Plain words. Here too.

Provider

Richard Mann
c/o Autorenglück #44796
Albert-Einstein-Str. 47
02977 Hoyerswerda
Deutschland

Business postal address via Autorenglück. Personal address is available on request to authorized bodies.

Contact

Email: [email protected]

Company Form

Sole proprietor, small business under §19 UStG (German Value Added Tax Act).
A value added tax identification number is not available.

Responsible for the Content

Richard Mann (address as above)

EU Commission platform for online dispute resolution

https://ec.europa.eu/consumers/odr

I am neither obliged nor willing to participate in a dispute resolution procedure before a consumer arbitration board.

Liability for Content

As a service provider, I am responsible for my own content on these pages under general law in accordance with §7 para.1 TMG (German Telemedia Act). According to §§8 to 10 TMG, however, as a service provider I am not obliged to monitor transmitted or stored third-party information or to investigate circumstances that indicate illegal activity.

Obligations to remove or block the use of information under general law remain unaffected by this. However, liability in this respect is only possible from the point in time at which knowledge of a specific legal violation is obtained. Upon becoming aware of corresponding legal violations, I will remove this content immediately.

Liability for Links

My offering contains links to external third-party websites, over whose content I have no influence. For this reason, I cannot assume any liability for this third-party content. The respective provider or operator of the pages is always responsible for the content of the linked pages.

Copyright

The content and works on these pages created by the site operator are subject to German copyright law. Duplication, processing, distribution and any kind of exploitation outside the limits of copyright require the written consent of the respective author or creator.

1. Controller

Controller within the meaning of the Datenschutz-Grundverordnung (DSGVO, GDPR):

Richard Mann
c/o Autorenglück #44796
Albert-Einstein-Str. 47
02977 Hoyerswerda
Germany
Email: [email protected]

2. General Information on Data Processing

I process personal data only insofar as this is necessary to provide this website and my content and services. As a rule, processing takes place only with the consent of the user (Art. 6(1)(a) GDPR) or where processing is permitted by statutory provisions (Art. 6(1)(b), (c), (f) GDPR).

3. Cookies & consent

On your first visit we show a consent banner. We always set strictly necessary cookies — no consent is required for these (Art. 6(1)(b) and (f) GDPR). The optional analytics category is off by default and is only activated after your explicit consent. We store your choice locally in your browser (first-party, not a cookie). You can change or withdraw it at any time via “Cookie settings” in the footer; withdrawing is as easy as consenting.

Necessary — always on:

• Clerk sets session cookies required for login and session security.
• Stripe sets cookies only during the checkout process on the checkout pages operated by Stripe.
• Functional preferences (e.g. sidebar, view) are stored locally in your browser.

Optional — only with consent:

• Analytics (PostHog, EU hosting Frankfurt): reach and usage analytics and session replays. PostHog operates in two stages: without consent it only performs anonymous reach measurement in memory — no cookie, no localStorage, no access to your device(legitimate interest, Art. 6(1)(f) GDPR). Only with your consent (Art. 6(1)(a) GDPR) does PostHog set persistent identifiers (cookie + localStorage), link the measurement to your account and record session replays. On withdrawal we switch back to the anonymous stage and delete the identifiers PostHog has set. With your consent, and for the anonymous measurement on product and freebie pages, the measurement data reaches PostHog through our own domain (ikrames.com/ingest). This way it reaches PostHog even when a tracking blocker blocks the direct connection; the scope of the data collected does not change.

No third-party advertising cookies are set and no data is shared with third parties for advertising purposes.

4. Hosting (Railway)

Our application and the render service are operated at Railway; since 17 August 2026 they run in the European Union (Amsterdam, Netherlands) on Google Cloud Platform infrastructure. The provider is Railway Corporation, San Francisco, USA. Railway processes account and usage data of our account as an independent controller in the United States as well; the basis for that transfer are the EU standard contractual clauses (data processing agreement of 16 August 2026).

When the website is accessed, technically necessary data is processed (server logs):

• IP address of the accessing device
• Date and time of access
• Accessed URL and HTTP status code
• User agent (browser and operating system)
• Referrer URL

The legal basis is Art. 6(1)(f) GDPR (legitimate interest in the stable provision of the website). The transfer to the USA mentioned above is governed by the EU Standard Contractual Clauses (SCC, Module 2 Controller-to-Processor), which Railway's data processing agreement (DPA) incorporates (applicable law: Irish law).

Data processing agreement (DPA): railway.com/legal/dpa. List of sub-processors: trust.railway.com. Railway data protection contact: [email protected]

5. DNS and Security (Cloudflare)

To provide the domain and for security functions (protection against DDoS, SSL encryption), Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA is used. For this purpose, Cloudflare processes technically necessary connection data including the IP address.

Legal basis: Art. 6(1)(f) GDPR. Cloudflare is certified under the EU-US Data Privacy Framework.

Cloudflare privacy policy: cloudflare.com/privacypolicy

6. Waitlist (Supabase)

If you sign up for the waitlist, the following data is processed and stored in a database at Supabase PTE. LTD., 65 Chulia Street #38-02/03, OCBC Centre, Singapore 049513. The server location is the project region eu-west-1 (Ireland, European Union):

• Email address
• Your answer to the form's single question: how your brand's content has mainly been created over the past three months. You pick one of five given answers; there is no free-text field.
• Plan, billing cycle and the occasion of the sign-up — these three follow from which button you clicked, you do not enter them.
• Where the sign-up came from: the campaign parameters in the address you opened (utm_source, utm_medium, utm_campaign), or the referring page. This lets us tell sign-ups from different channels apart; it does not identify a person.
• Time of registration
• The time of your consent and the version of the consent text you agreed to

Purpose: information about the launch and about Founder offers from Ikrames, and getting in touch with you about early access. Your answer to the question above is only evaluated in aggregate across all sign-ups, so that we understand how the people interested in Ikrames work today. Legal basis: Art. 6(1)(a) GDPR — your consent, which you give explicitly when you submit the form. Without that checkbox nothing is stored.

Signing up includes a confirmation email: we send you a link, and your address counts as confirmed only once you have opened it. Until you do, we send you no further emails.

After confirming, you can optionally answer two questions about how your content gets made (monthly spend and weekly hours, each as a choice from given ranges). These answers are voluntary, the waitlist works exactly the same without them, and they fall under the same consent as your sign-up.

You can withdraw your consent at any time with effect for the future: an informal email to [email protected] is enough, and you do not have to give a reason. This does not affect the lawfulness of the processing carried out before the withdrawal.

Retention period: until you withdraw your consent, at the latest until the early-access outreach is complete. After that we delete your data or, with your consent, transfer it into a customer account.

The data is held in the EU (Ireland). As our processor, however, Supabase may also access it from outside the EU — for support and administration, or via sub-processors. That transfer is based on the EU Standard Contractual Clauses incorporated into Supabase's data processing agreement, which takes effect upon acceptance of the terms.

Supabase privacy policy: supabase.com/privacy

7. Authentication (Clerk)

For the login area, Clerk Inc., 660 King Street, San Francisco, CA 94107, USA is used. When you register or sign in, the following data is processed:

• Email address
• Optional: name, profile picture
• Session data and IP address for session security
• Timestamp of the login

Legal basis: Art. 6(1)(b) GDPR (performance of a contract). Clerk is certified under the EU-US Data Privacy Framework.

Clerk privacy policy: clerk.com/legal/privacy

8. Payment Processing (Stripe)

For the processing of payments (subscriptions, one-time purchases, Founder offers), Stripe is used. Our contracting party is Stripe Payments Europe, Limited, 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland — a company established in the European Union. The transfer of your payment data to Stripe is therefore not a transfer to a third country. The group's parent company is Stripe, Inc., 354 Oyster Point Boulevard, South San Francisco, CA 94080, USA.

During a payment process, the following data is transmitted to Stripe and processed there:

• Name and email address
• Billing address (if provided)
• Payment data (credit card information, IBAN, etc.) — this is transmitted directly from the browser to Stripe and is not stored on my servers
• Transaction amount and currency
• IP address for fraud prevention
• Device information and browser metadata

The legal basis is Art. 6(1)(b) GDPR (performance of a contract) as well as Art. 6(1)(f) GDPR (legitimate interest in fraud prevention).

Stripe processes part of this data not on our behalf but as an independent controller within the meaning of Art. 4(7) GDPR — in particular to detect and prevent fraudulent transactions, to meet its own legal and regulatory obligations, and to involve banks and payment method providers. Stripe determines the purposes and means of that processing itself; it is not covered by our mandate. Stripe's own privacy policy governs in that respect.

Within the Stripe group, data may be passed on to Stripe, Inc. in the USA. Stripe is responsible for that onward transfer as our processor; it is governed by Stripe's data processing agreement, which incorporates the EU Standard Contractual Clauses.

Stripe privacy policy: stripe.com/de/privacy

9. Handling of Cancellations

When you submit a declaration through our cancellation button or our withdrawal button, we record it before we do anything else. The time of receipt is the legally decisive fact: the deadlines run from that moment, whether or not our confirmation email arrives. We process:

• Name
• Email address
• Type of declaration (cancellation or withdrawal)
• for a cancellation: ordinary or extraordinary
• for an extraordinary cancellation: a voluntary reason. Your cancellation is just as valid without it, and we do not need any details about your health or your finances.
• Contract designation and desired termination date, if provided
• Time of receipt

Purpose: handling your cancellation and keeping it verifiable — the match to your contract, the termination on the correct date, and the record of when your declaration reached us. Legal basis: Art. 6(1)(b) GDPR (performance of the contract, including its termination).

We ask for nothing here beyond the statutory mandatory details — no retention offer, no survey, and no question about your reasons for an ordinary cancellation.

Recipients: the data is held in our database at Supabase (server location eu-west-1, Ireland). We send your confirmation of receipt via Resend, with a copy to our own contact address. Both providers appear with their purpose and legal basis in the overview below.

Retention period: until your account is deleted. If you delete your account, the declaration is deleted with it. Declarations we could not match to an account are kept until the case has been resolved manually; after that we delete them. You can request deletion at any time by emailing [email protected].

10. AI Services for Content Generation

Ikrames uses the following AI service providers to generate content (images, videos, audio, text) and for machine classifications (for example whether a support request is genuine). Since 24 September 2026, requests to the Claude models run mostly via OpenRouter with EU routing, where they are processed by Amazon Web Services (Ireland) or Google Cloud (Europe), which operate the Claude models. Three paths still call Anthropic directly for now: the in-product assistant, the onboarding chat and the Auto-Planner's web research.

fal.ai (Features & Labels, Inc., 2261 Market St Suite 10467, San Francisco, CA 94114, USA) — media inference (image, video, audio and transcription models). Legal basis: Art. 6(1)(b) GDPR. Data transfer to the USA on the basis of Standard Contractual Clauses. When processing personal data, we set the header X-Fal-Store-IO: 0 to suppress storage of the requests. Details: fal.ai/legal/privacy-policy

Anthropic (Anthropic Ireland, Limited, 6th Floor, South Bank House, Barrow Street, Dublin 4, Ireland; parent company: Anthropic PBC, San Francisco, USA) — language models (Claude) for processing content texts. Our contracting party is the Irish company; the transfer to it is therefore not a transfer to a third country. Any onward intra-group transfer to the USA is governed by Anthropic's data processing agreement, which incorporates the EU Standard Contractual Clauses. Legal basis: Art. 6(1)(b) GDPR. Inference data is not used for training. Details: anthropic.com/legal/privacy

OpenAI (OpenAI, L.L.C., USA) — transcription of voice recordings (Whisper) and text embeddings. Legal basis: Art. 6(1)(b) GDPR. Details: openai.com/policies/privacy-policy

OpenRouter (OpenRouter, Inc., USA) — routing of model requests. OpenRouter does not operate models of its own; it forwards the request to the respective model provider, which in our case are TypeSafe AI (decisions, below) and the Claude models via EU routing (see above). For the language-model route we use OpenRouter's EU routing (eu.openrouter.ai): request and response are processed within the EU. Legal basis: Art. 6(1)(b) GDPR. Data transfer to the USA on the basis of Standard Contractual Clauses under Art. 46 GDPR. If a request to Jev contains text written by people, such as support requests, we first replace email addresses, phone numbers, profile links and names following a salutation with placeholders; names without a salutation and @-handles may remain. The exception is the check of a post immediately before publication: its text is sent to Jev unchanged, because it becomes public right afterwards. For requests to Jev we additionally send provider.data_collection: "deny" so that only providers without data collection are used. Details: openrouter.ai/privacy

TypeSafe AI (USA) — decision model (Jev). It assesses whether a support request is genuine, whether a signal fits the brand, whether a text matches a brand's voice, whether a post is fine to publish automatically and whether an action by the assistant needs approval. It does not generate content. The request reaches TypeSafe AI via OpenRouter, masked as described above. Legal basis: Art. 6(1)(b) GDPR. We have not received a basis for the transfer to the USA (Standard Contractual Clauses) from TypeSafe AI in writing. Details: docs.typesafe.ai

ElevenLabs (Eleven Labs Inc., 169 Madison Ave #2484, New York, NY 10016, USA) — text-to-speech, voice clones and music generation. Legal basis: Art. 6(1)(b) GDPR. Data transfer to the USA on the basis of Standard Contractual Clauses. Details: elevenlabs.io/privacy

11. Social Media Publishing (Bundle.social)

Provider: BUNDLE sp. z o.o., ul. Hoża 86/410, 00-682 Warsaw, Poland. Data processed: connected social media accounts, OAuth tokens, post content. Processing takes place in the European Economic Area; individual subprocessors and the connected platforms may process data outside the EEA. Legal basis: Art. 6(1)(b) GDPR.

Bundle.social privacy policy: bundle.social/privacy

12. Product Improvement Through Aggregated Statistics

We analyse performance data of published content (e.g. reach, impressions, interactions, follower trends) as well as related content characteristics (e.g. format, template, time of publication) in aggregated, de-identified form across customers in order to improve Ikrames — for instance for better defaults, generation quality and planning recommendations.

The following applies: analyses are only produced above fixed minimum thresholds (several brands from several mutually independent accounts), so that no conclusions can be drawn about individual customers, brands or persons. No profiling of natural persons takes place; data is not passed on to third parties for this purpose.

The legal basis is our legitimate interest in improving and further developing the service (Art. 6(1)(f) GDPR). You may object to this processing at any time with effect for the future (Art. 21 GDPR); please contact us via the channels stated in the legal notice.

13. Overview of Recipients and Processors

As part of providing Ikrames, personal data is processed by the following service providers:

• Railway — Hosting of the application and the render service (app data in transit, server logs). Operated in the EU (Amsterdam, Netherlands) since 17 August 2026, on Google Cloud Platform infrastructure. In addition, Railway processes account and usage data of our own account as an independent controller in the United States (basis: EU standard contractual clauses, Module 2, from the data processing agreement concluded on 16 August 2026). Provider: Railway Corporation, San Francisco, USA
• Supabase — Database and file storage (all user data). Project region eu-west-1 (Ireland, EU)
• Clerk — Identity and authentication (email, name, sessions)
• Stripe — Payments and invoices
• Bundle.social — Publishing to social networks: access keys of the connected channels and the content of the posts (texts, images, videos). Provider: BUNDLE sp. z o.o., ul. Hoża 86/410, 00-682 Warsaw, Poland; processing within the European Economic Area
• ElevenLabs — Voice clones (voice samples)
• Anthropic — LLM processing of content texts (Claude language models) for three paths that still call Anthropic directly for now: the in-product assistant, the onboarding chat and the Auto-Planner's web research (the contracting party is the Irish entity, see the AI services section). All other Claude requests run via OpenRouter with EU routing (see there)
• IONOS — LLM processing of content texts (Llama 3.3 language model in the AI Model Hub). Provider: IONOS SE, Elgendorfer Straße 57, 56410 Montabaur, Germany; processed in the Berlin data centre, i.e. within the EU — no transfer to a third country takes place
• OpenAI — Whisper transcription of standalone voice recordings, embeddings
• fal.ai — Image and video generation (prompts, in part brand images) and transcription of video audio tracks
• Cloudflare — DNS/proxy for ikrames.com
• PostHog — Product and reach analytics (page views, usage events) and session replays. EU hosting in Frankfurt (Germany). Anonymous reach measurement without access to your device on the basis of legitimate interest (Art. 6(1)(f) GDPR); identified analytics and session replays only with your consent (Art. 6(1)(a) GDPR). Provider: PostHog, Inc., 2261 Market St. #4008, San Francisco, CA 94114, USA. The data is hosted in the EU; where PostHog processes it in the USA beyond that, the EU Standard Contractual Clauses from PostHog's data processing agreement apply
• Resend — Delivery of system and transactional emails (recipient address, subject, message content). Provider: Plus Five Five, Inc. (trading as “Resend”), 2261 Market Street #5039, San Francisco, CA 94114, USA; basis: EU standard contractual clauses. Covers the acknowledgement for cancellation/withdrawal, the purchase confirmation for digital products, and the delivery of freebies together with the corresponding confirmation and welcome email
• OpenRouter — Routing of model requests: Claude requests via EU routing (processed by Amazon Web Services, Ireland, or Google Cloud, Europe) and decision requests to the model Jev (support gate, signal relevance, voice match, check before automatic publishing, assistant guard). OpenRouter does not operate a model of its own. Provider: OpenRouter, Inc., USA; the transfer is based on Standard Contractual Clauses under Art. 46 GDPR. If a request to Jev contains text written by people, such as support requests, we first replace email addresses, phone numbers, profile links and names following a salutation with placeholders; names without a salutation and @-handles may remain. The exception is the check of a post immediately before publication: its text is sent to Jev unchanged, because it becomes public right afterwards. For requests to Jev we additionally send `provider.data_collection: "deny"` so that only providers without data collection are used
• TypeSafe AI — Decision model (Jev): assesses whether a support request is genuine, whether a signal fits the brand, whether a text matches a brand's voice, whether a post is fine to publish automatically and whether an action by the assistant needs approval (support gate, signal relevance, voice match, check before automatic publishing, assistant guard). It does not generate content. Reachable exclusively via OpenRouter, masked as described above. Provider in the USA; we have not received a basis for the transfer to the USA (Standard Contractual Clauses) from TypeSafe AI in writing
• Inngest — Job orchestration (event payloads containing user and content IDs and job parameters). Provider: Inngest Inc., United States; processing takes place in the USA. The EU standard contractual clauses are the envisaged basis for the transfer; the data processing agreement that makes them binding has been requested and is not yet in place
• Evomi — Proxy for source downloads in the render service — both for retrieval via yt-dlp and for direct file downloads. For encrypted targets (HTTPS) the proxy sees only the target host, the time and the amount of data transferred, not the content transmitted; for unencrypted targets (HTTP) it also sees the content. Provider: TeraShift GmbH, Switzerland; the transfer is based on the European Commission's adequacy decision for Switzerland (Decision 2000/518/EC, Art. 45 GDPR) — standard contractual clauses are not required for it

14. Your Rights as a Data Subject

You have the following rights vis-à-vis the controller:

• Access to the data stored about you (Art. 15 GDPR)
• Rectification of inaccurate data (Art. 16 GDPR)
• Erasure of your data (Art. 17 GDPR)
• Restriction of processing (Art. 18 GDPR)
• Data portability (Art. 20 GDPR)
• Objection to the processing (Art. 21 GDPR)
• Withdrawal of consent with effect for the future (Art. 7(3) GDPR)

Account deletion (Art. 17 GDPR): You can delete your account directly in the application (Settings → “Delete account”). Deletion is immediate and final and covers all content including data held at the connected services. Invoice data remains with the payment provider due to statutory retention obligations (§ 147 AO, § 14b UStG — German tax law). For the same reason, we keep records of purchases, subscription payments and credit bookings without any link to your account, and delete them ten years after the end of the year in which they were created.

Data export (Art. 20 GDPR): You can export your data directly in the application (Settings → “Export my data”). You receive your data in a machine-readable JSON format; the download link is valid for 24 hours.

In addition, an informal email to [email protected] is sufficient to exercise your rights.

15. Right to Lodge a Complaint with the Supervisory Authority

You have the right to lodge a complaint with a data protection supervisory authority about the processing of your personal data (Art. 77 GDPR). The supervisory authority responsible for me is:

Der Sächsische Datenschutz- und Transparenzbeauftragte
Devrientstraße 1
01067 Dresden
www.saechsdsb.de

16. Retention Period

Personal data is stored only for as long as is necessary for the respective purpose or as required by statutory retention periods. Server logs are deleted after 30 days at the latest. Waitlist data is stored until withdrawal of consent or until the start of the service (then, where applicable, transferred into a customer account with consent). Cancellations and withdrawals (section 9) are stored until your account is deleted.

Videos you upload yourself are stored until you remove the video, delete the related post or delete your account. You cannot delete published posts, but you can remove their video at any time. If you remove or delete it, we delete it from our storage immediately. If you have scheduled the post, our publishing service provider has collected a copy; according to its own information, it deletes the video file about 16 days after the post was published, failed or was withdrawn, and keeps a preview image and the post details for the post history.

17. SSL Encryption

For security reasons, this website uses SSL encryption. You can recognize an encrypted connection by the fact that the address bar of the browser begins with “https://”.

18. Changes to This Privacy Policy

I reserve the right to amend this privacy policy so that it always complies with the current legal requirements or in order to implement changes to my services. The new privacy policy will then apply to your next visit.

Table of Contents

• Scope of the GTC
• Contact and Service Information
• General Information on Offers and Orders
• Ordering Process and Conclusion of Contract
• Contract Text and Contract Language
• Digital Content
• Service-Related Rights and Obligations of the Contracting Parties
• Cancellation Conditions for Services
• Digital Services
• Term, Termination and Renewal of Service Contracts
• Subscriptions
• Acquisition of Credit
• Promotional Vouchers
• Customer Account
• Information on Prices and Shipping Costs
• Payment Methods and Payment Terms
• Copyright and Usage Rights
• Cancellation Policy
• Warranty and Liability
• Amendment of the GTC
• Data Protection and Confidentiality
• Final Provisions
• Consumer Dispute Resolution

1. Scope of the GTC

1. The following General Terms and Conditions (hereinafter referred to as the „AGB“) apply exclusively to the business relationship between Ikrames, Richard Mann, Albert-Einstein-Str. 47 02977 Hoyerswerda (hereinafter referred to as the „Provider“) and the purchaser of the Provider's products designated below as the „Customer“.
2. Deviating terms of the Customer are not recognised, even if the Provider renders its performance without objection, unless the Provider expressly agrees to the application of the Customer's deviating terms.
3. All references to persons apply equally to both genders. For reasons of better readability, the simultaneous use of male and female language forms has been omitted.
4. A „Consumer“ within the meaning of these GTC is any natural person who concludes a legal transaction for purposes that can predominantly be attributed neither to their commercial nor to their independent professional activity.
5. An „Entrepreneur“ within the meaning of the GTC is a natural or legal person or a partnership with legal capacity that, when concluding a legal transaction, acts in the exercise of their commercial or independent professional activity.
6. A „Product“ within the meaning of the GTC is any goods, service and other performance offered by the Provider, any accessories as well as accompanying documentation that, in accordance with the product description provided to the Customer by the Provider or other agreement, form the subject of the contract between the Provider and the Customer.
7. Irrespective of the terminology used in the GTC, such as for example „Provider“, the legal classification of the contract as well as the applicable statutory provisions are always determined according to the statutory requirements of the respective contract types. These GTC do not in any way restrict the statutory definitions and provisions.

2. Contact and Service Information

1. Please note the following information regarding the availability of our customer service.
2. Email address: [email protected]
3. Availability of customer service: Inquiries are answered on working days within 48 Stunden.

3. General Information on Offers and Orders

1. The presentation and advertising of products on the Provider's websites as well as in digital or printed information materials does not constitute a binding offer to conclude a contract, but rather a non-binding invitation to the Customer to themselves submit an offer to purchase the products presented.
2. Customers are responsible for ensuring that the information they provide is accurate and that any changes are communicated to the Provider if they are necessary for the Provider's performance of the contract. In particular, Customers must ensure that the email, delivery and shipping addresses provided are accurate and that any obstacles to receipt for which the Customer is responsible are taken into account accordingly (e.g. by checking the spam folder of the email software used).
3. Customers are requested to read and observe the notices carefully during the ordering process and, if necessary, to use the available support functions of their software and hardware (e.g. magnification or read-aloud functions). Required information is marked by the Provider as such in a manner reasonably recognisable to the Customer (e.g. by visual highlighting and/or asterisk symbols). Up until the order is submitted, Customers can change and view the product selection as well as their entries at any time, as well as go back in the ordering process or cancel the ordering process entirely. For this purpose, Customers can use the customary functions available to them in their software and/or end device (e.g. the forward and back buttons of the browser or keyboard, mouse and gesture functions on mobile devices). Furthermore, unwanted entries can be corrected by cancelling the ordering process.

4. Ordering Process and Conclusion of Contract

1. The Customer can select from the products offered by the Provider and collect these in a so-called shopping cart or a corresponding selection overview. Within this selection, the Customer can edit their compilation, in particular make changes or remove individual items. Otherwise, the Customer can initiate the completion of the ordering process.
2. By clicking on the button completing the ordering process, the Customer submits a binding offer to the Provider to acquire the products located in the shopping cart or a corresponding selection overview.
3. The Provider accepts the Customer's offer, whichever event occurs first, (i) through an express declaration of acceptance in text form (e.g. by email, (ii) through the completion of the payment process, (iii) through a request for payment addressed to the Customer, (iv) in the case of an order of goods through their dispatch, in the case of a service through its commencement and otherwise through the provision of the product in accordance with the contract. The Provider can accept the Customer's offer within the acceptance period. The acceptance period is five days. The acceptance period begins with the completion of the ordering process by the Customer and ends upon the expiry of its last day. If the Provider does not accept the Customer's offer within the acceptance period, no contract is concluded and the Customer is no longer bound by their offer.

5. Contract Text and Contract Language

1. The Provider stores the contract text (in particular the order data, product details, prices, these GTC as well as other legally required mandatory information) and makes it available to the Customer in text form, by email or at the latest upon delivery of the order or the rendering of the ordered performance.
2. Insofar as Customers have set up a customer account, they can view the orders placed in their account area. The complete contract text is not accessible in the account area.
3. The contract languages are German and English; contracts can be concluded in these languages.

6. Digital Content

1. „Digital content“ is content such as software, video and audio content, e-books or apps, when it is provided digitally, e.g. as a download or stream (i.e. is not delivered on data carriers such as CDs or BlueRays).
2. The provisions of these GTC apply accordingly to the sale of digital content.
3. The Provider is entitled to subsequently adapt and modify digital content, insofar as this is necessary for the Provider (e.g. updates of a technical nature, corrections of a linguistic nature or mandatory legal reasons that make an adaptation of content necessary), is reasonable for the Customer and the contractual use of the products as well as the contractual balance are not impaired.
4. The digital content is made available to the Customer in the customer account, insofar as a customer account has been set up.
5. Use of the digital content requires access to the Internet as well as common and customary display capabilities that are reasonable for the Customer (e.g. a browser or PDF display software). The Provider assumes no responsibility for any prevention of access to digital content or its retrieval if these obstacles lie within the Customer's area of responsibility (this applies in particular to the Customer's access to the Internet).

7. Service-Related Rights and Obligations of the Contracting Parties

1. „Services“ within the meaning of these GTC are activities owed by the Provider that are based on an agreed action or contribution by the Provider.
2. The provisions of these GTC apply accordingly to contracts for services, insofar as nothing deviating is stipulated in this section.
3. The specific scope of performance results from the respective performance description, the offer or the individual agreement between Provider and Customer. Decisive in this regard is exclusively the scope of activity or support defined therein. The Provider does not owe a specific successful result, but rather the careful, professional execution of the agreed activity rendered to the best of its knowledge. This constitutes a service contract within the meaning of the law. Recommendations, assessments or proposals for action by the Provider expressly do not constitute a guarantee or assurance of success.
4. If the order description is insufficient or if its scope is doubtful in certain cases, the services to be rendered comprise those tasks customary in the industry and required under the circumstances that are necessary to achieve the agreed contractual purpose to a reasonable extent.
5. Changes or extensions of the originally agreed scope of performance („Performance Changes“) can be initiated by both parties. The Provider reviews every change request from the Customer and informs them without undue delay whether the desired adaptation is technically and organisationally feasible, what effects it has on the performance period and whether additional effort arises thereby that goes beyond the originally agreed scope of performance. If a change request leads to additional effort, this is to be remunerated separately by the Customer. Remuneration is made according to the agreed hourly rates or, if not specified, according to the Provider's customary hourly rates. Insofar as the change request results in changes to the schedule, duties to cooperate or delivery dates, these are likewise recorded in the course of the adaptation agreement. Performance Changes as well as their acceptance, rejection or implementation require text form (e.g. email), insofar as nothing deviating has been agreed. Without such textual confirmation, the originally agreed scope of performance remains decisive.
6. Insofar as the Provider renders its services on the basis of information, documents, accesses, systems or other materials that are to be provided by the Customer, the Customer must make these available to the extent required for the performance of the contract, properly and within a reasonable period. The Customer is responsible for the accuracy, currency, usage authorisation and admissibility of use of this content. The Provider's services regularly require reasonable cooperation and coordination on the part of the Customer. If such cooperation is absent for reasons for which the Customer is responsible, or occurs late, agreed deadlines and dates may be extended to a reasonable extent. The Customer bears the consequences of breaches of the aforementioned duties and obligations.
7. The Provider does not carry out any legal review of the information, content, specifications or materials provided by the Customer. Responsibility for ensuring that their use within the scope of the agreed services is legally permissible, free of third-party rights and suitable for the agreed purposes lies, insofar as nothing else has been expressly agreed and to the extent reasonable for the Customer under the circumstances, solely with the Customer. The Customer is obliged to carry out, or have carried out, the legal reviews required for this in good time and at their own responsibility.
8. The remuneration results from the respective offer or the performance description and is, unless otherwise agreed, payable in advance before performance is rendered. The payment terms of these GTC apply.
9. „The Provider is entitled to use auxiliary personnel, knowledgeable third parties as well as other vicarious agents and persons employed in the performance of an obligation to render the agreed services, insofar as this does not conflict with the contractual purpose. This does not apply if the performance, according to its content or its nature, is to be rendered strictly personally by the Provider (e.g. individually assured consulting or creative services). The selection is made at dutiful discretion and in accordance with confidentiality and data protection obligations.
10. If services are rendered online, by video call, telephone or email or other means of distance communication, it is incumbent on the Customer to provide a stable and suitable Internet or communication connection, insofar as this is reasonable for them under the circumstances. Disruptions or failures that lie within the Customer's area of responsibility may lead to delays or interruptions in the rendering of performance. In such cases, the Provider is not obliged to render the services again without a reasonable adaptation of the schedule or additional effort.
11. If the Customer has identified a defect in a rendered service and asserts rights based on defects, they should notify the Provider thereof within a reasonable period. The Provider is entitled to remedy the defect within a reasonable period or to render the performance again in a defect-free manner. For the examination and elimination of a defect, the Customer must enable the Provider to provide the cooperation required for this, insofar as this is reasonable for them under the circumstances. Insofar as the Customer is a commercial enterprise, the statutory duties of examination and notification of defects additionally apply.
12. Upon the occurrence of force majeure or other unforeseeable events not attributable to the Provider that considerably impede or render impossible the rendering of performance, the Provider is entitled to postpone agreed dates or to make up the services at a later point in time. Such events include in particular illness, accident, legal restrictions, official orders, failures of electricity, servers or other infrastructure, natural events or comparable situations. The Provider informs the Customer thereof without undue delay and offers replacement dates where possible. A claim by the Customer for reimbursement of travel, default or other costs does not exist in these cases. The Customer's statutory claims remain unaffected.
13. Files generated by the Provider (image, video, audio) carry a machine-readable indication of their AI origin: Content Credentials under the C2PA standard and, for image files, an additional watermark embedded invisibly into the image data. For exports intended for purely private use, the Customer may opt out of the visible label; the machine-readable indication remains in the file in every case. The Customer is not permitted to intentionally remove, alter or suppress these indications; this applies in particular to files the Customer publishes. Ordinary editing steps in which an indication is lost for technical reasons, without that being the purpose, remain permitted.
14. Where the Customer publishes content generated by the Provider that depicts persons, objects, places or events in a way that appears authentic — even where the person depicted does not exist — the Customer is, as deployer within the meaning of Regulation (EU) 2024/1689 (AI Act), responsible for disclosing to its audience that the content has been artificially generated or manipulated (Art. 50 (4)). The Provider provides tools for this purpose — the machine-readable marking as well as optional visible labelling features; responsibility for visible labelling in the respective publishing channel remains with the Customer.
15. The Provider marks generated content machine-readably as artificially generated (Art. 50 (2) AI Act). The marking is written into the file at generation time and when the content is prepared for publication. The Content Credentials can be read with common verification tools; the invisible watermark additionally survives re-compression by publishing platforms, but can only be read with the matching tool and is therefore available on request from the Provider. Neither replaces visible labelling under the preceding paragraph.

8. Cancellation Conditions for Services

1. The Customer can cancel a booked service before the commencement of performance. The cancellation must be made in text form, for example by email. Decisive for the calculation of any cancellation costs that may arise is the point in time of receipt of the cancellation by the Provider. Statutory rights of withdrawal remain unaffected.
2. The cancellation provisions do not affect the statutory rights of Customers who are consumers to rescind the contract, to withdraw from it or to otherwise terminate it. Legally mandatory rights of consumers remain unaffected by the cancellation provisions.
3. If a cancellation occurs at a point in time at which the Provider has already commenced the rendering of the service, the Customer owes the proportionate remuneration for services already rendered as well as the reimbursement of demonstrable expenses, insofar as these arose in connection with the rendering of performance and were not otherwise avoidable. In the case of lump-sum agreed remunerations, the calculation is made according to the ratio between the scope of performance already rendered and the total scope contractually agreed.

9. Digital Services

1. „Digital services“ exist when they enable the Customer who is a consumer to create, process or store data in digital form or to access such data, or enable the joint use of data uploaded or created in digital form by the consumer or by other users of the corresponding service, or other interactions with this data.
2. The provisions of these GTC apply accordingly to digital services.

10. Term, Termination and Renewal of Service Contracts

1. The service is rendered as a continuous performance over a longer period or in regularly recurring intervals (continuing obligation) and can be ordinarily terminated by either contracting party. The contract term is 1 Monat / 1 Jahr. The notice period is Zum Ende des jeweiligen Abrechnungszeitraums (monatlich oder jährlich).
2. After the expiry of the contract term, the service contract is extended for an indefinite period, insofar as it is not terminated by one of the parties.
3. The right to extraordinary termination for good cause remains unaffected for both contracting parties. Good cause exists if, taking into account all circumstances of the individual case and weighing the interests of both sides, the continuation of the contractual relationship until the expiry of the notice period cannot reasonably be expected of one contracting party. Good cause may exist in particular if i) the Customer fails to make agreed payments despite a reminder, ii) the Customer's required acts of cooperation are absent and the rendering of performance is thereby substantially impeded or rendered impossible, iii) the Customer breaches essential contractual obligations or behaves in a considerably contract-violating manner or iv) the rendering of performance becomes impossible or unreasonable due to force majeure or unforeseeable circumstances within the meaning of these GTC.
4. In the case of extraordinary termination, services already rendered by the Provider are to be remunerated proportionately and reasonably. If remunerations were paid in advance, a proportionate refund is made for services that are no longer rendered due to the extraordinary termination. In the case of ordinary termination, the remuneration is governed by the agreed billing or contract period. Remunerations already paid in advance are only refunded proportionately if the contract does not provide for a minimum term and the Customer can ordinarily terminate the contract before the expiry of the prepaid period. Otherwise, in the case of ordinary termination, there is no claim to a proportionate refund if the Customer has chosen a specific contract term or a discounted prepayment period and this term can be continued.
5. The termination provisions do not affect the statutory rights of Customers who are consumers to rescind the contract, to withdraw from it or to otherwise terminate it. Legally mandatory rights of consumers remain unaffected by the termination provisions.

11. Subscriptions

1. A „Subscription“ is understood to mean the regular receipt of products or other services by „Subscribers“ (as Customers are designated within the scope of subscription contracts) within the scope of an ongoing contractual relationship (also designated as „Subscription Contract“) over a defined period (also designated as „Receipt Period“).
2. A Subscription Contract obliges the Provider to deliver the services covered by the Subscription Contract or to undertake other actions at the agreed points in time or intervals and within the agreed Receipt Period. The details of the individual subscriptions are stated in each case with their respective offers.
3. The termination takes effect for the future. From the point in time at which the termination becomes effective and the contract ends, no further services or deliveries are made within the scope of the subscription.
4. Subscriptions are billed in advance at the beginning of the Receipt Period in each case.
5. Trial subscriptions automatically convert into a paid subscription, insofar as they are not terminated within the trial period.
6. The Subscriber notifies the Provider of changes to the delivery or shipping address without undue delay and is otherwise responsible for delivery obstacles resulting from the failure to notify.
7. The right to extraordinary termination of the Subscription Contract remains reserved in accordance with the statutory requirements.
8. Subscription Contracts can be terminated in text form (e.g. email).
9. It is incumbent on the Customer to independently back up their own content, data or files that they have stored or processed on online platforms, systems or other digital environments of the Provider before the termination of the contractual relationship, insofar as nothing deviating has been agreed or the Customer does not invoke legally granted rights. After the end of the contract, there is no obligation on the part of the Provider to keep, make available again or restore the Customer's content or data, insofar as no statutory retention or surrender obligations exist.
10. Insofar as not stated otherwise in the respective offer, the receipt duration of subscriptions is 1 Monat.
11. After the expiry of the receipt duration, the Subscription Contract is extended for an indefinite period, insofar as it is not terminated by one of the parties.
12. Insofar as not regulated differently in the respective offer, the notice period is Zum Ende des laufenden Abrechnungszeitraums.

12. Acquisition of Credit

1. These GTC apply accordingly to the sale of credit that embodies monetary values. Customers can acquire credit with the means of payment made available by the Provider, which is stored in their customer account. This credit can be redeemed by Customers in order to acquire, or make use of, the products and services of the Provider that are offered to Customers for redemption. The Provider informs Customers which products can be redeemed with the credit. Beyond that, the credit does not constitute a legally recognised asset outside of the Provider's offering.
2. The credit can only be transferred to third parties with the consent of the Provider.
3. Credit that has been paid in by the Customer or third parties for the benefit of the Customer is in principle non-refundable (i.e. not payable out or otherwise reimbursable). The exclusion of repayment, however, leaves unaffected the statutory rights of withdrawal, rescission, termination, warranty and rights based on defects as well as other mandatory rights of the Customer and does not restrict their payment and other claims in this regard. Likewise, the repayment claim is not restricted insofar as the deposited credit is not time-barred. The limitation period begins three years after the end of the calendar year in which the last payment to the credit was made.

13. Promotional Vouchers

1. „Promotional Vouchers“ are understood to mean vouchers that are issued free of charge by the Provider within the scope of, for example, promotional campaigns (e.g. discount vouchers with percentage or fixed reductions). By contrast, vouchers that embody a specific monetary or material value and are acquired by the Customer as a product do not constitute Promotional Vouchers.
2. Promotional Vouchers can only be taken into account under the communicated conditions, in observance of restrictions, e.g. their validity for specific product groups, frequency of use and in particular only within the stated period.
3. Insofar as not stated otherwise, Promotional Vouchers cannot be combined with other Promotional Vouchers.
4. Insofar as not stated otherwise, the Promotional Vouchers handed over to recipients may not be transferred to third parties.
5. Promotional Vouchers issued by the Provider may only be redeemed with the Provider.
6. Insofar as not stated otherwise, Promotional Vouchers can only be redeemed before the completion of the ordering process.
7. Insofar as a Promotional Voucher exceeds a value of goods, it is only taken into account up to the amount of the value of goods, without any payout of the remaining amount being made.

14. Customer Account

1. The Provider makes a customer account available to Customers. Within the customer account, Customers are provided with information about the orders and their customer data stored with the Provider. The information stored in the customer account is not public.
2. Customers can also place an order as a guest without having to set up a customer account.
3. Customers are obliged to provide truthful information in the customer account and to adapt the information to changes in the actual circumstances, insofar as this is necessary (e.g. the changed email address in the case of a change or the changed postal address before an order). Customers are responsible for any disadvantages that arise due to incorrect information.
4. Customers are responsible for their customer accounts within the scope of their sphere of influence and insofar as the responsibility is reasonable for them. It is incumbent on Customers to exercise the greatest possible care when using access data for the customer account and to take every measure that ensures the confidential, secure handling of the data and prevents its disclosure to third parties. Customers are obliged to inform the Provider immediately if there is cause to suspect that a third party has knowledge of access data and/or is misusing the customer account.
5. The customer account may only be used in accordance with the applicable statutory provisions, in particular the regulations for the protection of the rights of third parties, and in accordance with the Provider's GTC by means of the access interfaces and other technical access options provided by the Provider. Another type of use, in particular by external software such as bots or crawlers, is prohibited.
6. If Customers store, share or otherwise publish content or information in their customer account, they bear the responsibility for this content. Depending on the technical possibilities, this content includes, for example, texts, images and details about persons. The Provider does not adopt the Customers' content as its own and does not identify itself with this content. However, it reserves the right to take necessary measures upon indications of legal problems or dangers to third parties. These measures are based on carefully selected criteria. The aim is to ensure that every action is justified. It is examined whether a measure is necessary to solve the problem or to avert the danger. In addition, it is assessed whether the measure is in a reasonable proportion to the severity of the problem or the danger. Furthermore, care is taken that it is taken with the necessary diligence and after a thorough assessment of all relevant information and circumstances. Finally, the measure must be based on an objective and unbiased assessment of the situation. The possible measures include the deletion of the content concerned, requests for a statement or correction, warnings, legal steps or even bans from the premises. When deciding on these measures, the Provider carefully takes into consideration the requirements of the situation, the rights and interests of all parties involved. The fundamental rights of Customers in particular are taken into account in order to ensure a fair and just solution.
7. Customers can terminate the customer account at any time. The Provider can terminate the customer account at any time with a reasonable period, which is generally two weeks. The termination must be reasonable for the Customer. The Provider reserves the right to terminate for extraordinary reasons.
8. From the point in time of termination, the customer account and the information stored in the customer account are no longer available to the Customer. It is the responsibility of the Customer to back up their data upon termination of the customer account.

15. Information on Prices and Shipping Costs

All price details are understood to be final prices. The Provider falls under the small-business regulation for value-added tax purposes (umsatzsteuerliche Kleinunternehmerregelung) and therefore does not show any value-added tax or sales tax.

16. Payment Methods and Payment Terms

1. Payments are to be made, unless otherwise agreed, without deduction, cash discounts or other reductions.
2. When financial institutions and other payment service providers are used, the terms and conditions and data protection notices of the payment service providers additionally apply with regard to payment. Customers are requested to observe these provisions and notices as well as information within the scope of the payment process. This applies in particular because the provision of payment methods or the course of the payment procedure may also depend on the agreements between the Customer and financial institutions and payment service providers (e.g. agreed spending limits, location-restricted payment options, verification procedures, etc.).
3. The Customer ensures that they fulfil the prerequisites incumbent on them that are required for successful payment by means of the chosen payment method. This includes in particular sufficient funds in bank and other payment accounts, registration, legitimation and authorisation with payment services as well as the confirmation of transactions.
4. Should a payment not be carried out or be charged back due to insufficient funds in the Customer's account, provision of incorrect bank details or an unjustified objection by the Customer, then the Customer bears the fees incurred thereby, insofar as they are responsible for the failed or reversed booking and, in the case of a SEPA transfer, were informed of the transfer in good time (so-called „Pre-Notification“).
5. Insofar as the Provider assigns its payment claim against Customers to payment service providers, payment with debt-discharging effect can only be made to the respective payment service provider. The Provider's contractual obligations towards the Customer, in particular the performance and warranty obligations, observance of withdrawals as well as ancillary contractual obligations, are not affected by the assignment.
6. Credit card payment — Upon placing the order, Customers provide their credit card data. The Customer's credit card is charged immediately after the completion of the order and after its authorisation as the lawful card holder.
7. Klarna — The payment is carried out via the payment service provider Klarna AB, Sveavägen 46, Stockholm, Sweden (hereinafter: “Klarna”) by means of the type of Klarna payment provided or chosen by Customers. The terms of use of Klarna apply, which can be viewed at https://www.klarna.com/de/ and which are communicated to the Customer within the scope of the payment process.
8. Klarna PayNow credit card — The Customer must identify themselves as the lawful card holder in order to carry out the payment, before the payment transaction is carried out and the Customer's account is automatically charged.
9. Klarna PayNow direct debit — The Customer grants Klarna a SEPA direct debit mandate. With the granting of the SEPA direct debit mandate, Klarna is authorised to initiate the payment transaction, whereby the Customer's bank account is automatically charged. The Customer is informed of the date of the charge to the bank account (designated as „Pre-Notification“).
10. Klarna invoice — The prerequisite is a successful check of the address and the creditworthiness of the Customer by Klarna. In the case of a purchase on invoice, Customers first receive the goods. The payment term is 14 Tage, insofar as nothing else has been agreed within the scope of the payment process. The Provider assigns its payment claim to Klarna. A debt-discharging payment can only be made to Klarna in accordance with the conditions of Klarna.
11. Klarna instalment payment — The prerequisite for Klarna instalment purchase is a successful check of the address and the creditworthiness of the Customer by Klarna. The Provider assigns its payment claim against the Customer to Klarna. A debt-discharging payment can only be made to Klarna in accordance with the conditions of Klarna. Further information on European standard information for consumer credit, financing via Klarna, in particular on the instalments, and the minimum amount of the instalment payment as well as Klarna's terms and conditions: cdn.klarna.com/…/de_de/account
12. Apple Pay — The use of Apple Pay requires registration for this payment method. The payment transaction is carried out on the basis of the conditions of Apple Pay, which are also communicated to the Customer within the scope of the ordering process. Further information and conditions: apple.com/de/apple-pay
13. Google Pay — The use of Google Pay requires registration for this payment method. The payment transaction is carried out on the basis of the conditions of Google Pay, which are also communicated to the Customer within the scope of the ordering process. Further information: pay.google.com
14. Stripe — The use of Stripe may, depending on the chosen payment methods, require registration for this payment method. The payment transaction is carried out on the basis of the conditions of Stripe, which are also communicated to the Customer within the scope of the ordering process. Further information and conditions: stripe.com/de
15. Costs that arise from the reminder of due claims are charged to Customers. The Provider is entitled to assert reminder costs in a flat-rate amount of 1,50 Euro. In the case of Customers who are entrepreneurs, the Provider is entitled to assert reminder costs in a flat-rate amount of 5,00 Euro. Customers retain the right to prove that no, or lower, costs were incurred.
16. The Provider is entitled, in the case of default of payment, to assert default interest at the statutory rate as well as further consequences and costs determined by law against the defaulting Customers. In the case of Customers who are entrepreneurs, the Provider is entitled to assert at least default interest at a rate of 9 Prozentpunkten above the respectively applicable base interest rate. The Customer's obligation to pay default interest does not exclude the assertion of further default damages by the Provider. Default damages include costs of legal enforcement, such as costs for legal advice, dunning proceedings or debt collection.
17. A right of set-off is only available to Customers if their counterclaims have been legally established with final and binding effect or are recognised by the Provider.
18. Customers can only exercise their right of retention insofar as the claims result from the same contractual relationship.

17. Copyright and Usage Rights

1. The documents, instructions, information materials, products and media made available to the Customer by the Provider — such as photographs, images, graphics, videos or audio recordings (hereinafter referred to as „protected content“) — may, subject to an express deviating agreement, be used exclusively for the individual and contractual use by the Customer. Beyond that, they are protected by property rights, in particular by copyright. The usage and exploitation rights to the protected content lie with the Provider or the respective rights holders. The Customer undertakes to acknowledge and observe these usage restrictions as well as the property rights.
2. The Customer receives simple usage rights to use the acquired protected content for contractual purposes. Otherwise, the use and exploitation of the protected content is not permitted. In particular, protected content may not be reproduced, distributed, made publicly accessible or otherwise made available to third parties on the Internet or in intranets.
3. The Customer is not entitled to modify the protected content in terms of content, technically or editorially, unless this is mandatorily required for the contractual use, expressly permitted by the rights holder or permitted by law.
4. The Provider expressly reserves the use of the protected content for commercial text and data mining. Text and data mining is the automated analysis of single or multiple digital or digitised works in order to obtain information from them, in particular about patterns, trends and correlations. In particular, the protected content may not be used for the development, training, programming, improvement and/or enrichment of AI systems (including, but not limited to, generative AI systems) that can directly or indirectly output content, regardless of whether this is protected by copyright. In addition, the Customer undertakes to take the measures reasonable and necessary for them so that the acquired protected content is not subjected to text and data mining. This includes, for example, incorporating corresponding notices into one's own terms of use and ensuring that employees are instructed accordingly (in particular in the case of digital content). The details depend on the type of protected content and the type of use.
5. Insofar as the protected content is subject to a specific usage licence, Customers are informed about the usage licence. In the case of a contradiction between the usage licence and these GTC, the provisions of the usage licence take precedence.
6. If the Provider renders performance in advance, the Customer receives a simple, non-transferable usage right to the protected content that is revocable until the full payment of the owed remuneration.
7. The copyright notices and protective notes affixed to the protected content within a reasonable and legally recognised framework (for example the „Copyright“ symbol ©) are to be observed, and the granted usage rights only apply as long as the aforementioned notices and notes are not removed or otherwise rendered illegible. Unless the removal or rendering illegible occurs within the scope of the ordinary or intended use of the protected content.
8. If there is a justified suspicion of an abusive use or a considerable breach of these provisions for the protection of the protected content, the Provider is entitled to take reasonable review and protective measures until the suspicion is clarified. In the case of serious breaches or breaches continued despite a warning notice, the Provider is entitled to extraordinarily terminate the contractual relationship. The Customer is liable for damages that arise for the Provider through a breach of duty for which the Customer is responsible.

18. Cancellation Policy

1. The information on the right of withdrawal for consumers results from the Provider's cancellation policy. Customers are informed about this in accordance with the statutory requirements.
2. The right of withdrawal does not apply to consumers who, at the time of conclusion of the contract and of delivery, have their domicile, habitual residence or delivery address outside a member state of the European Union (EU) or the European Economic Area (EEA) and do not belong to any of these member states.
3. The provisions of these GTC do not restrict the statutory rights of withdrawal, rescission, termination, warranty and rights based on defects as well as other mandatory rights of the Customer and their payment and other claims in this regard, and apply subordinately to these.
4. Customers can access the Provider's cancellation policy at the following address: ikrames.com/widerruf

19. Warranty and Liability

1. The warranty (liability for defects) and liability for other deficient performance are determined, subject to the following provisions, according to statutory regulations.
2. Insofar as a guarantee is granted for the products in addition to a statutory warranty, this guarantee is to be taken from the product descriptions. Customers are informed about the guarantee conditions.
3. The Provider may restrict the warranty in the case of Customers who are consumers only if it has specifically informed the Customers thereof and the restriction of the warranty is expressly and separately agreed and this agreement is made available to the Customer on a durable medium.
4. Material defects become time-barred, notwithstanding the liability provisions of these GTC, in the case of Customers who are entrepreneurs, in principle one year after the passing of risk, insofar as longer periods are not mandatorily prescribed by force of law, in particular in the case of special provisions for the entrepreneur's recourse.
5. If the Customer is an entrepreneur, they must, notwithstanding statutory duties of notification of defects, examine the goods without undue delay and notify the supplier of recognisable material defects without undue delay as well as in writing, and of non-recognisable material defects without undue delay after discovery. A failure to examine and report in good time leads to the exclusion of the rights to assert material defects.
6. The legally non-waivable rights of recourse of the Customer against the Provider within the scope of the entrepreneur's recourse in the case of sales of consumer goods are not restricted.
7. If the Customer is an entrepreneur, the choice between rectification (i.e. elimination of the defect) of defective items or subsequent delivery (delivery of defect-free items) is made by the Provider.
8. Deviations in quality, weight, size, thickness, width, equipment, patterning, colour, etc. that are customary in trade, permissible according to quality standards or minor are not defects.
9. In relation to Customers who are entrepreneurs, only the details in the product description or product descriptions or manufacturer information otherwise expressly incorporated by the Provider are decisive for the condition of the goods. Other information in media or public statements as well as details of the manufacturer or third parties are not decisive.
10. The Provider assumes no guarantee for the Customer's Internet connection, the software and hardware used by the Customer as well as any disruptions to the establishment or execution of the contract between the Customer and Provider caused thereby.
11. The Provider is liable for damages without limitation insofar as the cause of damage is based on intent or gross negligence. Furthermore, the Provider is liable for the slightly negligent breach of essential obligations, the breach of which endangers the achievement of the contractual purpose, for the breach of obligations whose fulfilment makes the proper execution of the contract possible in the first place and on whose observance the Customer regularly relies (cardinal obligations) or in the case of agreed guarantee promises. In this case, however, the Provider is liable only for the foreseeable, contract-typical and expectable damage. The Provider is not liable for the slightly negligent breach of obligations other than those mentioned above. The aforementioned limitations of liability do not apply in the case of injury to life, body and health, for a defect after the assumption of a guarantee for the condition of the product and in the case of fraudulently concealed defects. Liability under the Produkthaftungsgesetz (German Product Liability Act) remains unaffected. Insofar as the liability of the Provider is excluded or limited, this also applies to the personal liability of employees, representatives and vicarious agents. Otherwise, the Customer's claims for damages are excluded. The aforementioned liability provisions also apply to the Customer's claims for damages within the scope of the Provider's statutory warranty.
12. The restrictions of the warranty and liability obligations as well as the shortening of the periods in this regard do not apply to claims of Customers for damages and reimbursement of expenses, goods that have been used in accordance with their customary manner of use for a building and have caused its defectiveness, as well as to existing update obligations in the case of contracts for digital products.
13. The restrictions of the warranty and liability obligations as well as the shortening of the periods in this regard do not apply in the case of mandatory consumer-law recourse claims of the Customer. This applies in particular in the case of claims of consumers for damages and reimbursement of expenses, in the case of the shortening of the period for products that have been used in accordance with their customary manner of use for a building and have caused its defectiveness, as well as in the case of any update obligations in contracts for digital products.

20. Amendment of the GTC

1. The Provider reserves the right to amend these GTC at any time with effect for the future in the case of continuing obligations (i.e. contracts running over a longer period, within the scope of which performances and/or considerations are rendered) in the following cases: a) If the amendment serves to establish conformity of the GTC with the applicable law, in particular if the applicable legal situation changes; b) If the amendment serves the Provider to comply with mandatory judicial or official decisions; c) If completely new services or service elements as well as technical or organisational processes require a description in the GTC; d) If the amendment is merely advantageous for the Customers.
2. In the case of Customers who are entrepreneurs, amendments may also be made beyond the cases mentioned, insofar as they are reasonable, appropriate and objectively justified for the Customer.
3. The Provider will send the amended GTC at least two weeks before they come into force to the email address deposited by the Customer with the Provider. If a Customer does not object to the new GTC within two weeks of receipt of the email, the amended GTC are deemed accepted by the Customer. With the notification of the amendment, the Provider will inform the Customers of the consequences of a failure to object. Customers can also agree to the amended GTC through express consent.

21. Data Protection and Confidentiality

1. The Provider processes personal data exclusively in accordance with the applicable data protection laws. Details on the data processing as well as on the rights of the data subjects result from the Provider's privacy policy.
2. Both parties undertake to treat all confidential information obtained within the scope of the contractual relationship in strict confidence. Confidential information includes in particular personal data, personal circumstances, contents of conversations, coordination, documents, concepts as well as business and trade secrets, such as internal procedures, pricing and calculation models, strategies, process descriptions, customer and supplier data, technical procedures or other non-public economic information, insofar as this is not generally known or was already lawfully accessible to the other party. Disclosure to third parties is made only with the express consent of the respective affected party. The consent may be dispensable if the disclosure is in the recognisable interest of the affected party and it is to be assumed that they would consent. Exempt from the confidentiality obligation is information that is to be disclosed on the basis of statutory provisions, must be communicated upon official or judicial order or whose use is required for the safeguarding of legitimate interests. Disclosure to persons from the private or professional environment of the parties is not covered by this. The confidentiality obligation continues to apply beyond the termination of the contractual relationship.
3. The provider may use performance and usage data in aggregated, de-identified form to improve, further develop and statistically evaluate its services. Minimum thresholds prevent any conclusions being drawn about the customer, its brands or individual persons. Details are governed by the privacy policy.

22. Final Provisions

1. The legal relationships between the Customer, insofar as they are an entrepreneur, and the Provider are subject exclusively to the law of the Federal Republic of Germany to the exclusion of UN sales law (UN-Kaufrecht / CISG).
2. The place of jurisdiction is at the Provider's registered office if the Customer is a merchant, a legal person under public law or a special fund under public law, or if the Customer has no general place of jurisdiction in the Provider's country of registered office. The Provider's right to choose another permissible place of jurisdiction remains reserved.

23. Consumer Dispute Resolution

We are not willing and not obliged to participate in a dispute resolution procedure before a consumer arbitration board.

A “consumer” (Verbraucher) within the meaning of this withdrawal instruction is any natural person who concludes a legal transaction for purposes that can predominantly be attributed neither to their commercial nor to their self-employed professional activity.

The simplest route: the withdrawal button

You do not need to print a form or type anything out. Declare your withdrawal directly online — without signing in. You will get an immediate confirmation with the date and time we received it.

Withdraw from contract now

Important: for services you have already used up to the withdrawal — in particular credits consumed — you owe compensation for value. At purchase you expressly requested that we begin performance before the withdrawal period ends.

Right of withdrawal (Widerrufsrecht)

You have the right to withdraw from this contract within 14 days without giving any reason.

The withdrawal period is 14 days from the day of the conclusion of the contract.

To exercise your right of withdrawal, you must inform us (Ikrames, Richard Mann, Albert-Einstein-Str. 47, 02977 Hoyerswerda, e-mail address: [email protected]) by means of a clear declaration (e.g. a letter sent by post or an e-mail) of your decision to withdraw from this contract.

To meet the withdrawal deadline, it is sufficient that you send the notification concerning the exercise of the right of withdrawal before the withdrawal period has expired.

Consequences of withdrawal

If you withdraw from this contract, we shall reimburse to you all payments that we have received from you, including the costs of delivery (with the exception of the additional costs resulting from the fact that you have chosen a type of delivery other than the least expensive type of standard delivery offered by us), without undue delay and at the latest within fourteen days from the day on which the notification of your withdrawal from this contract is received by us. For this reimbursement, we will use the same means of payment that you used for the original transaction, unless something different was expressly agreed with you; in no case will you be charged any fees on account of this reimbursement.

If you have requested that the service should begin during the withdrawal period, you shall pay us a reasonable amount corresponding to the proportion of the services already provided up to the point in time at which you notify us of the exercise of the right of withdrawal with regard to this contract, compared to the total scope of the services provided for in the contract.

Exclusion or premature expiry of the right of withdrawal

• The right of withdrawal expires prematurely if we have begun the performance of the contract only after you have given your express consent thereto and have at the same time confirmed your knowledge that you lose your right of withdrawal upon the commencement of the performance of the contract on our part. We point out that we may make the conclusion of the contract dependent on the aforementioned consent and confirmation.
• The right of withdrawal does not apply to consumers who, at the time of the conclusion of the contract and of delivery, have their domicile, habitual residence or delivery address outside a member state of the European Union (EU) or of the European Economic Area (EEA) and who do not belong to any of these member states.

Sample withdrawal form

If you wish to withdraw from the contract, please fill out this form and send it back.

To

Ikrames, Richard Mann
Albert-Einstein-Str. 47
02977 Hoyerswerda
E-mail address: [email protected]

I/We (*) hereby withdraw from the contract concluded by me/us (*) for the

purchase of the following goods (*) / the provision of the following service (*)

Ordered on (*) / received on (*)

Name of consumer(s)

Address of consumer(s)

Signature of consumer(s) (only for notification on paper)

Date

(*) Delete as appropriate.

Since August 2026, Article 50 of the EU AI Act applies. In short: AI-generated content must be recognisable as such. Part of that runs automatically at Ikrames, part is a setting, and part stays with you. This page separates the three.

What Ikrames does automatically

Every file created at Ikrames carries machine-readable provenance data — Content Credentials, following the C2PA standard. That covers generated images, carousel slides, the finished rendered reel, and the labelled version created at publishing time: it is re-marked after the icon is burned in, so the data matches the file. For exports intended for purely private use you can opt out of the visible label. The machine-readable provenance data always stays in the file. When you publish through us, visible labelling follows your brand's setting; the machine-readable provenance data always stays in.

This happens invisibly: you see nothing of it, and it cannot be switched off. The provenance data sits in the file container, alongside the pixels.

For images there is a second, entirely different marking: an invisible watermark computed directly into the pixels. It carries a reference number by which we can recognise the file later. You cannot see it, and it cannot be saved away — unlike the provenance data it also survives the re-encoding that happens on upload. Reading it requires the matching tool, so for that you depend on us.

For the labelling to be accurate, Ikrames determines where each post comes from. A carousel of text and layout is fully AI-generated. Put your own photo in it and it becomes a mix — and is labelled “AI modified”, not “AI generated”. That difference is not a formality: declaring your own photo as an AI creation would be just as wrong as a missing label, only in the other direction.

If you want it, Ikrames also appends a short note to your post text — “AI-generated” or “Edited with AI”, whichever applies to the post. In your brand language, without a hashtag, and placed so it does not fall victim to the platform's character limit. By default your text stays untouched — the visible icon does the labelling.

You can check this yourself. Upload a file from Ikrames to the official verification tool — it shows you the same data a platform would read.

Verify Content Credentials

When verifying, you will see that our certificate is not yet on the official trust list — the provenance data is readable, the issuer is us. We are moving to a recognised certificate; what the data says will not change.

One limitation we will not hide: many platforms re-encode files on upload, and the Content Credentials can be lost in the process — the watermark usually survives it, but „usually" is not a guarantee. That is not a fault on your side or ours — it is the reason the visible icon still matters.

What you are responsible for

The moment you publish, you are the deployer under the regulation. If content depicts people, places or events in a way that could be taken for real — the person does not have to exist — it must be visibly labelled as AI-generated when posted (Art. 50(4)). Ikrames can do that for you — the responsibility that it happens stays yours.

Visible means: recognisable to your audience, at the latest on first contact with the content. An icon in the image, a note in the caption, or the platform's own labelling feature — one of them has to apply.

And one more thing that is easily missed: the duty attaches to WHERE content arrives — not to which market you select. Platform algorithms distribute your posts to people you never aimed at. Anyone posting outside the EU who is seen there anyway can be covered by the duty.

This is also set out contractually in Section 7 of our GTC: visible labelling when you publish is your responsibility, and the machine-readable marking must not be intentionally removed.

When it does not apply

• Purely private and non-professional. Posting only for yourself or friends does not make you a deployer under the regulation.
• Artistic, creative, satirical or fictional. A lighter form is enough here — a credit or a note that does not disturb the work.
• Recognisably not real. Only what is obviously an illustration — stylised, drawn, visibly artificial — needs no deepfake label. Important: no existing person has to be shown. If a generated person looks like someone who could exist, the content counts as a deepfake and must be labelled.

When in doubt, label it. It costs you one line and takes the question off the table.

What you can configure

Available

• The target market per brand. If you serve EU markets, Ikrames labels automatically from then on — and explains once what the duty means. If you select no EU market, you get a shorter note instead: that algorithms may carry your posts into the EU anyway, and the duty can then apply. Either way we record what you were informed about.
• The visible icon in images and video. For AI-generated posts, Ikrames places one of the official EU icons in the corner when publishing — burned in, so it survives resharing and downloading. In carousels every slide gets one, because slides are shared individually.
• How the icon looks: corner, size, which of the three variants, a short text suffix of your own and — for video — whether it stays for the whole clip or only appears at the start. We do not recommend less than two seconds; it can be set from half a second, and we ask once if you do. A preview shows you the placement.
• A switch per post. Normally every post follows your brand setting — on the post you can see what that currently means. You can deviate for individual posts; if you turn labelling off in an EU market, we ask once and record your decision.
• Your original stays untouched. Ikrames writes the labelled version as a separate file next to it and publishes that one — you keep the unlabelled one.
• The official EU icons for your own use. There are three: a basic icon, one for fully AI-generated and one for partially AI-modified content. The Commission provides them freely — SVG and PNG, four colour variants each, without attribution and at no cost. Using them is voluntary; the labelling duty itself is not.
• The platforms' own AI switches. TikTok, Instagram, X and YouTube have dedicated fields for declaring a post as AI-generated on upload. Ikrames sets them automatically, based on how the post was created. That also applies when no mark is burned into the video. The one exception: if “AI mark in videos” is set to “Nothing” for your brand, Ikrames sets no switch for videos; declaring it to the platform is then up to you. The reason: the platforms require this declaration worldwide, not only in EU markets. On Instagram and X the platform then shows its own notice on the post — so alongside our icon there will be one of theirs. What the platform does with the declaration is up to it; we transmit it.

Download the EU icons

In progress

• Labelling for audio-only posts. The regulation also covers AI-generated speech; today Ikrames marks audio machine-readably, but there is no audible cue.
• A certificate from a recognised authority, so verification tools stop showing our marking as “not verifiable” (see above).

These points are not available yet. We name them here so you know what to wait for — and what you need to watch yourself until then.

Sources

• Article 50 of the AI Act (official text)
• Code of Practice on Transparent AI-Generated Content (Commission)
• The three EU labelling icons (download)

This page explains how we implement labelling. It is not legal advice — whether and how you must label in a given case depends on your content and your market.

pursuant to Art. 28 GDPR, between the customer (controller) and the provider (processor). This DPA forms part of the usage agreement for Ikrames (terms and conditions) and applies to all processing of personal data that the provider carries out on behalf of the customer.

§ 1 Subject Matter and Duration

The provider processes personal data on behalf of the customer in order to provide the Ikrames services (creation, planning, publication and analysis of social media content). The duration corresponds to the term of the usage agreement.

§ 2 Nature and Purpose of the Processing

Types of data: account and profile data of the customer's team members (name, email, profile picture) and their assignment to posts, content and media that the customer contributes or has generated, connected social media accounts (access tokens, account identifiers), performance and interaction data of published content (including third-party comments together with their public profile information), billing and usage data.

Categories of data subjects: employees and agents of the customer, persons who interact with the customer's published content (e.g. commenters), and where applicable persons depicted in content.

Purpose: exclusively the provision of the contractually agreed services. The processing of aggregated, de-identified data for the provider's own purposes is not part of this mandate (§ 6).

§ 3 Right to Issue Instructions

The provider processes the data only on documented instructions from the customer; the customer's use of the Ikrames features constitutes such an instruction. If the provider considers an instruction to be unlawful, it shall inform the customer without undue delay and may suspend execution until the matter is clarified.

§ 4 Obligations of the Provider

The provider (a) obliges all persons involved in the processing to maintain confidentiality, (b) takes technical and organisational measures pursuant to Art. 32 GDPR (Annex 1), (c) supports the customer in responding to data subject requests and with the obligations under Art. 32–36 GDPR, (d) deletes or returns personal data after the end of the contract (§ 9), and (e) makes available to the customer the information required to demonstrate compliance (§ 10).

§ 5 Sub-processors

The customer grants general authorisation for the use of the sub-processors listed in Annex 2. The provider shall inform the customer in text form in advance of any intended changes (addition or replacement); the customer may object for good cause relating to data protection. Contracts meeting the requirements of Art. 28 GDPR are in place with every sub-processor.

§ 6 Aggregated Data for the Provider's Own Purposes

Insofar as the provider processes personal data on behalf of the customer, the provisions of this DPA apply. Separately from this, the provider is entitled to process usage and performance data in aggregated, de-identified form in order to improve and further develop its services; in this respect the provider acts as an independent controller within the meaning of Art. 4(7) GDPR. By technical measures (aggregation minimum thresholds, no records relating to individual customers in the analysis layer) the provider ensures that no conclusions about the customer, its brands or individual persons can be drawn from the aggregates.

§ 7 Data Subject Rights

If a data subject contacts the provider directly, the provider shall forward the request to the customer without undue delay. The provider supports the customer with suitable means (the platform's access, export and deletion functions) in fulfilling data subject rights.

§ 8 Notification Obligations

The provider shall notify the customer of personal data breaches affecting the mandate without undue delay after becoming aware of them, providing the information required under Art. 33(3) GDPR insofar as it is available.

§ 9 Deletion and Return

After the end of the contract, the provider deletes the personal data processed on behalf of the customer, unless a statutory retention obligation applies. Beforehand, the customer may secure its content via the platform's export functions. Aggregates already formed within the meaning of § 6 remain unaffected, as they no longer relate to identifiable persons.

§ 10 Evidence and Audits

The provider demonstrates compliance with this DPA by means of suitable documentation (including the description of measures under Annex 1, certificates and the data processing agreements of its sub-processors). Further audits take place by appointment and at the customer's expense.

§ 11 Final Provisions

In all other respects the terms and conditions apply. In the event of contradictions concerning data protection provisions, this DPA prevails. The law of the Federal Republic of Germany applies.

Annex 1 — Technical and Organisational Measures (TOMs)

• Encrypted transmission (TLS) for all connections.
• Access control: role-based permissions per workspace, row-level isolation in the database (Row Level Security), separate service credentials for system processes.
• Authentication via a specialised identity provider; access tokens of connected social accounts are not delivered to end devices in plain text.
• Logging of security-relevant events; backups by the infrastructure providers used.
• Server locations: the database and file storage are located in the European Union (Ireland); the application and the rendering service are likewise operated in the European Union (Amsterdam, Netherlands), for which the hosting service provider (Railway) uses Google Cloud Platform infrastructure. Processing of the customer's data therefore takes place in the EU, with the exception of the services based in the USA listed in Annex 2. In addition, the hosting service provider processes account and usage data of the provider's own account (account, billing and usage information of the provider, not the customer's content) as an independent controller in the United States as well; that transfer takes place on the basis of the EU standard contractual clauses. Details in the „Hosting“ section of the privacy policy.

Annex 2 — Sub-processors

The same service providers are used as those named in the privacy policy under „Overview of Recipients and Processors“ — this list is generated from the same source and therefore cannot diverge from it:

• Railway — Hosting of the application and the render service (app data in transit, server logs). Operated in the EU (Amsterdam, Netherlands) since 17 August 2026, on Google Cloud Platform infrastructure. In addition, Railway processes account and usage data of our own account as an independent controller in the United States (basis: EU standard contractual clauses, Module 2, from the data processing agreement concluded on 16 August 2026). Provider: Railway Corporation, San Francisco, USA
• Supabase — Database and file storage (all user data). Project region eu-west-1 (Ireland, EU)
• Clerk — Identity and authentication (email, name, sessions)
• Stripe — Payments and invoices
• Bundle.social — Publishing to social networks: access keys of the connected channels and the content of the posts (texts, images, videos). Provider: BUNDLE sp. z o.o., ul. Hoża 86/410, 00-682 Warsaw, Poland; processing within the European Economic Area
• ElevenLabs — Voice clones (voice samples)
• Anthropic — LLM processing of content texts (Claude language models) for three paths that still call Anthropic directly for now: the in-product assistant, the onboarding chat and the Auto-Planner's web research (the contracting party is the Irish entity, see the AI services section). All other Claude requests run via OpenRouter with EU routing (see there)
• IONOS — LLM processing of content texts (Llama 3.3 language model in the AI Model Hub). Provider: IONOS SE, Elgendorfer Straße 57, 56410 Montabaur, Germany; processed in the Berlin data centre, i.e. within the EU — no transfer to a third country takes place
• OpenAI — Whisper transcription of standalone voice recordings, embeddings
• fal.ai — Image and video generation (prompts, in part brand images) and transcription of video audio tracks
• Cloudflare — DNS/proxy for ikrames.com
• PostHog — Product and reach analytics (page views, usage events) and session replays. EU hosting in Frankfurt (Germany). Anonymous reach measurement without access to your device on the basis of legitimate interest (Art. 6(1)(f) GDPR); identified analytics and session replays only with your consent (Art. 6(1)(a) GDPR). Provider: PostHog, Inc., 2261 Market St. #4008, San Francisco, CA 94114, USA. The data is hosted in the EU; where PostHog processes it in the USA beyond that, the EU Standard Contractual Clauses from PostHog's data processing agreement apply
• Resend — Delivery of system and transactional emails (recipient address, subject, message content). Provider: Plus Five Five, Inc. (trading as “Resend”), 2261 Market Street #5039, San Francisco, CA 94114, USA; basis: EU standard contractual clauses. Covers the acknowledgement for cancellation/withdrawal, the purchase confirmation for digital products, and the delivery of freebies together with the corresponding confirmation and welcome email
• OpenRouter — Routing of model requests: Claude requests via EU routing (processed by Amazon Web Services, Ireland, or Google Cloud, Europe) and decision requests to the model Jev (support gate, signal relevance, voice match, check before automatic publishing, assistant guard). OpenRouter does not operate a model of its own. Provider: OpenRouter, Inc., USA; the transfer is based on Standard Contractual Clauses under Art. 46 GDPR. If a request to Jev contains text written by people, such as support requests, we first replace email addresses, phone numbers, profile links and names following a salutation with placeholders; names without a salutation and @-handles may remain. The exception is the check of a post immediately before publication: its text is sent to Jev unchanged, because it becomes public right afterwards. For requests to Jev we additionally send `provider.data_collection: "deny"` so that only providers without data collection are used
• TypeSafe AI — Decision model (Jev): assesses whether a support request is genuine, whether a signal fits the brand, whether a text matches a brand's voice, whether a post is fine to publish automatically and whether an action by the assistant needs approval (support gate, signal relevance, voice match, check before automatic publishing, assistant guard). It does not generate content. Reachable exclusively via OpenRouter, masked as described above. Provider in the USA; we have not received a basis for the transfer to the USA (Standard Contractual Clauses) from TypeSafe AI in writing
• Inngest — Job orchestration (event payloads containing user and content IDs and job parameters). Provider: Inngest Inc., United States; processing takes place in the USA. The EU standard contractual clauses are the envisaged basis for the transfer; the data processing agreement that makes them binding has been requested and is not yet in place
• Evomi — Proxy for source downloads in the render service — both for retrieval via yt-dlp and for direct file downloads. For encrypted targets (HTTPS) the proxy sees only the target host, the time and the amount of data transferred, not the content transmitted; for unencrypted targets (HTTP) it also sees the content. Provider: TeraShift GmbH, Switzerland; the transfer is based on the European Commission's adequacy decision for Switzerland (Decision 2000/518/EC, Art. 45 GDPR) — standard contractual clauses are not required for it