Privacy Policy

This privacy policy applies to the aclipp marketing website (our public site and related pages such as contact, blog, and pricing). Personal data processed when you use the aclipp web application (SaaS) as a customer or user under a contract with us is described in Section 3 of our Terms of Service. Connecting aclipp to an AI assistant such as ChatGPT or Claude is covered below under aclipp in AI assistants (MCP connections).

According to Art. 4 No. 1 of Regulation (EU) 2016/679, i.e., the General Data Protection Regulation (hereinafter "GDPR"), "processing" refers to any operation or set of operations such as the collection, recording, organization, structuring, storage, adaptation, alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure, or destruction of personal data, whether by automated means or not.

This privacy policy is intended to inform you particularly about the type, scope, purpose, duration, and legal basis for the processing of such data on the marketing website either under our own control or in conjunction with others. Additionally, we inform you about third-party components we use to optimize our website and improve the user experience, which may result in these third parties also processing data they collect and control.

Our Privacy Policy is structured as follows

1. Information about us as controllers of your data
2. The rights of users and data subjects
3. Information about data processing

1. Information about us as controllers of your data

The party responsible for this website (the "controller") under data protection law is:

2. The rights of users and data subjects

Regarding the data processing described in more detail below, users and data subjects have the right:

• To confirm whether data concerning them is being processed, to information about the processed data, to further information about the nature of the data processing, and to copies of the data (see also Art. 15 GDPR).
• To correct or complete incorrect or incomplete data (see also Art. 16 GDPR).
• To the immediate deletion of data concerning them (see also Art. 17 GDPR), or, alternatively, if further processing is necessary pursuant to Art. 17(3) GDPR, to restrict processing in accordance with Art. 18 GDPR.
• To receive copies of data concerning them and/or provided by them and to have these transmitted to other providers/controllers (see also Art. 20 GDPR).
• To lodge complaints with the supervisory authority if they believe that data concerning them is being processed by the controller in breach of data protection provisions (see also Art. 77 GDPR).

Additionally, the controller is obliged to inform all recipients to whom it discloses data of any such corrections, deletions, or restrictions on processing in accordance with Articles 16, 17(1), 18 GDPR. However, this obligation does not apply if such notification is impossible or involves a disproportionate effort. Users have a right to be informed about these recipients.

Likewise, under Art. 21 GDPR, users have the right to object to the future processing of data concerning them by the controller pursuant to Art. 6(1)(f) GDPR. In particular, an objection to data processing for the purpose of direct advertising is permissible.

3. Information about data processing

Your data processed when using our marketing website will be deleted or blocked as soon as the purpose of the storage ceases to apply, provided the deletion does not conflict with any statutory retention obligations or unless otherwise specified below.

Cookies

Session cookies

We use cookies on our website. Cookies are small text files or other storage technologies that are stored on your computer by your browser. These cookies process certain specific information about you, such as your browser, location data, or IP address. This processing makes our website more user-friendly, efficient, and secure, allowing us, for example, to display our website in different languages.

The legal basis for such processing is Art. 6(1)(b) GDPR, insofar as these cookies are used to collect data to initiate or process contractual relationships. If the processing is not for the initiation or processing of a contract, our legitimate interest lies in improving the functionality of our website. The legal basis is then Art. 6(1)(f) GDPR. When you close your browser, these session cookies are deleted.

Cookie consent banner and categories

We use a consent management tool to record your choices for the categories necessary and external content. Necessary cookies and similar technologies are used for essential functions (for example language preferences and security). Embedded third-party content, namely YouTube videos and the OpenFreeMap maps in our PR agency directory, is loaded only if you consent to the external content category or explicitly load a single video or map. You can change your choices at any time via the cookie banner or cookie settings on this website (including from this privacy page where we provide access to the settings). The legal basis for optional content is your consent under Art. 6(1)(a) GDPR; for strictly necessary technologies, Art. 6(1)(f) GDPR or Art. 6(1)(b) GDPR may apply.

Third-party cookies

Our website may also use cookies or similar technologies from companies with whom we cooperate for advertising, analysis, or improving the functionalities of our website. Please refer to the following sections, particularly regarding the legal basis and purpose of such third-party collection and processing.

Disabling cookies

You can refuse the use of cookies by changing the settings of your browser. Likewise, you can use your browser to delete cookies that have already been stored. The necessary steps and measures vary depending on the browser you use. If you have any questions, please use the help function or consult the documentation of your browser or contact its manufacturer for support. If you prevent or restrict the installation of cookies, not all functions of our website may be fully usable.

Contact

If you contact us by email or via the contact form, the data you provide will be used to process your request. This data is necessary for us to process and answer your inquiry; otherwise, we cannot or can only partially answer your inquiry (Art. 6(1)(b) GDPR). Your data will be deleted once we have fully answered your inquiry and there are no further legal obligations to retain your data, such as resulting from an order or contract.

To deliver messages triggered by the contact form, we use Resend, Inc., which processes the data required for transmission (for example sender, recipients, and message content) on our behalf.

We also store contact form submissions in our CRM, Attio (see below).

Hosting and server log files

Our website is hosted by Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA. Every time you open a page, the hosting servers automatically record information your browser transmits: your IP address, the date and time of the request, the page requested, the referring page, the amount of data transferred, the HTTP status code, and your browser and operating system. We need this data to deliver the website, keep it stable and secure, and investigate attacks and errors. The legal basis is Art. 6(1)(f) GDPR (our legitimate interest in a secure and working website). The log data is kept only for a short period and then deleted, unless an incident requires us to keep it longer to investigate it. Vercel processes this data on our behalf under a data processing agreement. Vercel may process data in the United States; see International transfers below. Further information: https://vercel.com/legal/privacy-policy.

Vercel Speed Insights and Vercel Analytics

We use Vercel Speed Insights and Vercel Analytics to monitor and improve the performance and aggregate use of our pages (for example loading times, visit statistics, and interaction patterns). The legal basis is Art. 6(1)(f) GDPR (legitimate interests in operating and improving the website). Further information: https://vercel.com/legal/privacy-policy.

Attio (CRM)

We use Attio (Attio Ltd., United Kingdom) as our customer relationship management system. When you submit the contact form, we store your name, email address, phone number, company (derived from your email domain) and message in Attio so we can handle your request and follow up with you about it. Attio processes this data on our behalf. The legal basis is Art. 6(1)(b) GDPR (steps prior to a contract) and Art. 6(1)(f) GDPR (our legitimate interest in managing business contacts). The European Commission has recognised the United Kingdom as providing an adequate level of data protection; where Attio or its subprocessors process data in other third countries, appropriate safeguards under GDPR apply (for example standard contractual clauses). Further information: https://attio.com/legal/privacy.

AI visibility check

On our website you can request a free AI visibility report for a website. To do this, we collect your business email address and the website address you enter, along with your language. We use this data to create the report, send it to you by email, and contact you about it. The website address is sent to AI services, currently Google Gemini, to check how AI assistants describe that website; your email address is not sent to them. We store the request and the report in our database, which runs on Google Cloud in the European Union, deliver the email through Resend (see below), and record the company behind the website in our CRM Attio (see above). The legal basis is Art. 6(1)(b) GDPR (you asked us for the report) and Art. 6(1)(f) GDPR (our legitimate interest in following up with interested companies). We keep the data as long as we need it for these purposes; you can ask us to delete it at any time.

aclipp in AI assistants (MCP connections)

You can connect your aclipp account to an AI assistant such as ChatGPT or Claude through our MCP server at https://api.aclipp.com/mcp, including through the aclipp plugin in ChatGPT. This section describes the processing for these connections; the processing of the workspace data itself under your contract with us is governed by Section 3 of our Terms of Service.

Data we process: your aclipp account identity (user ID and the email address you sign in with), the organizations, projects and permissions you approve on the consent screen, the access and refresh tokens we issue to the assistant, the requests the assistant sends to aclipp tools and the workspace data they return (for example media coverage, outlets, authors and the journalists named in coverage, analytics and AI visibility results), and usage metadata about each call (tool name, time, duration, success or error, the assistant's user agent, your user and organization ID).

Purposes: to sign you in and verify that the assistant may act on your behalf, to carry out the requests you make in the assistant, to protect the service against abuse (for example rate limits), to investigate errors, and to understand which tools are used so we can improve them. The legal basis is Art. 6(1)(b) GDPR (performance of the contract) and Art. 6(1)(f) GDPR (our legitimate interest in a secure, working and improving service).

Recipients: the provider of the AI assistant you connected (for example OpenAI for ChatGPT, Anthropic for Claude) receives the results of the tool calls you trigger and processes them under its own terms and privacy policy; we send it nothing you did not request through the assistant. Sign-in runs through Google Firebase Authentication, which may process data in the United States (see International transfers below). Our API, database and error logs run on Google Cloud in EU data centers. Usage metadata is sent to PostHog (PostHog Inc., EU region) for product analytics; the content of tool requests and results is removed before it leaves our infrastructure. Google and PostHog process this data on our behalf.

Retention: access tokens expire after one hour. Refresh tokens expire after 30 days unless the assistant renews them, and the connection lasts until you or an admin of your organization disconnects it, or you leave the organization. Error logs are deleted after 30 days. Usage metadata is kept as long as we need it for the purposes above. Workspace data stays in your aclipp workspace under your contract; the assistant provider keeps the results it received according to its own retention settings.

Your controls: you choose which organizations and projects an assistant may access, and write access is only granted if you approve it on the consent screen. You can disconnect an assistant at any time in aclipp under Settings, Developers, Connected apps or in the assistant itself; admins of your organization see and can disconnect every connection. Your rights under Section 2 apply; contact us at the address in Section 1.

Cal.com (scheduling)

Some pages embed Cal.com so you can book appointments. The data you enter is processed by Cal.com, Inc. as described in their privacy notice. The legal basis is typically Art. 6(1)(b) GDPR (steps prior to a contract) or Art. 6(1)(f) GDPR, depending on the interaction.

YouTube videos

Some pages show videos from YouTube, a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. The video loads only once you consent to the external content category or explicitly load that video; until then, YouTube receives nothing. We use YouTube's privacy-enhanced mode (youtube-nocookie.com). Once the video loads, Google receives technical data such as your IP address and device information, and may set cookies or similar technologies when you play it. The legal basis is your consent under Art. 6(1)(a) GDPR, which you can withdraw at any time in the cookie settings. Google may process data in the United States; see International transfers below. Further information: https://policies.google.com/privacy.

OpenFreeMap (map view in the PR agency directory)

The maps of our PR agency directory (the map view and the office maps on agency profiles) use map tiles from OpenFreeMap (operator: Zsolt Ero, Hungary), based on OpenStreetMap data. The map loads only once you consent to the external content category or explicitly load the map. Loading it sends your IP address to OpenFreeMap's servers so they can deliver the tiles. The legal basis is your consent under Art. 6(1)(a) GDPR. More information: https://openfreemap.org. We locate the agencies' offices in advance on our servers using OpenStreetMap's Nominatim geocoding service; no visitor data is involved. Links to Google Maps next to the addresses are plain links: data reaches Google only if you follow one.

Firebase and Google (reCAPTCHA)

We use Google Firebase services to protect the contact form against spam and abuse with reCAPTCHA. Google may process technical and usage data. The legal basis is typically Art. 6(1)(f) GDPR (security and fraud prevention) and/or Art. 6(1)(b) GDPR where applicable. Further information: https://policies.google.com/privacy.

Email delivery (Resend)

We use Resend, Inc. to send emails initiated through our website (for example notifications from the contact form). The legal basis is Art. 6(1)(b) GDPR or Art. 6(1)(f) GDPR. Further information: https://resend.com/legal/privacy.

International transfers

Where personal data is transferred to countries outside the European Economic Area, we rely on appropriate safeguards under GDPR, such as standard contractual clauses adopted by the European Commission and/or the EU–US Data Privacy Framework where the recipient participates.

Surveys and promotions

If you take part in surveys or promotions we offer, we will inform you at the point of collection about the specific processing and legal basis. Lead forms on the website are generally handled as described under Attio (CRM) above.