Privacy policy
Controller: Stephan Lucka, Heide 27A, 41564 Kaarst, Deutschland, hello@agenticux.de. This policy explains what ActuallyUses processes and why (GDPR Art. 13).
Accounts
When you sign in we store your email, optional name/avatar from your OAuth provider, role, language and notification preferences. Legal basis: contract performance (Art. 6(1)(b)). Sessions use signed cookies strictly necessary for login.
Follows, stacks & notifications
Your follows, saved stacks and notifications are stored to provide those features (Art. 6(1)(b)). Public stacks are visible to anyone — you control the toggle.
Outbound link clicks
When you click an outbound tool link we log: timestamp, the page you came from, country-level geo (from your IP, which we do not store raw — only a salted hash), a device class (mobile/desktop), and a random click id used for affiliate attribution. Legal basis: legitimate interest in fraud-resistant commission attribution (Art. 6(1)(f)). The affiliate network sets its own cookies on the destination site — see their policies.
Analytics (consent only)
Analytics run ONLY after you consent in the banner (Art. 6(1)(a)): product analytics via PostHog (EU hosting) and traffic/search analytics via Google Analytics 4 (Google Ireland Ltd; data may be processed by Google LLC in the USA under EU Standard Contractual Clauses). IP addresses are anonymized. No analytics before consent; you can decline with one click and we never ask again on the same device.
Creator pages
Creator pages contain exclusively public information: public content metadata, short quotes (≤120 characters) with source links, and follower counts. Creators can claim their page, correct or hide data (audited), or contact us for removal requests.
Weekly digest
If you opt in we email you a weekly digest via our email provider. Unsubscribe anytime in settings; legal basis is consent (Art. 6(1)(a)).
Storage & processors
Data lives in our EU-hosted Postgres database and S3-compatible storage. Processors: hosting provider, email delivery (Resend), and analytics (PostHog EU; Google Analytics — Google Ireland Ltd / Google LLC, USA, under EU Standard Contractual Clauses) — each under a data processing agreement.
Your rights
Access, rectification, erasure, restriction, portability, objection (Art. 15–21): use the one-click export and delete-account functions in /account/settings, or email us. You can lodge a complaint with your supervisory authority.
Retention
Account data: until deletion. Click logs: 24 months (commission audit windows). Reports & correction audit trails: kept as integrity records with personal references minimized.