Privacy policy

1. Controller

Assetflow – Inh. Marco Koppenhöfer
Kaiserslauterer Straße 325
67098 Bad Dürkheim
Germany

Phone: +49 176 63872438
Email: support@profitkonsole.de
Data protection enquiries: datenschutz@profitkonsole.de

We have not appointed a data protection officer, as there is no legal obligation to do so. Your contact for data protection is datenschutz@profitkonsole.de.

Allocation of roles

We are the controller within the meaning of the GDPR for your user account and login, the record of your consent to our Terms and to the Data Processing Agreement, billing, our website, product analytics, feedback, the partner programme and our communication with you.

On behalf of our customers, we act as a processor under Art. 28 GDPR. This applies to the data from connected sales channels and ad accounts including the raw data archive, to your own entries relating to them (e.g. purchase prices), to the email addresses of invited persons and of recipients of automated reports, and to the logs of Cortex and the MCP access. Details are set out in the Data Processing Agreement (DPA, in German).

Customers of a merchant should address requests concerning their data to the respective merchant; we support the merchant in this.

2. Types of data and purposes

Types of data

• Account and master data (email, name, company name, language setting, role; email addresses of team members, agencies and other persons you invite)
• Record of your consent to the Terms and the DPA (version, time, person consenting)
• Contract and billing data (plan, chosen marketplace and number of selling accounts or additional accounts, term, payment status; when paying via Stripe also billing address and VAT ID where applicable; when installing via the Shopify App Store the address of your shop and the status of your subscription with Shopify)
• Business data from the sales channels you connect (orders and line items, invoices and documents, fees, returns, payouts, products and offers); buyer data only to the extent described in section 11
• Advertising data from the marketplaces' advertising programmes (OTTO Sponsored Product Ads, eBay Promoted Listings, bol.com Sponsored Products, Temu advertising; for Amazon the advertising costs from the settlement) and from optionally connected ad accounts (Google Ads, Meta, Microsoft Advertising, Pinterest, Snapchat, TikTok, ChatGPT Ads): campaign, cost and performance metrics (see section 11)
• Your own entries (e.g. purchase prices, shipping and payment costs, other costs, product mappings, settings)
• Access credentials for the channel interfaces and ad accounts, stored encrypted (see section 11)
• Raw data archive: responses of the channel interfaces (see section 11)
• Communication data (support requests, in-app feedback, email addresses of recipients of automated reports)
• Data relating to AI features (questions and answers in Cortex, see section 16; retrievals via the MCP access, see section 17)
• Partner data if you take part in the partner programme (see section 13)
• Application data if you apply to us (see section 18)
• Usage and metadata (log and IP data, including at login; browser identifier; technical events; product analytics, see section 10)

Purposes

• Provision and operation of the SaaS platform
• Synchronisation and analysis of your business data (profit and cost calculation)
• Features you switch on or use, e.g. automated reports, review requests on Amazon, Cortex, MCP access
• Billing and contract management, including the record of your consent to the Terms and the DPA
• Security, error management, support
• Partner programme (attribution of referrals, commission statements)
• Handling job applications (see section 18)
• Reach and success measurement of our own website and advertising (see section 8)

3. Legal bases

• Performance of a contract (Art. 6(1)(b) GDPR) for the account, use of the platform, billing and the synchronisation of connected sales channels and ad accounts
• Steps prior to entering into a contract (Art. 6(1)(b) GDPR) for job applications (see section 18)
• Legal obligation (Art. 6(1)(c) GDPR) for retaining invoices and accounting records (see section 6)
• Legitimate interest (Art. 6(1)(f) GDPR) for security, logs, error analysis, product analytics, reach measurement, measuring the success of our ads and the record of your consent to the Terms and the DPA
• Consent (Art. 6(1)(a) GDPR) for the optional newsletter and notification lists and for the use of the AI assistant “Cortex” by the individual user (see section 16)
• Where we process data on your behalf (see section 1), including transfer to AI applications you connect via the MCP access (see section 17), we process it only on your instructions under the DPA; the legal basis depends on your own processing as controller.

Obligation to provide data

Email address, name, company name and, for a subscription, billing details are required for registration and use; without them we cannot conclude a contract. After changes to our terms, your consent to the current version is required for further use. Connecting sales channels and ad accounts as well as Cortex, MCP access, automated reports and the newsletter are voluntary; without them only the corresponding features are unavailable. There is no statutory obligation to provide data.

4. Recipients and processors

We use the following processors. They process data only on our instructions:

The database, file storage and the application's functions run in EU data centres, except for individual helper functions for sending emails. Transfers to third countries are based on the EU-US Data Privacy Framework (DPF), standard contractual clauses (SCC) or an adequacy decision. You can obtain a copy of the standard contractual clauses agreed in each case by writing to datenschutz@profitkonsole.de; the list of companies certified under the EU-US Data Privacy Framework is available at www.dataprivacyframework.gov.

Recipients acting as independent controllers

• Sales channels and advertising platforms: see section 11.
• Operators of the connected platforms, insofar as they audit compliance with their developer terms (eBay also by accessing our systems) or we must report security incidents to them.

Processing outside the EU

Data may be processed outside the EU in the following cases:

• by providers and recipients based in the USA (Supabase, Vercel, Resend, Sentry, Google, Stripe, OpenAI), insofar as access is possible there, and by the functions of our website (see table)
• by Trigger.dev (United Kingdom), insofar as the provider can access the data processed in Frankfurt
• when retrieving data via the channels' interfaces, e.g. from eBay Inc. (USA) and Amazon (USA) (see section 11)
• by AI applications you connect yourself via the MCP access (see section 17)

Further recipients at your request

• Team members and agencies you invite to your account. Agencies only see the channels you release to them. We send invitations by email (see section 12).
• Recipients of automated reports whose email addresses you enter (see section 12).
• AI applications you connect via the MCP access (see section 17).
• Amazon, if you switch on review requests (see section 11).

Access by us

Only the owner of our business accesses the data in your account. He views it to ensure operation, fix errors, handle your requests and check that your analyses are calculated correctly; this is part of the commissioned processing. He views data from connected Google ad accounts only if you report a problem or agree. He changes your entries (e.g. purchase prices) only at your request or with your consent and documents the change. Administrative actions via our internal admin interface are logged.

No sale, no sharing, no AI training

We do not sell data. We do not make data from your sales channels and ad accounts available to other customers or third parties, not even in aggregated or anonymised form, and we do not use it to train AI or machine learning models. What an AI application you connect via the MCP access does with retrieved data is governed by its terms (see section 17).

Details of the commissioned processing are set out in the Data Processing Agreement (DPA).

5. Security measures (TOMs)

In accordance with Art. 32 GDPR, we take the following technical and organisational measures, among others. The full description is in Annex 1 of the DPA.

Confidentiality

• Encryption: TLS 1.2+ (transport), AES-256 (encryption at rest by the database provider)
• Access credentials for sales channels and ad accounts: additionally encrypted at application level with AES-256-GCM; the key is kept outside the database; readable only by our server functions
• Tenant separation: separate PostgreSQL schemas per customer; access only via database functions with authorisation checks, row-level security on shared tables
• Role concept: owner, administrator, moderator and advisor (agency) on a least-privilege basis; agencies only see the released channels
• Data minimisation: names, addresses and contact details of buyers are discarded on import (see section 11; current exception: the raw data archive of the Amazon connection)
• Raw data archive in non-public storage areas
• Multi-factor authentication for all administrative access to the services we use; in the application, every user can set up two-factor sign-in
• Secrets in environment variables, never hard-coded

Availability and recovery

• Hosting: serverless with auto-scaling and DDoS protection
• Database: automatic daily backups retained for seven days
• Code versioning via Git; deployment rollback possible at any time

Regular review

• weekly automated vulnerability scan of the running application (OWASP ZAP baseline)
• on every code change, automated checks for committed secrets (gitleaks) and known vulnerabilities (Trivy, npm audit) as well as static code analysis (Semgrep)
• assessment and updating of dependencies based on risk

Reporting security vulnerabilities

We accept reports of security vulnerabilities and incidents at datenschutz@profitkonsole.de.

6. Retention and deletion

We delete your personal data as soon as the purpose of storage no longer applies and no statutory retention obligations prevent this. In detail:

End of the trial period or the subscription

If the trial period ends without a subscription being taken out, your access to the application ends. We stop synchronising your channels at the earliest 24 hours later so that there is no gap if you subscribe shortly afterwards. After cancellation, you keep access until the end of the paid term; this applies to subscriptions via Stripe as well as via Shopify. Synchronisation stops when the term ends.

About one week before deletion you receive a notice by email. 30 days after the end of the trial period or the term, at the earliest seven days after the notice, we automatically delete:

• the data retrieved from all sales channels and ad accounts, including the raw data archive,
• the stored access credentials,
• your own entries, for example purchase prices, shipping costs and other cost details,
• the logs of Cortex and the MCP access as well as the synchronisation logs.

We delete data retrieved from Amazon earlier, at the latest 30 days after your access ends.

If you request a data export before deletion (see section 7), we delete at the earliest 30 days after it has been provided.

Your user account (email, name, company name), your team access and settings are kept so that you can resume use with a new subscription. You can request their deletion at any time (see “Account deletion on request”).

Resumption

If you subscribe again after the deletion, we reload the data of your channels once you reconnect them. Deleted own entries cannot be restored.

Channels you disconnect or that are no longer included in your plan

If you disconnect a sales channel, a selling account or an ad account in the application, revoke the authorisation with the provider, or a channel is no longer included in your plan (for example after a plan trial ends or after changing the marketplace in the “One Marketplace” plan), we stop retrieval; if you disconnect in the application, we delete the access credentials immediately. 30 days later we delete all data of this channel: the retrieved data, the raw data archive, any remaining access credentials and your entries relating to it (for example purchase prices and shipping costs). We remind you by email at least seven days beforehand; until deletion you can export your entries or request an export. If an authorisation with the provider merely expires or becomes invalid, this does not count as disconnecting. If you reconnect the channel or book a plan that includes it before the deletion, the deletion is cancelled. For Google Ads, we also revoke the authorisation with Google when you disconnect.

Shopify: uninstalling the app

If you uninstall our app in your Shopify shop, retrieval stops immediately; uninstalling counts as disconnecting this shop. Shopify sends us a deletion request 48 hours after uninstallation. Seven days after receiving it, we delete the order, refund, shipment, payment, payout and product data retrieved from Shopify, the Shopify raw data archive and the access token, unless the app has been reinstalled by then. We delete your entries for this shop according to the rule in the previous paragraph. If a subscription billed via Shopify ends with the uninstallation, the paragraph “End of the trial period or the subscription” applies.

Account deletion on request

You can request the deletion of your account at any time by email to datenschutz@profitkonsole.de (see section 7). We confirm the request, end a subscription running via Stripe at the time of deletion and, within 30 days, delete your user account including login data, the data of all connected channels and ad accounts, your own entries, the raw data archive and the access credentials, unless statutory retention obligations apply. You end a subscription billed via Shopify by uninstalling the app. Team members can also request the deletion of their own access by email. There is no delete button in the application.

Backups

Deleted data may remain in our hosting provider's daily database backups for up to seven days; the backups are then overwritten.

Overview of retention periods

Statutory retention obligations

The following data is retained even after account deletion due to statutory obligations:

This data is retained by our payment provider (Stripe, Ireland/USA) or by Shopify and in our accounting, and deleted after the statutory periods expire. Access is restricted to the purposes required by law (restriction of processing under Art. 18 GDPR). This also applies to credit notes and payout records in the partner programme (see section 13).

7. Your rights

You have the following rights towards us:

• Access (Art. 15 GDPR)
• Rectification (Art. 16 GDPR)
• Erasure (Art. 17 GDPR)
• Restriction of processing (Art. 18 GDPR)
• Data portability (Art. 20 GDPR)
• Objection to processing based on legitimate interests (Art. 21 GDPR)
• Withdrawal of consent given
• Right to lodge a complaint with a supervisory authority (Art. 77 GDPR): Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Rheinland-Pfalz, Hintere Bleiche 34, 55116 Mainz, Germany, phone +49 6131 8920-0, www.datenschutz.rlp.de

Right to erasure (Art. 17 GDPR)

You can request the deletion of your account or of individual data, such as the data of a specific channel or ad account, at any time by email to datenschutz@profitkonsole.de. Please write from the email address of your user account so that we can match the request. We confirm receipt, end a subscription running via Stripe at the time of deletion in the case of account deletion, carry out the deletion within 30 days and tell you which data remains restricted until the end of the statutory retention periods (see section 6). You end a subscription billed via Shopify by uninstalling the app. If you disconnect a channel in the application, we delete its access credentials immediately and its other data after 30 days (see section 6).

Right to data portability (Art. 20 GDPR) and data export

You can download individual analyses and reports yourself at any time as CSV or Excel files. You can request a complete export of your data in a structured, commonly used and machine-readable format by email to datenschutz@profitkonsole.de; in the application, the “Request” button under Settings > Profile > Data opens a pre-filled email for this. We provide the export within 30 days, also after the end of the contract until deletion; an export request postpones deletion until 30 days after it has been provided. Which data is included in the export and how a switch to another provider works is governed by our Terms (Sec. 7a(9) and Annex 2).

Right to object (Art. 21 GDPR)

Where we process your personal data on the basis of legitimate interests (Art. 6(1)(f) GDPR), you have the right to object to this processing at any time on grounds relating to your particular situation. We will then no longer process the data concerned unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims.

Withdrawal of consent and authorisations

You can deactivate Cortex in the settings; you can unsubscribe from the newsletter via the link in every email. Otherwise, an email to datenschutz@profitkonsole.de is sufficient. You can end the authorisation of an AI application connected via the MCP access under Settings > MCP; there, owners and administrators can switch off the MCP access for the whole account (see section 17).

Contact for all requests: datenschutz@profitkonsole.de. We respond within one month (Art. 12(3) GDPR). If you are a customer of a merchant who uses profitkonsole, please contact the merchant (see section 1).

8. Provision of the website and the application, web analytics

When you access our website and the application, IP address, date/time, URL, referrer and browser/OS are processed on the server side for security and operational purposes (legitimate interest, Art. 6(1)(f) GDPR). The website is delivered via the global network of our hosting provider Vercel; its functions currently run in the USA, those of the application in Frankfurt (see section 4). When you log in to the application, our authentication service (Supabase) stores IP address and browser identifier for your sessions as well as a log of login events (time, action, user ID) in order to detect misuse.

Vercel Web Analytics

On our website (profitkonsole.de) and in the application (app.profitkonsole.de) we use Vercel Web Analytics, a cookieless web analytics service of Vercel Inc. No cookies are set and nothing is stored in the browser; IP address and browser identifier are processed only briefly to form a daily changing hash and are not stored. The hash cannot be tracked across days or websites. On the website we also record individual events such as button clicks.

• Purpose: analysis of page views, referrers, device and location data
• Cookies: none
• Legal basis: legitimate interest (Art. 6(1)(f) GDPR)

Reach and funnel measurement (first-party)

To measure reach and the sign-up funnel (which content leads to a registration), we record our own cookieless events (e.g. page view, CTA click, registration) in our own database, without IP address. To combine the views within a session into one path, we use a randomly generated session ID. In the browser it is held only in a sessionStorage entry that is deleted when the tab is closed. In our database we store it with the events (retention see section 6). With the first page view we also store an existing click identifier of an ad (from Google Ads or ChatGPT) to recognise which ad you came from; we do not transmit the Google click identifier to Google. When you switch to registration, we pass the session ID to the application so that we can attribute the registration to the path on the website. There is no recognition across sessions or devices and no fingerprinting; data is linked to a person only once you register yourself.

• Purpose: reach/funnel analysis, origin of registrations (including paid campaigns such as Google Ads or ChatGPT Ads)
• Cookies: none (random session ID in sessionStorage, ends with the tab)
• Retention: see section 6
• Legal basis: legitimate interest (Art. 6(1)(f) GDPR); for the storage access Sec. 25(2) no. 2 German TDDDG

Conversion measurement for ads in ChatGPT (OpenAI)

If you reach our website via an ad in ChatGPT, OpenAI appends a click identifier to the URL called. We store this identifier together with the page view in our own database, not in your browser. If you then register in the same session, our server transmits the click identifier and the event “registration” with timestamp to OpenAI so that the ad can be attributed to the registration. This includes the URL of our registration page and an event ID derived from your user ID, used to detect duplicate reports. We do not load any script from OpenAI, set no cookies and transmit neither email address, name nor IP address.

• Purpose: measuring the success of our ads in ChatGPT
• Recipient: OpenAI as the provider of ChatGPT Ads; insofar as data is transferred to the USA, on the basis of the EU-US Data Privacy Framework or the EU standard contractual clauses
• Data: click identifier of the ad, event “registration”, timestamp, URL of the registration page, event ID
• Cookies: none
• Legal basis: legitimate interest (Art. 6(1)(f) GDPR); you may object at any time, see right to object in section 7

Demo usage analysis

When you use the demo, we additionally record the number of pages viewed and whether a registration took place. We do not store IP addresses or browser identifiers. This data serves solely to improve our offering. Retention: see section 6. Legal basis: legitimate interest (Art. 6(1)(f) GDPR).

Embedded videos (YouTube)

On some pages we embed a product video from YouTube (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). The video is only loaded when you click on it. Only then does your browser connect to YouTube or Google servers; in particular your IP address and device information are transmitted, and YouTube may use cookies or similar technologies. A transfer to the USA is possible; it is based on the EU-US Data Privacy Framework. Legal basis: consent by clicking the video (Art. 6(1)(a) GDPR, Sec. 25(1) TDDDG).

9. Error analysis (Sentry)

To analyse technical errors, we use Sentry, a service of Functional Software, Inc. When technical problems occur, error messages, stack traces and technical context information are recorded so that causes can be identified and fixed faster.

Data recorded

• technical error messages and stack traces
• browser and operating system information
• URL of the affected page
• a technical trail of the last actions before an error (e.g. clicked elements, page changes, network calls)
• in the application: your user ID, your name, the ID of the selected account and your role, so that we can attribute an error to an account; for synchronisation errors the ID and company name of the account
• at registration: the company name entered and the domain of your email address
• performance data for a sample of requests

Data protection measures

• No cookies are set and no sessions are recorded (no session replay). For troubleshooting, a technical trail of the last actions is transmitted with an error report (see above).
• We do not transmit your full email address to Sentry.
• Error reports are processed and stored in Sentry's EU region (Frankfurt, Germany).
• Error reports are deleted automatically after 30 days.
• Access only for the owner of our business for troubleshooting.

Legal basis: legitimate interest (Art. 6(1)(f) GDPR). Error analysis serves to ensure technical operation and to improve the application.

10. Product analytics and usage statistics

Within the application we record usage-related data in order to improve our product and offer you a better user experience. The data is linked to your user account and not passed on to third parties, except for the conversion report to OpenAI described in section 8.

Data recorded

• pages viewed within the application, including views of an account by agencies
• features used (e.g. channel connection, data synchronisation)
• onboarding progress (registration, email confirmation, first login)
• origin at registration (UTM parameters from referral links, referring website, landing page, partner code)

Storage location and sharing

The data is stored exclusively in our own database (Supabase, EU data centre) and not passed on to third parties, except for the conversion report to OpenAI described in section 8. We do not use external analytics services such as Google Analytics.

Retention: see section 6.

Legal basis: legitimate interest in improving the product (Art. 6(1)(f) GDPR). You can object to the processing at any time at datenschutz@profitkonsole.de.

11. Connection of sales channels and ad accounts

You decide which sales channels you connect. Each channel is connected in the way its provider intends:

Scope and period: after connecting, we load a channel's data up to two years retroactively, insofar as the provider makes it available, and keep it up to date thereafter. We retrieve the data needed for the profit and cost calculation:

Buyer details: we do not store names, addresses, email addresses or phone numbers of your customers in our database. Where a channel supplies such details (OTTO, eBay, Kaufland, bol.com, Temu), we discard them on import; only the details listed in the table are stored, because country and postcode are needed for tax rates and shipping costs and tracking numbers for matching shipments and returns. For Shopify we do not request any customer fields; we do not collect any data directly from customers of your shop. For Amazon we do not use any permissions for personal buyer data. During a retrieval, the providers' responses are briefly held in full in the memory of our background job provider (Trigger.dev, EU).

Raw data archive: we additionally store the interface responses in compressed form in a non-public storage area per channel. The archive allows us to trace and rebuild calculations in the event of errors or changes to the providers' interfaces without retrieving the data from the provider again. Before storing, we remove names, addresses, email addresses and phone numbers of buyers (OTTO, eBay, Kaufland, bol.com, Temu); the country and, for eBay, the postcode remain. Shopify responses contain no customer fields because we do not request them. We currently store the responses of the Amazon interface unchanged; they contain no names, street addresses or phone numbers, but may contain city, postcode, region and country of the delivery address as well as an email address of the buyer anonymised by Amazon. For retention, see section 6.

Access credentials: where a channel does not allow a mere authorisation but requires keys or tokens, we store them in a separate data area and additionally encrypt them at application level with AES-256-GCM; the key is kept outside the database. You can disconnect a connection in the application at any time; the credentials are deleted in the process. You can also revoke the authorisation with the respective provider. What then happens to the data already retrieved is set out in section 6.

Marketplace advertising data: for OTTO, eBay, bol.com and Temu we additionally retrieve the metrics of your advertising campaigns on the respective marketplace (e.g. campaigns, costs, clicks, revenue), for bol.com also from the advertising invoices; for Amazon we take the advertising costs from the settlement. For OTTO, eBay and Temu this uses the same authorisation as for the sales data, for bol.com a separate key pair. This data contains no buyer details.

Amazon: the connection is made via our application for the Amazon Selling Partner API. We use only permissions without access to personal buyer data. We use Amazon data only for the features in your account; it does not flow into Cortex. It flows into the MCP access only if Amazon is enabled there for your account (see section 17). When you disconnect, we delete the stored token; as Amazon does not provide for revocation via the interface, you remove the authorisation yourself in Seller Central under the management of your authorised applications. We detect a revocation in Seller Central at the latest on the next retrieval. We delete the data retrieved from Amazon, including the Amazon raw data archive, 28 days after disconnection or after that retrieval and at the latest 30 days after your access to the application ends.

Review requests on Amazon (optional): if you switch on the autoresponder, profitkonsole triggers Amazon's standard review request once a day for shipped orders via the Amazon interface, provided Amazon offers it for the order. Amazon sends the email to the buyer itself; we do not receive any contact details. For each order we store only the order number, the result and the time of the request. You can switch the feature off at any time.

eBay: we discard buyer-related details (name, address, email, phone, username) on import; postcode and country remain stored. eBay informs us about deleted eBay accounts (Marketplace Account Deletion). As we do not store buyers' usernames, such a notification cannot be matched to any buyer data stored by us. If a notification concerns the eBay account of one of our customers, we review it and delete the eBay data stored for this account within 30 days.

Shopify: if you install our app via the Shopify App Store, billing is handled by Shopify (see section 4). Shopify forwards data protection requests to us: access and deletion requests from customers of your shop as well as the deletion request after an uninstallation. As we do not request customer fields, we answer access and deletion requests concerning individual customers by stating that we do not store customer data about them. We carry out the deletion request after an uninstallation as described in section 6.

Temu: the connection requires your authorisation in your Temu seller account. All retrievals run via fixed server addresses of our background job provider in Frankfurt, because Temu only accepts calls from registered addresses. We do not read buyers' state, city or comments.

Independent responsibility of the providers: OTTO, Amazon, Kaufland, eBay, bol.com, Shopify and Temu are themselves responsible for the processing in their own systems and are not our processors. Their privacy notices apply to processing there. When retrieving data via the interfaces, data may also be transferred to recipients outside the EU – for example eBay Inc. (USA) and Amazon (USA) – on the basis of standard contractual clauses or an adequacy decision.

Ad accounts (Google Ads, Meta)

In addition, you can connect ad accounts so that your advertising costs flow into your profit calculation. You decide whether to connect accounts and which ones.

• Google Ads: The connection is made via Google OAuth. Via the Google Ads API, we retrieve campaign, cost and performance data of your ad account on a strictly read-only basis; we never create or change ads. We store an encrypted access or refresh token and the retrieved campaign metrics.
• Meta (Facebook/Instagram Ads): The connection is made via “Facebook Login for Business” with the read permission “ads_read”. Via the Meta Marketing API, we retrieve spend and performance data of the ad accounts you have released on a strictly read-only basis; we never create or change ads.

Sharing of connected ad account data

We do not share, transfer or disclose the data retrieved through the Google Ads API or the Meta Marketing API to any third party. The only exception are the processors we use to operate the application, which act solely on our instructions and for no purpose of their own: Supabase Inc. (database, EU data centre in Stockholm), Vercel Inc. (hosting and functions, EU data centre in Frankfurt) and Trigger.dev (background synchronisation, EU data centre in Frankfurt). Details are set out in section 4. Any disclosure beyond this takes place only with your explicit consent or where we are legally required to do so.

We do not sell this data and do not transfer it to advertising platforms, data brokers, credit agencies or information resellers. We do not use it for advertising, for creditworthiness assessment, or to train artificial intelligence or machine learning models. Nobody at our company reads this data unless you have explicitly agreed, it is necessary to resolve an issue you reported or for security reasons, or we are legally required to do so. The data is used solely for the user-facing feature of including your advertising costs in your profit calculation.

Disconnecting and deletion: You can disconnect a connection in the application at any time; the stored access tokens are deleted in the process. You can also revoke access directly with the provider – for Google at myaccount.google.com/permissions, for Meta in your account settings under “Business Integrations”. On request, we also delete ad metrics that have already been retrieved; an email to datenschutz@profitkonsole.de is sufficient.

profitkonsole's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Legal basis: performance of a contract (Art. 6(1)(b) GDPR).

When you disconnect a Google Ads account, we also revoke the authorisation with Google. Irrespective of any request, we automatically delete the retrieved ad metrics of a disconnected ad account 30 days after disconnection (see section 6). Advertising data from Google Ads and Meta does not flow into Cortex or automated reports. Via the MCP access (section 17), the AI application you connect yourself can retrieve the ad costs of the Google Ads and Meta ad accounts you have connected for Shopify.

Further ad accounts (Microsoft Advertising, Pinterest, Snapchat, TikTok, ChatGPT Ads)

As soon as the application offers them, you can also connect the following ad accounts:

• Microsoft Advertising (Bing): The connection is made via an authorisation in your Microsoft account (OAuth). Via the Microsoft Advertising API, we retrieve campaign, cost and performance data of the ad accounts you have released on a strictly read-only basis.
• Pinterest: The connection is made via an authorisation in your Pinterest account (OAuth) with read permission for advertising data. Via the Pinterest API, we retrieve campaign, cost and performance data of your ad accounts on a strictly read-only basis.
• Snapchat Ads (Snap): The connection is made via an authorisation in your Snapchat account (OAuth). For advertising data, Snap only offers a combined read and write permission; we use it on a strictly read-only basis and retrieve campaign, cost and performance data of the ad accounts you select via the Snap Marketing API. We store advertising data from Snapchat for no longer than 36 months. Processing by Snap is governed by Snap's privacy policy.
• TikTok: The connection is made via an authorisation in your TikTok for Business account (OAuth). Via the TikTok API for Business, we retrieve campaign, cost and performance data of the ad accounts you have released on a strictly read-only basis.
• ChatGPT Ads (OpenAI): The connection is made via an API key that you create in the OpenAI Ads Manager and enter in the application. With this key, we retrieve campaign, cost and performance data of this ad account via the OpenAI Ads API on a strictly read-only basis.

We never create or change ads with any of these providers. We store the encrypted access credentials (token or API key) and the retrieved campaign metrics. The paragraphs “Sharing of connected ad account data” and “Disconnecting and deletion” as well as the automatic deletion 30 days after disconnection apply accordingly to this data. You can also end access directly with the provider: at Microsoft in your Microsoft account under app permissions, at Pinterest in your Pinterest account settings, at Snapchat in your Snapchat account settings, at TikTok in your TikTok for Business account settings, at OpenAI by deleting the API key in the Ads Manager. Cortex (section 16) and the AI application you connect yourself via the MCP access (section 17) can only analyse ad costs from Microsoft Advertising and Snapchat for your account once the respective ad account is connected and fully retrieved. We do not use advertising data from Snapchat to train AI models. Legal basis: performance of a contract (Art. 6(1)(b) GDPR).

12. Email communication

For business email communication (support requests, personal correspondence), we use Google Workspace (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). Legal basis: performance of a contract (Art. 6(1)(b) GDPR) or legitimate interest (Art. 6(1)(f) GDPR).

We send system emails to users (registration, password reset, payment and system notices, notices before deletions, changed terms) via Resend (Plus Five Five, Inc., USA). Legal basis: performance of a contract (Art. 6(1)(b) GDPR); for team members who are not themselves contracting parties, our legitimate interest in operating the user accounts (Art. 6(1)(f) GDPR).

Team invitations: if you invite team members or agencies, we send the invitation via Resend on your behalf (commissioned processing under the DPA).

Automated reports: if you set up automated reports, we send them via Resend to the email addresses you enter, with the respective analysis as a CSV or Excel attachment (e.g. dashboard, product or order overview). You are responsible for selecting the recipients; we carry out the sending on your behalf (commissioned processing under the DPA).

Feedback: if you send us feedback via the application, we store your text and forward it to us by email together with your email address so that we can reply. Legal basis: legitimate interest (Art. 6(1)(f) GDPR).

Newsletter: if you have consented to receive the newsletter, we occasionally send product updates and tips, also via Resend, and only after you have confirmed your email address. Legal basis: consent (Art. 6(1)(a) GDPR). You can withdraw your consent at any time via the unsubscribe link in every email or by email to datenschutz@profitkonsole.de.

Customer list: if you take out a subscription via our website (Stripe), we add your email address and the name or company name entered at checkout to a customer list at Resend in order to inform you about changes to our service and your contract, such as changed terms or maintenance. We do not send advertising via this list. Legal basis: performance of a contract (Art. 6(1)(b) GDPR).

Notification list (English pages): on some English-language pages you can sign up with your email address for notifications (e.g. when OTTO opens for your country). We store the address in our own database and use it only for this purpose until you withdraw your consent. Legal basis: consent (Art. 6(1)(a) GDPR). Withdrawal at any time by email to datenschutz@profitkonsole.de.

13. Partner programme and partner tracking

Profitkonsole runs a referral/partner programme. If a visitor calls up our website via a partner link with the URL parameter “?via=CODE”, we store this code together with an expiry date in the browser's localStorage (“affiliate_code”). This serves solely to correctly attribute a subsequent registration to the referring partner.

• Only the partner code (e.g. “KCM”) with expiry date is stored, no personal data.
• The entry is valid for 60 days; a new partner link replaces an older code. In the application we delete the entry once registration is complete.
• To count the call-up of a partner link only once per session, we set a sessionStorage entry (“pk_ref_tracked_<code>”) and record the event with the partner code in our own database (see section 8).
• Upon registration, the code is linked to the user account created so that the partner can see, in pseudonymised form (customer number, registration date, subscription status and plan, end of trial period, commission), which referrals were successful. The partner sees the company name only once you link them to your account as an advisor.
• The partner receives no further data from your account unless you explicitly invite them as an advisor.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in correctly attributing referrals); for the storage access Sec. 25(2) no. 2 TDDDG.

Taking part in the partner programme

If you register as a partner, we process your name or company, contact person, email address and the email addresses of the members of your partner team, and for payouts also company address, VAT ID or tax number and IBAN. We record the referrals and commissions attributed to you, issue credit notes and pay out by bank transfer. Legal basis: performance of a contract (Art. 6(1)(b) GDPR); we retain credit notes and accounting records for the statutory periods (Art. 6(1)(c) GDPR, see section 6).

Agencies and advisors

If, as a customer, you invite an agency or a partner as an advisor to your account, this person sees the data of the channels you release to them. You can withdraw releases and invitations at any time.

14. Cookie and storage overview

We do not set any cookies for analytics or advertising purposes. In the application we set a single cookie that stores the state of the sidebar. The following tables give an overview of the entries we store in your browser.

Website (profitkonsole.de)

Application (app.profitkonsole.de)

15. Automated decision-making

There is no automated decision-making or profiling within the meaning of Art. 22 GDPR. The AI assistant “Cortex” (see section 16) and AI applications you connect via the MCP access (see section 17) merely provide informative analyses and answers; no decision with legal effect or similarly significant impact is made automatically as a result.

16. AI assistant “Cortex”

Cortex is an AI assistant with which you can ask questions about your own business data in natural language. It is part of our plans. You are interacting with an AI system; the answers are generated automatically by a language model. Each user can use Cortex only after consenting in the consent dialogue. Without this consent, no data is transmitted to the AI provider.

Data processed: the question you enter, aggregated metrics derived from your business data (e.g. revenue, margins, returns) and the answer generated. We do not transmit data from connected Google or Meta ad accounts to Cortex. No personal data of your customers is transmitted (see section 11).

Recipient: Mistral AI SAS, France (EU). Mistral uses the data solely to generate the answer, not to train its own models, and deletes it after 30 days at the latest.

Logging: to fix errors and make the answers traceable, we store your questions and the answers in your tenant area. They can be viewed by the owner of profitkonsole, are deleted automatically after 90 days and immediately when you withdraw your consent.

Note: AI-generated answers may be incorrect or incomplete and do not replace professional (tax, legal, accounting) advice. The analyses in the dashboard and your own records remain authoritative.

Legal basis: consent (Art. 6(1)(a) GDPR). You can withdraw your consent at any time in the settings; processing for you then ends and your stored conversations are deleted.

17. MCP access for AI applications

With the MCP access (Model Context Protocol), you can connect an AI application of your choice, such as ChatGPT or Claude, to your profitkonsole account and ask questions about your figures there. The access is available to owners, administrators and moderators of an account. Owners and administrators can switch it off for the whole account; we can block it per account. After the end of the trial period or the subscription, it is blocked.

Connection: you log in to profitkonsole from within the AI application and confirm on our authorisation page that this application may access your figures. Login runs via our authentication service (Supabase, EU). The AI application does not receive a password but an access token.

Data retrieved: the AI application can only retrieve on a read-only basis: aggregated metrics (account overview, result for a period, period comparisons, daily trends, analyses by segment, products with metrics and advertising metrics) and individual orders with order number, status, items, amounts, costs and contribution margin, separately per sales account if you wish. By default, this data comes from your OTTO channel; we enable further sales channels for your account at your request. For Shopify, the advertising metrics include the ad costs of your connected Google Ads and Meta ad accounts, summarised by period and by item, as well as the ad costs of your Microsoft Advertising and Snapchat ad accounts by period, once the respective ad account is connected and fully retrieved. The names, addresses, contact details and customer numbers of your buyers cannot be retrieved. Changes to your data are not possible via the MCP access.

Recipients: the figures retrieved go to the AI application you have connected and to its provider (e.g. OpenAI for ChatGPT, Anthropic for Claude). These providers are not our processors; the transfer takes place on your instructions. Further processing there, including storage, transfer outside the EU and possible use for training AI models, is governed by the respective provider's terms and your settings there.

Logging and limits: we log retrievals with the parameters passed and the response in your tenant area in order to fix errors and detect misuse; the entries are deleted automatically after 90 days. The number of retrievals is limited per day and per minute.

Ending the authorisation: you can revoke the authorisation of an AI application at any time under Settings > MCP; no further retrievals are possible afterwards.

Legal basis: the transfer takes place on your instructions as part of the commissioned processing (see DPA Sec. 7c).

18. Job applications

If you apply to us, for example with a speculative application by email, we process the data you provide. This usually includes your name and contact details, information about your education and career, links to work samples or profiles, and the content of your message and any attachments. We use this data solely to review your application, to get in touch with you and to decide on an employment or service relationship.

Legal basis: steps prior to entering into a contract (Art. 6(1)(b) GDPR). If you choose to tell us about special categories of personal data (e.g. a severe disability), we process them only to the extent necessary for the application process (Art. 9(2)(b) GDPR). After a rejection, we keep the documents for the period stated below so that we can defend ourselves against possible claims, for example under the German General Equal Treatment Act (legitimate interest, Art. 6(1)(f) GDPR).

Recipients: your application is seen only by the people who decide on the position. Applications by email arrive via our email service Google Workspace (see section 12), which stores them on our behalf as a processor. We do not pass your application on to third parties.

Retention: if we start working together, we transfer the necessary data to the personnel or contract records. Otherwise we delete your application six months after the application process has ended. If we would like to keep your documents for longer in order to contact you about a suitable position, we ask for your consent first (Art. 6(1)(a) GDPR); you can withdraw it at any time.

Obligation to provide data: you are not obliged to provide us with any data. Without information about you and a way to contact you, however, we cannot process your application. Decisions on applications are made by people; there is no automated decision-making (see section 15). Your rights under section 7 also apply to your application data.

We adapt this privacy policy as necessary to reflect legal requirements or changes to our services. If the use of data from connected ad accounts or sales channels changes materially, we inform affected customers by email in advance.