Privacy Policy

Tiki-Taka Media GmbH, Curschmannstraße 9, 20251 Hamburg, Germany ("we", "us") is the controller within the meaning of Art. 4(7) GDPR for all personal data processed through the CrunchJunkie platform (app.crunchjunkie.io) and the website crunchjunkie.io ("Service"). Contact: hello@crunchjunkie.io We have assessed our processing activities and have determined that, at the current scale of operations, the appointment of a Data Protection Officer is not mandatorily required under Art. 37 GDPR. We keep this assessment under review as the business grows. For all data-protection enquiries, please contact hello@crunchjunkie.io.

We process personal data for the following purposes and on the following legal bases: 2.1 Account management (Art. 6(1)(b) GDPR — contract performance) We process your name, email address, and (where applicable) a password hash in order to create and maintain your account and provide you with access to the Service. OAuth sign-in (Google) gives us your name, email, and profile picture; we do not receive your social-media password. 2.2 Delivery of the Service (Art. 6(1)(b) GDPR — contract performance) We store the advertising and analytics data you import (ad-account metrics, client names, campaign names, report content) and use it exclusively to render reports and provide the features you have subscribed to. This data originates from the advertising platforms you connect (e.g. Google Ads, Meta, LinkedIn) under OAuth authorisation you have granted. For connected Google Ads accounts we also store the account's change history — what was changed, when, and by which Google Ads user (that user's email address, as Google reports it). The email address is shown only to members of your workspace, never in shared reports or PDFs, and is never sent to an AI provider. 2.3 Billing and invoicing (Art. 6(1)(b) GDPR — contract, Art. 6(1)(c) GDPR — legal obligation) We pass your payment information to our payment processor Stripe, Inc. We retain invoice-relevant data (plan, amount, date) for as long as German commercial and tax law requires (currently 8 years for invoices; § 257 HGB, § 147 AO). 2.4 Service improvement and security (Art. 6(1)(f) GDPR — legitimate interest) We collect page-view data, feature-interaction logs, and error reports. Our legitimate interest is to diagnose bugs, prevent abuse, and improve the product. This data is not used for advertising profiling. 2.5 Direct communication (Art. 6(1)(f) GDPR — legitimate interest, or Art. 6(1)(a) GDPR — consent where required) We send transactional emails (password resets, scheduled report delivery, critical service notices). Promotional emails are only sent with your explicit consent. You may withdraw consent at any time via the unsubscribe link or by emailing hello@crunchjunkie.io. 2.6 Keys for your own provider accounts (Art. 6(1)(b) GDPR — contract performance) If you optionally connect your own AI provider key (e.g. Anthropic, OpenAI, Google), we store that key in encrypted form and use it solely to fulfil AI-feature requests you initiate. We do not use this key for any other purpose. If you connect your own DataForSEO account for the Rank Tracker, we store its API login and API password in encrypted form and use them solely to run the searches you set up or start. The password is never displayed again after it has been saved. 2.7 Demo bookings (Art. 6(1)(b) GDPR — pre-contractual measures at your request) If you book a demo call on crunchjunkie.io/demo, we process the name, email address and — if you choose to give them — company, website and the note you write, together with your timezone, so we can hold the call and send you a confirmation. The appointment is created in the founder's Google Calendar (Google Ireland Limited / Google LLC) with a Google Meet link, and Google sends you the calendar invitation; your name, email and note appear in that calendar entry. We keep a hashed form of your IP address (never the address itself) to limit automated booking abuse. Cancelling from the link in your confirmation email removes the appointment from both calendars. Booking records are deleted 12 months after the call. 2.8 Free tools and the contact form on our website (Art. 6(1)(b) GDPR — steps taken at your request; Art. 6(1)(f) GDPR — legitimate interest) Our website offers a free AI visibility check, a free GEO audit and a contact form. For the AI visibility check and the GEO audit we store the website you entered, the result, the language of the page you used and, if you give one, your email address. For the contact form we store your name, email address, company, number of clients and message. In our database your IP address is stored only in shortened form: an IPv4 address with its last block set to 0, an IPv6 address cut to its first 48 bits. The request itself is counted against your full IP address by our rate limiter for one minute (see Upstash in section 3.1); that count then deletes itself. We use this data to give you what you asked for (the result on screen and, if you gave an email address, the report the form offers by email; for the contact form, our answer) and to limit how often the free tools can be run from one network each day, so that they cannot be abused (our legitimate interest in protecting the service and its costs). The email address you give in a free tool is used only to send you that report; we contact you about it otherwise only if you ask us to. For the GEO audit we also record whether the report email was opened. Each submission is also emailed to our own mailbox (hello@crunchjunkie.io) so that we see it and can reply: for a free tool the website, the result and your email address if you gave one, for the contact form your message and details. These emails stay in that mailbox and are not deleted automatically; ask us and we delete them. Both tools read the public pages of the website you entered, and the AI visibility check asks AI providers questions about it on our own account. Neither passes on your email or IP address. 12 months after you submitted them, we delete the records of the AI visibility check and contact-form messages. A GEO audit result has its own page that you can share. That page holds no personal data, only the website you audited and its scores, and it stays available at its link; after 12 months we delete your email address, whether you opened the report email, and your shortened IP address from the audit's record.

We do not sell your personal data. We share data only with the following categories of recipients: 3.1 Infrastructure sub-processors As required by Art. 28 GDPR, we have concluded Data Processing Agreements with all sub-processors who handle personal data on our behalf. Some sub-processors receive only non-personal data — for example search vendors that receive brand, topic and competitor terms, not information about identifiable people — and for those a DPA is not required. Our sub-processor ledger (Settings → Data & residency, and the exportable Data Location & Subprocessor Report) states, per vendor, whether a DPA is in place and which transfer safeguard applies. Where a vendor publishes none, the ledger says so rather than implying one. The current list: • Vercel Inc. (USA) — Hosting, CDN, serverless function execution (application compute) and file/object storage (uploaded logos and generated report files). Data region: Frankfurt (fra1), EU. Transfer safeguard: EU–US Data Privacy Framework + Standard Contractual Clauses. DPA: vercel.com/legal/dpa • Neon Inc. (USA) — PostgreSQL database. Data region: Frankfurt (eu-central-1), EU. Transfer safeguard: Standard Contractual Clauses. DPA: neon.tech/dpa • Upstash, Inc. (USA) — Shared rate-limit counters for API and sign-in endpoints (request counts keyed by IP address; counters expire automatically within 15 minutes). Data region: Frankfurt (eu-central-1), EU. Transfer safeguard: Standard Contractual Clauses. DPA: upstash.com/static/trust/dpa.pdf • WorkOS, Inc. (USA) — OAuth authorization server for the MCP connector. When you connect an AI assistant (for example Claude or ChatGPT) to CrunchJunkie, WorkOS receives your user id, email address and name in order to issue that assistant's access token. Engaged only when you connect an MCP client. Transfer safeguard: Standard Contractual Clauses. DPA: workos.com/legal/dpa • Stripe, Inc. (USA) — Payment processing. Transfer safeguard: Standard Contractual Clauses. DPA: stripe.com/legal/dpa • Resend Inc. (USA) — Transactional email delivery. Transfer safeguard: Standard Contractual Clauses. 3.2 AI providers (AI features and AI Visibility scans) When you bring your own AI key, your query and relevant report data are sent to the API endpoint of the provider whose key you have configured (e.g. api.anthropic.com, api.openai.com). You are the controller of that processing; please review that provider's privacy policy and terms separately. Some AI steps run on CrunchJunkie's own Anthropic account, whether you bring your own key or use Managed AI: the AI-visibility analyses (the brand profile filled in from your website, objections, fact checks and competitor suggestions), the AI insights of a GEO audit, and reading each AI-visibility answer to find the brands it names. New answers are read with your own key only when an Anthropic key is saved as your AI assistant key (Settings → AI & API Keys); when we re-read stored answers to correct how they were read (an administrative re-check or re-extraction), our account is used in every case. For these steps Anthropic, PBC (USA) receives the stored AI answers, the brand details you track (brand and competitor names, brand facts) and the text of the pages concerned, and acts as our sub-processor (Standard Contractual Clauses; see the sub-processor register). When you use the Rank Tracker, the keywords you track, the place, the language and the device type of each search are sent to DataForSEO on the account you connected. You are the controller of that processing; DataForSEO acts on your account and under your agreement with it. Please review its privacy policy and terms separately. Keywords are search terms and as a rule contain no personal data; do not enter personal data as keywords. If your workspace uses a Rank Tracker budget instead of its own DataForSEO account, the same data is sent to DataForSEO OÜ (Estonia) on CrunchJunkie's account. DataForSEO then acts as our sub-processor (see the list of sub-processors); according to its privacy policy it keeps task data, including keywords, for 365 days. When you enable Managed AI, CrunchJunkie runs the AI calls on its own provider keys and therefore engages the following AI sub-processors for the models/features you enable: OpenAI, L.L.C. (USA), Anthropic, PBC (USA), Google LLC (USA), Perplexity AI, Inc. (USA), X.AI LLC (USA), DeepSeek (China), Meta Platforms Ireland Limited (Ireland, used for Meta AI visibility scans; processing by the DPF-certified Meta Platforms, Inc., USA), SerpAPI, LLC (USA, used to read Google AI Overviews, Google AI Mode and Microsoft Copilot), and Tavily (USA, used for supplementary web-search retrieval in research and content-brief features). For each, the prompt and the resulting AI response are processed to produce your visibility metrics. SerpAPI and Tavily receive only non-personal search terms (brand, topic and competitor keywords). DeepSeek and Meta AI are engaged only if you explicitly enable that model; DeepSeek processes data in China. Transfer safeguards vary by provider and are listed per provider in our sub-processor register (Settings → Data & Location, and the exportable Data Location & Sub-processor report): the EU–US Data Privacy Framework backed by Standard Contractual Clauses for DPF-certified US providers (e.g. OpenAI, Google), the EU–US Data Privacy Framework alone for Meta AI (EU contracting entity, DPF-certified US processing entity), Standard Contractual Clauses for others (e.g. Anthropic, Perplexity, xAI), and — for providers that publish no Article 46 transfer mechanism (currently SerpAPI, Tavily and DeepSeek) — our register records that openly rather than asserting a safeguard that does not exist. In all cases CrunchJunkie sends data to AI providers only as a result of your actions in the Service — configuring a key, enabling Managed AI, setting up AI-visibility scans or GEO audits, or using an AI feature. Training. CrunchJunkie does not use your content to train any AI or machine-learning model, and we build no models of our own. We engage AI sub-processors through their APIs. For the major providers (OpenAI, Anthropic, Google, Perplexity), data submitted via the API is not used to train their models by default. Some optional providers process API input under their own terms: per their published policies, DeepSeek and Tavily may use submitted input to train or improve their models — each is engaged only if you explicitly enable the relevant model or feature. When you bring your own key, your provider's API terms govern. Contractual specifics are set out in our DPA and in each provider's DPA. 3.3 Law enforcement We may disclose data if required by a valid legal order, court ruling, or applicable law. We will, where legally permitted, notify you before complying. 3.4 Business transfers If CrunchJunkie is sold, merged, or restructured, your data may transfer to the successor entity under the same privacy commitments.

Our primary infrastructure — application compute, file storage and database (Vercel, Neon) — is located in the EU (Frankfurt). Where data is transferred to sub-processors in third countries (primarily the United States, and — only if you explicitly enable the DeepSeek model — China), we rely on: • EU Standard Contractual Clauses (SCCs) pursuant to Commission Implementing Decision (EU) 2021/914. • The EU–US Data Privacy Framework (DPF) where the sub-processor is certified. Some optional sub-processors publish no Article 46 transfer mechanism; our sub-processor register (Settings → Data & Location) records this per provider rather than implying a safeguard that does not exist, and those providers receive only non-personal search terms or are engaged solely on your explicit opt-in. You may request a copy of the applicable transfer mechanism by emailing hello@crunchjunkie.io.

• Account and workspace data: retained while the workspace's subscription runs. When the subscription has ended (one whose payment is still being collected has not ended), we keep the workspace for 30 days so you can export it (Settings → Export your data) or choose a plan again. We then email its owner(s), and 7 days after that email we delete the workspace and everything in it, together with every login that belongs to no other workspace; choosing a plan before that date keeps everything. A paused subscription ("Pause subscription & keep my data") has not ended: your data is kept for up to 12 months while paused, and the owner(s) then get the same email with 30 days' notice; a pause or cancellation requested before pauses were recorded is treated as a pause from the day the subscription ended. A workspace on an individually agreed package is deleted as agreed; a few others (for example one given free of charge, or with our staff among its members) are reviewed and deleted by hand. Invoices are kept as stated for billing records below. When you delete your account yourself, its data is deleted or anonymised within 30 days of account deletion. • Ad-metric data you import: retained for up to 36 months, then deleted. • Google Ads change history (including the email address of the Google Ads user who made each change): retained for 25 months, then deleted. • Data imported from Peec AI with your Peec key — the AI answers with their sources and the brands they name, Peec's visibility figures (overall and per tag), the prompts and the fan-out queries: kept while Peec is connected, fan-out queries for at most 400 days. Disconnecting Peec deletes all of it, a large import within a few minutes, together with the analyses we built from those answers; a prompt that CrunchJunkie's own scans also ran, or that a content brief was made from, stays, and a content brief stays without its quotes from Peec answers. • Billing records: retained for as long as German commercial and tax law requires (currently 8 years for invoices; § 257 HGB, § 147 AO). • Server logs and error traces: retained for 90 days. • Records of changes made through the MCP connector (which account and connection made the change, which action, and the IDs of what changed — never the text sent): retained for 12 months, then deleted. • Client exports (a ZIP file of one client's reports and data, made when a workspace owner or admin asks for it): the file is kept for 7 days after it is ready, then deleted; an export that fails or is cancelled is deleted at once. The record that an export happened (who asked, when, its status and size, and when it was downloaded — never its contents or the client's name) is kept for 12 months, then deleted. • AI API keys: deleted immediately upon removal or account deletion. • Demo bookings (name, email, optional company/website/note, timezone, hashed IP): 12 months after the call, then deleted. • Free AI visibility check and contact form (the website entered, the result, an optional email address, the IP address shortened to /24 or /48; for the contact form name, email, company, number of clients and message): 12 months, then deleted. • Free GEO audit: the email address, whether the report email was opened and the shortened IP address are deleted after 12 months; the result page (the audited website and its scores, no personal data) stays available at its link. • Self-referral checks in the referral programmes (section 11b, from 29 October 2026): the network part of IP addresses (IPv4 /24, IPv6 /48) recorded with a referral is deleted 12 months after the referral was recorded; if the referral is then still under self-referral review, or one of its payments has an open chargeback, it is deleted in our next daily clean-up after the review is decided or the chargeback is closed. A referrer's last-seen network is deleted 12 months after it was last seen. • Emails to our mailbox about free-tool submissions and contact-form messages: not deleted automatically; deleted on request. Backups: we take an encrypted backup of the database every night and keep it for 30 days, after which it is deleted automatically. When we erase your data from the live system, copies can therefore remain inside those backups until the last one containing them rotates out — at most 30 days. Backups are restored only to recover from a failure, never to bring back data you asked us to delete. Where you request deletion before these periods expire, we will honour your request except where a longer retention period is required by law.

CrunchJunkie uses cookies and similar storage technologies in three categories: • Strictly necessary: sign-in, security, remembering your cookie choice, and remembering the referral link you arrived through (the "cj_ref" cookie; see section 11a). These are required for the site to function and need no consent. • Analytics: Google Analytics, set only with your consent, to understand how the website and product are used. • Advertising measurement: cookies from Google Ads, Meta, Reddit and OpenAI (ChatGPT Ads), set only with your consent, to measure whether our own advertising campaigns on those platforms work. We do not run third-party ad networks on this site, and we do not sell personal data. The complete, always-current list of cookies — names, vendors, lifetimes and purposes — is shown in the table below. It is generated from the same registry that drives our consent banner, so it cannot drift from what the site actually sets. Consent is requested before any non-essential cookie is set, and server-side events (Conversions APIs) are gated on the same consent. You can change or withdraw your choice at any time via “Cookie settings” in the footer. We honour the Global Privacy Control signal by pre-setting advertising to off. A record of each consent (a random identifier, the choices, and the policy version — never your IP address) is kept for five years as required by Art. 7(1) GDPR, then deleted automatically.

We implement the following technical and organisational measures (TOMs) in accordance with Art. 32 GDPR: • Encryption in transit: all connections use TLS 1.2 or higher (HSTS enforced). • Encryption at rest: AI API keys and OAuth access/refresh tokens are encrypted with AES-256-GCM at the application layer before storage; the database itself is additionally encrypted at rest by our infrastructure provider. Passwords are hashed with bcrypt (cost factor 12) and never stored in plain text. • Tenant isolation: all database queries are scoped to the authenticated team ID at the application layer; cross-tenant data access is architecturally prevented. • Access control: production database access is restricted to a minimal set of authorised personnel; multi-factor authentication is required; access is logged and reviewed. • Rate limiting: authentication endpoints and critical API routes are rate-limited per IP to prevent brute-force and credential-stuffing attacks. • Incident response: a documented process is in place to detect, assess, and notify data breaches within 72 hours of discovery in accordance with Art. 33 GDPR. A detailed description of our TOMs is available in our Data Processing Agreement (see /legal/dpa).

Under GDPR you have the following rights, exercisable at any time by emailing hello@crunchjunkie.io: • Access (Art. 15): obtain a copy of the personal data we hold about you. • Rectification (Art. 16): ask us to correct inaccurate or incomplete data. • Erasure (Art. 17): ask us to delete your data ("right to be forgotten") where no overriding legal basis applies. • Restriction of processing (Art. 18): ask us to restrict how we process your data while a dispute is resolved. • Data portability (Art. 20): receive your data in a structured, machine-readable format. • Objection (Art. 21): object to processing based on legitimate interest; we will stop unless we demonstrate compelling grounds. • Withdrawal of consent (Art. 7(3)): where processing is based on consent, withdraw it at any time without affecting the lawfulness of prior processing. We respond to all verifiable requests within 30 days (extendable by 2 months for complex requests, with notice). You also have the right to lodge a complaint with a supervisory authority — either the one where you live or work, or the one competent for us. Because our registered seat is in Hamburg, our competent authority is: Der Hamburgische Beauftragte für Datenschutz und Informationsfreiheit (HmbBfDI) Ludwig-Erhard-Str. 22, 20459 Hamburg, Germany datenschutz-hamburg.de

We do not use automated decision-making, including profiling, that produces legal or similarly significant effects on you within the meaning of Art. 22 GDPR, with one exception from 29 October 2026: the self-referral check in the referral programmes (section 11b), which can automatically withhold or reverse a referral reward. That decision is necessary for the performance of the contract (Art. 22(2)(a) GDPR): our Terms of Service (section 12b) and the Brand Ambassador Programme Terms (clause 7.2) do not reward self-referral. You can contest such a decision, give your point of view and have it reviewed by a person by emailing hello@crunchjunkie.io (Art. 22(3) GDPR).

The Service integrates with third-party advertising and analytics platforms (Google Ads, Meta, LinkedIn, TikTok, etc.). When you connect these platforms via OAuth, their own privacy policies govern the data held within their systems. We are not responsible for their data-processing practices.

When you connect a Google account (Google Ads, Google Analytics 4, or Google Search Console), CrunchJunkie requests read-only access to your own advertising and analytics data via Google APIs in order to display those metrics back to you inside the reports and dashboards you build. CrunchJunkie's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy (https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements. Specifically: • We only access the Google user data needed to provide and improve the reporting features you have requested. • We do not sell Google user data, and we do not use it for advertising. • We do not transfer Google user data to third parties except as necessary to provide or improve the Service (our sub-processors listed in section 3), to comply with applicable law, or as part of a merger/acquisition under equivalent commitments. • We do not allow humans to read your Google user data unless we have your affirmative agreement for specific data, it is necessary for security purposes (e.g. investigating abuse), to comply with applicable law, or the data is aggregated and anonymised for internal operations. • OAuth tokens are stored encrypted and used solely to fulfil the features you initiate. Disconnecting an integration in CrunchJunkie deletes its stored token once nothing else in your workspace uses the same Google login (see the Data Deletion Instructions, section 2). CrunchJunkie does not revoke Google tokens at Google, because a revocation there withdraws every permission you granted CrunchJunkie, including your other Google connections; to withdraw CrunchJunkie's access at Google, remove it in your Google Account settings (Security → Third-party apps and services) at any time. The same applies to Meta (Facebook: Settings → Business Integrations). Of the platforms you can connect, CrunchJunkie revokes a token at the provider itself only for Reddit Ads.

If you apply to or take part in our Brand Ambassador Programme (governed by the separate Programme Terms), we process personal data about you as a programme participant — distinct from any data we process about you as a customer. This includes: the details you submit in your application (your name, email, website, the audience and channels through which you promote, your follower ranges, promotion methods and any message you provide); your ambassador account and referral link; the payout details you give us in order to be paid your commission; and records of the referrals attributed to you and the commission calculated. The legal basis is the performance of the ambassador agreement (Art. 6(1)(b) GDPR) and our legitimate interest in operating the programme and preventing fraud (Art. 6(1)(f) GDPR). We keep this data for as long as you participate and thereafter for as long as required for tax, accounting and legal purposes. We do not disclose a referred customer's identity to you: your portal and the programme emails show only an opaque referral reference and subscription status, never the customer's name. Referral attribution uses the first-party "cj_ref" cookie described in section 6 and in the cookie table below.

This section applies from 29 October 2026. From that day, when someone signs up through a referral link, in the customer referral programme ("Refer & earn") or in the Brand Ambassador Programme, we check automatically whether the referral is a self-referral: whether the referrer and the referred customer are the same person or under common control. The purpose is to prevent referral fraud, so that no referral reward (account credit or commission) is paid for referring oneself. Legal basis: our legitimate interest in preventing referral fraud (Art. 6(1)(f) GDPR); for ambassadors, also the performance of the ambassador agreement, whose terms exclude self-referral (Art. 6(1)(b) GDPR). What we store for the check: • the network part of an IP address only, never the full address: the IPv4 /24 or IPv6 /48 network from which the referrer last opened the referral page or the ambassador portal (also recorded with each referral made through their link), and the one from which the referred customer signed up; • the names of the signals that matched (for example "same company email domain"), the result of the check, the dates of the check and of any review, and the email address of the CrunchJunkie admin who reviewed the case. What we compare without storing it for the check: the normalised email addresses and their domains, the billing email address and the billing address, all from data we already hold; and payment-card fingerprints, which we compare through our payment processor, Stripe. A fingerprint identifies a card without revealing it; we never see card numbers. What happens on a match: a strong match (for example the same email address, the same payment card, or the referrer already being a member of the referred workspace when it signed up) automatically withholds or reverses the referral reward. A weak match (for example the same company email domain or the same network) is held for review by a person at CrunchJunkie, who decides. The automated decision is necessary for the performance of the contract (Art. 22(2)(a) GDPR): our Terms of Service (section 12b) and the Brand Ambassador Programme Terms (clause 7.2) do not reward self-referral. Where a reward is withheld or reversed automatically, you can contest the decision, give your point of view and have it reviewed by a person (Art. 22(3) GDPR) by emailing hello@crunchjunkie.io. Retention: the networks recorded with a referral are deleted 12 months after the referral was recorded. If the referral is then still under self-referral review, or one of its payments is the subject of an open chargeback (a payment dispute with the customer's bank), they are kept until the review is decided or the chargeback is closed, and deleted in our next daily clean-up. The network from which a referrer last opened the referral page or ambassador portal is deleted 12 months after it was last seen, whether or not anyone signed up through the link. The names of the matched signals and the result are not network data; they are kept with the referral record. Ambassadors only ever see an opaque referral reference and a neutral status (such as "not eligible" or "under review"). They never see the referred customer's identity or which signal matched.

We may update this policy as our Service evolves or legal requirements change. Material changes will be communicated by email or in-app notice at least 14 days before taking effect. The "last updated" date at the top of this page indicates when the most recent revision was made. Continued use of the Service after the effective date constitutes acknowledgement of the updated policy.