Privacy policy

1. Controller

The controller is FNLY IT UG (haftungsbeschränkt), Am Kraftwerk 23, 34582 Borken, Germany, represented by its managing director Alina Schmid. Phone: +49 5682 7369200, email: info@fnly-it.com. Contact us at this address for any data protection question and to exercise your rights.

2. Data protection officer

We are not required to appoint a data protection officer under Art. 37 GDPR and § 38 BDSG. Management handles your requests directly.

3. This website

The website heyplanoo.com runs on servers we operate ourselves in the data centre of Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany. A data processing agreement under Art. 28 GDPR is in place with Hetzner. The connection is encrypted with TLS.

When you visit, your browser technically transmits your IP address, date and time, the page requested, the referrer and your browser and operating system. Our server processes this only to deliver the page (Art. 6 (1) (f) GDPR). We do not keep access logs with this information.

If you open heyplanoo.com without a language in the address, we forward you to the matching version of the site. To do this we derive your country from your IP address and take your browser's language setting into account. The lookup uses a database on our own server (IP geolocation by DB-IP, https://db-ip.com, license CC BY 4.0). Your IP address is not shared with anyone for this purpose and is not stored. The legal basis is our legitimate interest in showing you the site in your language and with the prices for your market (Art. 6 (1) (f) GDPR).

If you pick a language version yourself in the language selector, we store that choice in a cookie ("fnly_heyplanoo_locale", kept for one year) so we do not redirect you again on your next visit. The cookie is required for this function you requested (§ 25 (2) no. 2 TDDDG) and only contains the code of the version you chose.

Fonts and images are served from our own server. Scripts from other servers are only loaded with your consent, see the following sections.

4. Consent and local storage

We do not set advertising cookies without your consent. We store your choice in the consent banner in your browser's local storage (localStorage, entry “fnly-consent”) so the banner does not reappear on every page. This storage is strictly necessary for the service you requested.

We load all services that are not strictly necessary only with your consent under Art. 6(1)(a) GDPR. You can change or withdraw your consent at any time via the “Cookie settings” link in the footer of every page. Withdrawal takes effect for the future.

5. Website statistics with Matomo

If you consent to the “Statistics” category, we use the open-source software Matomo to measure how our website is used. The statistics server at statistik.fnly-group.com is run by FNLY Group in Germany, and the data is not shared with third parties.

We process your IP address, shortened by the last two bytes before storage, the pages you view and how long you stay, the website you came from, information about your device, browser and screen size, and actions such as submitting a form. Matomo sets the cookies “_pk_id” (stored for 13 months) and “_pk_ses” (30 minutes).

We use the results to improve our content and to understand which pages lead to beta sign-ups. The legal basis is your consent under Art. 6(1)(a) GDPR. Raw data is deleted after 395 days.

6. Advertising and ad measurement

If you consent to the “Marketing” category, we use services of the ad platforms where we run ads: Google Ads (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland), the LinkedIn Insight Tag (LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland), the Meta Pixel for Facebook and Instagram (Meta Platforms Ireland Limited, Merrion Road, Dublin 4, Ireland) and the TikTok Pixel (TikTok Technology Limited, Dublin, Ireland). Without your consent, these services are not loaded.

These services set cookies or similar identifiers and transmit data such as your IP address, device and browser information, the pages you view and whether you signed up for the beta. This lets us measure which ads lead to beta sign-ups and show ads on these platforms to visitors of our website. The legal basis is your consent under Art. 6(1)(a) GDPR. For data collected through the Meta Pixel, we and Meta are joint controllers under Art. 26 GDPR.

The providers may transfer data to the US. Google LLC, Meta Platforms, Inc. and LinkedIn Corporation are certified under the EU-US Data Privacy Framework, which is covered by an adequacy decision under Art. 45 GDPR. You can withdraw your consent at any time via “Cookie settings” in the footer.

If you reach us through an ad and sign up for the beta, we send the campaign details from the page address, such as utm_campaign or gclid, along with your sign-up. This shows us which campaign led to which sign-up. The legal basis is our legitimate interest in measuring the success of our advertising under Art. 6(1)(f) GDPR.

7. Beta sign-up

If you sign up for the beta through the form, we process the details you enter there: name, company, email address, phone number and website if you provide them, whether you sign up as a brand, an agency or a creator, the number of your brands, your channels and your message.

We use this data to get back to you and to admit you to the beta. The legal basis is Art. 6 (1) (b) GDPR where your sign-up aims at a contract, otherwise our legitimate interest in answering requests under Art. 6 (1) (f) GDPR.

Our server sends your details through the Microsoft Graph interface as an email to our Microsoft 365 mailbox. We do not run a database for form entries. To prevent abuse, the server briefly keeps your IP address in memory to limit too many requests in a short time. It is not stored permanently and is discarded after one hour at the latest.

We delete your sign-up once it is settled and no statutory retention duty applies. If it leads to a contract, the commercial and tax retention periods of up to ten years apply.

8. Contact by email and phone

If you write to or call us, we process your details to handle your request (Art. 6 (1) (b) GDPR where it concerns a contract, otherwise (f)). Emails are kept in our Microsoft 365 mailbox (Microsoft Ireland Operations Limited, Dublin), with which a data processing agreement is in place. We delete your request once it is settled and no retention duty applies.

9. Your heyplanoo account

To use heyplanoo we create an account. We process your name, email address, a password stored only as an irreversible hash, your roles and your sessions with IP address and browser identifier. The legal basis is Art. 6 (1) (b) GDPR.

For sign-in we set a session cookie that is technically necessary (§ 25 (2) no. 2 TDDDG). heyplanoo sets no other cookies.

System emails, for example confirmations or notices about a broken connection, are sent through Microsoft 365.

10. Content you process in heyplanoo

Brand profiles, posts, pictures, campaigns and the connections to your social media channels are processed on behalf of the respective customer. The customer is the controller for this data; we act as processor under Art. 28 GDPR on the basis of a data processing agreement.

The database and pictures are stored with Hetzner in Germany. Access credentials for your channels are stored encrypted. FNLY IT staff only see your content if you grant time-limited permission. Every such access is logged and visible to you.

11. AI processing

To write texts and to read websites and documents we send the necessary content to Anthropic, PBC (USA). To create and edit pictures we send picture briefs to Features & Labels Inc. (fal.ai, USA). We instruct fal.ai not to store inputs and outputs.

These providers do not currently offer processing in the EU. The transfer to the USA is based on the European Commission's standard contractual clauses (Art. 46 (2) (c) GDPR).

The AI produces drafts. It makes no decisions with legal effect for you. Only what a person has approved is published, and AI content is labelled.

12. Publishing via Meta

When you connect Facebook or Instagram, we receive the identifiers of your pages and accounts and access keys through the interfaces of Meta Platforms Ireland Limited, Merrion Road, Dublin 4, Ireland. We use them solely to publish approved posts, to check them and to take them down at your request. Meta is itself responsible for processing on its platforms.

13. Logs

So that it remains traceable who approved, changed or viewed what and when, heyplanoo keeps a log. It contains the person, the role, the action, the record concerned with the changed values, the IP address and the browser identifier. The legal basis is our and our customers' legitimate interest in accountability (Art. 6 (1) (f) GDPR). The log is deleted after three years.

14. Retention

• Account data: until the account is deleted. When a person is removed, name and email address are deleted; log entries keep an identifier without personal reference.
• A customer's content: until the customer is deleted. A requested deletion is carried out after 14 days; everything is deleted within 30 days.
• Export files: 7 days.
• Operational data such as background jobs and resolved notices: 90 days.
• Log: 3 years.
• Backups of our servers: up to 6 months. Deleted data may remain in backups until then but is not restored from them.
• Contract and invoice data: up to ten years under commercial and tax law.

15. Recipients

Your data is only received by those who need it for the purposes stated: our staff within their tasks and the processors named above, Hetzner, Microsoft, Anthropic and fal.ai, and Meta for publishing. With your consent, the FNLY Group statistics server and the advertising platforms named above also receive data about your visit to this website. We do not pass data on for advertising beyond that.

16. Your rights

• Access under Art. 15 GDPR
• Rectification under Art. 16 GDPR
• Erasure under Art. 17 GDPR
• Restriction of processing under Art. 18 GDPR
• Data portability under Art. 20 GDPR, in heyplanoo also yourself through the data export
• Withdrawal of consent under Art. 7 (3) GDPR with effect for the future

Right to object under Art. 21 GDPR: where we process data on the basis of Art. 6 (1) (f) GDPR, you may object at any time on grounds relating to your particular situation.

17. Complaints

You may lodge a complaint with a data protection supervisory authority. The authority responsible for us is the Hessian Commissioner for Data Protection and Freedom of Information, Gustav-Stresemann-Ring 1, 65189 Wiesbaden, Germany, www.datenschutz.hessen.de.

18. Changes

We update this policy when heyplanoo or the law changes. The version published here applies. The German version prevails.