As of: November 2026
The following information provides a simple overview of what happens to your personal data when you visit this website or use one of our tools (Website-Check, AI-Act-Kennzeichnungs-Check, Fördermittel-Finder, Ausschreibungsmatch) or our AI chat “Finn”. Personal data is all data with which you can be personally identified. For detailed information, please refer to the privacy policy below.
Who is responsible for data collection on this website?
Data processing on this website is carried out by the website operator. You can find their contact details in the section “Note on the controller” in this privacy policy.
How do we collect your data?
Your data is collected, on the one hand, by you providing it to us — e.g. via our contact form, the AI chat “Finn”, the AI potential calculator or by entering a URL for checking in our Website-Check or AI-Act-Kennzeichnungs-Check.
Other data is collected automatically or with your consent by our IT systems when you visit the website. This is primarily technical data (e.g. internet browser, operating system or time of the page request).
What do we use your data for?
Part of the data is collected to ensure error-free provision of the website. Other data may be used to analyse your user behaviour. If you submit a request via the website or use one of our tools, your data is used to process that request or to carry out the requested check.
What rights do you have regarding your data?
You have the right at any time to receive information free of charge about the origin, recipients and purpose of your stored personal data. You also have the right to request the correction or deletion of this data. If you have given consent to data processing, you can revoke it at any time with effect for the future. You also have the right, under certain circumstances, to request the restriction of the processing of your personal data.
Furthermore, you have the right to lodge a complaint with the competent supervisory authority.
We host the content of our website and the technical infrastructure of our analysis tools with the following providers:
The provider is Vercel Inc., 340 Pine Street, Suite 701, San Francisco, California 94104, USA (hereinafter Vercel).
When you visit our website, Vercel collects various log files including your IP addresses. For details, please refer to Vercel's privacy policy: https://vercel.com/legal/privacy-policy
Vercel is used on the basis of Art. 6(1)(f) GDPR (DSGVO). We have a legitimate interest in the most reliable possible presentation of our website.
To store request and scan data from our tools (Website-Check, AI-Act-Kennzeichnungs-Check) as well as the screenshots and PDF reports generated in the process, we use Supabase (Supabase, Inc.) as a database and storage service. Our project instance is configured for the Frankfurt am Main region (EU-Central) — this data is therefore processed within the European Union. For details on data processing by Supabase, please refer to their privacy policy: https://supabase.com/privacy
Processing is carried out on the basis of Art. 6(1)(b) GDPR (performance of the check you requested) or point (f) GDPR (reliable operation of our services).
The automated website scan for the AI-Act-Kennzeichnungs-Check is technically carried out by a standalone service operated by us, which is hosted at Fly.io in the Frankfurt am Main region (fra). Only the target URL you specified for checking and the resulting technical scan results (detected scripts, screenshot) are processed — no personal data of third parties stored by us.
The operators of these pages take the protection of your personal data very seriously. We treat your personal data confidentially and in accordance with the statutory data protection regulations and this privacy policy.
The controller responsible for data processing on this website is:
Softstorm UG (haftungsbeschränkt)
Kiefernstr. 9
82549 Königsdorf
Email: info@softstorm.de
The controller is the natural or legal person who, alone or jointly with others, decides on the purposes and means of the processing of personal data.
Unless a more specific storage period has been stated within this privacy policy, your personal data will remain with us until the purpose for data processing no longer applies. If you assert a legitimate request for deletion or revoke consent to data processing, your data will be deleted, unless we have other legally permissible grounds for storing it (e.g. retention periods under tax or commercial law).
For security reasons and to protect the transmission of confidential content, this site uses SSL or TLS encryption. You can recognise an encrypted connection by the fact that the address bar of the browser changes from “http://” to “https://” and by the lock symbol in your browser bar.
If you send us enquiries via the contact form, your details from the enquiry form, including the contact details you provided there, will be stored by us for the purpose of processing the enquiry and in the event of follow-up questions. The message is sent via our email service provider Resend (see below) and is protected against automated misuse by a security check via Cloudflare Turnstile (see below).
We also use your enquiry for an automatically generated reply email (see “Automated email communication”). Beyond that, we pass this data on only to the service providers named in this policy, or if you have consented or we are legally obliged to do so.
This data is processed on the basis of Art. 6(1)(b) GDPR, insofar as your enquiry is related to the performance of a contract or is necessary for the implementation of pre-contractual measures. In all other cases, processing is based on our legitimate interest in the effective handling of enquiries addressed to us (Art. 6(1)(f) GDPR).
If you contact us by email or telephone, your enquiry, including all resulting personal data (name, enquiry), will be stored and processed by us for the purpose of handling your request. We do not pass this data on without your consent.
This data is processed on the basis of Art. 6(1)(b) or point (f) GDPR.
On our website, you can request a free AI potential check, on the home page also via an interactive AI potential calculator. When you make a request, your first name, your email address, your industry and, in the case of the calculator, the calculation inputs you entered (e.g. number of employees, hourly rate) are transmitted to us in order to process your request. The message is sent via our email service provider Resend (see below) and is protected against automated misuse by a security check via Cloudflare Turnstile (see below).
Processing is carried out on the basis of Art. 6(1)(b) or point (f) GDPR (processing of your request).
On our website, you can chat with “Finn”, an AI system and not a human. Finn answers questions about our services and can forward your enquiry to us. Use is voluntary. You can also reach us via the contact form, by email or by telephone.
Data processed: Your chat messages and all information you provide in them (e.g. name, email address, your concern), Finn's replies, the industry or service page you visited, and your IP address, which we store only in hashed form to prevent misuse. Please do not enter any special categories of personal data (e.g. health data), any data of third parties or any access credentials in the chat.
Recipients: Your messages are transmitted to Anthropic to generate the replies (see “Anthropic Claude API”). If you have written at least two messages, we email ourselves the conversation history via Resend when the chat is closed or when your enquiry is forwarded, even if you have not provided contact details.
Forwarding of your enquiry: If you provide your email address and Finn forwards your enquiry, we have a summary created by Anthropic. We store your name, email address, the summary and the conversation history with Supabase. You will receive an email asking you to confirm your address. You will only receive an automatic reply email after this confirmation.
Storage on your device: As soon as you use the chat, the history is stored for 24 hours in your browser's local storage so that the conversation is retained when you change pages. This is necessary for the service you requested (§ 25 (2) no. 2 TDDDG).
Legal bases: Art. 6(1)(b) GDPR, insofar as the chat serves to answer your enquiry or for pre-contractual measures. Otherwise, in particular for sending the conversation history to us, Art. 6(1)(f) GDPR: Our legitimate interest lies in following up on enquiries, reviewing the quality of the chat and preventing misuse. You can object to this at any time (Art. 21 GDPR). For the automatic reply email after confirmation of your address, the legal basis is your consent (Art. 6(1)(a) GDPR), which you can revoke at any time with effect for the future, e.g. by email to info@softstorm.de.
Storage period: We store unconfirmed enquiries, conversation histories and the associated emails until their purpose has been achieved, i.e. until the enquiry has been completed and no follow-up questions are to be expected, unless statutory retention obligations exist.
Finn does not make decisions with legal or similarly significant effect within the meaning of Art. 22 GDPR. AI replies may be incorrect and are not binding information and are not legal advice.
We respond to enquiries via the contact form and to confirmed enquiries from the chat with an email that is created automatically by an AI system and sent without prior review by a human. It contains appointment suggestions and a personal booking link. If you reply to this email, the further reply may also be created automatically, and an appointment may be created automatically if you agree to one.
For this purpose, we process your name, your email address, the content of your enquiry and the email history. Name, enquiry and history are transmitted to Anthropic; sending and receiving is done via Resend; the free appointments are retrieved from our Google Calendar. On request, we will reply to you personally: To do so, write to info@softstorm.de.
The legal basis is Art. 6(1)(b) GDPR (processing of your enquiry) and Art. 6(1)(f) GDPR (prompt handling of enquiries), and for confirmed chat enquiries Art. 6(1)(a) GDPR.
You can book an appointment via your personal booking link. For this purpose, we process your name, your email address and the selected appointment. The appointment, including this data and a Google Meet video conference, is created in Google Calendar, and you receive an invitation. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. A transfer to the USA cannot be ruled out in this context. We send the confirmation via Resend.
The legal basis is Art. 6(1)(b) GDPR (implementation of pre-contractual measures at your request).
On several forms on this website (contact, Website-Check, AI-Act-Kennzeichnungs-Check), we use the Cloudflare Turnstile service of Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA, to detect and prevent automated misuse (bots, spam). In doing so, technical data of your device is transmitted to Cloudflare and evaluated, without you having to solve a visible captcha.
Processing is carried out on the basis of Art. 6(1)(f) GDPR (protection of our forms against misuse). Details: https://www.cloudflare.com/privacypolicy/
This website uses Google Analytics, a web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”). Google Analytics uses so-called “cookies” – text files that are stored on your computer and that enable an analysis of your use of the website.
The information generated by the cookie about your use of this website (including your IP address) is generally transmitted to a Google server in the USA and stored there. We have activated IP anonymisation, so that your IP address is truncated by Google beforehand within member states of the European Union or in other contracting states of the Agreement on the European Economic Area.
Purpose: Google Analytics is used to analyse the use of our website and to continuously improve our offering.
Legal basis: Google Analytics is activated exclusively after your express consent pursuant to Art. 6(1)(a) GDPR via our cookie banner. You can revoke your consent at any time. Deactivation has no effect on the functionality of the website.
Transfer to third countries: Google may transfer the collected data to servers in the USA. Google LLC is certified under the EU-US Data Privacy Framework. Details: https://policies.google.com/privacy
If you enter a URL for checking via our “Website-Check” tool, we process the website URL you specified, your email address and the technical results of the automated scan (including PageSpeed, SEO and accessibility metrics) in order to show you the result and send it to you by email. To create the substantive evaluation, we use the Anthropic Claude API (see below). Your IP address is stored only in hashed, non-reversible form to prevent misuse (rate limiting).
The legal basis is Art. 6(1)(b) GDPR (pre-contractual measure at your request) and point (a) GDPR, insofar as you have expressly consented to the processing in the form.
If you opt for the paid, detailed PDF report, we process the payment via Stripe and issue you an invoice (for details on both services, see the section “Payment processing and invoicing” below). The full report is delivered to you by email via Resend.
If you enter a URL for checking via our “AI-Act-Kennzeichnungs-Check” tool, we process your name, your email address, the website URL you specified and the technical results of the automated scan (detected chat/voice widgets, text passages found relating to AI labelling, a screenshot of the checked page) in order to create and send you an automated technical initial assessment of possible applicability of the labelling obligation under Art. 50 EU AI Act. This assessment expressly does not constitute legal advice and does not constitute a binding legal review.
The technical scan is carried out via a scan infrastructure operated by us at Fly.io (Frankfurt region). The Anthropic Claude API is used for the substantive evaluation of the scan results (see below). Optionally, the Voyage AI service is used to improve provider detection; only short, technical URL fragments (no personal data) are transmitted to it in order to match them against known provider signatures.
Your IP address is stored only in hashed, non-reversible form to prevent misuse (rate limiting, max. three checks per hour). To confirm your email address (double opt-in), we send you a confirmation email via Resend.
The legal basis is Art. 6(1)(b) GDPR (pre-contractual measure at your request) and point (a) GDPR, insofar as you have expressly consented to the processing in the form.
If you opt for the paid full audit (single domain or several domains/language versions), we process the payment via Stripe, optionally collect your company and billing address for invoicing, and issue you an invoice. The complete report, including wording proposals and verification document, is delivered to you as a PDF via Resend.
For the Fördermittel-Finder, we process your name, your email address, industry, location (postcode, federal state), number of employees and the description and category of your project in order to identify suitable funding programmes and send them to you. In the case of a subscription, payment, invoicing and subscription data are added (see “Payment processing and invoicing”). Your IP address is stored only in hashed form to prevent misuse.
To identify matches, we transmit industry, location, number of employees and project, but not your name and email address, to Anthropic (see “Anthropic Claude API”). The text of your project is also transmitted to Voyage AI (see “Voyage AI”). We receive an internal notification about your profile by email via Resend.
The legal basis is Art. 6(1)(b) GDPR (contract or pre-contractual measures) and point (a) GDPR, insofar as you have consented in the form. We store subscription data for the duration of the subscription and within the scope of statutory retention obligations.
For the Ausschreibungsmatch, we process your name, your email address, industries, location (postcode, federal state), your desired contract value and your service profile in order to identify suitable public tenders and send them to you. In the case of a subscription, payment, invoicing and subscription data are added (see “Payment processing and invoicing”). Your IP address is stored only in hashed form to prevent misuse.
To identify matches, we transmit your profile details, but not your name and email address, to Anthropic (see “Anthropic Claude API”). The text of your service profile is also transmitted to Voyage AI (see “Voyage AI”). We receive an internal notification about your profile by email via Resend.
The legal basis is Art. 6(1)(b) GDPR (contract or pre-contractual measures) and point (a) GDPR, insofar as you have consented in the form. We store subscription data for the duration of the subscription and within the scope of statutory retention obligations.
If you create a customer account, we process your name, your email address, your password (stored only as a hash) and the time of your consent with Supabase. You must confirm your email address. Your previous purchases and profiles with the same confirmed email address are automatically assigned to your account so that you can retrieve reports and invoices there. Invoices are retrieved from LexOffice for this purpose.
The legal basis is Art. 6(1)(b) GDPR. We store the account data until you request deletion of the account; invoices and proofs of purchase are retained within the scope of statutory retention obligations.
For the following functions, we use the API of Anthropic PBC, San Francisco, USA, as a processor (Claude language model). Depending on the function, the following is transmitted:
Processing by Anthropic takes place on servers in the USA. This is a data transfer to a third country; it takes place on the basis of the EU Commission's standard contractual clauses pursuant to Art. 46(2)(c) GDPR within the framework of the data processing agreement with Anthropic. For details, please refer to Anthropic's privacy policy: https://www.anthropic.com/legal/privacy
The legal bases are those stated for the respective function; otherwise Art. 6(1)(f) GDPR (reliable operation of our tools and efficient handling of enquiries).
For matching with funding programmes and tenders, we convert the text of your project or service profile into a mathematical representation using the Voyage AI service (USA). Only this text is transmitted, not your name and not your email address. Please do not state any personal data there. For the AI-Act-Kennzeichnungs-Check, only technical URL fragments are transmitted.
The transfer to the USA takes place on the basis of the EU Commission's standard contractual clauses pursuant to Art. 46(2)(c) GDPR. The legal basis is Art. 6(1)(b) GDPR or, for the AI-Act-Kennzeichnungs-Check, point (f) GDPR (reliable detection).
For the payment processing of our paid services (Website-Check full report, AI-Act-Kennzeichnungs-Check full audit, subscriptions for Fördermittel-Finder and Ausschreibungsmatch), we use Stripe Payments Europe, Limited, 1 Grand Canal Street Lower, Dublin 2, Ireland. When you place an order, we transmit the data required for payment processing (including name, email address, payment information, order amount) to Stripe. The payment data itself (e.g. credit card data) is processed exclusively by Stripe and does not pass through our own systems.
The legal basis is Art. 6(1)(b) GDPR (performance of a contract). Details: https://stripe.com/de/privacy
To create and manage invoices for paid services, we use the accounting service lexoffice of Haufe-Lexware GmbH & Co. KG. For this purpose, we transmit the data required for invoicing (name, billing address, service description, amount).
The legal basis is Art. 6(1)(c) GDPR (fulfilment of retention obligations under commercial and tax law) in conjunction with point (b) GDPR (performance of a contract).
For sending transactional emails (including result emails from our tools, confirmation emails, invoice dispatch, form notifications to us, chat histories) and for receiving replies to our automated emails, we use the email delivery service Resend. For this purpose, the email address and the respective email content are transmitted to Resend.
The legal basis is Art. 6(1)(b) GDPR (performance of a contract or processing of your enquiry). Details: https://resend.com/legal/privacy-policy
Links to the social networks Instagram, LinkedIn and X (formerly Twitter) are included on this website. The services are operated by Meta Platforms Ireland Limited, LinkedIn Corporation and X Corp. respectively. The links lead to our profiles on the respective platforms.
When you click the links, you are redirected to the respective platforms. Data is transmitted to the respective providers in the process. Please note the privacy policies of the respective platforms.
This website uses a cookie consent banner, through which you can decide for yourself which categories of cookies you wish to allow:
You can change your selection at any time via the corresponding link in the footer of the website.
Within the scope of the applicable statutory provisions, you have the right at any time to free information about your stored personal data, its origin and recipients and the purpose of the data processing, and, where applicable, a right to correction or deletion of this data. For this and for further questions on the subject of personal data, you can contact us at any time.
You have the right to request the restriction of the processing of your personal data. For this, you can contact us at any time. The right to restriction of processing exists in the following cases:
You have the right to receive data that we process automatically on the basis of your consent or for the performance of a contract in a commonly used, machine-readable format or to have it transmitted to another controller (Art. 20 GDPR).
You can revoke consent that you have given at any time with effect for the future (Art. 7(3) GDPR), e.g. by email to info@softstorm.de. Processing that took place up to that point remains lawful.
In the event of violations of the GDPR, data subjects have the right to lodge a complaint with a supervisory authority. The competent supervisory authority for Bavaria is the Bayerisches Landesamt für Datenschutzaufsicht (BayLDA), Promenade 18, 91522 Ansbach.
