Legal

Privacy policy

This translation is provided for information only. The German version is legally binding.

Last updated: October 2026

1. Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) is signundsinn GmbH, named above. No data protection officer has been appointed, as the legal requirements for this are not met. If you have any questions about data protection, please use the contact details above.

2. Overview: what this website does and does not do

3. Hosting and server log files

When you visit this website, the web server automatically stores information transmitted by your browser in so-called server log files. This is:

• IP address of the requesting device
• Date and time of access
• Page or file accessed and amount of data transferred
• Referrer URL (previously visited page)
• Browser type and version, operating system

Processing is based on Art. 6(1)(f) GDPR. Our legitimate interest lies in the technically error-free provision, security and stability of the website. This data is not combined with other data sources. The log files are deleted after 30 days at the latest, unless security-related incidents require longer retention.

The website is hosted by the following provider: Timme Hosting GmbH & Co. KG, Marie-Curie-Straße 5, 21337 Lüneburg, Germany. The server is located in Germany. A data processing agreement pursuant to Art. 28 GDPR is in place with the hosting provider.

4. Contact form

On the homepage, you can send us a demo request or a question via a contact form. In doing so, we process the details you enter: name, email address and, optionally, company, phone number, shop or website URL and the system used, the selected topic and your message. We also store the time of the enquiry and the IP address in order to detect and prevent misuse (spam, automated requests).

Your details are processed in two ways:

• By email to our team (kontakt@signundsinn.de), so that we can reply to your enquiry.
• In our customer relationship management system (CRM), which signundsinn GmbH operates itself. There, we create your enquiry as a case with contact and company, so that follow-up questions, demo appointments and quotes can be handled in a traceable manner. The CRM is not a third-party service.

The legal basis is Art. 6(1)(b) GDPR (steps prior to entering into a contract at your request). We base spam prevention on Art. 6(1)(f) GDPR (legitimate interest in a functioning form). For spam prevention, the form uses a hidden control field, a timing check, a limit on requests per IP address and a small computational task that your browser solves in the background while you fill in the form (proof of work; no data about you is collected and no cookie is set); for this purpose, the IP address is kept on the web server exclusively in hashed form for no more than one hour. No external captcha service is used.

Providing your name, email address and message is required; all other details are voluntary. We delete the data as soon as your enquiry has been fully dealt with and no contractual relationship is established, but no later than after 12 months, unless statutory retention obligations prevent this.

5. Contacting us by email or phone

If you contact us by email (e.g. at info@eywora.com) or by phone, for example to arrange a live demo, we process the data you provide (name, email address, phone number, company, content of your enquiry) to handle your enquiry and in case of follow-up questions.

The legal basis is Art. 6(1)(b) GDPR, insofar as your enquiry is aimed at concluding a contract or serves to carry out pre-contractual measures; otherwise Art. 6(1)(f) GDPR (legitimate interest in responding to enquiries).

The data is deleted as soon as it is no longer required to achieve the purpose and no statutory retention obligations (in particular under the HGB and AO) prevent this.

6. Live demo and pre-contractual steps

To carry out an agreed live demo, we process the contact details of the participants and information about your shop or website system, insofar as you provide this to us for preparation. The demo takes place as a video conference or on site. We will inform you about the video conferencing tool used when arranging the appointment. The legal basis is Art. 6(1)(b) GDPR.

Appointment booking on this website. When you click a link to book an appointment, a booking form opens on our website. There you choose a day and a free time and enter your name and email address, optionally your company, phone number and a message. To offer you only free times, our web server checks, when you pick a day, when our team's calendar is busy; no details about you are transmitted for this. When you book, our web server creates the appointment in our Google Workspace calendar (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, as a processor for signundsinn GmbH) and adds you as an attendee with your name and email address; Google then sends you a calendar invitation with the link to the video call (Google Meet). You also receive a confirmation from us by email, and we record the booking in our CRM in the same way as an enquiry via the contact form (section 4). Spam protection is the same as for the contact form (section 4). A transfer to Google LLC in the USA cannot be ruled out; it is based on the adequacy decision for the EU-US Data Privacy Framework, to which Google is certified. The legal basis is Art. 6(1)(b) GDPR (arranging an appointment at your request). Without JavaScript, the link instead leads to the Google Calendar booking page in a new window, where Google's privacy policy applies. If you prefer neither, email us at info@eywora.com or give us a call.

7. External links

This website contains links to external websites (e.g. signundsinn.de, eywora.com, the EU ODR platform). When you click on them, you leave our website. The privacy policies of the respective operators apply to data processing on the linked sites. Merely viewing our site does not transmit any data to these providers.

8. Recipients and transfers to third countries

Your data is passed on to third parties only where necessary to perform the contract (e.g. the hosting provider as a processor), where you have consented, or where a legal obligation exists. No transfer to third countries outside the EU or EEA takes place in connection with this website, except for the possible transfer to Google when booking an appointment (see section 6), when playing a video on the “Video Hub” page (see section 13) and, only after your consent, for Google Ads and the Meta pixel (see section 12). For customers of the Eywora AI Crew platform who connect a social media account, the approved content is transmitted to the respective network (see section 14); for providers based in the USA, this is based on the adequacy decision for the EU-US Data Privacy Framework or on standard contractual clauses.

9. Your rights as a data subject

You have the following rights with respect to us regarding the personal data concerning you:

• Access (Art. 15 GDPR) to the data we process
• Rectification (Art. 16 GDPR) of inaccurate or incomplete data
• Erasure (Art. 17 GDPR), unless retention obligations prevent this
• Restriction of processing (Art. 18 GDPR)
• Data portability (Art. 20 GDPR)
• Objection (Art. 21 GDPR) to processing based on Art. 6(1)(f) GDPR

To exercise your rights, an informal message to kontakt@signundsinn.de is sufficient.

Right to object

Where we process data on the basis of a legitimate interest (Art. 6(1)(f) GDPR), you have the right to object to the processing at any time on grounds relating to your particular situation. We will then no longer process the data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms.

Right to lodge a complaint with a supervisory authority

You have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The supervisory authority responsible for us is:

10. Data security

This website is delivered over a TLS-encrypted connection (HTTPS). We use technical and organisational measures to protect your data against accidental or intentional manipulation, loss, destruction or access by unauthorised persons.

11. Audience measurement with Matomo

With your consent, we use the open-source software Matomo on this website to understand how the website is used and to improve it. We operate Matomo ourselves (server of signundsinn GmbH at m.signundsinn.de, hosted by Timme Hosting GmbH & Co. KG in its data centre in Falkenstein, Germany, with which a data processing agreement exists). No data is passed on to the manufacturer of Matomo or to other third parties.

Without your consent, no measurement takes place. We ask you on your first visit. Until you have agreed, no data is transmitted to Matomo and no Matomo cookies are set. We store your decision (consent or refusal) for 12 months in the cookie aicrew_consent_stats (valid for this website only). It contains your choice (yes/no), a random consent ID and the version of this description, but no other personal data. The cookie is technically necessary so that we can respect your choice (Section 25(2) no. 2 TDDDG). If the description of the audience measurement changes materially, we ask again. Every Eywora website asks you separately: a decision made on eywora.com does not apply here, and your decision here does not apply there. If you refuse, we delete any Matomo cookie that is still present.

Which data is processed?

• pages viewed, time of the visit and time spent
• the previously visited page (referrer) and campaign parameters in links, e.g. if you come to us from another Eywora website
• clicks on external links, the successful submission of the contact form and the opening of the appointment booking (only as events, without what you entered)
• mouse clicks, mouse movements and scroll depth on individual pages, which we evaluate in aggregate as heatmaps (text entered in form fields is not recorded)
• browser, operating system, device type, screen resolution and language
• the IP address: it is processed in full only briefly to determine the rough location (country/region) and is shortened by 1 byte before storage; the full IP address is not stored
• a randomly generated visitor ID

Cookies and recognition across websites. After your consent, Matomo sets two cookies: _pk_id (visitor ID, lifetime up to 13 months) and _pk_ses (session, 30 minutes). The cookies apply to all subdomains of eywora.com (e.g. aicrew.eywora.com and www.eywora.com); we evaluate these websites together in one Matomo installation. This information does not apply to cip.eywora.com. If you visit several of these websites, we therefore recognise you as the same visitor by your visitor ID, even if you do not click a link between the websites. This lets us see which of our pages contributed to an enquiry or trial registration, without identifying you by name. We do not combine this data with the contact details from the contact form.

Cookie for the withdrawal. Because the visitor ID is shared by all of these websites while your consent applies per website, we additionally store in the cookie eywora_tracking_hosts (valid for eywora.com and all subdomains, 12 months) for which of these websites your consent currently exists. It contains only those host names and an expiry date for each — no identifier, no choice and no other personal data. We need it so that we can delete the shared visitor ID as soon as no consent exists for any of these websites, and so that a withdrawal here does not end the measurement on another website for which you have given consent. The cookie is technically necessary for this purpose (Section 25(2) no. 2 TDDDG).

Heatmaps. With your consent, we use the heatmap function of Matomo. It shows us where on individual pages people click frequently, how far they scroll and where the mouse moves, so that we can improve content and navigation. For this, your browser records clicks, mouse movements, scroll depth, window size and the page viewed and transmits them to our Matomo server. The data is only displayed in aggregate as a heatmap; we do not see individual visits. Entries in form fields (e.g. in the contact form) and keyboard input are not recorded. The raw data from which the heatmaps are built is deleted after 390 days, like the other raw data; the finished, aggregated heatmaps contain no personal reference and are kept. The same consent, the same legal basis and the same withdrawal apply as for the rest of the audience measurement.

Recordings of individual sessions (session recordings). With your consent, we occasionally record individual sessions, limited in time or number and only on selected pages, to find usability problems. Mouse movements, clicks, scrolling and the displayed page content are recorded. Entries in form fields and keyboard input are not recorded. The recordings are deleted after 390 days. The same consent, the same legal basis and the same withdrawal apply as for the rest of the audience measurement.

Legal basis. Processing takes place exclusively on the basis of your consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG). Consent is voluntary; the website can be used in full without it.

Withdrawal. You can withdraw or re-grant your consent at any time with effect for the future: click Cookie settings (also in the footer of every page) and choose “Decline”. This deletes this website’s Matomo cookies and reloads the page. We delete the shared visitor ID (_pk_id) as soon as no Eywora website holds a consent any more — if you withdraw here while you have consented on eywora.com, it remains for that website; if you later withdraw there too, it is deleted. The lawfulness of processing carried out before withdrawal is not affected. The decision applies only to audience measurement on this website; you decide separately about the marketing category (Google Ads and Meta pixel, section 12) in the same dialog. On eywora.com you decide there separately, including about its own Meta pixel and the tag manager, which does not exist on this website. These statements do not apply to cip.eywora.com.

Proof of consent. To be able to demonstrate your consent (Art. 7(1) GDPR), we store every decision made in the dialog (consent, decline or withdrawal, for statistics and marketing) on this website’s server: consent ID, your choice per category, time, version of the description, website (host) and language. Your IP address and user agent are not stored. Entries are deleted after 3 years. The dialog shows your consent ID under “Cookie settings” once you have decided; on request we use it to look up the entries. The legal basis is Art. 6(1)(c) GDPR in conjunction with Art. 7(1) GDPR.

Retention. Individual visits (raw data) are deleted after 390 days (about 13 months). After that, only aggregated statistics without personal reference remain.

Browser signals (Do Not Track, Global Privacy Control). We use audience measurement exclusively on the basis of your consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG). Until you expressly agree in the consent dialog, it is not loaded – regardless of whether your browser sends a “Do Not Track” or “Global Privacy Control” signal. Processing for tracking purposes on the basis of legitimate interests does not take place.

Because these signals are often set across the board in browser settings, we show you the consent dialog even if such a signal is sent. If you expressly give your consent there, we assume that it is your more specific decision for our website. You can withdraw your consent at any time with effect for the future via Cookie settings.

12. Conversion measurement and retargeting with Google Ads and Meta (marketing)

We run ads in Google Search and on Facebook and Instagram. With your consent to the “Marketing” category, we use two services: Google Ads conversion tracking (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland) and the Meta pixel (Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland). Both measure whether a click on one of our ads led to an appointment booking or an enquiry on this website. We also use the Meta pixel to show visitors of this website matching ads on Facebook and Instagram later (retargeting, “custom audiences”).

Nothing happens without your consent. Only when you choose “Marketing” in the dialog does your browser load the scripts from Google (gtag.js from googletagmanager.com) and Meta (fbevents.js from connect.facebook.net) and connect to Google’s and Meta’s servers. Before that, no script is loaded and no cookie is set. We store your decision for 12 months in the cookie aicrew_consent_ads (valid only for this website; choice yes/no, the same random consent ID as for statistics, and the version of this description). This cookie is technically necessary so that we can respect your choice (Section 25(2) no. 2 TDDDG).

What is measured. Three events: a page view (sent to Meta only), the click on a link to the appointment booking (“Book a demo”) and the successful submission of the contact form (“Enquiry”). Only the event itself, the time and the page visited, your IP address and browser details are transmitted, plus, if you arrived via an ad, the ad’s click identifier (the gclid or fbclid parameter in the address). What you enter in the form or during booking is transmitted neither to Google nor to Meta; we have switched off the Meta pixel’s automatic collection of clicks, form fields and page content (“automatic advanced matching”, automatic events). Google sets the cookies _gcl_au (90 days) and, after an ad click, _gcl_aw (90 days); Meta sets _fbp (90 days) and, after an ad click, _fbc (90 days). From Google we receive only aggregated figures (conversions per ad and search term), no information about individual persons.

Retargeting with Meta. If you are logged in to Facebook or Instagram, Meta can link the events to your account and add you to an audience “visitors of this website” to which we show ads there. We ourselves see no individual persons, only the size of the audience and aggregated figures. For collecting the events and transmitting them to Meta, we and Meta are joint controllers (Art. 26 GDPR, joint processing agreement); Meta alone is responsible for any further processing, for example to improve Meta’s advertising system. You can set which ads you see on Meta in your ad preferences at Meta. With Google Ads we use no remarketing and no personalised advertising based on your visit (consent mode “ad_personalization” remains switched off). We do not use Google Analytics.

Transfer to third countries. A transfer to Google LLC and Meta Platforms, Inc. in the USA cannot be ruled out; it is based on the adequacy decision for the EU-US Data Privacy Framework, of which both companies are members. Further information is available in Google’s privacy policy, at business.safety.google/adscookies and in Meta’s privacy policy.

Legal basis and withdrawal. Processing takes place exclusively on the basis of your consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG). It is voluntary; the website can be used in full without it. You can withdraw or re-grant your consent at any time with effect for the future: click Cookie settings (also in the footer of every page) and untick “Marketing”. This deletes the cookies _gcl_au, _gcl_aw, _fbp and _fbc and reloads the page. The lawfulness of processing carried out before withdrawal is not affected. The proof of your decision is stored as described in section 11.

13. Videos on the “Video Hub” page and on the home page

On the Video Hub page we show the videos from our YouTube channel. On the home page, the YouTube icon in the header area opens a small window with the latest video; everything that follows applies there in the same way. Nothing is loaded from YouTube or Google when you open the pages. Our web server itself fetches the titles, dates and descriptions of the videos from the public channel feed of YouTube and caches them for a short time; the preview images are also stored on our server and delivered from our domain. Your browser does not communicate with Google in the process, no third-party cookies are set and your IP address is not transmitted to Google.

Only when you click. When you click a video, a notice appears first. If you confirm “Load video” there, the YouTube player (youtube-nocookie.com) is embedded in the page and the video starts. Only this establishes a connection to Google servers (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). In particular, your IP address, browser details and the page you are visiting are transmitted; YouTube may set cookies or comparable identifiers and analyse your viewing behaviour. If you are signed in to Google, Google can link the request to your account. A transfer to Google LLC in the USA cannot be ruled out; it relies on the adequacy decision on the EU-US Data Privacy Framework, which Google participates in. Further information is available in Google’s privacy policy.

Legal basis and withdrawal. The embedding takes place solely on the basis of your consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG), which you give by clicking “Load video”. So that you do not have to confirm the notice for every single video, your browser remembers this consent for the current session only (session storage, entry eywora_youtube_ok); it ends as soon as you close the browser tab and it is not transmitted to us. After that we ask again. Without your consent the page remains fully usable, just without embedded videos; you can watch the videos at any time directly on our YouTube channel.

14. Eywora AI Crew: connected social media accounts

This section applies to customers of the Eywora AI Crew platform operated by signundsinn GmbH who connect their own YouTube, Facebook, Instagram, LinkedIn or TikTok account in the “Social Media” module of their customer portal, so that the AI Crew can publish approved posts there. It does not apply to visitors of this website. Connecting an account is voluntary; without a connected account, posts can still be created and published manually.

What data we access

You sign in directly with the respective network and explicitly grant our application the following permissions there. We only request the permissions that are needed for publishing:

• YouTube (Google): youtube.readonly – we read the ID and name of the connected channel so that the portal can show which channel is linked. youtube.upload – we upload the videos you approved to your channel, with the title, description and privacy status you set.
• Facebook (Meta): pages_show_list, pages_read_engagement, business_management – we read the list of Facebook Pages you manage (ID and name) so that you can choose the Page to publish on. pages_manage_posts – we publish the approved posts on that Page.
• Instagram (Meta): instagram_business_basic – we read the ID, username and name of your professional Instagram account. instagram_business_content_publish – we publish the approved photos, carousels, reels and stories.
• LinkedIn: r_basicprofile – we read your member ID and your name. rw_organization_admin – we read the list of company pages you administer (ID, name and page address) so that you can choose whether posts are published as your personal profile or as one of these pages. w_member_social or w_organization_social – we publish the approved posts on your behalf or on behalf of the selected company page.
• TikTok: user.info.basic – we read your account ID and display name. video.publish – we publish the approved videos and photo posts. Before each post we retrieve, as required by TikTok, the settings allowed for your account (e.g. visibility, comments, duets).

In addition, we store the access tokens (access and refresh tokens) that the network issues after you sign in. We do not read any other data from your accounts, in particular no existing posts or videos, comments, messages, followers or subscribers, analytics, e-mail addresses or contacts.

How we use the data

We use this data exclusively to publish the content you approved on the selected account at the desired time, and to show you in the portal which account is connected and whether a post was published successfully. We only publish what you have approved. We do not use the data for advertising, do not sell it, do not build profiles from it and do not use it to develop, train or improve AI or machine-learning models. The AI Crew’s agents create the content but have no access to your accounts or access tokens; publishing is done by the portal itself.

Storage and protection

• Access tokens and account details are stored exclusively on the dedicated server of your own instance of the platform, which is operated for you alone and located in Germany.
• The tokens are never sent to your browser, never shown in the portal and never passed to the AI agents; the agents run in a separate, isolated environment.
• All communication with the networks and with the portal uses TLS-encrypted connections (HTTPS).
• Access to the server is limited to a few authorised technical staff of signundsinn GmbH. They only see the data when this is necessary for security, to fix an error or because of a legal obligation.
• For TikTok photo posts we make the approved images available at a time-limited, signed address on our server, because TikTok only retrieves photos from there.

Sharing

We transmit the content you publish to the respective network; that network’s privacy policy applies there. Beyond that, we do not share the data with third parties, except with our hosting provider as a processor or where we are legally obliged to do so. Where we process the data on behalf of our customer, the data processing agreement applies in addition.

Retention, deletion and revocation

We store the access tokens and account details only as long as the account is connected. If you disconnect the account in the portal or your contract ends, they are deleted. Posts that have already been published remain on the network and can be deleted there. You can also revoke our application’s access directly with the network at any time, for example at Google Account → Third-party apps, in the Facebook settings under “Business integrations”, in Instagram under “Apps and websites”, on LinkedIn under “Permitted services” and on TikTok under “Manage app permissions”. Your rights under section 9 apply here as well; you can request deletion at any time at kontakt@signundsinn.de.

Legal basis

The processing is carried out to perform the contract for the use of the platform (Art. 6(1)(b) GDPR), and only after you have connected the account yourself.

Google API Services User Data Policy (Limited Use)

Eywora AI Crew’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

15. Changes to this privacy policy

We reserve the right to amend this privacy policy so that it always complies with current legal requirements or to reflect changes to our services. The version current at the time of your next visit will then apply.