นโยบายความเป็นส่วนตัว

1. Controller and EU representative

DACH Digital Growth Group LLC, 30 N Gould St, STE R, Sheridan, WY 82801, United States of America
Email: service@pagekoala.com

You can contact us by email at any time with any data protection concerns at service@pagekoala.com.

2. Principle: data minimisation, processing in Germany

This website uses no tracking services, no analytics tools and no advertising cookies. Fonts are loaded from our own server. A cookie banner is therefore not required. We store your language choice (German, English or Thai) in a technically necessary first-party cookie (pk_lang, 1 year, valid for pagekoala.com and app.pagekoala.com); it serves solely to display the site in the selected language and is not analysed in relation to individuals (§ 25(2) no. 2 TDDDG (German Telecommunications Digital Services Data Protection Act), Art. 6(1)(f) GDPR). All account and website data are stored on servers in Germany. Where, in individual cases, data are transferred to service providers outside the EU (section 10), we point this out separately.

3. Hosting and server log files

PageKoala is operated on servers of Hetzner Online GmbH (Industriestr. 25, 91710 Gunzenhausen, Germany); a data processing agreement is in place with Hetzner. When the website is accessed, the server processes technically necessary data (IP address, time, page accessed, browser identifier) in order to deliver the website and to ensure secure operation (Art. 6(1)(f) GDPR). System and security logs are deleted after 14 days at the latest.

4. Customer account, guest account and login

If you create an account, we process the data you provide (name, company, email address, password in encrypted form) for the performance of the contract or for taking steps prior to entering into a contract (Art. 6(1)(b) GDPR). To confirm your email address, we send you a confirmation link. For logging in, we set a technically necessary session cookie (pk_session, 30 days). Login events are logged including the IP address (Art. 6(1)(f) GDPR – protection against misuse); the IP address and browser identifier are removed after 30 days and the log entry is deleted after 12 months. Where passkeys or two-factor authentication are used, we store only cryptographic key data, never biometric characteristics.

If you start via the chat on the home page, we create a provisional guest account without an email address. Guest accounts are automatically deleted together with all associated data (website, images, enquiries) if they are not converted into a full account within 14 days.

5. AI-assisted website creation

To create and revise your website, we transmit your business details (company name, industry, location, description, change requests, optionally stored knowledge) to the following service providers: Anthropic PBC, USA (text generation), Black Forest Labs GmbH, Freiburg (image generation – receives only the image description) and DataForSEO LLC, USA (keyword research – receives only industry and location). The legal basis is Art. 6(1)(b) GDPR. The service providers do not use the inputs to train their models. Please do not include any personal data of third parties in your details. For transfers to third countries, see section 10.

Voice input in the chat

On pagekoala.com you can choose to dictate your details. Speech is converted into text exclusively by your browser using its built-in speech recognition (Web Speech API); only the recognised text is transmitted to us. Depending on the browser, it sends the audio recording to the browser manufacturer for recognition (for Google Chrome and Microsoft Edge: Google LLC or Microsoft Corporation, USA; for Safari: Apple). This only happens if you actively start voice input by clicking the microphone and allow access to your microphone; the legal basis is your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time by stopping the recording. We do not store any audio recordings. A visible level indicator shows you whenever the microphone is active.

6. Payment processing

We process payments via Stripe Payments Europe, Ltd. (1 Grand Canal Street Lower, Dublin, Ireland). Stripe receives the data required for the payment (name, email address, invoice amount, payment details); credit card and bank account details are collected directly by Stripe and never reach our servers (Art. 6(1)(b) GDPR). Stripe is an independent controller for payment processing; for details, see Stripe’s privacy policy. We retain invoice data for up to 10 years in accordance with tax law requirements.

7. Sending emails

We send transactional emails (confirmation links, enquiry notifications, invoices, support) via Microsoft 365 (Microsoft Ireland Operations Ltd., One Microsoft Place, Dublin 18, Ireland) on the basis of a data processing agreement (Art. 6(1)(b) GDPR). Sending events (recipient, subject, status) are logged for 90 days for error diagnosis.

8. Support and communication

If you contact us via the support form in the customer area or by email, we process your details in order to handle your request (Art. 6(1)(b) GDPR). Support histories remain visible in the customer account for the duration of the contractual relationship.

9. Enquiries and visitors on customer websites (data processing on behalf)

On the websites our customers create with PageKoala, we process incoming contact enquiries and cookieless visitor statistics (a daily changing, non-reversible identifier instead of the IP address; retention 13 months) on behalf of the respective website owner (Art. 28 GDPR, see Data Processing Agreement). The respective website owner is the controller for these data; please contact the party named in the imprint of the website you visited.

10. Transfers to third countries

The controller is a company with its registered office in the USA; however, all data processing takes place in Germany (servers at Hetzner, access exclusively from the EU). Where data are transferred to providers in the USA as part of the AI services (section 5) (Anthropic, DataForSEO), we base this on the EU standard contractual clauses (Art. 46(2)(c) GDPR), which form part of the respective data processing agreements. Only the business details required to create the website are transferred.

11. Retention period and deletion

• Account data: for the duration of the contractual relationship; you can delete your account yourself at any time in the settings
• Guest accounts: 14 days after creation, unless converted into an account
• Login/security log: IP address removed after 30 days, entry deleted after 12 months
• Server/system logs: 14 days
• Language cookie (pk_lang): 1 year
• Email sending log: 90 days
• Visitor statistics of customer websites: 13 months
• Invoice data: 10 years (§ 147 AO (German Fiscal Code), § 14b UStG (German VAT Act))
• Backups: daily, retained for 21 days

12. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20), as well as the right to object to processing based on Art. 6(1)(f) GDPR (Art. 21). To exercise these rights, please contact service@pagekoala.com. You also have the right to lodge a complaint with a data protection supervisory authority; the authority responsible for us is: กรรมาธิการด้านการคุ้มครองข้อมูลและเสรีภาพในข้อมูลข่าวสารแห่งรัฐบาเดิน-เวือร์ทเทมแบร์ก (Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg), Lautenschlagerstraße 20, 70173 Stuttgart, ประเทศเยอรมนี.