Privacy policy

2. What data we process

We process personal data only to the extent necessary to provide our service and to process your order. In particular, this includes:

• Order and contract data: the email address you provide, the selected services, order quantity, order and transaction numbers, and the order status.

• Target URLs and order details: the public profile or post links you enter during the ordering process (e.g. to Instagram, TikTok, YouTube) and any further information required for delivery. No passwords are required for delivery; please never share any login credentials with us.

• Payment data: the data required to process the payment. This is processed directly by our payment service provider Stripe; full card details are not stored on our systems.

• Communication data: the content and metadata of your support requests and the associated email communication.

• MCP keys: if you create a personal key for our MCP interface in your customer account, we store only a cryptographic hash of the key, its last four characters, the name you give it, its link to your customer account including your email address, and the time it was created and last used. We do not store the key itself; it is shown only once when it is created. Revoking the key deletes this information. Orders created with the key belong to your customer account and are processed like any other order.

• Usage and server log data: technical access data such as IP address, date and time of access, requested resource, volume of data transferred, referrer, and browser and operating system information.

3. Purposes and legal bases of processing

We process your data on the basis of the following legal bases under the GDPR:

• To perform the contract and to carry out pre-contractual measures – in particular to process, deliver and confirm your order and to issue invoices and provide support (Art. 6(1)(b) GDPR).

• To comply with legal obligations, such as retention obligations under commercial and tax law (Art. 6(1)(c) GDPR).

• To safeguard our legitimate interests, in particular to ensure the secure and stable operation of the website, to prevent abuse and fraud, and to assert legal claims (Art. 6(1)(f) GDPR).

• On the basis of your consent, where you have granted it, for example for non-essential cookies (Art. 6(1)(a) GDPR). You may withdraw any consent given at any time with effect for the future.

4. Hosting and provision of the website (AWS)

Our website is operated on Amazon Web Services (AWS). When the pages are accessed, technically necessary data is processed in server log files to ensure delivery of the website, its stability and security, and to defend against attacks. The legal basis is our legitimate interest in a secure and functional service (Art. 6(1)(f) GDPR). A data processing agreement pursuant to Art. 28 GDPR is in place with the provider.

5. Payment processing (Stripe)

Payments are processed via the payment service provider Stripe (Stripe Payments Europe, Ltd. and affiliated companies). To process the payment and issue invoices, the required data – in particular name, email address and payment and billing details – is transmitted to Stripe and processed there by Stripe under its own responsibility. The legal basis is performance of the contract (Art. 6(1)(b) GDPR) and our legitimate interest in secure, fraud-free payment processing (Art. 6(1)(f) GDPR). For details, please refer to Stripe's privacy policy.

6. Order fulfilment via SMM dispatch provider

To deliver the ordered social media marketing services, we use a specialised provider (wholesale/SMM provider). Only the information required to fulfil your order is transmitted to this provider, in particular the public target URLs you provide as well as the service and quantity ordered. The legal basis is performance of the contract (Art. 6(1)(b) GDPR). Since the URLs entered relate to public profiles or posts, the sharing of login credentials is neither required nor intended.

7. Email delivery (Resend / Amazon SES)

To confirm orders, send invoices and status notifications, and handle support communication, we send emails via an email delivery provider (Resend or Amazon SES, depending on configuration). In doing so, we process your email address and the associated transaction and message data. The legal basis is performance of the contract and our legitimate interest in reliable communication (Art. 6(1)(b) and (f) GDPR). A data processing agreement pursuant to Art. 28 GDPR is in place with the provider.

8. Protection against abuse (Cloudflare Turnstile)

To protect our forms and ordering processes against automated abuse (bots, spam), we use Cloudflare Turnstile, a service provided by Cloudflare, Inc. In this process, technical information (including IP address and device/browser data) is transmitted to Cloudflare and analysed in order to distinguish human from automated access. The legal basis is our legitimate interest in the security and abuse-free operation of our service (Art. 6(1)(f) GDPR).

9. IP reputation check for abuse prevention (IPQualityScore)

To protect our paid analysis and search functions (retrieval of public profile and post data) against automated abuse, we check the reputation of your IP address via the IPQualityScore service (IPQualityScore LLC) when you use these functions. Your IP address is transmitted to IPQualityScore and evaluated to determine whether the access originates from anonymising networks (e.g. proxies, VPNs, the TOR network) or from known bot or abuse infrastructure. We cache the result of this check per IP address in order to avoid repeated lookups and thus unnecessary costs. The legal basis is our legitimate interest in the security, abuse and fraud prevention, and the economic viability of our service (Art. 6(1)(f) GDPR). IPQualityScore may also process data in third countries (in particular the USA); the statements under 'Transfers to third countries' apply.

10. Web analytics and session recording (Mouseflow)

With your consent, we use Mouseflow, a web analytics service provided by Mouseflow ApS (Denmark). Mouseflow creates anonymised recordings of individual sessions (including mouse and scroll movements, clicks and page views) and aggregated heatmaps so that we can understand how our website is used and improve its usability. Entries in form fields are suppressed and not recorded. The legal basis is solely your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time with effect for the future via the cookie banner settings. Mouseflow may also process data in third countries; the statements under 'Transfers to third countries' apply.

11. Review portal (Trustportal)

On the home page we show a summary of the reviews of follower.kaufen from the review portal Trustportal (trustportal.biz). Trustportal is operated by B A Media Group FZE LLC, which also operates this website. To do so, your browser loads a script and the review summary from trustportal.biz, which technically involves transmitting your IP address. Trustportal sets no cookies and does not access your browser's local storage. The legal basis is our legitimate interest in presenting our reviews (Art. 6(1)(f) GDPR). The Fairness-Siegel on the home page is a locally stored file; displaying it does not establish any connection to fairness-siegel.de.

12. Live chat (fonella)

On our pages we offer a live chat in which an AI assistant answers your questions about our services, prices and orders. The chat runs on fonella, a service of WBA Systems GmbH, Kienberger Allee 4, 12529 Schönefeld, Germany, which operates it on our behalf (Art. 28 GDPR). So that the page loads quickly, your browser only fetches the chat window from fonella.ai after your first input or a few seconds after the page has loaded; fonella receives your IP address and the details your browser sends with every request. The chat sets no cookies. In your browser's storage it keeps a random id (fonella-chat-session) that links your chats across tabs and later visits and stays there until you delete it; the history of the current conversation and whether you have already opened the chat window are only kept until you close the tab. The legal basis is our legitimate interest in answering your questions directly on the page and without waiting (Art. 6(1)(f) GDPR). You can delete the entries at any time in your browser's settings.

When you write, we process your messages with everything you state in them, such as links to profiles or posts, your name or your email address, as well as the id, the language, the address and the title of the page you are writing on, the kind of page, the link open in the builder, the items and the total of your cart, your IP address, information about your browser and the time, in order to answer your question (Art. 6(1)(b) and (f) GDPR). The chat asks our shop for the catalog, prices, profile analyses and recommendations; our server only receives the details of the request, such as a profile link, the service and the quantity, and an id of the conversation, not your messages. Like our builder, a profile analysis reads the publicly visible details of the profile (follower count, posts and their statistics). So that new analyses cannot be abused, our page gives the chat an encrypted token that contains your IP address and expires after two hours; only our server can read it, to count the analyses per visitor and to check the reputation of the IP address as described in section 9 (Art. 6(1)(f) GDPR). On your request the chat adds services to your cart, removes them or opens a page, each only after you have confirmed this in the chat. Payment only takes place via the cart.

The answers are generated automatically by a language model, as is a short summary of the chat that we receive by email and as a push notification together with the contact details given in it. For this, your messages and the previous history are sent to OpenRouter, Inc. in the USA, which forwards them, depending on availability, to a language model of OpenAI, Anthropic, Google or Meta; we base the transfer to the USA on the standard contractual clauses of the EU Commission (Art. 46(2)(c) GDPR). fonella stores the chat on servers of Amazon Web Services EMEA SARL in the Frankfurt region; it is deleted as soon as your request has been dealt with and no retention obligation applies. To prevent abuse, fonella counts the messages per IP address and minute and deletes this count after about a day (Art. 6(1)(f) GDPR). Where we rely on our legitimate interest in offering the chat, answering requests quickly and preventing abuse, you may object at any time on grounds relating to your particular situation (Art. 21(1) GDPR). OpenRouter privacy notice: openrouter.ai/privacy.

13. Telephone enquiries

Calls to the phone number shown on this website are answered by an AI-powered phone assistant. At the start of the call you are told that you are speaking with an AI-powered phone assistant.

The controller is B A Media Group FZE LLC, Business Centre, Sharjah Publishing City Free Zone, Sharjah, United Arab Emirates (see imprint). The telephony platform is operated as a technical service provider by WBA Systems GmbH, Kienberger Allee 4, 12529 Schönefeld, Germany, with its service fonella.

We process your phone number, if it is transmitted, the number you called, the date, time and duration of the call, the content of the conversation as speech and as text (transcript), an automatically generated summary, and any details you give during the call, for example your name, email address or a callback number.

During the call your speech is converted into text. An AI language model generates a reply, which is read out by speech synthesis. After the call a summary is created, the transcript and summary are translated, and contact details you mentioned are identified. We are notified of the call by email and, where enabled, by push notification. The call is not recorded as audio.

The following service providers are used:

sipgate GmbH, Düsseldorf, Germany: phone number and call routing.

Vapi Inc., 150 Spear Street, Suite 1000, San Francisco, CA 94105, USA: handling of the conversation and the summary. For this Vapi uses Deepgram, Inc., San Francisco, USA (speech recognition), Google LLC, Mountain View, USA (Gemini language model) and ElevenLabs, Inc., New York, USA (speech synthesis).

OpenRouter, Inc., USA: translation of transcript and summary and identification of contact details, using models from Google, with OpenAI or Meta as fallback.

Amazon Web Services EMEA SARL, Luxembourg: storage in data centres in Frankfurt am Main.

Mailgun Technologies, Inc. (Sinch), USA: sending the notification email via its EU region.

The legal basis is Art. 6(1)(b) GDPR where your call relates to entering into or performing a contract, and Art. 6(1)(f) GDPR otherwise. Our legitimate interest is to receive and answer enquiries at any time, including outside business hours.

Data is transferred to the USA in the process. Vapi bases transfers from the EU on the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR).

We delete the data as soon as it is no longer needed for the purpose described, or at your request, unless statutory retention obligations apply. Vapi also stores the transcript, the course of the conversation, the summary and technical logs and deletes them on request. According to WBA Systems GmbH, the call data is not used to train AI models. Under its terms of service Vapi does not pass it on to third parties for their model training, but may use it, without reference to us or to you, to improve its own service, for example speech recognition.

If you prefer not to speak with the AI assistant, you can also reach us by email at the address given in the imprint. Your rights of access, rectification, erasure, restriction of processing, data portability and objection, and your right to lodge a complaint with a supervisory authority (Art. 15 to 21 and 77 GDPR), also apply to this data.

14. Cookies and consent

By default, we only use technically necessary (essential) cookies or comparable technologies that are required for the operation of the website, the shopping cart and the ordering process (Sec. 25(2) TDDDG). Non-essential cookies or analytics/marketing technologies are only set after your explicit consent (Sec. 25(1) TDDDG, Art. 6(1)(a) GDPR). You may withdraw your consent at any time with effect for the future via the “Cookie settings” link in the footer or your browser.

15. Recipients and processors

Your data is only transmitted to third parties where this is necessary to perform the contract, where we are legally obliged to do so, or where you have consented. Processors or recipients include in particular: the hosting provider (AWS), the payment service provider (Stripe), the email delivery provider (Resend or Amazon SES), the bot-protection service (Cloudflare Turnstile), the IP reputation service (IPQualityScore), the web analytics service (Mouseflow), the review portal (Trustportal), the live chat service fonella (WBA Systems GmbH) with OpenRouter and the providers of the language models for the answers in the live chat, and the SMM dispatch provider for fulfilling the order. We conclude agreements with processors pursuant to Art. 28 GDPR.

16. Transfers to third countries

The controller (B A Media Group FZE LLC) is based in the United Arab Emirates, a country outside the EU/EEA (third country). In addition, some of the service providers used may process data in third countries, in particular the USA. Any such transfer only takes place in compliance with the requirements of Art. 44 et seq. GDPR, in particular on the basis of an adequacy decision by the EU Commission, appropriate safeguards (e.g. EU standard contractual clauses), or your explicit consent. We will inform you of the safeguards in place upon request.

17. Retention period

We store personal data only for as long as necessary for the purposes stated. Order and contract data is retained for the duration of the business relationship and, beyond that, within the scope of statutory retention obligations (in particular under commercial and tax law, generally up to 10 years). Target URLs and order details are deleted as soon as they are no longer required for delivery, for any top-ups (refill), or for the establishment, exercise or defence of legal claims. Server log data is stored only for a short period and then deleted or anonymised.

18. Your rights as a data subject

Under the GDPR you have the following rights:

• Right of access to the data stored about you (Art. 15 GDPR);

• Right to rectification of inaccurate data (Art. 16 GDPR);

• Right to erasure (Art. 17 GDPR) and to restriction of processing (Art. 18 GDPR);

• Right to data portability (Art. 20 GDPR);

• Right to object to processing based on a legitimate interest (Art. 21 GDPR);

• Right to withdraw any consent given at any time with effect for the future (Art. 7(3) GDPR).

To exercise your rights, an informal message to the contact details above is sufficient.

19. Right to lodge a complaint with a supervisory authority

Without prejudice to any other remedy, you have the right to lodge a complaint with a data protection supervisory authority if you believe that the processing of your data infringes the GDPR (Art. 77 GDPR). You may contact the supervisory authority of your habitual residence, your place of work, or the place of the alleged infringement.

20. Currency and changes

This privacy policy is currently valid. As our service evolves or due to changes in legal or regulatory requirements, it may become necessary to amend this privacy policy. The version published on this page applies in each case.