Security and privacy

Where your data lives

Server and database are run by Hetzner Online GmbH, a provider from Germany, in its data centre in Helsinki (Finland). The data stays in the EU and under the GDPR. The connection to the website is always encrypted (HTTPS).

A backup is made every night and also stored outside the server, at Amazon Web Services in Frankfurt. The server may only add new backups there. It can neither read nor delete old ones, so a backup survives even if the server itself is attacked.

Your ad accounts

Your ads run on your own account. You pay Google or Meta directly, with your card and your limit. We do not advance any ad budget.

For Google Ads you accept a link request from us in your account. For Meta you add us as a partner. We get neither your password nor an access key. You can remove the link in your own account at any time.

Protection against unplanned ad costs

No campaign starts by itself. A person checks copy, budget and audience and presses start.

The budget is limited in three places: directly at Google or Meta, in our system before every start, and by a check every 15 minutes. A campaign over its budget or past its end date is paused. A kill switch stops all ads at once.

Sign-in and payment

You sign in with a link sent by e-mail. There is no password that could be stolen or guessed.

The admin console can additionally be protected with a code from an authenticator app. Every change made there is logged with name and time.

Payments run through Stripe (Ireland). You enter card details directly at Stripe. We never see them.

AI and your content

Text and code are written by the AI model Claude from Anthropic (USA). Images for ads are made by OpenAI (USA) from a description of the app, without your contact details. Transfers to the USA rely on the EU-US Data Privacy Framework or the EU standard contractual clauses.

The AI suggests, you decide. You approve everything that goes public or costs money. An automatic check stops pages that state prices, insurer contracts, certificates or awards you never named.

Your visitors and customers

On our website we count visits without cookies. Google Analytics, Google Ads and Meta load only after consent, and consent can be withdrawn at any time.

Sign-ups on your landing page use double opt-in. The consent is stored with its time, and every e-mail has a link that deletes the address at once.

Data processing agreement

When we process data of your customers for you, for example sign-ups on your landing page, you are the controller and we are your processor. For this we sign a data processing agreement under Art. 28 GDPR with you. Write to office@codemenschen.at.

Who else processes data

How long we keep data

Questions, or found a security issue?

Write to office@codemenschen.at. A person answers. All details of the processing are in the privacy policy.

Read the privacy policy