Privacy policy

1. Controller

The controller responsible for data processing on this website: see Imprint.

Email: privacy@reviseberg.com

We have not appointed a data protection officer: the thresholds of Art. 37 GDPR and § 38 BDSG do not apply to a business of this size, and our core activity is not large-scale monitoring or processing of special categories of data. Write to the email address above for any data protection matter.

2. Your rights at a glance

Under the GDPR you have the right to information (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21). Where processing is based on consent, you may withdraw it at any time with effect for the future (Art. 7 (3)).

To exercise a right, write to privacy@reviseberg.com. You also have the right to lodge a complaint with a supervisory authority — for us that is the Berliner Beauftragte für Datenschutz und Informationsfreiheit, Alt-Moabit 59–61, 10555 Berlin.

3. Hosting and server log files

This website is hosted by Vercel Inc., 340 S Lemon Ave #4133, Walnut, CA 91789, USA, which serves it from edge locations in the EU. Vercel processes data on our behalf under a data processing agreement (Art. 28 GDPR). Transfers to the USA are based on the EU standard contractual clauses and the EU–US Data Privacy Framework.

Scan results, findings and account data are stored with Supabase Inc., 970 Toa Payoh North, Singapore 318992, in a database and object storage located in the EU (Frankfurt, eu-central-1), likewise as a processor under Art. 28 GDPR.

When you open a page, the server automatically records:

• the requested URL and referrer
• date and time of the request
• browser type and version, operating system
• a shortened or hashed IP address

This is technically necessary to deliver the page and to keep the service secure and stable. Legal basis: Art. 6 (1) (f) GDPR (legitimate interest in secure, functioning provision of the website). Log data is deleted or anonymised after 30 days at the latest.

4. Cookies and local storage

This website sets no cookies for analytics. We store one entry in your browser's local storage (bz-consent) to remember your answer to our consent banner — whether you agreed, when, and which version of the banner you answered — so we do not ask again; after twelve months, or when the banner asks about something new, we ask once more. That entry contains no personal data and is not transmitted. If you use the accessibility toolbar on this website and change a setting, the toolbar keeps your settings in a second local-storage entry so they stay in place on the next page; nothing is written before your first change, the entry holds only those settings, and it is not transmitted. The toolbar's reset button deletes it.

If you agree, we keep a random ID for our own statistics in a further local-storage entry (rb-visitor), as described in section 6; it is sent with those statistics, and it is deleted when you decline or your agreement runs out. Google sets cookies as described in section 7, and we keep the advertising parameters of the address you arrived on (utm_*, gclid) in your browser's session storage until you close the tab, so that a request you send a few pages later can still be attributed to the advertisement. Without your agreement nothing is kept. Details, including how to withdraw consent, are in the cookie notice.

5. Reach measurement with Plausible Analytics

We use Plausible Analytics to count visits, on the public pages and in the signed-in dashboard at /app/ alike. Plausible is cookieless: it sets no cookies, stores nothing on your device and does not create a cross-site profile. IP addresses are only processed transiently to generate a daily, salted hash and are never stored. The data collected — page, referrer, country, device class, browser — cannot be traced back to you.

Processing takes place on servers in the EU. Provider: Plausible Insights OÜ, Västriku tn 2, 50403 Tartu, Estonia, as a processor under Art. 28 GDPR.

Legal basis: Art. 6 (1) (f) GDPR — our legitimate interest in understanding how many people visit which pages. Since no information is stored on or read from your device, no consent under § 25 TDDDG is required.

6. Our own statistics: journeys and A/B tests

Besides counting visits with Plausible, we record a few steps ourselves, so we can see which pages and buttons lead people to a free scan, a report or an account, and so we can try alternative wording on this website against each other. The events go to our own server function on Vercel and are stored in our database at Supabase in the EU (section 3); nobody else receives them.

What is recorded: the type of event — a page view, a click on one of our buttons, seeing the result of a free scan, asking for a sign-in link, or which wording of a test you were shown — together with the path of the page without its query string, the language of the page, and where the visit came from: the utm_source of the address you arrived at, or else the name of the website that linked here. For the steps that happen on our server — starting a free scan, asking for the report, sending an enquiry, creating an account — the event points to the record of that step, so that a visit can be connected to the account it led to; if you ask for a report and later create an account with the same email address, we connect the two. No form contents, no web address you type into the scanner and no email address are part of an event, and no IP address is stored. If you have an account, we also note the days on which you use the dashboard — your user ID and the date, nothing else — to see whether people come back.

Without your consent, the events of one day are tied together by a daily key: a hash of a random value that is made new each day, your IP address and the identification string your browser sends. The random value is deleted the day after it was made; from then on nobody — us included — can work out the key from an IP address again, and a visit on another day has a different key. Nothing is stored on or read from your device, so no consent under § 25 TDDDG is required. Legal basis: Art. 6 (1) (f) GDPR — our legitimate interest in understanding which pages and steps lead people to a scan or an account, and in testing alternative wording.

With your consent (“Agree” in the banner), we also keep a random ID in your browser's local storage (rb-visitor). It is sent with these events, with a request for a free scan, a report or an enquiry, and when you create an account, and we store it only in hashed form, so that visits on different days can be seen as one journey. Legal basis: Art. 6 (1) (a) GDPR and § 25 (1) TDDDG. “Decline”, or withdrawing your consent later via “Cookie settings” in the footer, deletes the ID from your browser.

A/B tests: from time to time we show different visitors different wording for one part of this website, such as a button, to learn which works better. Which version you see follows from the key above — the ID if you agreed, otherwise the daily key — and is recorded as an event. Nothing is decided about you as a person: there is no profile and no automated decision within the meaning of Art. 22 GDPR, and every version offers the same service on the same terms.

Retention: events and days of dashboard use are deleted after 13 months, the daily random value after one day. Our own crawler, browsers under automation and preview versions of this website send no events.

7. Google Ads and conversion measurement — only with your consent

We advertise our service with Google Ads. Only if you press “Agree” in our consent banner do we load Google's tag, which then sets cookies and transmits data to Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (and, where applicable, to Google LLC in the USA under the EU–US Data Privacy Framework and standard contractual clauses).

The purpose is conversion measurement: to see which advertisement led to a request for a scan or a demo, and to optimise our campaigns. Data processed may include: click identifiers, the pages you visit on this site, device and browser information, an IP address, and interaction events.

Until you agree, we operate Google Consent Mode v2 with all storage set to denied, and advertising data redaction switched on.

Legal basis: Art. 6 (1) (a) GDPR and § 25 (1) TDDDG (consent). You can withdraw consent at any time via “Cookie settings” in the footer, with effect for the future. Google's privacy information: policies.google.com/privacy.

8. Contact forms and email

If you send us a request for a free scan, a demo or a general enquiry, we process the details you enter (name, email address, company, website, your message) in order to answer you. The form is submitted to our own server function and forwarded to our internal inbox and CRM.

Legal basis: Art. 6 (1) (b) GDPR where your request relates to a contract or pre-contractual steps, otherwise Art. 6 (1) (f) GDPR (legitimate interest in answering enquiries). Providing the data is voluntary, but without an email address we cannot reply.

We keep enquiries for as long as needed to process them and afterwards in line with statutory retention obligations (generally 6 or 10 years for commercially relevant correspondence under § 257 HGB and § 147 AO). Enquiries with no commercial relevance are deleted after 12 months.

Email is delivered by Resend (Plus Five Five, Inc., 2261 Market Street #5039, San Francisco, CA 94114, USA) as a processor under Art. 28 GDPR, on the basis of the EU standard contractual clauses. We run no newsletter and no marketing automation; we do not pass your details to an external CRM.

9. When you run a free scan of your website

If you ask us to scan a website, our crawler retrieves publicly accessible pages of the domain you specify and stores the results (findings, screenshots, HTML fragments) in order to produce your report. Where those pages contain personal data, we process it solely to produce the report and delete the crawl data no later than 90 days after delivery, unless you become a customer and the data belongs to your account.

Legal basis: Art. 6 (1) (b) GDPR (performance of the requested service). Please only request scans for domains you are authorised to have tested.

10. Google Search Console, if your organisation connects it

If an administrator of your organisation connects Google Search Console in the dashboard, Reviseberg reads, with read-only access, the Search Console performance data — search queries, clicks, impressions, click-through rate, average position and the pages they led to — of the properties your organisation chooses, and the email address of the Google account used. We show it only to members of your organisation who can see the site concerned, keep at most 16 months of it, and delete it when the connection is removed. We do not use it to advertise, sell it, or use it to train AI models.

Reviseberg's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. You can also remove the access at any time in your Google account under third-party connections.

Legal basis: Art. 6 (1) (b) GDPR (performance of the contract with your organisation).

11. The visitor toolbar on our customers’ websites, and the apps and plugins that add it

Our customers can add an optional visitor toolbar to their own websites. This section is for visitors of those websites, and for the people who install the toolbar through a platform app or a plugin.

Visiting a website that uses the toolbar. Your browser loads the toolbar's script and its settings from reviseberg.com. Like any request for a file, that request carries your IP address, your browser's identification string and the address of the page, and it is logged like the server log files in section 3. Nothing is stored on your device until you change a setting in the toolbar: then your settings are kept in your browser's local storage on that website, they are not transmitted, and the toolbar's reset button deletes them. The toolbar sets no cookies and creates no ID. Once per page view, and only if you used it, it sends us counts of which of its features were used, so the website's owner can see how often the toolbar helps; the counts carry no ID and no IP address is stored with them. Legal basis: Art. 6 (1) (f) GDPR — the interest of the website's owner and of us in offering the toolbar the owner chose to add.

The assistant, if the website's owner turned it on. A typed or spoken request is first matched on your own device and sent nowhere. Only a request the toolbar cannot place there goes to an AI model, and only after a notice in the toolbar has told you which provider answers and what is sent. What is sent: your request, the toolbar's language, the settings you have on, and an outline of the page (headings, landmarks, the names of links and buttons, and the page's path without its query); the page's main text only when you ask about the page. Form values, the query string and anything the owner marked private are never sent. We keep no text of the request or the reply: we count the request against the website's limit, together with a salted hash of your IP address so no single visitor can use up the website's requests, and delete those counts at the end of the following month. If your browser's own speech recognition is used, your browser's vendor may process your voice under its own terms; the notice says so. Legal basis: Art. 6 (1) (b) GDPR — answering the request you sent.

Installing the toolbar through a platform app (Shopify, BigCommerce, Webflow, Wix, Square Online). When you install our app, we store the shop's address, or the ID the platform gives the shop, site or account, the access token the platform issues to us — encrypted, and used only to add our script tag to your storefront and to remove it again — the permissions granted, the Reviseberg site it is linked to, and the email address of the member of your organisation who linked it. We receive nothing about your shop's customers, orders or products, and the apps ask for no permission that would give us any. When you disconnect or uninstall the app, the token is deleted at once and the record is marked as uninstalled; it is deleted entirely when the platform asks us to erase the shop's data (Shopify does this 48 hours after an uninstall), when you ask us to, or with your organisation's account. Legal basis: Art. 6 (1) (b) GDPR (performance of the contract with your organisation).

Installing the toolbar through a plugin (WordPress, Shopware, TYPO3 and the other plugins on our download page). The plugin keeps your site key and its settings in your own system's database and sends nothing from your server to us or to anybody else. Removing the plugin removes its settings wherever the platform runs an uninstall step.

12. Recipients and transfers

We pass personal data only to processors who support us in operating this website and our business, each bound by a data processing agreement: Vercel (hosting), Supabase (database and file storage in the EU), Resend (email delivery), Plausible (cookieless reach measurement, EU), the AI provider named in the toolbar's notice when a visitor uses the assistant (section 11), and — only with your consent — Google for advertising measurement. Our own statistics (section 6) go to nobody beyond Vercel and Supabase. We do not sell personal data and do not use your data to train third-party AI models.

13. Security

This website is delivered exclusively over TLS (HTTPS). We apply technical and organisational measures appropriate to the risk, including access control, encryption in transit and at rest, and least-privilege access for our team. Report a suspected vulnerability to security@reviseberg.com.

14. Changes to this policy

We update this policy when our processing changes or the legal situation requires it. The current version is always available at this address. Version: 25 October 2026.