Privacy

1. Controller

The controller under the General Data Protection Regulation (GDPR) is:

2. General information and legal bases

Personal data is processed only where necessary to operate this website securely and reliably, measure aggregate reach with limited data, or respond to enquiries. Depending on the activity, processing is based on Article 6(1)(b) GDPR where necessary for pre-contractual steps or a contract, or Article 6(1)(f) GDPR. The legitimate interests are secure operation, delivery of the content, responding to enquiries, and privacy-minimizing measurement and improvement of the service.

This notice describes the current technical implementation and is not individualized legal advice.

3. Hosting and delivery through Lovable

The website is delivered through Lovable. Technically necessary log data may be processed when pages are delivered. Lovable describes such log data as including IP address and approximate location, browser type and version, pages, APIs or features accessed, timestamps and time spent, session or device identifiers, and error, debug and usage data. Processing supports secure, stable and reliable delivery of the website under Article 6(1)(f) GDPR.

The provider is Lovable Labs Incorporated, 1 Lincoln St, Boston, MA 02111, USA. Lovable provides a data processing agreement under Article 28 GDPR for this processing. Processing of log data in the United States cannot be ruled out; see section 8 for the safeguards applying to transfers to third countries.

4. Interactive Playground

When you submit a test email in the Playground, its subject and text are sent to an AI language model together with a fictional inbox, and the response is displayed to you. Processing takes place through the AI service of Lovable (Lovable Labs Incorporated, USA), which uses models from OpenAI and Google for this purpose. This website does not store your inputs or the model's responses; the providers may retain data for a limited period under their terms for abuse detection. To protect against abuse, your IP address is processed only as a salted hash and deleted after 24 hours at the latest.

Before each attempt, Cloudflare Turnstile (Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA) checks that the request comes from a browser and not from an automated script. Cloudflare processes your IP address and technical characteristics of your browser for this; no user identifier is created. The legal basis is Article 6(1)(f) GDPR, and the legitimate interest is protecting the Playground against automated abuse. The transfer to the United States relies on the EU-US Data Privacy Framework, which Cloudflare has joined. More information: https://www.cloudflare.com/privacypolicy/

To track your progress, a random session identifier is stored in your browser's session storage. The legal basis is Article 6(1)(f) GDPR; the legitimate interest is providing the feature and protecting it against abuse. Please do not enter personal or confidential data.

5. Web analytics with Ahrefs Web Analytics

This website is intended to use Ahrefs Web Analytics, provided by Ahrefs Pte. Ltd., UEN 201227417H, 16 Raffles Quay, #33-03 Hong Leong Building, Singapore 048581. The required site-specific code is not currently installed. Once activated, it will be used to measure aggregate audience and reach, analyze traffic sources, and improve content and usability. The intended legal basis is Article 6(1)(f) GDPR. The legitimate interest is privacy-minimizing reach measurement and improvement of the website.

According to its current documentation, the default configuration stores page URL, referrer, browser, device and operating-system information derived from the user agent, country and city, language information, and common events such as page views, link clicks and form submissions. The visitor's IP address reaches the service and is used transiently to derive location and, together with the user agent, to create a daily salted hash for unique-visitor counting. Ahrefs says raw IP addresses are discarded and are not stored in its databases or logs, and that the random salt is regenerated or deleted every 24 hours. This is intended to prevent persistent identification across days. Ahrefs also says it does not track individuals across devices, websites or apps.

6. Cookies, local storage and consent status

If you actively choose a color scheme, this choice ("light" or "dark") is stored in your browser's local storage to keep it on later visits; it contains no personal data and is not transmitted.

Ahrefs Web Analytics is intended to operate in its default cookieless configuration. The website does not currently set analytics or advertising cookies for it and does not use persistent local browser storage for it. Therefore, no analytics cookie banner is currently implemented solely for this planned cookieless analytics setup. Site search, filters and interactive labs run in the browser and, under the current implementation, do not persist their inputs.

If future services use cookies or comparable storage mechanisms that require consent, this notice and the consent mechanism will be updated before those services are activated.

The Playground stores a random session identifier in your browser's session storage. It is technically required for the function you request and is deleted when you close the browser tab.

7. Contact by email

If you contact the operator by email, your email address, message content and associated message metadata are processed to respond to your enquiry. Ordinary correspondence is based on Article 6(1)(f) GDPR. Where a message concerns pre-contractual or contractual steps, Article 6(1)(b) GDPR may apply. The website does not provide a contact form.

8. Recipients, processors and international transfers

Data may be disclosed to technical service providers where necessary for hosting, delivery, security and activated audience measurement. These providers include Lovable, Cloudflare (Turnstile as bot protection for the Playground) and, once analytics is activated, Ahrefs. These providers may use subprocessors as described in their published documentation.

Processing outside the European Economic Area may occur. In its data processing agreement, Lovable bases transfers to the United States on the EU Standard Contractual Clauses. Cloudflare bases transfers to the United States on the EU-US Data Privacy Framework, which the company has joined. Ahrefs is based in Singapore and publishes a Data Processing Addendum incorporating EU Standard Contractual Clauses for applicable transfers. There is no European Commission adequacy decision for Singapore; transfers there are therefore based on the EU Standard Contractual Clauses.

For the Playground, Lovable uses the model providers OpenAI and Google as subprocessors. This may involve processing in the United States; the safeguards described in this section apply.

9. Retention

Personal data is retained only for as long as necessary for its purpose or required by statutory retention obligations. Technical log data follows the retention periods applicable to the hosting service. Email correspondence is deleted after an enquiry has been resolved unless legal obligations or legitimate reasons require further retention. Ahrefs processing follows its provider documentation, including daily regeneration or deletion of the salt used for visitor counting.

10. Data-subject rights

Subject to the statutory conditions, you have rights of access, rectification, erasure, restriction of processing and data portability. You may also object to processing. Where processing is based on consent, you may withdraw that consent at any time for the future. To exercise these rights, contact the controller identified above.

11. Right to object under Article 21 GDPR

Where personal data is processed under Article 6(1)(f) GDPR, you have the right to object at any time on grounds relating to your particular situation. Processing will then cease unless compelling legitimate grounds are demonstrated that override your interests, rights and freedoms, or the processing is required for the establishment, exercise or defense of legal claims.

12. Right to complain to a supervisory authority

You have the right to lodge a complaint with a data protection supervisory authority, particularly in the Member State of your habitual residence, place of work or the place of the alleged infringement. This right is without prejudice to other administrative or judicial remedies.

13. Automated decision-making and profiling

The website does not make solely automated decisions that produce legal or similarly significant effects for visitors. Under the current implementation, the website does not perform personal profiling. The planned Ahrefs use is limited to aggregate web analytics in the cookieless default configuration described above.

14. Updates to this privacy notice

This privacy notice will be updated when the website, its services or applicable requirements change. The date above identifies the current version.