Privacy Policy
Information about the protection of your personal data
Last updated: October 2026
1 Data Controller
The controller within the meaning of the General Data Protection Regulation (GDPR) and other national data protection laws is:
Provimedia GmbH, Weidenweg 12, 74321 Bietigheim-Bissingen, Germany
Email: info@provimedia.de | Phone: +49 (0)7142-9170511 | Managing Director: Alexander Weipprecht
2 Overview of Data Processing
We process personal data only to the extent necessary to provide a functional platform and our content and services. Processing is based on the following legal grounds:
- Consent (Art. 6(1)(a) GDPR)
- Performance of a contract (Art. 6(1)(b) GDPR)
- Legal obligation (Art. 6(1)(c) GDPR)
- Legitimate interests (Art. 6(1)(f) GDPR)
- Consent for cookies and tracking (Section 25 TDDDG)
3 Hosting and Server Logs
Our platform is hosted on servers in Germany. The hosting provider automatically collects and stores information in server log files that your browser automatically transmits. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in securely providing the platform).
The following data is collected:
- Page visited and time of access
- Browser type and version
- Operating system used
- Referrer URL (previously visited page)
- IP address of the accessing device
Server logs are automatically deleted after 7 days. This data is not merged with other data sources.
4 SSL/TLS Encryption
This site uses SSL/TLS encryption (Let's Encrypt) for security reasons and to protect the transmission of confidential content. You can recognize an encrypted connection by the browser address bar changing from "http://" to "https://". Encryption serves to protect your data in accordance with Art. 32 GDPR.
5 Registration and User Account
Registration is required to use certain features. The legal basis is Art. 6(1)(b) GDPR (performance of a contract). The following data is collected:
- Name
- Email address
- Password (stored encrypted)
Data is stored as long as your user account exists. When you delete your account, your personal data will be deleted unless statutory retention periods apply.
Deleting your account also deletes your contributions: products, reviews, comments, forum topics and forum replies. Comments and reviews by others on your products are deleted along with them. If others have replied to one of your comments or forum posts, their replies are kept: we then replace your text (for a forum topic also the title) with a placeholder, and the post is no longer linked to you but appears as “Gelöschtes Konto / Deleted account”.
6 Payment Processing (Stripe)
We use Stripe (Stripe, Inc., 510 Townsend Street, San Francisco, CA 94103, USA) for payment processing. The legal basis is Art. 6(1)(b) GDPR (performance of a contract). During a purchase, your payment data is transmitted directly to Stripe and processed there.
Stripe is certified under the EU-US Data Privacy Framework (DPF) (participant no. 6436). The EU Commission's adequacy decision of 10 July 2023 ensures an adequate level of data protection at Stripe.
For more information, see Stripe's privacy policy: https://stripe.com/privacy
7 Use of artificial intelligence
Artificial intelligence is used in several places on our platform. Using the chatbot is voluntary, and the legal basis there is your consent (Art. 6(1)(a) GDPR); you can revoke it at any time by no longer using the chatbot. The other AI features serve the operation of the platform, and the legal basis for those is Art. 6(1)(f) GDPR (legitimate interest in a useful product overview).
These features use AI, and this is what gets transmitted: the chatbot (your chat input), the summary of reviews (the review texts written by users), the product comparison (the public details of the compared products), suggestions for search engine texts and taglines (the product details entered by the submitter), the suggestion for a profile text (the keywords you enter) and the import of a product page (the publicly available content of the address you provide).
For these processing operations we use OpenAI (OpenAI, L.L.C., San Francisco, USA) and Google Gemini (Google Ireland Limited, Dublin, Ireland). Data transfer to OpenAI in the USA is based on Standard Contractual Clauses (SCCs) pursuant to Art. 46 GDPR, as OpenAI is not certified under the EU-US Data Privacy Framework.
Chat histories are not permanently stored. There is one exception: if you save a product comparison in order to share it, the AI text generated for it is stored along with it so that the shared link shows the same state. No training of AI models takes place with your inputs.
Wherever an output comes entirely from the AI, we label it visibly on the spot: in the chatbot, in the product comparison and in the summary of reviews. Suggestions for taglines, search engine texts, categories or profile texts are not such outputs: they are shown to the submitter, who reviews them, can edit them and takes responsibility for them on submission.
Notice pursuant to Art. 50 AI Act (effective from 02 August 2026): The labelled outputs are generated by an AI system. They are not human contributions.
8 WebSocket Connections (Real-time)
For real-time features such as notifications, we use WebSocket connections via Laravel Reverb. No personal data is transmitted during this process. The connection serves exclusively for technical communication between your browser and our server. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in real-time platform delivery).
9 Cookies and local storage
We only store what the platform needs to work. These cookies are set based on Section 25(2) TDDDG because they are strictly necessary. We embed no advertising services, and other third-party services only with your consent. Only two things require consent; we ask about them in the cookie notice and use them only if you agree (Section 25(1) TDDDG in conjunction with Art. 6(1)(a) GDPR): "external media", meaning book covers from Amazon on the book page (section 13), and statistics with Matomo (section 11), once we use it. Neither category is pre-selected.
The following is stored on your device. Entries marked "localStorage" are not cookies but live in your browser's local storage:
| Name | Provider | Duration | Type |
|---|---|---|---|
| XSRF-TOKEN | MyStartup24 | Session | Necessary |
| mystartup-session | MyStartup24 | Session | Necessary |
| pusherTransportTLS (localStorage) | MyStartup24 | Until you clear the website data | Necessary |
| locale (localStorage) | MyStartup24 | Until you clear the website data | Functional |
| theme (localStorage) | MyStartup24 | Until you clear the website data | Functional |
| ms24_cookie_consent (localStorage) | MyStartup24 | Until you clear the website data | Necessary |
The functional entries are only created once you change something yourself, such as the language or the theme. You can delete all entries at any time by clearing the website data for mystartup24.com in your browser.
10 Newsletter and Email Marketing
If you subscribe to our newsletter, we use your email address to send the newsletter. The legal basis is your consent (Art. 6(1)(a) GDPR). Registration uses a double opt-in process: after signing up, you will receive a confirmation email in which you must confirm your subscription.
You can unsubscribe from the newsletter at any time via the unsubscribe link in each email. Your email address will be promptly removed from the distribution list.
11 Analytics Tools
From 15 October 2026 at the earliest, we use the analytics tool Matomo, and only if you explicitly consent in the cookie notice. Without your consent, nothing is recorded. Until then we use no analytics tools; the cookie notice then only asks about external media (section 13).
The purpose is to understand which pages are visited and how visitors reach the platform, so that we can improve it. The legal basis is your consent (Section 25(1) TDDDG, Art. 6(1)(a) GDPR).
Matomo is run by Provimedia GmbH itself on its own servers. The data does not go to any third party. Matomo sets no cookies on our site. It records the page visited (without search parameters and without personal links such as password reset links), the previous page, the time, browser, operating system, screen resolution, language and your IP address, which is shortened by two bytes before it is stored. We do not link this data to your user account. If your browser has “Do Not Track” enabled, we record nothing.
We delete the raw data after 13 months at the latest: we keep it for 12 months so that we can compare usage with the same period of the previous year, and the automatic deletion runs weekly. After that, only aggregated statistics without reference to individual visitors remain. You can withdraw your consent at any time via “Cookie settings” at the bottom of the page. This does not affect the lawfulness of the processing carried out before the withdrawal. We store your choice in your browser's local storage (section 9) and as a record without an IP address on our server (section 15).
12 Contact
When you contact us via the contact form or email, your details are stored for processing the inquiry and in case of follow-up questions. The legal basis is Art. 6(1)(b) GDPR (pre-contractual measures) or Art. 6(1)(f) GDPR (legitimate interest in answering your inquiry).
Your data will be deleted once your inquiry has been fully processed and no statutory retention periods apply.
13 Recipients and Data Processors
We only share your personal data with third parties to the extent necessary to provide our services. The following categories of recipients may access your data:
- Hosting provider (server operation and maintenance)
- Payment service provider (Stripe, Inc.)
- AI service providers (OpenAI, Google)
We have concluded data processing agreements (DPAs) with all processors in accordance with Art. 28 GDPR.
Amazon affiliate links: our book list links to amazon.de with our partner ID. We take part in the Amazon EU Associates Programme. As long as you neither click such a link nor allow "external media", no data is transferred to Amazon. Book covers: the book page only shows covers if you allow "external media" in the cookie notice. Your browser then loads the images from Amazon servers (m.media-amazon.com) on every visit to the book page; Amazon receives your IP address and technical details of your browser, but not which page the request comes from. The legal basis is your consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG). We store your choice in the local storage of your browser (section 9) and as a record without IP address on our server (section 15). You can withdraw it at any time via "Cookie settings" at the bottom of the page; this does not affect the lawfulness of processing carried out before the withdrawal. Amazon may transfer data to the USA; Amazon.com, Inc. is certified under the EU-U.S. Data Privacy Framework (EU Commission adequacy decision of 10 July 2023). Affiliate links: if you click one, you leave our site; Amazon can then tell from the link that you came from us and processes your data on its own website under its own responsibility and privacy notice. From Amazon we only receive reports on clicks and sales, without any details about you as a person.
14 Data Transfer to Third Countries
In the course of using our platform, data is transferred to providers in the USA. The transfer is based on the following grounds:
- Stripe, Inc. (USA): Adequacy decision pursuant to Art. 45 GDPR, EU-US Data Privacy Framework (DPF-certified)
- OpenAI, L.L.C. (USA): Standard Contractual Clauses (SCCs) pursuant to Art. 46 GDPR (not DPF-certified)
- Google (Ireland/USA): Standard Contractual Clauses (SCCs) pursuant to Art. 46 GDPR
- Amazon.com, Inc. (USA), only if you allowed "external media" (section 13): Adequacy decision pursuant to Art. 45 GDPR, EU-US Data Privacy Framework (DPF-certified)
15 Data Retention
We store your personal data only for as long as necessary for the respective processing purposes or as required by statutory retention periods:
- Server logs: 7 days
- Account data: until account deletion
- Billing and payment data: 10 years (Section 147 AO, Section 257 HGB)
- Contact inquiries: until final processing, max. 6 months
- Record of your choice in the cookie notice (without IP address): 12 months after your last choice
- Matomo raw data (only with consent): 13 months at most
16 Your Rights as a Data Subject
You have the following rights regarding your personal data:
- Right of access (Art. 15 GDPR): You have the right to request information about your personal data stored by us.
- Right to rectification (Art. 16 GDPR): You have the right to have inaccurate data corrected or incomplete data completed.
- Right to erasure (Art. 17 GDPR): You have the right to request the deletion of your data, provided no statutory retention obligations apply.
- Right to restriction (Art. 18 GDPR): You have the right to request the restriction of processing of your data.
- Right to data portability (Art. 20 GDPR): You have the right to receive your data in a structured, commonly used and machine-readable format.
- Right to withdraw consent (Art. 7(3) GDPR): You can withdraw your consent at any time with effect for the future.
Right to Object (Art. 21 GDPR)
You have the right to object at any time, on grounds relating to your particular situation, to the processing of your personal data based on Art. 6(1)(f) GDPR (legitimate interests). We will then no longer process your data unless we can demonstrate compelling legitimate grounds that override your interests. To exercise your right to object, contact us at info@provimedia.de.
To exercise your rights, contact us at: info@provimedia.de
17 Right to Complain and Currency
You have the right under Art. 77 GDPR to lodge a complaint with a data protection supervisory authority. The supervisory authority responsible for us is:
Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg, Lautenschlagerstraße 20, 70173 Stuttgart, poststelle@lfdi.bwl.de
As of: October 2026