Privacy policy

The controller within the meaning of Art. 4 (7) GDPR is:

TechnoWrite UG (haftungsbeschränkt)Leinorstr. 35A85757 Karlsfeld, GermanyEmail: info@technowrite.de

You can find further company details in our imprint.

Placeholder: Name and contact details of the data protection officer. If no officer has to be appointed, delete this section.

We process personal data only where a legal basis allows it. Most processing is needed to provide the marketplace you signed up for (Art. 6 (1) (b) GDPR). Other legal bases are named in the sections below.

We do not sell personal data, and we do not use tracking or advertising cookies.

Our website and API run with Placeholder: Hosting provider and server location. When you open a page, the server processes technical data such as your IP address, date and time, the requested address, browser and operating system. We need this data to deliver the website and keep it secure (Art. 6 (1) (f) GDPR). Server logs are deleted after Placeholder: Retention period, e.g. 14 days.

Fonts are served from our own server, not from third parties.

When you sign up we process your name, email address, a hash of your password, your role (brand or creator), your language, and the version and time at which you accepted our terms and confirmed that you have read this privacy policy. We send you an email to confirm your address. The legal basis is Art. 6 (1) (b) GDPR; we keep the record of your acceptance so that we can prove it (Art. 6 (1) (c) and (f) GDPR).

Your session is secured with a cookie that is necessary for logging in (see Cookies).

• Creators: profile data such as handle, country, languages, niches, rates, bio, portfolio videos and capacity slots. Approved profiles are shown to brands, and the public Performance Passport shows anonymised performance figures.
• Brands: company name, legal name, billing address and VAT ID. We check VAT IDs with the VIES service of the European Commission.
• Briefs, orders, chat messages, uploaded videos, revision notes and reviews, so that brands and creators can work together and disputes can be resolved.

The legal basis is Art. 6 (1) (b) GDPR.

Payments are processed by Stripe Payments Europe Ltd. (Ireland) through Stripe Connect. Stripe receives the data needed for the payment and for paying out creators, including identity checks required by law. Stripe partly acts as an independent controller; its privacy policy is available at stripe.com/privacy.

We create invoices and credit notes and keep them for the statutory retention periods (Art. 6 (1) (c) GDPR together with § 147 AO and § 257 HGB, generally 8 to 10 years).

As a platform operator we are required by the German Platform Tax Transparency Act (PStTG, DAC7) to collect certain data about creators and report it to the Federal Central Tax Office (Art. 6 (1) (c) GDPR).

We send transactional emails such as the sign-up confirmation, password reset links and order updates through Resend (Resend, Inc., USA) as our processor. Placeholder: Confirm the transfer mechanism, e.g. EU-US Data Privacy Framework or standard contractual clauses.

The brief copilot and the automatic pre-check of uploaded videos use models by Anthropic (Anthropic, PBC, USA) as our processor. For the pre-check we send individual frames of the video, which can show the people in it. The results support the brand's review; they never decide on their own. The legal basis is Art. 6 (1) (b) and (f) GDPR. Placeholder: Confirm the transfer mechanism and the data processing agreement with Anthropic.

Brands can connect their Meta or TikTok ad accounts. With this permission we load metrics such as impressions, hook rate, hold rate, CTR and ROAS for the ads that use a Hookline video. Access tokens are stored encrypted. The metrics flow into the creator's Performance Passport, which shows them only in anonymised form and never names the brand. Brands can disconnect an account at any time.

The legal basis is the brand's consent to the connection (Art. 6 (1) (a) GDPR) and our legitimate interest in verified performance data for matching (Art. 6 (1) (f) GDPR).

On your first visit we ask which cookies you allow. You can change or withdraw your choice at any time via “Cookie settings” in the footer.

Strictly necessary (§ 25 (2) no. 2 TDDDG, no consent required):

• Session cookie (better-auth.session_token): keeps you signed in. It is deleted when you sign out or the session expires.
• hl_consent: stores your cookie choice for 12 months.
• NEXT_LOCALE and hl_theme: store language and theme for one year, only when you change them yourself.
• Stripe: on the payment page our payment provider Stripe sets cookies for fraud prevention. Details: stripe.com/privacy.

With consent (convenience, § 25 (1) TDDDG, Art. 6 (1) (a) GDPR):

• hl_ref: remembers the invite code you arrived with for 30 days, so the person who invited you gets their reward. Without consent we don’t store it.

We do not use analytics, tracking or advertising cookies.

Some photos on the homepage are loaded from images.unsplash.com (Unsplash Inc., USA). Your browser connects to Unsplash and transmits your IP address in the process. The legal basis is our legitimate interest in an appealing presentation (Art. 6 (1) (f) GDPR). Placeholder: Replace with self-hosted images or confirm the transfer mechanism.

Besides the providers named above, Hookline staff can access data where support, creator vetting, dispute handling or accounting require it. Where data is transferred to countries outside the EU or EEA, we rely on an adequacy decision or on the EU standard contractual clauses.

Placeholder: Complete list of processors and their locations.

We delete personal data as soon as it is no longer needed for the purpose it was collected for, unless statutory retention periods apply. Account data is deleted when the account is closed, except for data we have to keep for tax and commercial law reasons. Placeholder: Define deletion periods for account, chat and video data.

You have the right to:

• access your data (Art. 15 GDPR)
• rectification (Art. 16 GDPR)
• erasure (Art. 17 GDPR)
• restriction of processing (Art. 18 GDPR)
• data portability (Art. 20 GDPR)
• object to processing based on legitimate interests (Art. 21 GDPR)
• withdraw a consent at any time with effect for the future (Art. 7 (3) GDPR)

To exercise your rights, write to info@technowrite.de. You can also lodge a complaint with a data protection supervisory authority, for example the one responsible for our registered office: Bayerisches Landesamt für Datenschutzaufsicht (BayLDA), Promenade 18, 91522 Ansbach, Germany.

We update this privacy policy when our services or the law change. The version date is shown at the top of this page.