Privacy Policy

Last updated: 3 November 2026

This Privacy Policy applies to the use of the Briefkraft SaaS platform at briefkraft.co. Briefkraft is an AI-powered social media management service operated by Klejdi Meleqi.

1. Controller

2. Data Collected

We collect and process the following data:

• Account data: Name, email address, password (stored encrypted), company information
• Payment data: Processed directly by our payment provider Stripe. We do not store credit card numbers.
• Social media data: OAuth tokens, usernames, account IDs and metrics of connected platforms (Instagram, Twitter/X, LinkedIn, TikTok, YouTube)
• Usage data: Created posts, captions, generated images, scheduling information
• Technical data: IP address, browser type, access times (server logs)
• Referral data: If you arrive via an affiliate or partner link, a referral cookie (bk_ref) is stored for up to 90 days to attribute the referral correctly.
• Content and media: Texts, images, videos and audio files you upload or generate. These may contain personal data (e.g. faces, voices, names of people). For video repurposing, the audio track is processed for transcription.
• Third-party data from connected accounts: Comments and messages from followers (e.g. for Auto-Reply and analytics). You are the controller for these; we process them as processor under the DPA.
• Proof records: Time, IP address and browser identifier when you accept terms, give or withdraw consent, confirm an automation feature or cancel – so that the declaration can be proven.
• Fraud prevention data: A one-way hash (SHA-256) of your email address is stored to detect duplicate trial registrations. This hash cannot be reversed to recover your email address and is processed on the basis of our legitimate interest in preventing abuse (Art. 6(1)(f) GDPR).

3. Purpose of Data Processing

We process your data exclusively for:

• Providing and operating the Briefkraft platform
• Managing your user account and subscription
• Publishing content on your connected social media platforms
• AI-powered generation of captions and images
• Analysis and display of social media metrics
• Payment processing via Stripe
• Communication regarding your account (e.g. token expiry, payment issues)

4. Legal Basis

Processing is based on:

• Art. 6 Abs. 1 lit. b DSGVO — Performance of contract (provision of service)
• Art. 6 Abs. 1 lit. b DSGVO — also for connecting your social media accounts via OAuth, which you initiate to use the service
• Art. 6 Abs. 1 lit. a DSGVO — Consent (optional promotional emails)
• Art. 6 Abs. 1 lit. c DSGVO — legal obligations (tax retention, handling cancellations under § 312k BGB)
• Art. 6 Abs. 1 lit. f DSGVO — legitimate interests (security, abuse prevention, proof of declarations, product analytics, direct marketing to existing customers)

Providing your name, email address and password is required to conclude the contract; without them we cannot create an account. No automated decision-making including profiling within the meaning of Art. 22 GDPR takes place.

Note on approvals: where the following sections state that content is only published after your explicit approval, this includes automation features you have activated yourself (Auto-Post, Evergreen, automatic Shopify product posts, Auto-Reply). These are switched off by default and can be deactivated at any time.

4a. Promotional Emails and Objection

We only send promotional emails (tips, news, offers) if you consented at registration or later (Art. 6(1)(a) GDPR, § 7(2) UWG) or – as a paying customer – for our own similar services on the basis of § 7(3) UWG and Art. 6(1)(f) GDPR. You can withdraw consent or object to this use at any time via the unsubscribe link in every email or at kontakt@briefkraft.co, without incurring any costs other than transmission costs at basic rates. You will still receive contract-related emails (e.g. account confirmation, payment and security notices, end of trial).

5. TikTok Integration (Login Kit and Content Posting API)

Briefkraft uses the official TikTok API (provided by TikTok Pte. Ltd.). By connecting your TikTok account to Briefkraft, the following products and scopes are used:

• Login Kit (user.info.basic): Briefkraft uses Login Kit to authenticate TikTok users. When connecting your TikTok account in the Briefkraft dashboard, we receive your display name and Open ID to confirm the connection and display your account in the dashboard. Briefkraft does not gain access to your TikTok password.
• Content Posting API (video.publish): Briefkraft uses the Content Posting API to automatically publish approved video posts to your TikTok profile on your behalf at the scheduled time. Posts are only published after your explicit approval in the Briefkraft dashboard. No content is ever published without your prior consent.
• Video Upload (video.upload): Briefkraft uses the video upload scope to send video drafts to your TikTok inbox, which you can then review, edit, and publish directly from the TikTok app. This scope is used as an alternative posting method for creators who prefer to finalise posts in TikTok Studio.

The following TikTok user data is processed by Briefkraft:

• Public profile information (display name, Open ID) — used solely to confirm account connection and display the connected account in the dashboard
• OAuth access token and refresh token — stored encrypted in the Briefkraft database; used exclusively to publish content and manage the TikTok connection on your behalf

Data sharing: Briefkraft does not share, sell, or transfer your TikTok user data to any third party, except to TikTok's own APIs when performing actions you have explicitly requested (e.g. publishing a video). No other third party receives your TikTok user data.

Data protection: TikTok OAuth tokens are stored encrypted at rest in our PostgreSQL database. All communication between Briefkraft and the TikTok API is transmitted exclusively over HTTPS/TLS. Access to the database is restricted to authorised server processes only. Briefkraft does not store TikTok videos, captions entered on TikTok, private messages, or any non-public TikTok content.

Briefkraft's use of TikTok platform data complies with the TikTok Platform Terms of Service.

The TikTok connection can be disconnected at any time in the Briefkraft dashboard under Accounts. Upon disconnection, all stored TikTok tokens are immediately and irrevocably deleted from our systems.

6. YouTube Integration (YouTube Data API v3)

Briefkraft uses the official YouTube Data API v3 (provided by Google LLC). By connecting your YouTube account to Briefkraft, the following OAuth 2.0 scopes are requested:

• youtube (Manage your YouTube account): Briefkraft uses this scope to read your channel information (channel name, subscriber count) to confirm a successful connection, and to publish community posts on your behalf. Actions are only taken after your explicit approval in the Briefkraft dashboard.
• youtube.upload (Manage your YouTube videos): Briefkraft uses this scope to upload videos to your YouTube channel on your behalf. Videos are only published after your explicit approval in the Briefkraft dashboard.

The following YouTube/Google user data is processed by Briefkraft:

• Channel information (channel name, channel ID, subscriber count) — used solely to confirm account connection
• OAuth access token and refresh token — stored encrypted in the Briefkraft database; used exclusively to publish content on your behalf

Data sharing: Briefkraft does not share, sell, rent, or transfer your YouTube/Google user data to any third party. The only external system that receives your Google user data is Google's own YouTube Data API v3, and only when you explicitly request an action (e.g. uploading a video or reading channel information). No other third party, advertiser, or partner receives your Google user data under any circumstances.

Internal access: Access to stored Google/YouTube tokens and user data is restricted to automated server processes required to operate the service. No Briefkraft staff member accesses your Google user data except when necessary to resolve a support issue you have explicitly requested, and only with your consent.

Data protection: YouTube OAuth tokens are stored encrypted at rest in our PostgreSQL database hosted on Hetzner servers in Germany. All communication between Briefkraft and Google APIs is transmitted exclusively over HTTPS/TLS. The database server is access-controlled and not publicly reachable. Tokens are deleted immediately and irrevocably upon disconnection of your YouTube account.

AI/ML training: Briefkraft does not use Google user data — including any data obtained from Google APIs — to develop, improve, or train generalised artificial intelligence or machine learning models. Information received from Google APIs is used solely to provide the specific features the user requests (publishing videos, displaying channel info).

Briefkraft's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

The YouTube connection can be disconnected at any time in the Briefkraft dashboard under Accounts. Upon disconnection, all stored Google/YouTube tokens are immediately and irrevocably deleted.

7. Meta (Facebook & Instagram) Integration

Briefkraft uses the official Meta Graph API (provided by Meta Platforms, Inc.) to connect Facebook Pages and Instagram Business/Creator accounts. By connecting your Meta account to Briefkraft, the following OAuth 2.0 permissions are requested:

• instagram_business_basic: Briefkraft uses these permissions to read your Instagram account name, profile ID, and performance metrics (reach, impressions, engagement) to confirm a successful connection and display analytics in your dashboard.
• instagram_business_content_publish: Briefkraft uses this permission to publish photo, video, and carousel posts to your Instagram Business or Creator account on your behalf. Content is only published after your explicit approval in the Briefkraft dashboard.
• instagram_business_manage_insights: Briefkraft uses this permission to read insights (reach, views, interactions, follower development) for your Instagram account and your own posts, solely to display them in your Briefkraft analytics dashboard and to improve your future posts.
• pages_show_list / pages_read_engagement: Briefkraft uses these permissions to identify and display the Facebook Pages associated with your account and to read page engagement metrics for your analytics dashboard.
• pages_manage_posts: Briefkraft uses this permission to publish posts to your Facebook Page on your behalf. Posts are only published after your explicit approval in the Briefkraft dashboard.
• read_insights: Briefkraft uses this permission to read statistics for your Facebook Page and your own Page posts (views, unique views, profile views, new followers, clicks, interactions), solely to display them in your Briefkraft analytics dashboard and to improve your future posts.

The following Meta user data is processed by Briefkraft:

• Instagram account information (account name, Instagram User ID, follower count) — used solely to confirm account connection and display analytics
• Facebook Page information (Page name, Page ID) — used solely to confirm connection and enable publishing
• OAuth access token and refresh token — stored encrypted in the Briefkraft database; used exclusively to publish content and retrieve analytics on your behalf
• Post performance metrics (reach, impressions, likes, comments) — displayed in the Briefkraft analytics dashboard

Data sharing: Briefkraft does not share, sell, or transfer your Meta/Facebook/Instagram user data to any third party, except to Meta's own APIs when performing actions you have explicitly requested (e.g. publishing a post). No other third party receives your Meta user data.

Data protection: Meta OAuth tokens are stored encrypted at rest in our PostgreSQL database. All communication between Briefkraft and the Meta Graph API is transmitted exclusively over HTTPS/TLS. Access to the database is restricted to authorised server processes only. Tokens are deleted immediately and irrevocably upon disconnection.

Briefkraft's use of Meta platform data complies with the Meta Platform Terms and the Meta Developer Policies.

The Meta connection can be disconnected at any time in the Briefkraft dashboard under Accounts. Upon disconnection, all stored Meta/Facebook/Instagram tokens are immediately and irrevocably deleted.

If you remove Briefkraft in your Facebook or Instagram settings, Meta notifies us and we delete the stored token automatically. Instructions and the status of a deletion request: briefkraft.co/meta/data-deletion

7a. Threads Integration

Briefkraft uses the official Threads API (provided by Meta Platforms, Inc.) to connect Threads accounts. By connecting your Threads account to Briefkraft, the following OAuth 2.0 permissions are requested:

• threads_basic: Briefkraft uses this permission to read your Threads profile information (username, profile ID) to confirm a successful connection and display it in your dashboard.
• threads_content_publish: Briefkraft uses this permission to publish text and media posts to your Threads account on your behalf. Content is only published after your explicit approval in the Briefkraft dashboard.
• threads_manage_insights: Briefkraft uses this permission to read post performance metrics (views, likes, replies) for display in your analytics dashboard.

The following Threads user data is processed by Briefkraft:

• Profile information (username, Threads User ID) — used solely to confirm account connection and display in dashboard
• Post performance metrics (views, likes, replies) — displayed in the Briefkraft analytics dashboard
• OAuth access token and refresh token — stored encrypted in the Briefkraft database; used exclusively to publish content and retrieve analytics on your behalf

Data sharing: Briefkraft does not share, sell, or transfer your Threads user data to any third party, except to Meta's Threads API when performing actions you have explicitly requested (e.g. publishing a post). No other third party receives your Threads user data.

Data protection: Threads OAuth tokens are stored encrypted at rest in our PostgreSQL database. All communication between Briefkraft and the Threads API is transmitted exclusively over HTTPS/TLS. Access to the database is restricted to authorised server processes only. Tokens are deleted immediately and irrevocably upon disconnection.

Briefkraft's use of Threads platform data complies with the Meta Platform Terms.

The Threads connection can be disconnected at any time in the Briefkraft dashboard under Accounts. Upon disconnection, all stored Threads tokens are immediately and irrevocably deleted.

7b. LinkedIn Integration

Briefkraft uses the official LinkedIn API (provided by LinkedIn Corporation) to connect LinkedIn accounts. The connection runs through our LinkedIn application "Briefkraft Community" (LinkedIn Community Management API). By connecting your LinkedIn account to Briefkraft, the following OAuth 2.0 scopes are requested:

• r_basicprofile: your name, photo, headline and LinkedIn member ID — used to confirm the connection, show the account in your dashboard and set you as the author of the posts you approve.
• w_member_social: Briefkraft uses this scope to publish posts on your behalf to your LinkedIn profile. Content is only published after your explicit approval in the Briefkraft dashboard.
• r_member_postAnalytics: impressions, reactions, comments and reshares of your own posts, shown as aggregate numbers in your Insights dashboard.
• r_member_profileAnalytics: your follower count.

During the transition to this application, our older LinkedIn application "Briefkraft" may additionally request the scopes openid and profile (name, photo, member ID) to confirm the connection.

The following LinkedIn user data is processed by Briefkraft:

• Profile information (name, profile picture, headline, LinkedIn member ID) — used to confirm the account connection, display it in the dashboard and publish your approved posts as their author
• Post performance metrics (impressions, reactions, comments, shares) — displayed in the Briefkraft analytics dashboard
• OAuth access token and refresh token — stored encrypted in the Briefkraft database; used exclusively to publish content and retrieve analytics on your behalf

Retention: Performance figures are aggregate counts about your own posts; we store them as a time series so you can see trends. We never retrieve names, profiles or comments of other LinkedIn members, and we never read posts you did not publish through Briefkraft. OAuth tokens are deleted immediately when you disconnect LinkedIn. All stored LinkedIn analytics are deleted when you delete your Briefkraft account, or earlier on request to kontakt@briefkraft.co within 10 days.

Data sharing: Briefkraft does not share, sell, or transfer your LinkedIn user data to any third party, except to LinkedIn's own APIs when performing actions you have explicitly requested (e.g. publishing a post or retrieving analytics). No other third party receives your LinkedIn user data.

Data protection: LinkedIn OAuth tokens are stored encrypted at rest in our PostgreSQL database. All communication between Briefkraft and the LinkedIn API is transmitted exclusively over HTTPS/TLS. Access to the database is restricted to authorised server processes only. Briefkraft does not store LinkedIn private messages or any non-public LinkedIn content.

Briefkraft's use of LinkedIn platform data complies with the LinkedIn API Terms of Use and the LinkedIn Marketing API Program Terms.

The LinkedIn connection can be disconnected at any time in the Briefkraft dashboard under Accounts. Upon disconnection, all stored LinkedIn tokens are immediately and irrevocably deleted from our systems.

7c. API and AI assistants (MCP connector)

At your own request you can connect your Briefkraft account to an AI assistant (e.g. Claude by Anthropic, ChatGPT by OpenAI, Grok by xAI, Perplexity, Cursor) or your own program — via sign-in and explicit approval (OAuth) or via an API key. The connected service can then, on your behalf, read posts, schedule, analytics, your media library and your brand voice as well as the name, e-mail address and plan of your account and the public competitor posts you watch together with their analysis, and create and edit drafts; publishing requires your confirmation in the chat. For this we store the app's name, times of use and access tokens as hash values only. Data is transmitted to the service you chose at your instruction (Art. 6(1)(b) GDPR); that provider is responsible for its own processing under its own terms. You can disconnect any connection at any time under Settings → API & AI apps; access ends immediately.

7e. Analysis of your published posts

So that Briefkraft learns which hooks and structures work for you, your published posts and the posts of accounts you watch in Briefkraft are analysed sentence by sentence (Satz für Satz — e.g. hook type, call to action, length) and linked with their reach figures. For this the post text is sent to Anthropic, PBC (USA) (see section 8); the sentences and features are stored in our database and used for your account; texts and sentences are never shown to other customers. Anonymised statistics derived from them also improve the recommendations for all customers (see section 7h). When you delete a post we remove its analysis by the following night at the latest; when you delete your account, immediately. Legal basis: Art. 6(1)(b) GDPR (providing the analysis and recommendation features).

7f. Import of your earlier posts

When you connect an account (TikTok, YouTube, Instagram, X), Briefkraft also reads the posts you published outside Briefkraft through the platform's official interface (at most the last 12 months or 200 posts): text, publishing time, link and metrics (e.g. views, likes, comments). For LinkedIn you can voluntarily upload your LinkedIn data export; your browser reads only the file "Shares.csv" (your posts) from it — messages, contacts and everything else in the archive never leave your device. We then fetch the metrics of these LinkedIn posts through the LinkedIn interface. The posts are analysed as described in section 7e, shown in the analytics area and used for your account only. They are deleted immediately when you delete your account. Legal basis: Art. 6(1)(b) GDPR (providing the analysis features).

7g. Newsletter inbox

On request you get a personal address (…@in.briefkraft.co) that you add to your newsletter's mailing list yourself. Emails sent there are received by our own server in Germany; no further service provider is involved. We store only subject, sender address, date, message ID and the text; the complete email, images and attachments are discarded. Images and links in the email are never loaded or opened. For confirmation emails (double opt-in) we show you the confirmation link; it is only opened if you click it yourself. To prevent abuse we store the sender and the DKIM-verified sending domain of your first newsletter as well as subject and sender of held-back emails. Briefkraft creates post drafts from the text; for this the text is sent to Anthropic, PBC (USA) (see section 8). At most the last 30 issues are kept; when you remove the address or delete your account, the address and all issues received by email are deleted immediately. Legal basis: Art. 6(1)(b) GDPR (providing the feature you use).

7h. Anonymised, aggregated statistics

So that Briefkraft gives better recommendations to all customers over time, we compute summarised figures from the analyses under section 7e, e.g. "posts opening with a question reach on average 1.3× their usual reach among coaches". These figures contain no texts, sentences, post identifiers or account data; every figure is based on posts from at least 5 different accounts, so no conclusions about individual customers are possible. You can object to the inclusion of your posts at any time in the settings ("Contribute anonymised statistics"); your posts are then excluded from the next weekly recalculation. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in improving recommendations for all customers).

7i. Context, brand voice and learning from your edits

In "Context", Briefkraft collects your own published content (posts from connected accounts, newsletters, blog and podcast feeds, and links and texts you add yourself) so that new content matches your style. Feeds and links you add are fetched directly by our server; only title, text, link and date are stored, and you decide per entry whether it is used. For "Brand Voice" you can have your website analysed (colours, fonts, logo, texts) and receive suggestions that are applied only after you confirm them. So that Briefkraft learns your preferences, we also store how you edit, discard or regenerate AI drafts (text before and after the change, your slide feedback) for at most 90 days; from this, Briefkraft proposes rules and no-gos for your account weekly, which you accept or reject. For suggestions and analyses, texts are sent to Anthropic, PBC (USA) (section 8); none of it is shown to other customers. Legal basis: Art. 6(1)(b) GDPR.

7j. Voice recordings and videos with your voice

If you create content by voice recording or dictate feedback on slides, the recording is processed on our server and sent to Replicate, Inc. (USA) for transcription (section 8); for this it is stored temporarily at Cloudinary and deleted there right after transcription. Recordings for content creation are deleted after 48 hours at the latest; dictations are deleted immediately after transcription, only the text is kept. Short videos made from your recording contain your real voice; no synthetic voice is created. Legal basis: Art. 6(1)(b) GDPR.

7k. Google Drive (optional)

If you import images or videos from Google Drive into your media library, Google opens its own selection dialog. Briefkraft receives only the files you select there (Google scope "drive.file") and a short-lived access token that is used once for the download and not stored. Briefkraft's use of data received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Google's privacy policy applies to the selection dialog. Legal basis: Art. 6(1)(b) GDPR.

7d. Free LinkedIn hook check

At /tools/linkedin-hook-check you can have a post text analysed without signing up. The text is sent to Anthropic, PBC (USA) for analysis (see section 8) and is not stored by us; we only store an irreversible hash of the text, keyed with a secret and the derived features (e.g. hook type, length) for statistics. Your IP address is held briefly in our rate limiter (Redis) to prevent abuse and deleted after 24 hours at the latest. If you click "Start free", your browser stores the text locally (localStorage) so it appears in the editor after signup; it does not leave your device in that step. Legal basis: Art. 6(1)(b) GDPR (analysis you requested) and (f) (abuse prevention).

8. Other Third-Party Providers and Processors

We use the following third-party providers:

• Stripe, Inc. (USA) — Payment processing. Privacy Policy
• Brevo SAS (France) — Email delivery (lifecycle and marketing emails). Privacy Policy
• Resend, Inc. (USA) — Transactional email delivery (alerts and notifications). Privacy Policy
• Cloudinary Ltd. (Israel/USA) — Hosting of images, videos and audio files, backup storage and short-term storage of recordings for transcription. Privacy Policy
• Replicate, Inc. (USA) — AI image and video generation and transcription of uploaded audio/video files and voice recordings (Clip Studio, content creation, dictation). Personal data (e.g. voices, images of people) may be transmitted; basis: data processing agreement and Standard Contractual Clauses. Privacy Policy
• Anthropic, PBC (USA) — AI text generation (captions, content strategy). Prompt data is retained by Anthropic for up to 30 days for safety monitoring, after which it is deleted. Anthropic does not use your data to train its models under our agreement. Privacy Policy
• Hetzner Online GmbH (Germany) — Server hosting. All data is stored on servers located in Germany. Privacy Policy
• Cloudflare, Inc. (USA) — Content delivery network and protection against attacks. All requests to briefkraft.co pass through Cloudflare; IP addresses and request data are processed for this purpose only. Privacy Policy
• PostHog, Inc. (servers in the EU) — Product analytics: our server records which features of the dashboard are used (e.g. sign-up, post created), linked to your customer ID, in order to improve the product. Privacy Policy
• Supadata — Retrieval of transcripts of public videos (e.g. YouTube) when you enter a video link for repurposing. Only the link is transmitted.
• Telegram FZ-LLC (UAE) — internal operational and error notifications to the operator and approval of outreach messages (section 14). No customer data is transmitted this way; for outreach contacts only business contact details for approval. Basis: Art. 6(1)(f) GDPR.
• Google LLC (USA) — YouTube Data API v3. Google Drive only if you import images or videos from it (section 7k). Privacy Policy
• TONVI TECH SL – Upload-Post (Spain, EU; servers at Hetzner in Germany) — only if you connect Instagram, Facebook or Threads and agree to it: storage of the access permission for these accounts, publishing of the posts you approve (incl. stories) and retrieval of their statistics. Upload-Post is a sub-processor (agreement under Art. 28 GDPR); when you disconnect the last of these connections or delete your account, we delete your profile at Upload-Post. Data processing agreement
• Meta Platforms, Inc. (USA) — Instagram API
• X Corp. (USA) — Twitter/X API
• LinkedIn Corporation (USA) — LinkedIn API
• ByteDance Ltd. (Singapore) — TikTok API

Transfers to third countries (USA) are based on the EU-U.S. Data Privacy Framework or Standard Contractual Clauses (SCCs). Transfers to Israel are based on the EU adequacy decision for Israel.

9. Retention Period

We store your data for as long as your account exists. After your account is deleted, we delete personal data within 30 days unless statutory retention obligations apply (e.g. 10 years for tax-relevant records). OAuth tokens are deleted immediately when a connection is removed. Server logs are deleted after 14 days. Proof records of terms acceptance, consents and cancellations are kept for the term of the contract and thereafter until the regular limitation period expires (3 years from the end of the year).

10. Your Rights

You have the right to:

• Access (Art. 15 DSGVO) — What data we have stored about you
• Rectification (Art. 16 DSGVO) — Correction of inaccurate data
• Erasure (Art. 17 DSGVO) — Deletion of your data
• Restriction (Art. 18 DSGVO) — Restriction of processing
• Data portability (Art. 20 DSGVO) — Export of your data
• Objection (Art. 21 DSGVO) — Objection to processing
• Withdrawal of consent — At any time with effect for the future

To exercise your rights, please contact us at kontakt@briefkraft.co.

11. Data Security

We implement technical and organisational measures: SSL/TLS encryption, encrypted password storage, regular backups, access-restricted server infrastructure.

Backups and trash: The database and the media you upload are backed up daily in encrypted form and additionally stored on a second server of Hetzner Online GmbH in Germany. We use backups solely to restore data after a technical fault or data loss. Deleted data disappears from the backups as they rotate, after five weeks at the latest. Voice recordings for content creation are not included in the media backup. Deleted posts stay in the trash for 30 days so you can restore them, and are then deleted permanently; when you delete your account, immediately.

12. Cookies

Without consent we only set technically necessary cookies and storage entries (login session, security, language setting, storing your cookie choice), § 25(2) no. 2 TDDDG.

Only with your consent (§ 25(1) TDDDG, Art. 6(1)(a) GDPR) via the cookie banner: Analytics – PostHog stores a random ID (cookie/localStorage) to measure use of the website and dashboard; without consent PostHog runs without storing anything on your device. Marketing – the partner cookie "bk_ref" (see below). You can withdraw consent at any time by deleting your browser's site data for briefkraft.co; the banner will then appear again. We do not use third-party advertising or retargeting cookies.

Fonts and scripts are loaded from our own server; no data is transmitted to Google Fonts or other font providers when you visit the site.

Partner programme (referral cookie): If you reach our website via a partner's referral link (a link containing ?ref=…), we store the partner code in the cookie "bk_ref" for 90 days. If you sign up during this period, your customer account is assigned to that partner so that the partner can be paid a commission. The partner can see in their partner area your first name and the initial of your last name, your plan, your subscription status and the amounts paid — never your email address, your content or your social media accounts. Legal basis: Art. 6(1)(f) GDPR (our legitimate interest in a correct commission settlement with our partners).

The "bk_ref" cookie is only set if you consented to the "Marketing" category in the cookie banner (§ 25(1) TDDDG); the subsequent assignment of your account to the partner is based on Art. 6(1)(f) GDPR.

13. Right to Lodge a Complaint

You have the right to lodge a complaint with a data protection supervisory authority. The competent authority is the Hessian Commissioner for Data Protection and Freedom of Information, Postfach 3163, 65021 Wiesbaden.

14. Business Outreach and Sales Prospecting

Status 3 November 2026: we currently no longer contact prospects. Data already collected has been removed from our production system. Until the deletion deadline it is kept, without further use, in an access-restricted, encrypted archive on a server of Hetzner Online GmbH in Germany, and deleted no later than 6 months after collection. People who objected stay on our suppression list so their objection is permanently honoured. The following paragraphs describe how the data was collected.

As part of our business development activities, we may process publicly available professional contact information (name, job title, company, professional email address or LinkedIn URL) of individuals at companies that may benefit from Briefkraft's services.

This processing is based on our legitimate interest in contacting potential B2B customers (Art. 6(1)(f) GDPR). We process this data exclusively for the purpose of sending a single initial contact message. We do not engage in repeated unsolicited contact.

You have the right to object to this processing at any time (Art. 21 GDPR) by emailing kontakt@briefkraft.co with subject line "Opt-out — Outreach". Upon receipt we will immediately delete your data from our prospect database and cease all contact.

We retain prospect data for a maximum of 6 months from collection. Data is sourced via Brave Search API (USA, Standard Contractual Clauses), publicly available business directories, and businesses' own published contact pages (e.g. legally mandated Impressum disclosures under German law). No message is sent automatically — every message is manually reviewed and sent by a person at Briefkraft.