Privacy notice

Controller and contact

Paragamix GmbH, Alte Dorfstraße 37, 39326 Angern, Germany. Represented by Alexander Graf Schulenburg. For privacy questions and rights requests: info@renewstory.com.

Website and technical connections

The website, account interface, app generator and marketing runtime operate on Hetzner servers in Germany. Visits involve processing technical connection data, such as IP address, requested address and browser data. Application databases and their background processing are located in Germany. Integrated external services such as OpenAI, Google and Cloudflare may also process data internationally.

Website analysis at your request

You submit a public company URL. Our backend reads up to 20 public HTML pages on that website and uses AI to produce an offering profile and up to five product ideas. It processes URLs, page titles, selected text, sources, results and usage receipts for cost control. Protected pages and login credentials are not needed. Recognizable email addresses and telephone numbers are removed before AI processing; public text may still contain other personal data. Providing a service you request relies on Article 6(1)(b) GDPR where processing is necessary for that service. Limited analysis of public company information and service security rely on Article 6(1)(f) GDPR: our interests in traceable analysis and preventing abuse. Do not submit internal or confidential website addresses.

OpenAI AI service

Selected public website text and derived analysis content are sent from the server to the standard OpenAI API. This project currently has no EU processing guarantee. API content is not used for model training by default. We use store:false; this does not eliminate security logs. OpenAI can normally retain content in these logs for up to 30 days, or longer in legal or security exceptions. Processing and international transfer details: OpenAI data controls and Data Processing Addendum. The latter describes standard contractual clauses or adequacy decisions as transfer safeguards.

Description after a failed website fetch

Only when the website could not be read can you provide its business name, offerings, audiences and benefits yourself. At your request, this input is processed by the German backend and sent to the currently configured OpenAI API to develop ideas. Do not enter personal, confidential or login data. The description is not an independently verified website source; results and exports are labeled accordingly. Descriptions are not shared between visitors through the website cache. Text is kept for no more than 7 days and jobs and results for 30 days in the active database; German backups may retain it for 14 additional days. The basis is Article 6(1)(b) GDPR for your requested analysis.

Cloudflare Turnstile

Turnstile loads only when you start an analysis or request an email sign-in link. Cloudflare receives signals including IP address, technical browser and connection information, and the website origin. Our backend validates its token with Cloudflare. The purpose is preventing automated abuse and resulting AI costs, relying on Article 6(1)(f) GDPR. Cloudflare processes signals as a processor to protect our website and also as a controller to improve its bot detection. Processing exclusively in Germany is not promised. See the Turnstile privacy notice and Cloudflare privacy policy.

Retention and protection

Source text is deleted from the active database after no more than 7 days; analysis jobs and results after 30 days. Results can be reused within 7 days to avoid further AI calls. Rate-limit counters with cryptographically derived visitor and IP identifiers expire within 24 hours. German backups may contain deleted data for up to 14 additional days and are used for recovery. Error logs are size-limited; they contain no API keys, raw text or visitor IP addresses. Connections to the backend and providers are encrypted. Random access tokens protect analysis results.

Browser storage, downloads and contact

Example favorites are stored locally as digitizer-example-favorites-v1 until you delete them. A deletion button is available in the homepage privacy dialog. Analysis access tokens and selected results use session storage, which you can clear using browser controls. These stores support the functions you choose. Ad measurement is used only with your separate consent as described below. Fonts are served locally. Text and JSON exports and inquiry drafts are saved to your device only when you click to download them. The website sends no contact forms. Incoming messages to login@renewstory.com are also forwarded to the operator’s Gmail inbox; Google also processes these messages and may do so internationally. If you contact us by email, we process your message to respond and retain it as long as handling or legal obligations require, relying on Article 6(1)(b) or (f) GDPR depending on your request.

Free accounts

New analyses require a free account and belong to the signed-in user. The rest of the marketing website can be used without an account. Google provides a stable user identifier, a verified email address and, if available, a name. We request no access to Gmail, Drive or contacts.

Alternatively, you can request a single-use email sign-in link valid for 15 minutes. Links are sent from login@renewstory.com through a dedicated Hetzner mailbox over encrypted SMTP. Your email provider also processes the message. Sign-in messages contain no analysis results or marketing. Links are consumed only after you explicitly confirm sign-in in the browser.

A necessary HttpOnly session cookie on api.renewstory.com keeps you signed in for up to 14 days. A short-lived cookie protects Google sign-in. Account data, sessions, analyses and project drafts are stored in our German database. Accounts use renewstory.com. Account data remains until account deletion; expired sessions and login tokens are removed regularly. Results and project drafts are deleted after 30 days each. An account deletion function is provided; German backups may retain data for up to 14 more days.

Creating a project carries the offering profile, selected idea, rationale, sources and your project notes into the same account. Unverified user input remains labeled. This creates no paid order and makes no further AI call. Other users cannot access your account-bound analyses or projects. Public website results may still serve as the basis for separate analyses; your own business descriptions are not shared between accounts.

Your rights

Subject to legal conditions, you have rights to access, rectification, erasure, restriction and portability. You may object to processing based on legitimate interests for reasons relating to your situation. Contact info@renewstory.com. You may complain to a supervisory authority, particularly where you live, work or suspect an infringement. AI evaluates product ideas; it makes no legally consequential decisions about people. Providing a URL is optional but necessary for your requested analysis.

Market potential assessment and invoicing

For an ordered assessment, the saved idea, offering profile, public sources and project goals are sent to OpenAI for web research and analysis. Do not include personal or confidential information in project goals. Billing details are stored on our German backend and are not sent to the AI provider. If you choose online payment, PayPal also processes the payment information described below. Processing necessary to deliver the ordered service is based on Art. 6(1)(b) GDPR. Reports and project details are retained for one year. Unordered drafts remain available for 30 days.

Business orders cost US$49 including VAT. On successful completion, an invoice is created and made available in the account. Required billing, order and invoice records are retained for eight years after the end of the invoice year under applicable law, based on Art. 6(1)(c) GDPR. Account deletion removes reports and goals but does not remove records required by law. German backups expire within 14 additional days. International business billing is supported. For EU VAT validation, your VAT number and company billing details are sent to the European Commission’s VIES service.

Online payment with PayPal

If you choose PayPal or a card payment offered there, we send the invoice number, amount, currency and a technical order identifier to PayPal. We do not send project goals or analysis reports. PayPal also processes the payment details you enter and technical connection data. We do not store card details on our server. PayPal (Europe) S.à r.l. et Cie, S.C.A., Luxembourg, processes payment data under its own privacy notice, potentially internationally. Transaction identifiers, amounts and payment status are retained with invoice records for contract performance and statutory accounting duties (Art. 6(1)(b) and (c) GDPR). PayPal privacy notice.

Customer applications and Phase 4 billing

Development orders retain the agreed scope, billing address, prices and contract status. Monthly operations invoices start upon publication; cancellations are recorded in the account. Custom customer domains are verified using public DNS records.

For end-customer payments, the respective business is the seller and payment recipient. Its service description and payment details are sent to its PayPal account. Billing addresses and payment status are available to that business in its protected project. Business PayPal credentials are stored encrypted on the German server. The respective business privacy notice also applies.

Google Analytics and Google Ads – only with your consent

We use Google Analytics 4 linked to Google Ads (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland) to measure public page views, idea-generator usage steps, successfully submitted website analysis requests, viewed analysis results and confirmed payments for Renewstory services and attribute them to ads. The Google tag loads only after you choose “Allow analytics & ad measurement”. Earlier analytics-only consent is not reused. Without consent, we send no measurement requests to Google.

With consent we process pseudonymous browser/session identifiers, technical device/browser data, cleaned page addresses, campaign parameters and ad-click identifiers (UTM, gclid, gbraid, wbraid). Other query parameters and fragments are removed; referring URLs are reduced to their origin. Account, analysis, project and payment pages send no automatic page views; measurement loads there only for explicitly configured usage and successful business events. We do not send form entries, email addresses, analysed websites, project content, billing addresses, payment credentials or data belonging to users of generated apps to Google. Automatic form/search measurement, Google Signals, enhanced conversions using customer data and personalised advertising are disabled.

With your consent, we also measure the steps from the visible idea entry through the start click, description preparation, sign-in and security check to the accepted request and visible idea result. A random identifier links these steps for 24 hours, including when the sign-in link opens in a new tab. We store this identifier, step timestamps and internal request references in your browser; expired references are removed on the next visit. Only the random identifier, entry type, step and, where relevant, a general error category or sign-in method are sent to Google. The website, description and email address you enter are not transmitted in these events. Withdrawing consent stops step measurement and removes these local references.

An analysis request counts only after server acceptance. A result view counts only when the rendered result becomes visible; result content is not sent. A purchase counts only after the server confirms a paid status; we send the amount, currency, generic service category and a hashed transaction identifier to prevent duplicates. An order or PayPal return alone is not a purchase. With your separate measurement consent, we store the Google client identifier, session identifier where available, and consent timestamp with your business account. Confirmed Renewstory payments, including automatic subscription payments, are sent from our server to Google Analytics and through the existing Google Ads link; returning to the website is not required. Only eligible ad interactions within the applicable attribution windows can appear as ad-attributed purchases. Nothing is sent without consent. We do not send payment credentials, contact details or project content to Google. Server-side measurement identifiers are retained for at most 180 days. A random withdrawal identifier lets this browser revoke server-side measurement even after sign-out. Withdrawal also cancels pending server-side transfers.

The basis is your consent under Article 6(1)(a) GDPR and Section 25(1) TDDDG. Google uses cookies including _ga, _ga_RBD171NCM5 and, where applicable, _gcl_*. Analytics cookies last up to 180 days without automatic renewal; advertising cookies may last up to 90 days. We store your choice with a timestamp in renewstory.analytics-consent.v3 for up to 180 days. After consent, cleaned campaign details are kept in session storage under renewstory.attribution.v1 for at most two hours; hashed event identifiers in renewstory.conversions.v1 prevent duplicates for up to 180 days. Detailed Analytics data is retained for two months; aggregate reports may persist longer.

Processing by Google LLC and other Google companies, particularly in the US, is possible. See Google’s privacy policy and Google’s data processing terms. You can withdraw consent at any time through “Cookie settings”. We then stop measurement, remove the relevant cookies and local measurement data, and reload the page. Withdrawal does not affect the lawfulness of earlier processing.

Open cookie settings

Letter offers and associated app views

Business letter offers use publicly available business addresses and websites. When you open the app link associated with a letter code, we store the code, view count, and first and most recent view times to evaluate the offer. Campaign statistics do not store IP addresses, device identifiers or tracking cookies and are not sent to Google or other analytics providers. Technical hosting connection data is separate.

A subsequent order is associated with its letter code. Without a code, attribution is made only when the business website matches uniquely. A paid adoption is counted only after confirmed payment and activation. Email responses are summarized to handle the offer. Statistics are available only in the account of the letter offer provider. A code does not establish personal identity and can be shared with other people. For questions, objections or deletion requests, contact info@renewstory.com. Inputs inside the customer app are not collected for campaign statistics.