests (i.e. interest in analysing, optimising and operating our online offering economically within the meaning of Art. 6(1)(f) GDPR) or, if the use of cookies is necessary to provide our contractual services, pursuant to Art. 6(1)(b) GDPR, or, if the use of cookies is necessary for the performance of a task carried out in the public interest or in the exercise of official authority, pursuant to Art. 6(1)(e) GDPR.

If users do not want cookies to be stored on their computer, they are asked to deactivate the corresponding option in their browser's system settings. Stored cookies can be deleted in the browser's system settings. Excluding cookies may limit the functionality of this online offering.

A general objection to the use of cookies for online marketing purposes can be declared for many services, especially in the case of tracking, via the US site http://www.aboutads.info/choices/ or the EU site http://www.youronlinechoices.com/. Furthermore, the storage of cookies can be prevented by deactivating them in the browser settings. Please note that in this case not all functions of this online offering may be available.

Deletion of data

The data we process is deleted or its processing restricted in accordance with the legal requirements. Unless expressly stated in this privacy policy, the data stored by us is deleted as soon as it is no longer required for its intended purpose and no statutory retention obligations prevent deletion.

If the data is not deleted because it is required for other and legally permissible purposes, its processing is restricted. This means the data is blocked and not processed for other purposes. This applies, for example, to data that must be retained for commercial or tax reasons.

Changes and updates to this privacy policy

Please check the content of our privacy policy regularly. We adapt the privacy policy as soon as changes to our data processing make this necessary. We will inform you as soon as the changes require action on your part (e.g. consent) or other individual notification.

Services (studies and retainers)

We process our customers' data within the scope of our contractual services. These include studies with buyer research, building a target audience, simulations, reports and ongoing consulting.

In doing so, we process master data (e.g. customer master data such as names or addresses), contact data (e.g. email, telephone numbers), content data (e.g. text input, photographs, videos), contract data (e.g. subject matter, term), payment data (e.g. bank details, payment history), usage and metadata (e.g. in the evaluation and measurement of the success of marketing measures). We generally do not process special categories of personal data unless they are part of a commissioned processing. Data subjects include our customers, prospects and their customers, users, website visitors or employees, as well as third parties. The purpose of processing is the provision of contractual services, billing and our customer service. The legal bases of processing are Art. 6(1)(b) GDPR (contractual services) and Art. 6(1)(f) GDPR (analysis, statistics, optimisation, security measures). We process data that is necessary to establish and perform the contractual services and point out when providing it is necessary. Disclosure to external parties only takes place if it is necessary within the scope of an assignment. When processing data provided to us within the scope of an assignment, we act in accordance with the instructions of the client and the legal requirements for processing on behalf pursuant to Art. 28 GDPR and do not process the data for any purposes other than those of the assignment.

We delete the data after statutory warranty and comparable obligations have expired. The need to retain the data is reviewed every three years; in the case of statutory archiving obligations, deletion takes place after they expire (6 years pursuant to § 257(1) of the German Commercial Code (HGB), 10 years pursuant to § 147(1) of the German Fiscal Code (AO)). In the case of data disclosed to us by the client within the scope of an assignment, we delete the data in accordance with the assignment, generally after the assignment has ended.

Administration, financial accounting, office organisation, contact management

We process data in the course of administrative tasks and the organisation of our business, financial accounting and compliance with legal obligations such as archiving. In doing so, we process the same data that we process in the course of providing our contractual services. The legal bases are Art. 6(1)(c) GDPR and Art. 6(1)(f) GDPR. Data subjects are customers, prospects, business partners and website visitors. The purpose of and our interest in the processing lies in administration, financial accounting, office organisation and archiving of data, i.e. tasks that serve to maintain our business activities, perform our tasks and provide our services. The deletion of data with regard to contractual services and contractual communication corresponds to the information given for those processing activities.

In doing so, we disclose or transfer data to the tax authorities, advisers such as tax advisers or auditors, as well as other fee offices and payment service providers.

Furthermore, on the basis of our business interests, we store information about suppliers, organisers and other business partners, e.g. for the purpose of contacting them later. We generally store this data, which is mostly company-related, permanently.

Contacting us

When you contact us (e.g. via contact form, email, telephone or social media), the information provided by the user is processed to handle and respond to the contact request pursuant to Art. 6(1)(b) GDPR (within contractual or pre-contractual relationships) and Art. 6(1)(f) GDPR (other enquiries). Users' information may be stored in a customer relationship management system ("CRM system") or a comparable system for organising enquiries.

We delete enquiries once they are no longer required. We review this every two years; statutory archiving obligations also apply.

Hosting and delivery (Cloudflare)

The website is delivered via Cloudflare Pages and Cloudflare Workers of Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA. Cloudflare processes the data that technically arises when a page is accessed, such as IP address, date and time, the address requested, browser and operating system. Cloudflare also protects the website against attacks and obfuscates email addresses in the delivered code to protect them from automated harvesting. Cloudflare Email Routing forwards emails to addresses at 99takes.com to our mailbox.

The legal basis is our legitimate interest in providing the website securely and quickly (Art. 6(1)(f) GDPR). Cloudflare is certified under the EU-US Data Privacy Framework; standard contractual clauses also apply. Further information: https://www.cloudflare.com/privacypolicy/.

Protection against automated requests (Cloudflare Turnstile)

We protect some forms against automated sign-ups and abuse with Cloudflare Turnstile from Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA. On the website, these are the enquiry form (/de/start, step 4) and the Headline Analyzer; in the application at run.99takes.com, registration, sign-in, "Forgot password", resending the confirmation email and connecting to Claude. Your browser loads a script from challenges.cloudflare.com for this. It checks technical characteristics of your browser and connection, such as IP address and user agent. It does not read what you type into the form and does not set tracking cookies.

Cloudflare acts as our processor and also uses the data as a controller in its own right to improve its bot detection. Transfers to the USA are based on the EU-US Data Privacy Framework and the standard contractual clauses in the data processing agreement. The legal basis is our legitimate interest in protection against abuse (Art. 6(1)(f) GDPR). We load the script without consent because it is strictly necessary for the service you request (Section 25(2) No. 2 TDDDG, the German Telecommunications Digital Services Data Protection Act). Further information: https://www.cloudflare.com/turnstile-privacy-policy/.

Fonts

The website's fonts are hosted on our own server. No connection to Google Fonts or other font providers is established when the page loads.

Cookie settings (consent management)

On your first visit, we ask whether we may use analytics and marketing services. We store your choice in the cookie "cookie-consent-v2" for the domain 99takes.com and also in your browser's local storage. The cookie contains only your choice, a version number and the time; it expires after twelve months. We only load Google Tag Manager, and with it Google Analytics and Google Ads, on this website once you have consented under "Analytics" or "Marketing". Without consent, the website does not connect to Google. In addition, we pass your choice to Google Consent Mode so that Google services only use what you have allowed.

The legal basis for storing your choice is § 25(2) no. 2 of the German Telecommunications Digital Services Data Protection Act (TDDDG) and Art. 6(1)(c) GDPR in conjunction with Art. 7(1) GDPR (proof of consent). You can change or withdraw your choice at any time via "Cookie settings" at the bottom of every page.

Enquiry form

If you request a call via our enquiry form (at /de/start), we process your first name, your email address, optionally the address of your landing page and your answers to the questions in the form. We use this information to answer your enquiry (Art. 6(1)(b) GDPR). We need your first name and email address for this; without them we cannot reply. All other information is voluntary.

To notify us of a new enquiry, we send the information by email via the delivery service Resend (Plus Five Five, Inc., USA). Resend stores data in the USA and is certified under the EU-US Data Privacy Framework; a data processing agreement with standard contractual clauses is in place with Resend. In addition, the information may be passed to an automation service from Make (make.com, part of the Celonis group), which transfers the enquiry to our contact management. Further information: https://resend.com/legal/privacy-policy and https://www.make.com/en/privacy-notice.

Headline check

On the "Headline Analyzer" page, you can have a headline checked without signing in. For this, we send the headline you enter, an optional context and the selected language to the 99takes application. It runs on Supabase (Supabase Pte. Ltd., Singapore) in the Frankfurt am Main region (details under "The 99takes application"); the texts are evaluated by the language model Claude from Anthropic (Anthropic Ireland, Limited, Ireland) as a processor; data may be processed in the USA and in other countries outside the EU on the basis of the EU Commission's standard contractual clauses. Headline, context and result are stored in the 99takes database and deleted after 90 days. We hold your IP address in memory only briefly, to limit excessive requests within a short time; it is neither stored nor passed on to Supabase or Anthropic. Please do not enter personal data in this field.

The legal basis is your request, i.e. carrying out the check you asked for (Art. 6(1)(b) GDPR), and our legitimate interest in protecting the service against misuse (Art. 6(1)(f) GDPR).

The 99takes application (account and use in Claude)

The application at run.99takes.com, the reports at read.99takes.com and access from Claude run on Supabase (Supabase Pte. Ltd., Singapore). The database is located in the Frankfurt am Main region. For logs, operations and support, Supabase and its sub-processors may also process data in the USA and in Singapore. The data processing agreement is part of Supabase's terms of service; the transfer is based on the EU Commission's standard contractual clauses (Module 2, Decision (EU) 2021/914). We have configured the AI assistant in the Supabase dashboard so that it receives no data from our database.

Account and sign-in

For an account, we process your email address and your password (stored only as a hash), the time of confirmation and of your last sign-in, your credit balance and your bookings, voluntary answers to the questions after registration, and the time at which 99takes was first called from Claude. For API keys, we store only a hash; you see the key itself only once. If you connect 99takes via claude.ai, you sign in with us and allow Claude to access your account. The legal basis is the user agreement (Art. 6(1)(b) GDPR). We store the data for as long as the account exists. On request to [email protected], we delete the account; we retain booking and invoice data for as long as commercial and tax law require.

Testing, writing and research

When you use 99takes, we process the content that you, or Claude on your behalf, pass to 99takes: texts, addresses of web pages, your target audiences with their personas and evidence, and the results. Evaluation and writing are carried out by the language model Claude from Anthropic (Anthropic Ireland, Limited, Ireland) as a processor; data may be processed in the USA and in other countries outside the EU on the basis of the EU Commission's standard contractual clauses. Under its contractual terms, Anthropic does not use this content to train its models. What you write in Claude yourself is processed by Anthropic under your own agreement with Anthropic; 99takes only receives what Claude passes to 99takes.

If you provide a web address, 99takes retrieves the page and takes screenshots. For this, we use Firecrawl (SideGuide Technologies, Inc., USA) and Cloudflare Browser Rendering (Cloudflare, Inc., USA). Firecrawl processes the data in the USA. To research a target audience, 99takes uses Firecrawl to search public pages and posts, such as reviews, forum posts and comments, and takes short excerpts from them as evidence, together with their address. We only read pages whose robots.txt allows automated reading; platforms that prohibit it, such as Reddit and Trustpilot, are excluded. We do not store usernames. Screenshots are kept in non-public storage; you receive links that are valid for seven days.

The legal basis is the user agreement (Art. 6(1)(b) GDPR); for research in public sources, our legitimate interest and that of our users in evidence-based target audiences (Art. 6(1)(f) GDPR). We store content and results for as long as the account exists. Please do not pass on personal data of third parties that is not needed for the check.

If you wrote a public post from which an excerpt appears in 99takes and you do not want this, write to [email protected] with the address of the post. We will then delete the excerpt, including from the ready-made target audiences available to all accounts. This section also serves as the information under Art. 14 GDPR for people from whose public posts we take excerpts.

Your own conversations

From the Pro plan, you can upload your own conversations, such as interviews, support tickets or call notes. 99takes extracts quotes from them as evidence for your own target audiences. Before the text is evaluated, we replace email addresses, phone numbers, links, account, customer and ticket numbers and postal addresses with placeholders, and we remove sentences in which someone talks about health, religion, trade union membership, political party, sexuality or ethnic origin. The evaluation is carried out by the language model Claude from Anthropic (Anthropic Ireland, Limited, Ireland) as a processor; it names the quotes and the passages that would identify a person, company or place, and we replace those passages. We store only these pseudonymised quotes with their type and a general role of the speaker. We do not store the uploaded conversations, their file names or the replaced passages. According to Anthropic, it deletes inputs and outputs within 30 days, and keeps them for up to two years if they violate its usage policy. We use the quotes only for the target audiences of your account, never in ready-made target audiences and never word for word in reports. You can delete them at any time; they are deleted with your account. Pseudonymisation is automatic and may miss a passage.

Towards your conversation partners you are the controller, and we process the conversations on your behalf (data processing agreement at /de/avv, in German). Please upload only conversations you may use for this purpose: your conversation partners have been informed, recordings were made only with their consent, and the conversations contain no information in the special categories named above.

Reports

You can share a report via a link. Anyone with the link can see the report. You can revoke the link at any time. If you restrict a report to invited addresses, we store these addresses. An invited person receives a code by email that is valid for 15 minutes; after entering it, they stay signed in to this report for 30 days. We store the code and the sign-in only as a hash, and the sign-in additionally in the local storage of their browser. The legal basis is the user agreement with you (Art. 6(1)(b) GDPR) and, with regard to invited persons, our legitimate interest in showing the report only to them (Art. 6(1)(f) GDPR).

Emails

We send confirmation and password emails, codes for reports and notices about your account via Resend (Plus Five Five, Inc., USA) from the address [email protected], sending region Ireland. Click and open tracking are switched off. Resend is certified under the EU-US Data Privacy Framework.

While you are using your starter credits, for example once a large part of them has been used, we email you about how to get more credits. This is advertising for our own similar services to the address you provided when registering (§ 7(3) of the German Act Against Unfair Competition, UWG); the legal basis is our legitimate interest in informing our users (Art. 6(1)(f) GDPR). You can object to this at any time via the unsubscribe link in each of these emails or by email to [email protected], without incurring any costs other than the transmission costs at basic rates.

Payment and invoices

You pay for plans and credits via Mollie (Mollie B.V., Amsterdam, Netherlands). You enter your payment details directly with Mollie; we do not receive them. For invoices, we process your name or company, address, country and, where applicable, your VAT identification number or registration number. We check the VAT ID with the VAT Information Exchange System (VIES) of the European Commission. Mollie creates and sends invoices on our behalf. The legal basis is the contract (Art. 6(1)(b) GDPR) and our obligation to issue and retain invoices (Art. 6(1)(c) GDPR); retention is up to ten years pursuant to § 147 AO and § 257 HGB.

If we offer you credits for adding a card, we store the card identifier that Mollie gives us for this (not the card number). We keep this identifier even after your account has been deleted, so that the credit per card is granted only once (Art. 6(1)(f) GDPR).

Browser storage

The application stores your sign-in and your cookie choice in your browser's local storage. This is necessary for the use you requested (§ 25(2) no. 2 TDDDG).

Google Tag Manager

Google Tag Manager is a solution that lets us manage so-called website tags via an interface (and thus integrate, for example, Google Analytics and other Google marketing services into our online offering). The Tag Manager itself does not evaluate any usage data. When it loads, however, your browser technically transmits your IP address to Google (Google Ireland Limited). We therefore only load it with your consent under "Analytics" or "Marketing" (Art. 6(1)(a) GDPR, § 25(1) TDDDG). With regard to the processing of users' personal data, please refer to the following information on the Google services. Use policy: https://www.google.com/intl/en/tagmanager/use-policy.html.

Google Analytics

We use Google Analytics, a web analytics service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland ("Google"). Google uses cookies. The information generated by the cookie about users' use of the online offering is generally transmitted to a Google server in the USA and stored there.

Google uses this information on our behalf to evaluate users' use of our online offering, to compile reports on activities within this online offering and to provide us with further services related to the use of this online offering and the internet. Pseudonymous usage profiles of users may be created from the processed data.

We use Google Analytics 4. According to Google, Google Analytics 4 does not log or store IP addresses; the IP address is only used briefly to derive an approximate location (such as country or city) (https://support.google.com/analytics/answer/12017362).

The IP address transmitted by the user's browser is not merged with other Google data. Users can prevent cookies from being stored by adjusting their browser software accordingly; users can also prevent Google from collecting the data generated by the cookie and relating to their use of the online offering, and Google from processing this data, by downloading and installing the browser plugin available at the following link: http://tools.google.com/dlpage/gaoptout?hl=en.

Google Analytics is only loaded if you have consented under "Analytics" in the cookie settings (see "Cookie settings" above). The legal basis is your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG), which you can withdraw at any time via "Cookie settings".

This also applies to our application at run.99takes.com (registration, sign-in, account). There we use the same Google Tag Manager to measure whether a registration was completed and confirmed, a sign-in took place, the questions after registration were answered, an API key was created and 99takes was called from Claude for the first time. Names, email addresses and content are not sent to Google. We store your cookie choice in a cookie for the domain 99takes.com; it therefore applies on the website and in the application, and you can change it in both places via "Cookie settings". In the application, too, we only load Google Tag Manager once you have consented under "Analytics" or "Marketing".

Where data is processed in the USA, the transfer is based on Google LLC's certification under the EU-US Data Privacy Framework (https://www.dataprivacyframework.gov/).

Further information on Google's use of data and on setting and objection options can be found in Google's privacy policy (https://policies.google.com/privacy) and in the settings for the display of advertisements by Google (https://adssettings.google.com/authenticated).

Users' personal data is deleted or anonymised after 14 months.

Google Ads (conversion measurement)

If you consent under "Marketing" in the cookie settings, Google Ads conversion measurement (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland) may be loaded via Google Tag Manager. This lets us measure whether visitors who come via one of our ads, for example, create an account. Cookies are set and usage data is transmitted to Google, including to the USA (Google LLC is certified under the EU-US Data Privacy Framework). The legal basis is your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG), which you can withdraw at any time via "Cookie settings". Without this consent, no advertising cookies are set. Further information: https://policies.google.com/privacy.

Online presences on social media

We maintain online presences within social networks and platforms in order to communicate with customers, prospects and users active there and to inform them about our services.

Please note that users' data may be processed outside the European Union. This may result in risks for users, for example because it could make it more difficult to enforce users' rights. For US providers certified under the EU-US Data Privacy Framework, the EU Commission has determined an adequate level of data protection.

Furthermore, users' data is usually processed for market research and advertising purposes. For example, usage profiles can be created from users' usage behaviour and the resulting interests. The usage profiles can in turn be used, for example, to place advertisements inside and outside the platforms that presumably correspond to users' interests. For these purposes, cookies are usually stored on users' computers, in which the usage behaviour and interests of the users are stored. Furthermore, data can also be stored in the usage profiles independently of the devices used by the users (especially if the users are members of the respective platforms and are logged in to them).

Users' personal data is processed on the basis of our legitimate interests in informing and communicating with users effectively pursuant to Art. 6(1)(f) GDPR. If users are asked by the respective platform providers for consent to the data processing described above, the legal basis of the processing is Art. 6(1)(a) and Art. 7 GDPR.

For a detailed description of the respective processing and the options to object (opt-out), please refer to the providers' information linked below.

With regard to requests for information and the assertion of user rights, please note that these can be asserted most effectively with the providers. Only the providers have access to users' data and can take appropriate measures and provide information directly. If you nevertheless need help, you can contact us.