Privacy policy

Last updated: 14 October 2026. Deutsche Fassung

1. Who is responsible

Philip Schrickel, feedgrove, Frühlingstraße 1
87775 Salgen, Germany.
Email: hello@feedgrove.de

We have not appointed a data protection officer because there is no legal obligation to do so (Section 38 German Federal Data Protection Act).

2. Overview

This website uses JavaScript for controls (e.g. the example carousel and the price switch). Fonts, images, videos and stylesheets are delivered by our own server; no content from other providers is loaded. There is no contact form. Section 7 applies to our customer pages at mein.feedgrove.de.

Cookies and consent. This website currently sets no cookies and loads no content from third-party servers; fonts and images are served from our own server. We will only use tools for reach measurement and advertising (Meta pixel, Google Ads) if you choose “Accept all” or the “Marketing” category in a cookie banner (Section 25(1) of the German TDDDG, Art. 6(1)(a) GDPR). The banner only appears once we actually use such tools; the only technically necessary storage will then be your choice (cookie cc_cookie, 6 months; Section 25(2) TDDDG), nothing of this is loaded before your consent, and you can change your choice at any time via “Cookie settings” at the bottom of the page. We will then add provider, purpose, storage period and third-country transfer here (Meta Platforms Ireland Ltd.; Google Ireland Ltd.; USA on the basis of the EU-US Data Privacy Framework).

For security reasons the whole website is encrypted with SSL/TLS (you can tell by “https://” and the padlock in your browser). Data between your browser and our server therefore cannot be read by third parties. Please note that data transmission over the internet, for example by email, can have security gaps; complete protection against access by third parties is not possible.

3. Hosting and visiting this website

The website runs on a server of Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany, in the Nuremberg data centre. We have concluded a data processing agreement with Hetzner (Art. 28 GDPR); Hetzner processes data only on our instructions. Details: Hetzner's privacy policy.

When you open a page, the server necessarily processes your IP address, date and time, the requested address, the previously visited page (referrer, if your browser sends it) and your browser details (browser type and version, operating system) in order to deliver the page to you. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is providing the website securely and reliably.

We keep no access logs (server log files) for this website. The data is processed only while the page is being delivered and is not stored afterwards.

4. Email and Google Workspace

For email and for storing business and customer data (Gmail, Google Drive, Google Sheets) we use Google Workspace provided by Google Cloud EMEA Limited, 70 Sir John Rogerson's Quay, Dublin 2, Ireland. Google processes this data as our processor, only on our instructions; we have concluded a data processing agreement with Google for this (Cloud Data Processing Addendum, Art. 28 GDPR).

If you email us at hello@feedgrove.de or at our support address support@feedgrove.de, we process your email address, your name (if given) and your message to answer your request. The legal basis is Art. 6(1)(b) GDPR where your request relates to a contract, otherwise Art. 6(1)(f) GDPR (answering enquiries).

Google may also process data outside the EU, in particular in the USA. The transfer is based on the European Commission's adequacy decision for the EU-U.S. Data Privacy Framework (Art. 45 GDPR), under which Google LLC is certified. Where it does not apply, the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR), which are part of the Cloud Data Processing Addendum, apply.

We keep business emails for six years and emails that serve as accounting records (for example invoices) for eight years (Section 147 German Fiscal Code), each counted from the end of the calendar year. Other emails, such as advertising or automatic notifications, are deleted after one year.

5. Inbox and receipts

A program on our server sorts incoming emails automatically and files invoices in our accounting. If an email or receipt cannot be assigned clearly, the necessary content goes to Anthropic's Claude API (processor, see section 6); requests to support@ do not. The legal basis is Art. 6(1)(f) GDPR (an organised inbox) and, for receipts, Art. 6(1)(c) GDPR (retention: receipts eight years, bookkeeping records ten years, Section 147 German Fiscal Code).

6. Orders via Fiverr

Services ordered through the Fiverr platform are handled via Fiverr. Fiverr is responsible for processing on the platform itself; Fiverr's privacy policy applies there.

We process the details you give us for an order (for example business name, trade, town, dates, target group, your Fiverr username and order number) to create and deliver your content plan and, if you ordered it, your finished content (section 8). The legal basis is Art. 6(1)(b) GDPR (performance of a contract).

We use these service providers:

• Hetzner Online GmbH (server, Germany) – automation and creation of the PDF files.
• Google Workspace (Google Drive and Google Sheets, see section 4) – storage of order details and plans.
• Anthropic Ireland, Limited, 6th Floor, South Bank House, Barrow Street, Dublin 4, D04 TR29, Ireland (AI text generation via the Claude API) – receives the order details needed for the plan. We have concluded a data processing agreement with Anthropic (Data Processing Addendum, Art. 28 GDPR); Anthropic may not use the data to train AI models. Processing may also take place in the USA; the transfer is based on the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR).

If you voluntarily send us details about other people who should appear in the plan (for example first names of staff or customer quotes), we use them only for that plan. We delete the details themselves after the end of the plan month; they remain in the delivered plan until we delete the plan (twelve months after your last order). Please only send such details if the people concerned agree. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is creating your plan the way you want it. The details come from you as our client.

We delete your order details and plans twelve months after your last order. We keep the order number, order date and package for eight years as proof of our income (Section 147 German Fiscal Code).

7. Ordering via mein.feedgrove.de

Visiting the pages. When you open mein.feedgrove.de, our server (Hetzner, Nuremberg) keeps an access log with IP address, time, requested address (without personal link keys) and browser identifier in order to detect and prevent misuse (Art. 6(1)(f) GDPR). The log is deleted after 14 days. The pages set no cookies and load no third-party services; the questionnaire keeps your progress only in your browser (sessionStorage, technically necessary) until you close the window.

Order and payment. For your order we process your first and last name, business name, email address, the chosen package and the payment status (Art. 6(1)(b) GDPR). For payment we forward you to our payment service Stripe (Stripe Payments Europe, Limited, 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland). Stripe receives your order and payment details and your billing address and processes them on our behalf (Data Processing Agreement, Art. 28 GDPR); for its own purposes, such as fraud prevention, anti-money-laundering checks and processing with card networks and banks, Stripe is itself the controller. Stripe may transfer data to the USA; this is based on the EU-U.S. Data Privacy Framework or EU Standard Contractual Clauses. On Stripe's payment pages Stripe's privacy notice applies, and Stripe may set cookies there. If you choose PayPal, PayPal (Europe) S.à r.l. et Cie, S.C.A. processes your data as an independent controller. We do not receive card details.

Invoice. We create your invoice ourselves; we keep invoices and accounting records for eight years under Section 147 German Fiscal Code (Art. 6(1)(c) GDPR), in Google Workspace (see section 4).

Questionnaire and photos. We use the details in your questionnaire and the photos, videos and notes you upload to create your plan and your content (Art. 6(1)(b) GDPR). We store photos on our server in Germany. To add the town to your postcode, our server sends only the postcode to the OpenPLZ API, without any other details. If you give us your website, we automatically read the public pages of that website (texts, colours, fonts, logo, images) to match your look; we do not take photos showing recognisable people from it. If other people can be seen in your photos (for example staff), you confirm to us that they agree.

AI services. For the plan, design and checks we use AI services under data processing agreements; details are in section 8.

Emails about your contract. We email you about your order, send you your personal links to the questionnaire and photo page right after payment (including a reminder if the questionnaire is still open), remind you in an ongoing subscription about 14 days before each new plan start to add new photos, dates and wishes, write to you about reviewing and accepting your content, and send you your invoice (Art. 6(1)(b) GDPR). These emails contain no advertising.

Reminder and waiting list (consent). If you tick the box in the questionnaire, we remind you by email after a one-off order when the next month is due, or inform you once by email as soon as our offer “Website by feedgrove” is available (Art. 6(1)(a) GDPR, Section 7(2) German Act against Unfair Competition). You can withdraw your consent at any time by emailing hello@feedgrove.de, also simply by replying to one of our emails.

Storage period. We delete unpaid orders after 30 days. We delete customer data, questionnaires and plans twelve months after your last order. We keep invoices for eight years. The other periods (photos, download, waiting list) are listed in section 15.

8. Finished content made with AI (images, carousels, reels)

If you order finished content, we create images, carousels and reels from your content plan, your photos, videos and notes, your logo, colours and fonts (and, where applicable, your website). The legal basis is Art. 6(1)(b) GDPR (performance of a contract). We use photos of people only as a template for your content, not to recognise people.

In addition to Hetzner (storage and processing on our server in Germany) and Google Drive (archive of the finished content, see section 4) we use these service providers:

• Anthropic (Claude API, see section 6) – plans each post and checks the results. For this Anthropic receives texts and downsized photos. In addition, an automatic visual check of the finished posts runs on our server, which also uses the Claude API (preview images, single frames from reels, your photos and the texts of the posts).
• Magnific AI S.L.U., Málaga, Spain – creates images, videos and music from our descriptions (without names) and your photos as a template. We have a data processing agreement with Magnific (Art. 28 GDPR). For this, Magnific uses models from other providers as sub-processors, depending on the motif including GPT Image (OpenAI, USA), Lyria (Google, USA) and Kling (Lohas Games, Singapore). For these transfers Magnific has concluded EU Standard Contractual Clauses (Art. 46(2)(c) GDPR) with the providers; for the USA the EU-U.S. Data Privacy Framework also applies where the provider is certified under it. There is no adequacy decision of the European Commission for Singapore.
• ElevenLabs (Eleven Labs Inc., USA) – creates the narrator voice for reels from the script; only if you have given consent, also from your own voice (section 9). We have a data processing agreement with ElevenLabs; the transfer to the USA is based on EU Standard Contractual Clauses or the EU-U.S. Data Privacy Framework.
• Google (Gemini API, Google LLC, USA) – creates short video scenes showing people from a prepared still image and a motion description (without names). Google processes the data as a processor under its data processing terms, does not use it for training on the paid tier and keeps requests for 55 days solely for abuse detection. The transfer to the USA is based on the EU-U.S. Data Privacy Framework.

Anthropic, Magnific and Google may not use your data to train AI models; Magnific has also confirmed this to us in writing for the other providers' models. With ElevenLabs we have switched off the use of our data for training.

Before you receive your content, we check every piece ourselves. Content created or changed with AI carries a small visible label (“AI generated” or “AI modified”) and technical provenance information in the file (IPTC, C2PA); your unchanged photos carry none. When posting, please also set the AI label of the platform concerned. How long we store photos and content is set out in section 15.

9. AI avatar and your own voice (consent)

On the photo page you can voluntarily give us photos of yourself (up to three), a short video (up to 30 seconds) and a voice recording (about one minute, recorded in your browser after you allow access to the microphone). We use them to recreate your face and, if you tick the box, your voice with AI services, exclusively for the content of your business. This is only offered to the person who placed the order, not to employees or other people. You must be at least 18 and give separate consent for your face, your voice and publication by your business; we keep the date and version of your consent as proof. We do not use the recordings to recognise or identify you.

We store the photos, video and recording on our server in Germany. For images and videos your photos are sent as a template to the image and video models via Magnific, including providers outside the EU (section 8). From your voice recording ElevenLabs creates a voice in our account, which is used to narrate your reels.

The legal basis is your explicit consent (Art. 6(1)(a) GDPR and, insofar as your face or voice count as biometric data, Art. 9(2)(a) GDPR). You can withdraw it at any time by emailing hello@feedgrove.de; we then create nothing new with your face or voice and delete the photos, video, recordings and the voice created in our ElevenLabs account within 7 days. Content already delivered is published by your business itself; you decide whether it stays online. Without withdrawal we delete them at the latest 30 days after the end of the contract. Without consent we create your content without your face and with an AI voice that you choose in the questionnaire.

9a. Messages via WhatsApp (consent)

In the questionnaire you can choose to let us send you messages about your order via WhatsApp (reminders, approvals, questions) and give us your mobile number. This is voluntary and we do not send advertising this way. We only contact you once your consent is in place; we keep the date, time and wording of your consent as proof.

For this we use the WhatsApp Business Platform of Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland. We process your mobile number, your name or business name, the content and time of messages and delivery information (delivered, read). Meta processes this data on our behalf as a processor under the WhatsApp Business data processing terms; data may be transferred to Meta Platforms, Inc. in the USA on the basis of the EU-US Data Privacy Framework or EU standard contractual clauses. WhatsApp's own terms and privacy policy also apply to your use of WhatsApp.

The legal basis is your consent (Art. 6(1)(a) GDPR, § 7 German Unfair Competition Act). You can withdraw it at any time by sending “STOP” in the WhatsApp chat or by email to hello@feedgrove.de; after that we will no longer message you on WhatsApp. You will still receive emails about your contract. We delete your number and the message history 30 days after withdrawal, at the latest 30 days after the end of the contract.

10. Connecting your Google Business Profile (optional)

In the questionnaire you can connect your Google Business Profile with us. If you click “Connect with Google” and allow access, we read from your profile: the photos and media you uploaded as the owner, your business description, categories, opening hours and posts. We use this information only to create your social media content.

Google requires the permission “business.manage” for this, which in principle would also allow changes. We only read and change nothing in your profile. The data read may be passed to the AI services in section 8 (under data processing agreements, without AI training). We store it for at most 30 days and delete it earlier as soon as we no longer need it. We do not use it for advertising and do not sell it.

The legal basis is Art. 6(1)(b) GDPR (performance of a contract) and the consent you give by allowing access (Art. 6(1)(a) GDPR). You can disconnect at any time: by emailing hello@feedgrove.de (we then stop access within seven days) or yourself in your Google Account under third-party apps with access to your account (myaccount.google.com/connections).

feedgrove's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

11. Use of the Google Ads API (Opportunity Scout)

12. Internal login pages

portal.vortexcontenthub.com and n8n.vortexcontenthub.com are our internal, password-protected work areas (the old address fiverr.vortexcontenthub.com redirects there). For these addresses (not for the public website) our server keeps an access log with IP address, time and requested address in order to detect repeated failed login attempts and temporarily block the IP address concerned. Passwords and cookies are not logged. The legal basis is Art. 6(1)(f) GDPR (protecting our systems). The log is started anew every day and deleted after 14 days.

13. Backups

To prevent data loss we back up our server every day: on the server itself (14 days), via Hetzner (seven versions), encrypted in Google Drive (30 days, then up to 30 days in the bin) and on our own PC. Deleted data therefore disappears from the backups after about 60 days at the latest. The legal basis is Art. 6(1)(f) GDPR (data security, Art. 32 GDPR).

14. Obligation to provide data, no automated decisions

You are not obliged to give us any data. Without the details for an order we cannot carry it out. Consents (sections 7, 9 and 10) are voluntary; we carry out your order without them as well. We do not use automated decision-making, including profiling, under Art. 22 GDPR.

15. Storage period

Unless a more specific period is given above, we keep personal data only until the purpose of processing no longer applies. If you make a justified request for deletion, we delete your data unless other legal reasons for keeping it exist (for example retention periods under tax or commercial law); in that case we delete it once those reasons no longer apply.

For orders via mein.feedgrove.de and finished content these periods apply:

• Unpaid, expired or failed orders: 30 days.
• Customer data, questionnaires, plans and paid orders: twelve months after your last order; invoices eight years (Section 147 German Fiscal Code).
• Download copy of your finished content: two days after acceptance.
• Intermediate versions, finished content and delivery data on our server: 30 days after acceptance; we delete the archive of finished content in Google Drive twelve months after your last order.
• Photos you release for one month only: end of that month plus 30 days. Photos we may always use: 30 days after the end of the contract.
• Photos, video and voice recording for the AI avatar and your own voice, and the voice created from them: within 7 days after you withdraw consent, otherwise 30 days after the end of the contract.
• Personal links to the questionnaire and photo page: 30 days after the end of the contract.
• Waiting list “Website by feedgrove”: after the one information email, at the latest after twelve months.
• Data read from your Google Business Profile: at most 30 days.
• Mobile number and WhatsApp messages: 30 days after you withdraw consent, at the latest 30 days after the end of the contract; the consent record itself as proof for up to three years after the end of the contract.

Deleted data disappears from the backups (section 13) after about 60 days at the latest.

16. Your rights

You have the right at any time to free information about your stored data, its origin, recipients and the purpose of processing (Art. 15 GDPR), and the right to rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). Just send us an email.

You can withdraw any consent (for example for reminders and the waiting list, for the AI avatar and your own voice, or for connecting your Google Business Profile) at any time with effect for the future (Art. 7(3) GDPR), for example by emailing hello@feedgrove.de. This does not affect the lawfulness of processing before the withdrawal.

17. Right to complain

You can lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), in particular in the EU member state of your habitual residence, your place of work or the place of the alleged infringement. The authority responsible for us is the Bavarian Data Protection Authority (Bayerisches Landesamt für Datenschutzaufsicht, BayLDA), Promenade 18, 91522 Ansbach, Germany, www.lda.bayern.de.

18. Objection to advertising emails

We object to the use of the contact details published in our legal notice for sending advertising and information material that we have not expressly requested. We expressly reserve the right to take legal action in the event of unsolicited advertising, such as spam emails.

19. Language versions

This privacy policy is available in English and German with the same content. In case of differences, the German version applies.