Privacy policy

1. Controller

Email: eller.julius@gmail.com

For any questions about data protection and to exercise your rights, simply send an email to this address.

2. Visiting the website and hosting

The website runs on Vercel Inc. (USA), with servers in Frankfurt am Main, Germany. Whenever a page is accessed, Vercel processes technically necessary data: IP address, time, the address accessed, referrer and browser identifier. These logs serve the secure operation of the website and the defense against attacks, and Vercel deletes them after a short time.

Vercel derives the country from the IP address. Together with your browser’s language setting, the country only determines whether we show you the website in German or English. We store neither the country nor the IP address.

The database is hosted by Supabase Inc. (USA), also in Frankfurt am Main. We load fonts from our own server, not from Google.

The legal basis is our legitimate interest in a secure and available website (Art. 6(1)(f) of the EU General Data Protection Regulation, GDPR, known in German as DSGVO).

3. Cookies and browser storage

We don’t use cookies for advertising or analytics. We only store what the website needs to work:

• Workspace login cookie (ub_w_…): keeps you logged in after you enter the access code, 30 days.
• Operator login cookie (ub_betrieb): only for us as the operator, 30 days.
• Language cookie (ub_sprache): remembers whether you chose German or English via the flag, 1 year.
• Local storage: the progress last shown in the workspace and the start time of a running check, so the display doesn’t start over when you reload the page. These values never leave your browser.

The legal basis is § 25(2) no. 2 TDDDG (German Telecommunications Digital Services Data Protection Act), because this storage is strictly necessary for the service you requested.

4. Audience measurement

To see which pages are used and where visitors stop, we use Vercel Web Analytics. It counts page views and individual steps, such as a started check, an upload or an order. Vercel records the page accessed, the referring website, country, browser, operating system and device type.

Vercel sets no cookies for this and stores nothing in your browser. Vercel recognizes repeat visits only by a hash value derived from the request, which expires after 24 hours. No profile spanning several days is created, and we only see aggregated figures. Before sending, we shorten addresses that contain access links, codes or IDs to the general page. Email addresses and form entries are not sent to the measurement, and we don’t measure our own operator area.

The legal basis is our legitimate interest in improving the website and understanding which offers are used (Art. 6(1)(f) GDPR). You can object at any time. A script or ad blocker in your browser prevents the measurement.

5. Free checks

For the “Are ChatGPT Ads worth it?” check and the landing page check, you enter a website and your email address. We read the publicly accessible content of the website, analyze it and send you the result by email.

For the analysis, we transmit website content to xAI (USA). For the landing page check, we ask ChatGPT questions via cloro. Both services receive page content and questions derived from it, not your email address.

The legal basis is carrying out the check you requested (Art. 6(1)(b) GDPR). To limit abuse, we briefly count requests per IP address in memory, without storing them (Art. 6(1)(f) GDPR). We delete the website, email address and result after 12 months.

6. Workspace and uploads

When you use Unblock, we create a workspace with your email address, protected by an access code. We store the code only as a hash.

From the uploaded Ads Manager exports, Unblock reads campaigns, ad groups, ad copy, context hints, landing pages and metrics. We don’t store the files themselves. For the check and for drafts, we transmit ad copy, context hints and landing page content to xAI (USA). The legal basis is the performance of the contract and pre-contractual measures (Art. 6(1)(b) GDPR).

How long we store data:

• Metrics and imported tables of an upload: 12 months from the upload.
• Ad groups, ad copy, context hints, your answers, orders and deliveries: as long as the workspace exists, because results and deliveries build on them.
• The workspace: until you haven’t opened it for 24 months. We announce the deletion by email 30 days in advance; opening the workspace is enough to keep it. We don’t delete it while Watch is running or a delivery is outstanding.

At your request, we delete the workspace earlier at any time, unless a statutory retention obligation prevents this.

7. Orders and invoices

For an order, we collect company name, contact person, address, VAT ID and billing address. We create invoices with Lexware (Haufe-Lexware GmbH & Co. KG, Freiburg, Germany). The legal bases are the performance of the contract (Art. 6(1)(b) GDPR) and our legal obligations (Art. 6(1)(c) GDPR). We keep invoices and accounting records for up to ten years, as required by German commercial and tax law.

8. Emails

We send emails via Resend (USA): results of the checks, access codes, deliveries and notices about your orders. For this, Resend receives your email address and the content of the message. We delete the log of sent emails after 12 months.

Tips and offers. If you tick the box in the form, we send you an email with a confirmation link. Only once you confirm it do we send you tips on ChatGPT Ads and offers from Unblock (double opt-in, Art. 6(1)(a) GDPR). You can withdraw your consent at any time, via the unsubscribe link in each of these emails or by emailing us.

As proof, we store the email address, the form, the wording of the consent and the times of sign-up, confirmation and unsubscribing (Art. 6(1)(c) and (f) GDPR). We delete unconfirmed sign-ups after 30 days, and the proof of a withdrawn consent 3 years after unsubscribing.

9. Review of public ads

We look at ads that are shown publicly in ChatGPT and check the linked landing page. In doing so, we store the company name, ad copy, landing page and the result of the check, so that we can point out possible problems to businesses. The legal basis is our legitimate interest in making our offer known (Art. 6(1)(f) GDPR). We delete this data after 12 months. You can object at any time.

10. Recipients outside the EU

Vercel, Supabase, Resend and xAI are based in the USA. We base transfers there on the European Commission’s adequacy decision for the EU-US Data Privacy Framework where the provider is certified, and otherwise on the European Commission’s standard contractual clauses (Art. 46(2)(c) GDPR). We have data processing agreements with all service providers.

11. Your rights

You have the following rights:

• access to your stored data (Art. 15 GDPR),
• rectification (Art. 16 GDPR) and erasure (Art. 17 GDPR),
• restriction of processing (Art. 18 GDPR),
• data portability (Art. 20 GDPR),
• withdrawal of a consent with effect for the future (Art. 7(3) GDPR).

Right to object. Where we process data on the basis of legitimate interests, you can object at any time on grounds relating to your particular situation (Art. 21 GDPR). You can object to processing for advertising purposes without giving reasons.

You can also lodge a complaint with a data protection supervisory authority. The authority responsible for us is the Bavarian Data Protection Authority (Bayerisches Landesamt für Datenschutzaufsicht), Promenade 18, 91522 Ansbach, Germany.

12. Obligation to provide data and automated decisions

Without an email address, we can’t send results or create a workspace; without billing details, we can’t accept an order. Unblock evaluates ads and websites, not people. We don’t make automated decisions within the meaning of Art. 22 GDPR.