Privacy Policy

01Controller

02Who we are

Our website address is: https://thinver.com.

03Legal basis for processing

We process personal data on the basis of the GDPR, in particular:

• Art. 6(1)(a) GDPR (consent), e.g. for optional cookies, analytics or newsletters.
• Art. 6(1)(b) GDPR (contract performance / pre-contractual steps), e.g. for inquiries received through contact channels.
• Art. 6(1)(f) GDPR (legitimate interests), e.g. for IT security, fraud prevention and statistical analysis within strictly necessary limits.

04Hosting & server log files

Our web server automatically processes data whenever the website is accessed (server log files): IP address, date and time, requested URL, referrer URL, user agent and HTTP status code.

Purpose: operation of the website, stability, security (Art. 6(1)(f) GDPR).

Retention: generally 7–30 days, unless specific events require longer retention for evidentiary purposes.

05Comments

When visitors leave comments on the site we collect the data shown in the comments form, as well as the visitor's IP address and browser user agent string to help spam detection.

An anonymized string created from your email address (also called a hash) may be provided to the Gravatar service to see if you are using it. The Gravatar service privacy policy is available here: https://automattic.com/privacy/.

After approval of your comment, your profile picture is visible to the public in the context of your comment.

06Media

If you are a registered user and upload images to the website, you should avoid uploading images with embedded location data (EXIF GPS) included. Visitors to the website can download and extract any location data from images on the website.

07Cookies

• If you leave a comment, you may opt-in to saving your name, email address and website in cookies as a convenience feature. Retention: 1 year.
• If you have an account and log in, we set a temporary cookie to determine whether your browser accepts cookies (contains no personal data and is discarded when you close your browser).
• When you log in, we will also set up several cookies to save your login information (expires after 2 days) and your screen display choices (expires after 1 year). If you select "Remember Me", your login will persist for 2 weeks. Logging out will remove the login cookies.
• If you edit or publish an article, an additional cookie is saved referencing only the article ID (expires after 1 day).

Cookie consent & management

We set non-essential cookies (e.g. analytics or marketing) only with your consent via our cookie banner. You can change or withdraw your choice at any time via the cookie settings on our website.

08Embedded content from other websites

Articles on this site may include embedded content (e.g. videos, images, articles). Embedded content from other websites behaves in the exact same way as if the visitor has visited the other website.

These websites may collect data about you, use cookies, embed additional third-party tracking, and monitor your interaction with that embedded content, including tracking your interaction with the embedded content if you have an account and are logged in to that website.

09Who we share your data with

If you request a password reset, your IP address will be included in the reset email (for abuse prevention purposes).

10Contacting us (email / form)

When you contact us, we process the data you provide (e.g. name, email, message) to handle your request.

Legal basis: Art. 6(1)(b) GDPR (contract / pre-contractual steps) or (f) GDPR (legitimate interest in efficient communication).

Retention: until your request has been handled; statutory retention periods may require longer storage (e.g. 6–10 years for business correspondence under German Commercial and Tax Code).

11How long we retain your data

• Comments and their metadata are retained indefinitely, so we can recognize and approve follow-up comments automatically.
• User accounts / profiles: for as long as the account exists; users can see, edit or delete their personal information at any time (the username cannot be changed). Administrators can also see and edit that information.
• Server logs / contact inquiries / contract and accounting data: in accordance with sections 4 and 10 above and applicable statutory obligations.

12What rights you have over your data

Under the GDPR, you have the following rights:

• Access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20), and objection (Art. 21 GDPR).
• Withdrawal of consent at any time with effect for the future (Art. 7(3) GDPR).
• Right to lodge a complaint with a supervisory authority (Art. 77 GDPR). In Baden-Württemberg: The State Commissioner for Data Protection and Freedom of Information (LfDI BW). You may also contact any other competent supervisory authority.

To exercise your rights, an informal message to info@thinver.com is sufficient.

13Analytics tools and advertising

Google Analytics

Our website uses Google Analytics, a web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland ("Google").

How it works: Google Analytics uses cookies. The information generated about your use of the website is generally transmitted to Google's servers and stored there; we use IP anonymization (anonymizeIp), so Google truncates your IP address within the EU/EEA beforehand.

Purpose: reach measurement, usage analysis and needs-based design of our website.

Legal basis: consent (Art. 6(1)(a) GDPR) via the cookie banner.

Withdrawal: You can withdraw your consent at any time via the cookie settings on our website. You can also disable cookies in your browser or use the browser add-on to deactivate Google Analytics.

Transfer to third countries: Processing on servers in third countries (including the USA) is possible. Safeguards include Standard Contractual Clauses (Art. 46 GDPR) and additional measures.

More information: https://policies.google.com/privacy and https://tools.google.com/dlpage/gaoptout

Note: If we use additional analytics or marketing tools (e.g. Matomo, Hotjar, LinkedIn Insight Tag), we will notify you via the cookie banner and update this privacy policy accordingly.

14Newsletter

You can subscribe to our newsletter (thinverAI newsletter) on thinver.com and check.thinver.com. The controller is thinver GmbH (see section 1). To subscribe, we only need your email address and your consent; we do not ask for any further details such as your name.

Double opt-in and records

After you submit the sign-up form, you will receive a confirmation email. Your subscription only becomes active once you open the link in that email and confirm your subscription (double opt-in). The confirmation link is valid for 48 hours and can only be used once. We do not store it in plain text, only as a cryptographic hash. We send the newsletter exclusively to email addresses whose subscription has been confirmed in this way.

For each subscription, we store:

• your email address,
• the time of sign-up or consent, the time the confirmation email was sent and the number of confirmation emails sent,
• the time of confirmation as proof of your consent,
• the language of the sign-up (German or English), which determines the language of our emails,
• the source of the sign-up (e.g. "thinver.com" or the sign-up form on check.thinver.com),
• a randomly generated code for your personal unsubscribe link and, if applicable, the time you unsubscribed.

We do not store your IP address in our database. To prevent abuse, we limit the number of sign-up requests per IP address (no more than 10 requests within 10 minutes). For this purpose, the IP address is only processed briefly in the server's memory and is not stored permanently. In addition, we send a confirmation email to the same email address no sooner than 5 minutes after the previous one and no more than 5 times within 24 hours.

After you confirm, you will receive a welcome email with an unsubscribe link. At the same time, our team receives an internal notification at info@thinver.com containing your email address, the language and the time of confirmation.

Unsubscribing and withdrawal

You can withdraw your consent at any time with effect for the future: via the unsubscribe link in every newsletter email, via the unsubscribe function of your email program (our emails include the "List-Unsubscribe" header for this purpose, including one-click unsubscribe) or by email to info@thinver.com. The lawfulness of the processing carried out until the withdrawal remains unaffected.

When you unsubscribe, your email address is not deleted automatically; instead, it is marked as unsubscribed together with the time of unsubscribing. We no longer send the newsletter to unsubscribed addresses. We keep the records of sign-up, confirmation and unsubscription so that we can prove that consent was given or withdrawn. Unconfirmed sign-ups are not deleted automatically either; however, the confirmation link expires after 48 hours. There is currently no automatic deletion after a fixed period. You can request the deletion of your data at any time (see section 12); an informal message to info@thinver.com is sufficient.

Legal basis

• Art. 6(1)(a) GDPR (consent) for sending the newsletter and the processing required for it. You can withdraw your consent at any time (Art. 7(3) GDPR).
• Art. 6(1)(f) GDPR (legitimate interest) for keeping records of sign-up, confirmation and unsubscription as proof of consent (Art. 7(1) GDPR), for limiting requests to prevent abuse and for the internal notification of our team.

Service providers and transfers to third countries

The sign-up form on thinver.com transmits your details directly to our application check.thinver.com. For this purpose, we use the following service providers, which process the data on our behalf in accordance with Art. 28 GDPR:

• Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA – hosting of the application check.thinver.com, which receives the sign-up. For technical reasons, Vercel processes your IP address and the submitted form data. The sign-up is currently processed in data centers in the USA.
• Supabase Inc. – database in which the sign-up data listed above is stored. The data is stored on servers in the EU (Frankfurt am Main).
• Resend, provided by Plus Five Five, Inc., 2261 Market Street #5039, San Francisco, CA 94114, USA – delivery of the confirmation email, the welcome email, the newsletter issues and the internal notification. In doing so, the recipient's email address and the content of the respective email are transmitted to Resend. A data processing agreement (DPA) is in place with Resend as part of Resend's terms of service.

Transfer to a third country: USA – Standard Contractual Clauses pursuant to Art. 46 GDPR; Plus Five Five, Inc. (Resend) and Vercel Inc. are also certified under the EU-U.S. Data Privacy Framework (adequacy decision pursuant to Art. 45 GDPR).

15Recipients / data processors

We may use service providers for hosting, maintenance, newsletter delivery and analytics. These providers are contractually obligated under Art. 28 GDPR to process data only on our instructions and to implement adequate security measures.

16International data transfers

If data is transferred to recipients outside the EU/EEA (e.g. US providers), we ensure that either an adequacy decision of the EU is in place or appropriate safeguards such as EU Standard Contractual Clauses (Art. 46 GDPR) and additional protective measures are applied. In individual cases, a transfer may also be based on Art. 49 GDPR (derogations) — we will inform you separately in such cases.

17Security

We implement technical and organizational measures (TOMs) to protect personal data against loss, destruction, access, alteration or disclosure by unauthorized persons. Our measures are regularly reviewed and adapted to the state of the art.

18Automated decision-making / profiling

No automated decision-making within the meaning of Art. 22 GDPR takes place. Profiling only occurs — subject to your consent — in the context of standard web analytics/marketing tools for statistical analysis.

19Changes to this privacy policy

We reserve the right to amend this privacy policy when required due to legal, technical or organizational changes. The current version is always available at thinver.com.

Contact for privacy inquiries