Inboundy
DEEN
Start free
← Back to home

Privacy notice

Inboundy platform notice: This notice applies to the Inboundy website and related online services. When you use app features (for example account management, subscriptions, or LinkedIn integrations), additional feature-level privacy information may apply in the product interface.

Contents

  • A. Controller, roles and scope
  • B. Technical usage data
  • C. Accounts, contracts and payments
  • D. Providers, international transfers and cookies
  • E. AI transparency
  • F. Retention
  • G. Your rights
  • H. Data protection contact

A. Controller, roles and scope of processing

A.1 Controller

The controller under the GDPR is Lorenz Wieseke, LOVIZ, Roßmarktstraße 37, 04177 Leipzig, Germany, phone: +49 1577 1572415, email: contact@inboundy.app.

A.2 Roles under data protection law

Depending on the processing activity we act in different roles under the GDPR:

  • Controller for data that concerns us directly: website visitors, prospects, account and contract data of our customers and general communication.
  • Processor under Art. 28 GDPR insofar as our customers process personal data of third parties through inboundy, in particular LinkedIn profile and message data of their contacts (Section C.5). In that case the customer is the controller.

The Data Processing Agreement under Art. 28 GDPR is accepted at registration and forms part of the service contract.

A.3 Scope and legal bases

We process personal data only where this is required to operate the website, provide our SaaS services, perform contracts, or communicate with you. Depending on the context, legal bases are Art. 6(1)(a), (b), (c), or (f) GDPR.

B. Technical data when visiting the website

When you access our pages, we process technically required connection and log data. This includes in particular requested URL, timestamp, amount of transferred data, referrer, browser type, operating system, and IP address (where applicable in shortened form).

This processing is necessary for secure delivery of the website, error diagnostics, and abuse prevention. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in security and stability).

Our website uses HTTPS/TLS encryption to protect data in transit.

C. Accounts, contracts and payments

C.1 Registration and customer account

If you create an account, we process the data provided in the form for account creation, authentication, and account administration. Legal basis: Art. 6(1)(b) GDPR.

You may request account deletion at any time. After open contractual matters are completed, we erase data unless statutory retention duties apply.

C.2 Contract performance and support

To provide booked services, handle requests, and perform contract-related operations, we process required master data, usage data, and communication data. Legal basis: Art. 6(1)(b) GDPR and, where necessary, Art. 6(1)(c) GDPR.

C.2a Product news by e-mail

We occasionally inform customers who hold an inboundy account about new features and changes to the service by e-mail. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in informing existing customers about our own, similar services) in conjunction with Sec. 7(3) of the German Unfair Competition Act (UWG). Every such e-mail contains an unsubscribe link; after one click we add the address to a suppression list and send no further news, even after a new registration. The list holds only the e-mail address and the time of the request and is deliberately kept when an account is deleted so that the opt-out remains effective. Messages required to operate your account (for example an expired LinkedIn connection or a completed campaign) are not affected and are sent on the basis of Art. 6(1)(b) GDPR.

C.3 Payment processing (Stripe)

For payment flows we use Stripe Payments Europe Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland. Depending on the selected payment method, billing-relevant data are transferred to Stripe.

For certain payment methods, Stripe may conduct credit or risk checks. Legal bases: Art. 6(1)(b) GDPR (payment execution) and Art. 6(1)(f) GDPR (default prevention).

C.4 Cancellation

Subscriptions can be cancelled in the dashboard under “Billing”. The details collected are processed to handle and confirm the cancellation (Art. 6(1)(b) GDPR).

C.5 LinkedIn connection and data of your contacts

Connection: To connect inboundy with LinkedIn you enter your LinkedIn credentials. The password is passed to our automation server for the sign-in only and is not stored. The resulting LinkedIn session (session cookies and a browser profile) is kept on the automation server so that automations run without a new sign-in; it remains until you disconnect in the dashboard or delete your account. Alternatively you can hand over the session via our browser extension. Legal basis: Art. 6(1)(b) GDPR.

Your own profile data: We read your LinkedIn profile (name, title, about text, experience), your profile statistics (followers, profile views, post impressions) and your posts to create search suggestions, message drafts and reports (Art. 6(1)(b) GDPR).

Data of your contacts: When you create lists, send connection requests or prepare messages, inboundy collects from the public LinkedIn profiles of the persons concerned: name, profile URL, title, company, location, about text, experience, education, skills and recent posts, as well as the contact details published in the profile (e-mail address, phone, website, birthday, address) insofar as the person has made them visible to their connections. In addition, your message history with the person and reactions and comments on your posts. This data serves the selection, personal approach and follow-up of your contacts.

For this processing you are the controller under the GDPR and we are the processor. In your role the legal basis is typically Art. 6(1)(f) GDPR (legitimate interest in business contact). Informing the data subjects under Art. 14 GDPR is your responsibility; inboundy provides the data categories (this notice) and an export of your lists for that purpose. Please observe LinkedIn's terms of use.

C.6 Contact form

When you use our contact form, we process the data you provide (name, email address, message) to handle your request and any follow-up communication. Legal basis: Art. 6(1)(b) GDPR for contract-related requests, otherwise Art. 6(1)(f) GDPR (legitimate interest in efficient communication).

For technical delivery of the form submission to our inbox, we use Web3Forms as a processor. Data may be transferred to third countries outside the EEA; appropriate safeguards under Section D.7 (such as standard contractual clauses) apply where required. We retain the content of your request for as long as necessary to handle it and to comply with statutory retention obligations.

C.7 My own business outreach

For my own customer acquisition, I process names, companies, business email addresses, websites and service descriptions from publicly accessible freelancermap profiles and company websites, including legal notices. I also record sources, messages, delivery status, replies and objections. The purpose is to identify relevant business contacts, introduce inboundy individually and handle responses. The legal basis is Article 6(1)(f) GDPR: my legitimate interest in acquiring business customers, unless your interests and rights outweigh it. The separate requirements for marketing emails under section 7 of Germany’s UWG remain applicable.

I store contact and handling records in my own files. Anthropic (Claude), and OpenAI (Codex) for supplementary work, receive relevant contact details and business context for AI-assisted drafting. Hostinger provides email delivery and website hosting. Suppression records are stored locally and with Supabase. See section D for provider information.

The campaign uses no email tracking pixels, UTM parameters or automated follow-up emails. After 14 days, I assess results and review continued retention needs. I delete data once unnecessary for handling contacts or required records, subject to statutory retention duties.

You may object to direct-marketing processing at any time, free of charge and without giving reasons: contact@inboundy.app. I stop this processing upon receipt. I retain the minimum suppression information solely to honour your objection.

There are no automated decisions with legal or similarly significant effects. See sections A, G and H for the controller, further rights and contact details.

D. Providers, international transfers and cookies

D.1 Database and sign-in (Supabase)

Account, sign-in, settings, lists and contact data are stored in a database operated by Supabase, Inc., USA. The data is stored in Frankfurt am Main (AWS region eu-central-1). Legal basis: Art. 6(1)(b) GDPR.

D.2 Hosting (Hostinger)

Website, dashboard and our workflow server run on servers of Hostinger International Ltd., 61 Lordou Vironos Street, 6023 Larnaca, Cyprus, located in Frankfurt am Main. Legal basis: Art. 6(1)(f) GDPR (secure operation).

D.3 Automation server and tunnel (ngrok)

LinkedIn sessions run on our own server at our business premises in Leipzig. It is reachable only through an encrypted tunnel provided by ngrok, Inc., San Francisco, USA. ngrok transports the encrypted connections and does not store content; connection data (IP addresses, timestamps) may arise at ngrok in the USA. Safeguards under Section D.7.

D.4 AI text suggestions (OpenRouter)

For message and post suggestions we transmit to OpenRouter, Inc., New York, USA: excerpts of your profile, the profile and recent posts of the person addressed, the previous message history and your outreach goal. OpenRouter forwards the request to the model provider selected by us; processing may take place outside the EEA. We do not train models with your data. Legal basis: Art. 6(1)(b) GDPR; for the data of your contacts we act on your behalf (Section C.5). Safeguards under Section D.7.

D.5 E-mail delivery (Resend, Hostinger)

Sign-in and confirmation e-mails are sent via Resend, Inc., San Francisco, USA; your e-mail address and the content of the respective mail are transmitted. Account notices (for example about an expired LinkedIn session) and invoices are sent from a mailbox at Hostinger (Section D.2). Legal basis: Art. 6(1)(b) GDPR.

D.6 LinkedIn

All actions on LinkedIn take place in your own LinkedIn account. The provider is LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland, which is an independent controller for its own processing. Legal bases: Art. 6(1)(b) and (f) GDPR.

D.7 Third countries

Providers based in the USA are Supabase (storage in Frankfurt), ngrok, OpenRouter, Resend, Web3Forms, Meta, Google and OpenAI. Where data is transferred outside the EEA we rely on the adequacy decision for the EU-US Data Privacy Framework where the provider is certified, and otherwise on EU standard contractual clauses.

D.8 Cookies and similar storage technologies

For the operation of the website and the dashboard we use cookies and similar storage technologies (localStorage, sessionStorage). Strictly necessary storage (sign-in session, language, theme, record of your acceptance of the contract documents) takes place under Section 25(2) TDDDG and Art. 6(1)(f) GDPR without separate consent.

Non-essential cookies (marketing, third parties) are set only after your consent under Section 25(1) TDDDG in conjunction with Art. 6(1)(a) GDPR. You can withdraw your consent at any time via the cookie settings in the footer.

D.9 First-party reach measurement (website)

To measure reach and usage of the website we use our own cookie-free system. It processes page views, a random session identifier in sessionStorage, dwell time, clicked buttons, the device category (mobile, tablet, desktop) and referrer and UTM parameters. The data is stored in the database under D.1 and deleted after 90 days; no profiles of individual persons are created. Legal basis: Art. 6(1)(f) GDPR. You can switch the measurement off for your browser by opening the site with the suffix “?no_analytics=1”.

D.10 Meta Pixel (Facebook and Instagram)

Based on your consent (Art. 6(1)(a) GDPR in conjunction with Section 25(1) TDDDG) we use the Meta Pixel of Meta Platforms Ireland Ltd., 4 Grand Canal Square, Dublin 2, Ireland, to measure the effectiveness of our ads on Facebook and Instagram. The pixel is loaded only after you have agreed in the consent banner. Meta then sets cookies (including _fbp) and processes IP address, browser and device information and visited pages. This data may be transferred to Meta Platforms, Inc. in the USA (safeguards under D.7). You can withdraw consent at any time via “Cookie settings” in the footer.

D.11 Google Ads (conversion measurement)

Based on your consent (Art. 6(1)(a) GDPR in conjunction with Section 25(1) TDDDG) we use the Google Ads tag of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, to measure whether a click on a Google ad led to a sign-up with inboundy. The tag is loaded only after you have agreed in the consent banner. Google then sets cookies and processes IP address, browser and device information, visited pages and the time of the sign-up (not your e-mail address). This data may be transferred to Google LLC in the USA (safeguards under D.7). You can withdraw consent at any time via “Cookie settings” in the footer.

D.12 ChatGPT Ads (OpenAI pixel)

Based on your consent (Art. 6(1)(a) GDPR in conjunction with Section 25(1) TDDDG) we may use the measurement pixel of OpenAI (OpenAI Ireland Limited, Dublin, Ireland) to measure the effect of ads in ChatGPT. The pixel is loaded only after you have agreed in the consent banner. It processes page views, browser and device information and the time of the sign-up (not your e-mail address). A transfer to OpenAI, L.L.C. in the USA is possible (safeguards under D.7). You can withdraw consent at any time via “Cookie settings” in the footer.

D.13 AI assistance for my own business outreach

For the outreach described in section C.7, I use Anthropic (Claude) to draft messages and OpenAI (Codex) for supplementary editing and review. These AI service providers receive the information used for that work, including names, companies, publicly described services and business context, and, where applicable, message drafts.

Data may be processed outside the European Economic Area, particularly in the United States. Information about the providers’ processing, retention and international data transfers is available in the privacy notices of Anthropic and OpenAI. Section C.7 describes the purpose, legal basis and right to object for my processing.

E. Transparency on AI-supported features

inboundy generates suggestions for messages and posts using language models (Section D.4). Suggestions are labelled as AI-generated in the dashboard and are sent or published only after you have approved them. Recipients of your messages are not labelled; the message is sent from your account and in your name.

No solely automated decision with legal or similarly significant effect within the meaning of Art. 22 GDPR takes place.

F. Retention and deletion approach

We store personal data only for as long as necessary for the respective purpose. Afterwards it is deleted or anonymised unless statutory retention duties apply.

  • Server and automation logs: 30 days
  • Website reach measurement: 90 days
  • Suppression list for product news (e-mail address, time): indefinitely, also after account deletion – this is what keeps the opt-out effective
  • Account data, settings, lists, contact data, message drafts: until you delete them or until account deletion
  • LinkedIn session (cookies, browser profile) on the automation server: until you disconnect or delete the account
  • Contract and billing data: statutory retention periods (usually 10 years under German tax and commercial law)
  • Consents (cookies): until withdrawal

Account deletion: You can delete your account yourself in the dashboard under “Settings”. This removes account, settings, lists, contact data, invitations, message drafts and the LinkedIn session on the automation server; a running subscription is cancelled. Accounts unused for 90 days without an active subscription may be deleted after prior notice by e-mail.

G. Your data protection rights

Under the GDPR, you have in particular the rights of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), portability (Art. 20), withdrawal of consent (Art. 7(3)), and complaint to a supervisory authority (Art. 77).

If processing is based on legitimate interests (Art. 6(1)(f) GDPR), you may object under Art. 21 GDPR on grounds relating to your particular situation.

The supervisory authority competent for us is the Saxon Commissioner for Data Protection and Transparency (Sächsische Datenschutz- und Transparenzbeauftragte), Devrientstraße 1, 01067 Dresden, Germany, website: www.saechsdsb.de.

H. Contact for privacy requests

For privacy questions, access requests, DPA requests, or other data subject matters, please contact: contact@inboundy.app.

Last updated: 2026-09-16