Datenschutzerklärung
Wie wir personenbezogene Daten auf unserer Website gen23.ai und in unserer App auf gen23.app verarbeiten.
1. Data protection at a glance
General notes
The following notes give a simple overview of what happens to your personal data when you visit our website gen23.ai, use our app on gen23.app or open a space that one of our customers shares with you. Personal data is any data that can identify you personally. You'll find detailed information in the sections below.
Who is responsible for the data collection?
Data on gen23.ai and gen23.app is processed by the operator, Maximilian Wolf. You'll find the contact details under Controller in section 3.
How do we collect your data?
You give us some data yourself, for example when you request a demo, email us, create an account or accept an invitation to an organization.
Our IT systems collect other data automatically when you visit the website or use the app. This is mainly technical data, such as your browser, your operating system or the time of your visit.
What do we use your data for?
We use part of the data to provide the website and the app without errors, to answer your requests and to run your account. Other data helps us understand how the website, the app and the spaces are used, so we can improve them.
What rights do you have regarding your data?
You have the right to receive information free of charge about the origin, recipients and purpose of your stored personal data at any time. You also have the right to request that this data be corrected or deleted. If you have given consent to data processing, you can withdraw it at any time with effect for the future. Under certain circumstances, you can also request that the processing of your personal data be restricted. You also have the right to lodge a complaint with the competent supervisory authority.
For this and any other questions about data protection, you can contact us at any time at mwolf@foldfocus.com.
Analysis tools
When you visit our website gen23.ai, open a space or use our app, your behavior can be analyzed statistically, mainly with analysis tools. The previews of example spaces on gen23.ai also load pages from gen23.app (see section 7). You'll find details in section 5.
2. Hosting
We host the website, the app and their data with the following providers. They process personal data only on our behalf and according to our instructions.
Cloudflare
Our website gen23.ai and the front end of our app on gen23.app are hosted and delivered by Cloudflare. The provider is Cloudflare, Inc., USA. Cloudflare also optimizes the images on gen23.ai and protects both domains against attacks.
When you visit gen23.ai or gen23.app, your browser connects to Cloudflare's servers. Cloudflare processes your IP address, the requested page, the time of the request and technical information about your browser. Cloudflare runs a worldwide network, so a server outside the EU may answer your request.
We use Cloudflare in our legitimate interest in delivering the website and the app securely, quickly and reliably (Art. 6(1)(f) GDPR).
DigitalOcean
The server of our app on server.gen23.app, its database and the files uploaded to the app are hosted by DigitalOcean. The provider is DigitalOcean, LLC, USA. We use its data center in Frankfurt, Germany. Uploaded files are delivered through DigitalOcean's content delivery network.
This includes your account data, the content of organizations and spaces, and the files you upload. We use DigitalOcean to fulfill our contracts with our customers (Art. 6(1)(b) GDPR) and in our legitimate interest in running the app securely and reliably (Art. 6(1)(f) GDPR).
Data processing agreements
To ensure that your data is processed in compliance with data protection law, we have concluded a data processing agreement (Art. 28 GDPR) with Cloudflare and with DigitalOcean.
3. General notes and mandatory information
Data protection
We take the protection of your personal data very seriously. We treat your personal data confidentially and in accordance with the statutory data protection regulations and this privacy policy.
When you use our website and our app, various personal data is collected. This privacy policy explains what data we collect, what we use it for, and how and for what purpose this is done.
Please note that data transmission on the internet, for example when communicating by email, can have security gaps. Complete protection of data against access by third parties isn't possible.
Controller
The controller is the natural or legal person who, alone or jointly with others, decides on the purposes and means of processing personal data, such as names or email addresses. The controller for data processing on gen23.ai and gen23.app is:
Maximilian Wolf Sole proprietor Remystr. 4 56170 Bendorf Germany Email: mwolf@foldfocus.com
Storage duration
Unless this privacy policy specifies a more specific storage period, your personal data remains with us until the purpose for processing it no longer applies. If you make a justified request for deletion or withdraw your consent to data processing, we delete your data unless we have other legally permissible reasons for storing it, such as retention periods under tax or commercial law. In that case, we delete it once these reasons no longer apply.
Data transfers to the USA and other third countries
Some of the providers we use are based in the USA or other countries outside the EU, or process data there. Where the European Commission has decided that a country ensures an adequate level of data protection, for example for companies in the USA that are certified under the EU-U.S. Data Privacy Framework, we transfer data on the basis of that decision (Art. 45 GDPR). Otherwise, transfers are based on the EU standard contractual clauses (Art. 46(2)(c) GDPR).
Withdrawal of your consent to data processing
Some data processing is only possible with your express consent. You can withdraw consent you have already given at any time. The withdrawal doesn't affect the lawfulness of the processing carried out until then.
Right to object to data collection in special cases and to direct marketing (Art. 21 GDPR)
If data processing is based on Art. 6(1)(e) or (f) GDPR, you have the right to object to the processing of your personal data at any time on grounds relating to your particular situation. This also applies to profiling based on these provisions. You'll find the legal basis of each processing in this privacy policy. If you object, we'll no longer process your personal data unless we can demonstrate compelling legitimate grounds for the processing that override your interests, rights and freedoms, or the processing serves to establish, exercise or defend legal claims (objection under Art. 21(1) GDPR).
If your personal data is processed for direct marketing, you have the right to object at any time to the processing of personal data concerning you for such marketing. This also applies to profiling to the extent that it's related to such direct marketing. If you object, your personal data will no longer be used for direct marketing (objection under Art. 21(2) GDPR).
Right to lodge a complaint with a supervisory authority
If the GDPR is breached, you have the right to lodge a complaint with a supervisory authority, in particular in the member state of your habitual residence, your place of work or the place of the alleged breach. This right exists without prejudice to any other administrative or judicial remedies.
The supervisory authority responsible for us is the State Commissioner for Data Protection and Freedom of Information of Rhineland-Palatinate (Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Rheinland-Pfalz), Hintere Bleiche 34, 55116 Mainz, Germany.
Right to data portability
You have the right to have data that we process automatically on the basis of your consent or to fulfill a contract handed over to you or to a third party in a common, machine-readable format. If you request the direct transfer of the data to another controller, we'll do so only as far as it's technically feasible.
Information, correction and deletion
Within the applicable legal provisions, you have the right at any time to free information about your stored personal data, its origin and recipients and the purpose of the processing, and, where applicable, the right to have this data corrected or deleted. For this and any other questions about personal data, you can contact us at any time at mwolf@foldfocus.com.
Right to restriction of processing
You have the right to request that the processing of your personal data be restricted. You can contact us about this at any time at mwolf@foldfocus.com. This right exists in the following cases:
- If you dispute the accuracy of your personal data stored by us, we usually need time to check it. For the duration of the check, you have the right to request that the processing of your personal data be restricted.
- If the processing of your personal data was or is unlawful, you can request the restriction of processing instead of deletion.
- If we no longer need your personal data, but you need it to exercise, defend or assert legal claims, you have the right to request the restriction of processing instead of deletion.
- If you have objected under Art. 21(1) GDPR, your interests and ours have to be weighed against each other. As long as it hasn't been decided whose interests prevail, you have the right to request that the processing of your personal data be restricted.
If you have restricted the processing of your personal data, this data may, apart from being stored, only be processed with your consent, to establish, exercise or defend legal claims, to protect the rights of another natural or legal person, or for reasons of important public interest of the European Union or a member state.
SSL and TLS encryption
For security reasons and to protect the transmission of confidential content, such as the requests you send us as the operator, gen23.ai and gen23.app use SSL or TLS encryption. You can recognize an encrypted connection by the address in your browser starting with https:// instead of http:// and by the lock icon in your browser bar.
When SSL or TLS encryption is active, third parties can't read the data you send to us.
Objection to advertising emails
We hereby object to the use of the contact details published under our legal notice obligation for sending advertising and information material that we haven't expressly requested. We expressly reserve the right to take legal action if unsolicited advertising, such as spam emails, is sent.
4. Data collection on our website and in our app
Cookies and browser storage
Our website gen23.ai sets no cookies.
Our app on gen23.app stores your login session in cookies in your browser, so you stay logged in. These cookies are technically necessary to provide the app you requested (§ 25(2) no. 2 TDDDG), and we process the data in them to fulfill our contract with you or your organization (Art. 6(1)(b) GDPR).
The app also saves some information in your browser's local and session storage, for example your choice to turn off analysis (see section 5). Hotjar and the services described in section 7 can set their own cookies.
Server log files
When you use our app, our server logs every request with the requested address, the response status, the response time and, if you're logged in, your user ID and organization ID. We use these logs to run the app securely and to find errors, and store them with Better Stack (see section 6). Cloudflare and DigitalOcean also process technical data about every request, including your IP address (see section 2).
The legal basis is our legitimate interest in running the website and the app securely and without errors (Art. 6(1)(f) GDPR).
Demo requests
You can request a demo of GEN23 with the form on gen23.ai. The form is provided by Lead Booster Pro, our own form software, and loads from app.leadboosterpro.io. We store the data you enter, such as your name, your email address and your company, to handle your request and to contact you about the demo. Lead Booster Pro also records how the form is used, for example which steps are completed, so we can improve it.
The processing is based on Art. 6(1)(b) GDPR, since your request serves to prepare a contract. We store the data until your request has been handled, unless it leads to a contract or statutory retention periods apply.
Contact by email
If you contact us by email, we store your request, including all personal data it contains, such as your name and your request, to process it. We don't pass this data on without your consent.
The processing is based on Art. 6(1)(b) GDPR if your request is related to the performance of a contract or is necessary to take steps before entering into a contract. In all other cases, it's based on our legitimate interest in effectively handling the requests sent to us (Art. 6(1)(f) GDPR) or on your consent (Art. 6(1)(a) GDPR) if we asked for it.
The data you send us remains with us until you ask us to delete it, withdraw your consent to its storage, or the purpose for storing it no longer applies, for example after your request has been handled. Mandatory statutory provisions, in particular retention periods, remain unaffected.
User account
To use our app, you create an account with your first name, last name, email address and a password, or you sign in with your Google account. We store your password only as a salted hash. If a member of an organization invites you, we store your email address to send you the invitation (see section 6).
When you register, we also store the browser, operating system and device type you use, and your approximate location (country, region, city and time zone). We determine the location from your IP address on our own server with a local database, without passing your IP address on to anyone.
We process your account data to provide your account and the app (Art. 6(1)(b) GDPR), and the registration details in our legitimate interest in understanding which devices and regions our customers use (Art. 6(1)(f) GDPR). We store this data until your account is deleted, unless statutory retention periods require us to keep it longer.
Sign in with Google
You can sign in to our app with your Google account. The provider is Google Ireland Limited, Ireland. When you use this option, Google confirms your identity to us and shares your name, your email address and your Google account ID with us. Google learns that you're signing in to GEN23.
The legal basis is the performance of our contract with you (Art. 6(1)(b) GDPR). You can always register with your email address and a password instead.
Spaces
Our customers use GEN23 to create spaces, personal web pages for their prospects and clients. For personal data that a customer adds to their organization and spaces, for example the names of their prospects, we act as a processor on the customer's behalf (Art. 28 GDPR). For that data, the customer who shares the space with you is the controller, so please contact them with any requests about it.
When you open a space or a page of our app, we record the page view with the page address and the page you came from. If you're logged in, we link the page view to your user ID. We store page views in our database and send them to Mixpanel (see section 5).
The legal basis is our legitimate interest in understanding how spaces and the app are used, so we can improve them (Art. 6(1)(f) GDPR).
5. Analysis tools
Plausible runs on our website gen23.ai. Plausible and Hotjar run on the spaces on gen23.app, including the documentation and examples in the GEN23 library. Mixpanel receives events from our server. The previews of example spaces on gen23.ai load Plausible and Hotjar from gen23.app (see section 7).
Plausible Analytics
We use Plausible Analytics to count visits to our website and to spaces. The provider is Plausible Insights OÜ, Estonia.
Plausible measures page views, the referring website, and the country, browser, operating system and device type of visitors. It uses no cookies and doesn't store IP addresses. To count unique visitors, Plausible creates an anonymous identifier from your IP address and browser with a key that is deleted and replaced every 24 hours. All data is processed and stored in the EU.
The legal basis is our legitimate interest in understanding how our website and spaces are used, so we can improve them (Art. 6(1)(f) GDPR).
Hotjar
We use Hotjar to understand how visitors use spaces. The provider is Hotjar Ltd., Malta, which is part of Contentsquare.
Hotjar can record your mouse movements, clicks and scrolling, and how long you stay on a page. From this, it creates heatmaps that show which parts of a page visitors look at most. Hotjar uses cookies and comparable technologies to recognize returning visitors.
The legal basis is our legitimate interest in analyzing how spaces are used, so we can improve them (Art. 6(1)(f) GDPR).
Mixpanel
We use Mixpanel to analyze how our app is used. The provider is Mixpanel, Inc., USA. We use Mixpanel's EU data residency, so the data is stored in the EU.
Our server sends Mixpanel events such as registrations, logins, page views and created spaces. For logged-in users, the events carry your user ID, and we also send your name, your email address and information about your account, so we can assign the events to your account. Mixpanel sets no cookies in your browser, since the data comes from our server.
The legal basis is our legitimate interest in understanding how our customers use the app, so we can improve it (Art. 6(1)(f) GDPR).
Turning off analysis
You can turn off Plausible, Hotjar and the events our app sends from your browser, such as page views, by opening an address with ?tracking=off at the end, for example https://gen23.ai/?tracking=off for our website and https://gen23.app/space/library/?tracking=off for our app and spaces. Your browser saves this choice in its local storage, separately for gen23.ai and gen23.app. To turn analysis back on, open an address with ?tracking=on at the end. The choice applies only to the browser you used, so repeat it for both domains, in every browser and on every device.
6. Emails, logs and notifications
SendGrid
We send the app's emails, such as invitations to an organization and emails to reset your password, with SendGrid. The provider is Twilio Inc., USA. SendGrid processes your email address, the content of the email and technical information about its delivery.
The legal basis is the performance of our contract with you or your organization (Art. 6(1)(b) GDPR). For invitations, it's the legitimate interest of the organization that invites you in adding you as a member (Art. 6(1)(f) GDPR).
Better Stack
We store the logs and error messages of our server with Better Stack. The provider is Better Stack, Inc., USA. The request logs contain your user ID and organization ID, but not your IP address.
The legal basis is our legitimate interest in running the app securely and without errors (Art. 6(1)(f) GDPR).
Slack
When someone creates an account in our app, our server sends their first name, last name, email address and user ID to our internal Slack workspace, so we know about new customers right away. Slack is a service of Slack Technologies, which is part of Salesforce.
The legal basis is our legitimate interest in supporting new customers personally (Art. 6(1)(f) GDPR).
7. Embedded content
Previews of example spaces
Some pages of gen23.ai show live previews of example spaces from our app. When a preview loads, your browser connects to gen23.app, which is hosted by Cloudflare (see section 2). The example spaces load the analysis tools described in section 5 and can contain the content described below.
Videos from YouTube, Vimeo and Loom
Spaces can contain videos from YouTube, Vimeo and Loom. When a space with a video loads, your browser fetches the title and preview image of the video from its provider, which transmits your IP address to it. The video player itself only loads when you click the video. The provider can then set cookies and collect data about how you use the video.
We embed YouTube videos in YouTube's privacy-enhanced mode (youtube-nocookie.com). The provider of YouTube is Google Ireland Limited, Ireland. The provider of Vimeo is Vimeo.com, Inc., USA. The provider of Loom is Loom, Inc., USA, which is part of Atlassian.
We use these services in our legitimate interest in an appealing presentation of spaces (Art. 6(1)(f) GDPR).
Calendly
Spaces can contain a booking calendar from Calendly. The provider is Calendly, LLC, USA. When the calendar loads, your browser connects to Calendly's servers, which transmits your IP address, and Calendly can set cookies. If you book an appointment, Calendly processes the data you enter, such as your name and your email address, for the person you book with.
We use Calendly in our legitimate interest in letting visitors book appointments easily (Art. 6(1)(f) GDPR). If you book an appointment, the legal basis is taking steps before entering into a contract (Art. 6(1)(b) GDPR).
Content from other websites
Our customers can show images and documents in their spaces that are stored on other websites. Your browser then loads them directly from those websites, which transmits your IP address to their operators.
Fonts
Our website and our app load their fonts from our own servers. Your browser doesn't connect to Google Fonts or any other font provider.