Privacy policy

This website and our backend (the server functions for the contact form and the tools) run at Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA. Vercel delivers pages, images and program files through its worldwide network of data centres, usually from a location near you. The server functions of the website and the backend run in Vercel’s region “iad1” in Washington, D.C., USA: what you enter in forms and tools is processed there before it goes to the services named in this policy or into our database. Vercel also processes the technically necessary data described in section 3. Vercel is certified under the EU-US Data Privacy Framework; a data processing agreement under Art. 28 GDPR is in place with Vercel. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is the secure and efficient provision of the website.

When you visit our pages, data is transmitted automatically and stored in log files, in particular IP address, date and time, requested page, browser type and operating system. The data serves operation, security and error analysis and is deleted after [PLATZHALTER: retention period].

The legal basis is Art. 6(1)(f) GDPR.

When you use our contact form, your browser sends what you enter to our backend (section 2), which stores it in our database at Supabase in the EU region (section 12). We store the name, email address, company, area of interest and message, the page language, the page path from which you sent the form, and the date and time it arrived. We also store a short description of browser, operating system and device type (for example “Chrome on Windows, desktop”), which our server derives from the browser identifier when the form arrives, and a hash of your IP address made with a secret key. We do not store the full browser identifier or the IP address itself.

We use the content of your enquiry only to handle and answer it. The browser and device description helps us spot forms sent by scripts and understand questions about how our pages display. The hash only serves to turn away more than five enquiries in ten minutes from the same IP address; we delete it two days after the enquiry arrived. We delete the enquiry itself automatically 24 months after it arrived, or earlier if you ask, unless statutory retention duties apply. The same applies to help requests from the full check (section 6).

The legal basis for this data processing is Art. 6(1)(b) GDPR (pre-contractual measures or performance of a contract) and Art. 6(1)(f) GDPR (our legitimate interest in handling enquiries effectively and in protecting the form against abuse). If submitting via the form fails in an exceptional case, an option to send a prepared email to hello@clypi.de is provided as a fallback.

When you start our website check, two checks run through our servers; your browser sends the address to no other provider. To measure performance, accessibility, best practices and SEO, our server opens the web address you enter itself, in a browser without a profile (Chromium), and measures it with the open measuring tool Lighthouse. The measurement runs in our server functions at Vercel (section 2); the address goes to no other provider for it, Google included. The checked website receives the usual requests of a browser from our server, no data about you. Our server keeps the result in memory for up to 15 minutes, so a repeated request for the same address does not start a new measurement.

For the check of content, SEO, AI readability and legal pages, our backend loads the home page of the website you enter and up to two of its legal pages (Impressum and privacy policy, on the same domain only) itself. It identifies itself as “ClypiSiteCheck”. The loaded pages are only processed for the analysis and are not stored.

For every measurement and every check we store one entry in our database with the checked address and its host name, the result (for the Lighthouse measurement the four scores and whether it measured mobile or desktop, for our own check the number of critical, improvable and passed points, for an error only its type), the page of our website on which the check ran, the page language, the device type (mobile, tablet or desktop) and the pseudonymous visitor key that changes daily, described in section 10. We do not store your IP address or your full browser identifier. The entries serve statistics on how our tools are used and help us improve the checks; they are deleted automatically after 13 months. If your browser sends “Do Not Track” or “Global Privacy Control”, we create no entry; the check still runs.

Visitor simulation: after the results, our server sends the visible text of the checked home page (title, headings, texts, labels of buttons and links) and the image of its first screen from the Lighthouse measurement to the AI service Claude of Anthropic Ireland, Limited, Ireland; processing by Anthropic, PBC in the USA is possible. From this, Claude describes how three typical visitors might experience the page. This is a simulation, not a measurement with real visitors; we send no data about you as a visitor. We store the result (address, language, texts of the simulation, usage and cost) like the entries above and delete it after 13 months; for 24 hours we also show it to others who check the same address in the same language. To limit simulations to five per day, the entry holds a daily changing hash of your IP address, not the IP address itself. We create this entry even if your browser sends “Do Not Track” or “Global Privacy Control”, because the cache, the limit and our cost control depend on it. Before the simulation, Cloudflare Turnstile checks that a person started it (section 8).

The legal basis for the check is Art. 6(1)(b) GDPR (the check you start), and for the entries Art. 6(1)(f) GDPR (our legitimate interest in usage statistics and in improving our service). Please do not enter URLs that contain personal data or confidential information.

The full check looks at a business in one go: how well it is placed to be recommended by AI assistants (AI visibility check), its website as in section 5, the email records of its domain, and the embedded services and cookies of its website as in the email check and the privacy check in section 7. You enter the business’s name and city, optionally the sector and website, and pick your business from the Google Search results; the search box on our home page leads into the same flow. No sign-up is needed.

For the AI visibility check our server queries the search service Serper (provider: Serper, serper.dev) with the name and city you type and with the sector. Serper returns public data from Google Search and Google Maps: the business’s Google profile (name, address, rating, number of reviews, website, phone number, description, opening hours where shown), some review texts and the businesses of the same sector nearby, plus the search results for city and sector and for directories. Through OpenRouter (OpenRouter, Inc., USA) we ask the AI services Perplexity (Perplexity AI, Inc., USA) and ChatGPT (OpenAI, USA) a question with sector and city; the same question goes directly to Claude (Anthropic Ireland, Limited, Ireland; processing by Anthropic, PBC in the USA is possible). The services search the web themselves to answer. We send these services only details of the business, no data about you as a visitor: the requests come from our server, not from your browser. Your browser loads nothing from Google Maps. For transfers to third countries see section 13.

We also load publicly available pages: the home page of the business’s website, its robots.txt and llms.txt, and the list pages from the search. We respect each site’s robots.txt.

In addition, our server itself checks a few security features of the website, such as whether it is served encrypted (HTTPS) and tells browsers to keep using the encrypted connection; for this it loads the website, and no data goes to third parties. We do not store the address or the result of this request, nor of the email and privacy parts. Section 5 applies to the website part, including what is stored.

For each check we store, in our database at Supabase in the EU region, the business’s Google ID and our own evaluation: the score, the steps, the list pages from the search, the AI services’ answers and the website’s signals. With the evaluation we also store, from Google Search, the checked business’s name, address, category, rating, number of ratings, website and opening hours, to document the check. We do not store its phone number, its description, review texts or the names of reviewers, nor any details about other businesses; those are queried again each time they are shown. The evaluation lets us answer a new check of the same business within seven days without a new search, documents the check and helps us improve it. It is deleted after 90 days together with the stored details of the business. To limit checks to five per day we store a pseudonymous hash of your IP address, not the address itself; this value is deleted after two days. The legal basis is Art. 6(1)(b) GDPR (the check you start) and Art. 6(1)(f) GDPR (our legitimate interest in a reliable service protected against abuse).

Details about a business, such as name, address, reviews and opening hours, come from public sources. If the business is run by an individual, they can be personal data; we then process them on the basis of Art. 6(1)(f) GDPR to produce the analysis requested. Owners can object to this at any time by email to hello@clypi.de; we then delete stored results for their business.

If you ask for help after the result, we store your email address as a contact request together with the business name as you typed it, the topic you want help with (if you pick one), the sector, the score, the date of the check and the Google ID with a link to Google Maps, and get in touch by email about this business. This only happens when you tick the box for it yourself. The legal basis is your consent under Art. 6(1)(a) GDPR, which you can withdraw at any time. We store it like a contact enquiry with the details listed in section 4 and delete it 24 months after it arrived.

The website does not keep check results in your browser. Anything earlier versions stored there is deleted on your next visit to a tool.

Google review QR card: to find your business, our server queries the search service Serper with name and city (as in the full check). The link, QR code and card are made in your browser. An own logo is processed only in your browser and is neither uploaded nor stored; the same goes for the downloaded files. We store the Google ID of the chosen business, the name and city you typed into the search, when the card was first and last opened, how often it was opened and downloaded, whether an own logo was used (yes or no) and the page language. We store no IP address, no browser identifier and no cookie ID. The purpose is to evaluate how the tool is used and to improve it; the legal basis is Art. 6(1)(f) GDPR. The data is held by Supabase (database, section 12) and our hosting provider (server, section 2) and is deleted 12 months after the last use.

Schema and llms.txt generator: after the search and the Cloudflare Turnstile check, our server fetches through Serper the public details of the chosen entry in Google Search (name, address, phone, website, opening hours where shown) and prefills the form; you can also fill in everything yourself without a search. Code and file are made in your browser from the form; we store nothing.

Email check: we look up the public DNS records of the domain you enter (MX, SPF, DMARC, DKIM, BIMI). The domain is not stored.

Privacy check: we load the publicly available home page of the website you enter and up to two of its legal pages and analyse them (embedded services, cookies set, consent banner). Our backend identifies itself as “ClypiSiteCheck”. The address and the result are not stored.

Last chosen business: when you pick a business in one of the tools, we keep the business’s Google ID, the name, city and, if given, website as you typed them, and the business’s country and its customers’ language as you chose them in your browser’s local storage for 30 days, so the other tools can offer it without a new search. This data stays on your device and is not sent to us (Section 25(2) No. 2 TDDDG). Remove it with “Forget” or by clearing this site’s data.

Email signature and social media post: both are made entirely in your browser. Your details, photos and logos are not sent to us and not stored. If you choose to keep a signature draft, it stays only in your browser’s local storage. If you add icons to the signature (contact or social media icons, rating star), these are images on clypi.de: when a recipient opens your email, their mail app loads these images from our server. Our hosting provider (section 2) then processes technically necessary data such as IP address, time and browser identifier to deliver the images (Art. 6(1)(f) GDPR). To avoid this, choose “Text only” and switch the icons off.

Menu maker: the menu is made entirely in your browser. Dishes, logo and files are not sent to us and not stored. If you choose, a draft is kept only in your browser’s local storage (without the logo); the font files for the preview and the PDF load from clypi.de.

Gift voucher: the voucher is made only in your browser. Texts, logo and voucher numbers are neither sent to us nor stored; for this the page only loads font files from clypi.de.

Shop screen: the screen is made entirely in your browser. Texts, photos and logo are not sent to us and not stored. A link carries the screen after the # sign, which browsers send to no server; opening it loads only program and font files from clypi.de. The tool keeps a draft (texts and image addresses, no photos from files) only in your browser’s local storage. Images you add by address are loaded by the screen from that provider’s server.

The legal basis in each case is Art. 6(1)(b) GDPR (the tool you start). To limit requests we evaluate your IP address briefly in memory without storing it (Art. 6(1)(f) GDPR).

Before the full check starts the AI visibility check, the website check starts the visitor simulation or the schema generator loads data, Cloudflare Turnstile checks that a person started it, without you having to click on pictures. For this your browser loads a script from Cloudflare (challenges.cloudflare.com) as soon as this person check appears on the page. The provider is Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA. Cloudflare processes your IP address and technical details about your browser and device; processing in the USA is possible. Cloudflare is certified under the EU-US Data Privacy Framework.

The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is to protect these tools against automated requests that cause costs. Where information is stored in or read from your browser in the process, this is required under Section 25(2) No. 2 TDDDG for the service you asked for. More information: https://www.cloudflare.com/privacypolicy/

The fonts used on this website are delivered locally from our own server. No connection to Google servers or other font providers is made when you visit the page. Your browser keeps the font files in its cache like the website’s other files; the page does not create an entry of its own in local storage for this. A note “clypi-fonts-2” set by earlier versions is removed on your next visit.

We perform privacy-friendly, cookieless reach measurement on this website. For the measurement, no cookies are stored on your device and no data is kept in local storage; what individual functions keep there is listed in section 11. Your IP address and your browser identifier are not stored.

To count visitors per day, our server makes a pseudonymous hash from your IP address, your browser identifier and a daily key; only this hash is stored. The server computes the daily key for each calendar day (German time) from the date and a fixed secret key that exists only in our server’s configuration. The same visitor therefore gets a different value every day, and the stored values cannot be used to link visits on different days. Someone who knows the secret key and has your IP address and browser identifier could compute the value for a given day.

Besides this hash we store: the requested page path, language, referring website (host name or domain only, if any) and device type (mobile, tablet or desktop); for website checks also the details listed in section 5. Raw event data is automatically deleted after 13 months.

The legal basis for this processing is Art. 6(1)(f) GDPR. Our legitimate interest lies in the demand-oriented optimisation, statistical analysis, and reliable operation of our website.

We respect your browser’s privacy settings: if your browser sends “Do Not Track” (DNT) or “Global Privacy Control” (GPC), our website sends no events, and our server creates no entry for website checks either. This website sets no cookies for analytics or advertising purposes; therefore, no cookie consent banner is required.

Some functions keep data in your browser’s local storage (localStorage). This data stays on your device, the website does not send it to us, and you can delete it at any time by clearing the site data of clypi.de in your browser. In detail:

“clypi.myBusiness”: the business you last picked, as its Google ID with the name, city and, if given, website as you typed them, and the business’s country and its customers’ language (no Google Maps data), as soon as you pick a business in a tool. After 30 days the website no longer uses it; “Forget” removes it at once.

“clypi.signatureDraft”: your email signature draft without logo and photo files, only if you choose “Remember my entries in this browser”, until you switch the option off or delete the draft.

“clypi.menuCardDraft”: your menu draft without the logo, only if you switch on “Remember the draft in this browser”, until you switch it off or delete the draft.

“clypi.shopScreen.draft”: the shop screen draft (texts and image addresses, no photos from files), which the tool keeps while you edit so a reload loses nothing. “Delete the draft in this browser” removes it.

The entries for the business, results and drafts are only created when you use the function concerned. The legal basis is Section 25(2) No. 2 TDDDG, because the storage is required for this function you use. What Cloudflare Turnstile stores in your browser is covered in section 8.

Supabase runs our database for us in the EU region. Supabase’s data processing agreement names Supabase Pte. Ltd., 65 Chulia Street, Singapore 049513, as the contracting party; it contains the EU standard contractual clauses for access from outside the EU. What we store there and for how long is described with each function in this policy.

The screenshots on our home page and on the reference pages are kept in Supabase’s file storage (Supabase Storage). Your browser loads them directly from an address under supabase.co; Supabase processes your IP address, the time and your browser identifier to deliver the images. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is to show our work with real examples.

Some of the providers named are based in the USA or process data there. According to the list of the US Department of Commerce (dataprivacyframework.gov, checked on 25 October 2026), Cloudflare, Inc. is certified under the EU-US Data Privacy Framework; transfers to it are therefore covered by the European Commission’s adequacy decision. For the hosting provider see section 2, for Supabase section 12.

OpenRouter, Inc., Perplexity AI, Inc., OpenAI and Anthropic, PBC (all USA) are not on this list, so no adequacy decision covers them. With Anthropic we have a data processing agreement that includes the European Commission’s standard contractual clauses; the contracting party is Anthropic Ireland, Limited. OpenRouter’s privacy policy names the European Commission’s standard contractual clauses as the basis for transfers from the EU. For the search service Serper, the provider’s website names neither a registered office nor an address; its terms of service are governed by the law of the United Kingdom. We therefore cannot establish whether an adequacy decision applies to it. We send OpenRouter, Perplexity and Serper only details about the business, that is the name entered, the city and the sector, no data about you as a visitor. Serper returns public data from Google Search to us for this. The transfer is necessary to carry out the check you requested; as for the check itself, the legal basis is Art. 6(1)(b) GDPR.

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and the right to object to processing (Art. 21). You can withdraw any consent at any time with effect for the future.

To exercise your rights, an email to hello@clypi.de is sufficient. You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), in particular in the member state of your habitual residence, your place of work or the place of the alleged infringement.

We update this privacy policy when our services or the legal situation change. The version published on this page applies. Last updated: 2 November 2026