Privacy Policy

Last updated: 31 August 2026

1. Controller

The controller under data protection law, in particular the EU General Data Protection Regulation (GDPR), is Hendrik Reichel e.U.
Email: [email protected]

2. Scope

This policy explains the nature, scope and purpose of the processing of personal data on our platform. We process data only to the extent required to provide a functioning platform, our content and our services.

3. Legal bases

• Consent: Art. 6(1)(a) GDPR
• Performance of a contract: Art. 6(1)(b) GDPR
• Legal obligation: Art. 6(1)(c) GDPR
• Legitimate interest: Art. 6(1)(f) GDPR

4. Data we collect

• Registration data: name, email address and password.
• Profile information: everything you enter in your profile.
• Usage data: your interactions with the platform.
• Technical data: IP address, browser type, operating system, access data.
• Cookies: information stored in cookies or similar technologies.

Purposes: providing and improving our services, profile creation and personalisation, protection against abuse, analysis and optimisation, and communication with you.

5. Retention

• Registration and profile data: for as long as your account exists, then up to 30 days.
• Usage data: aggregated up to 24 months, personally identifiable up to 12 months.
• Log files: typically 7 to 30 days.

6. Recipients

Internally, only people who need the data to fulfil our obligations have access. External processors:

• Hetzner Online GmbH (Germany): hosting and content delivery network
• Stripe Payments Europe, Ltd. (Ireland): subscription payment processing
• Mailgun Technologies, Inc.: transactional email delivery
• Google Ireland Limited (Ireland): Google Analytics 4 and Google Ads — only with your consent, see section 9
• Meta Platforms Ireland Ltd. (Ireland): only when an Instagram connection is active — see section 7

Some processors are based outside the EU. Such transfers are made in accordance with Art. 44 et seq. GDPR, in particular on the basis of Standard Contractual Clauses.

7. Instagram and Facebook connection (Meta)

This processing takes place only if you actively connect your Instagram account. Without that connection, no data whatsoever is transmitted to Meta.

7.1 What we send to Meta

• The public CDN URL of the image(s) you select for publishing
• The caption text you write

Transmission happens solely as a result of your explicit action — there is no automatic or background transfer.

7.2 What we store from Meta

• Instagram Business account ID and Instagram username
• The ID of the linked Facebook Page
• Your app-scoped Facebook user ID
• An access token, stored encrypted (Fernet/AES). It is never stored or logged in plain text.

7.3 Legal basis and recipient

The legal basis is Art. 6(1)(b) GDPR (performance of the contract for the publishing feature you requested). The recipient is Meta Platforms Ireland Ltd., Merrion Road, Dublin 4, Ireland. Meta may transfer data to third countries on the basis of Standard Contractual Clauses.

7.4 Retention and revocation

We store this data until you disconnect. The token is deleted immediately when you

• click Disconnect in Settings → Instagram,
• remove the app in your Facebook settings under "Apps and Websites", or
• delete your udots account.

You can check the status of a deletion triggered via Facebook at udots.me/meta/data-deletion/ using your confirmation code.

8. Your rights

• Right of access (Art. 15 GDPR)
• Right to rectification (Art. 16 GDPR)
• Right to erasure (Art. 17 GDPR)
• Right to restriction of processing (Art. 18 GDPR)
• Right to data portability (Art. 20 GDPR)
• Right to object (Art. 21 GDPR)
• Right to withdraw consent (Art. 7(3) GDPR)
• Right to lodge a complaint with a supervisory authority (Art. 77 GDPR)

9. Cookies, analytics and advertising

• Necessary cookies: required for operation (session, CSRF protection, language preference). Legal basis: Art. 6(1)(f) GDPR.
• Functional cookies: for settings and convenience features.
• Analytics and advertising cookies: only after your explicit consent.

9.1 Google Analytics 4 and Google Ads

We use Google Analytics 4 (measurement ID G-9SX419XPJ8) and Google Ads (AW-17726736827) via the Google tag GT-WBL9S3SJ. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

We use Google Consent Mode v2. By default, analytics_storage, ad_storage, ad_user_data and ad_personalization are set to denied — so no analytics or advertising data is collected unless you consent. Only when you accept in the cookie banner are these four consent signals set to granted. If you choose "udots only" in the banner, Google remains fully disabled.

The data processed includes usage and device data, a truncated IP address and information about your interactions with our website. Google Ads also uses this data for conversion measurement and personalised advertising.

The legal basis is your consent under Art. 6(1)(a) GDPR. You can withdraw it at any time with effect for the future via the cookie settings. Google may transfer data to Google LLC in the USA on the basis of Standard Contractual Clauses.

9.2 Retargeting pixels on profile pages

Profile owners with a Pro subscription can add a Meta or TikTok pixel to their own profile page. These pixels load only if you have consented to analytics and advertising ("udots only" is not sufficient). The profile owner is the controller for any processing carried out by that pixel.

10. Security measures

• Encryption in transit (HTTPS/TLS)
• Encryption of stored access tokens
• Regular security updates
• Access restrictions and access controls
• Regular backups

11. Changes & contact

We reserve the right to amend this privacy policy. Email: [email protected]