1. Controller and contact
The controller for the processing described here is CG Marketing GmbH, Gartengasse 25, 7083 Purbach am Neusiedler See, Austria, represented by Christoph Görbicz. Please contact us directly with privacy requests.
2. Website, access and security
Necessary connection data, including IP address, time, requested address, browser information and error data, is processed to deliver and protect the website. The basis is our legitimate interest in a secure, functioning service under Article 6(1)(f) GDPR.
To prevent abuse, the application limits login attempts using a secret-key-protected value derived from the IP address and 15-minute time windows. This value is pseudonymous, not anonymous.
3. Accounts, companies and cases
Registration involves email, account identifiers and authentication data. Setup also involves contact names, company and billing details, public seller ID, language, time zone and optional information such as phone number or referral source. Approvals, progress records, messages, evidence and powers of attorney you upload may also be processed.
Purposes are account provision, company verification, requested case handling, communication and billing. Article 6(1)(b) GDPR applies to a natural person’s own contract; for company contacts the basis is our legitimate interest in business administration under (f). Statutory retention is based on (c). Required account and company details are necessary for the relevant features; optional fields are identified.
Registration does not appoint a law firm. Only upload necessary documents and redact personal information that is not needed.
4. Public reviews
Sources are public Amazon.de product and review pages and related imports. Data may include ASIN, review ID, publicly displayed author name, title, text, rating, date, public link and publicly visible images or purchase-status information.
The purpose is product matching, technical identification of possible grounds for a complaint and preparation of cases selected by the customer. The interest relied on is assessing and, where justified, pursuing legitimate claims under Article 6(1)(f) GDPR. Negative criticism alone is not a reason for removal, and authors’ rights and interests must be considered.
This information also addresses authors of imported reviews under Article 14 GDPR. If a review concerns you, contact us with its link or ID. Technical classifications are not binding legal decisions. Screening does not itself make a solely automated decision with legal effects under Article 22 GDPR.
5. Services and recipients
Sites/OpenAI and Cloudflare provide the technical infrastructure; the application uses Cloudflare database and file storage. Supabase is used for customer authentication and technical handling of account emails. The Supabase project is in eu-central-1 (Frankfurt); this does not describe every subprocessor or globally executed function. The configured import-completion email is sent through Google/Gmail SMTP. Where Google sign-in is offered, the identity data released by that service is processed. The separate operator login uses ChatGPT.
Apiguru and Apify services retrieve public product and review data using public seller IDs, product identifiers or review IDs. Amazon passwords and Seller Central access are not requested for this.
An appointed law firm receives the data necessary for its separate engagement. Automatic law-firm transmission is not connected yet. The specific firm and its privacy information must be identified before data is passed on. Tax advisers, competent authorities or courts may also receive data when necessary and lawful.
The final mapping of contracting providers, their roles, email contract configurations and storage locations must be completed before customer operations. The provider notices below do not replace our own assessment.
6. Cookies and browser storage
reviewdesk-locale remembers your selected language for up to one year. __Host-yukeqi-access remembers invitation access for up to seven days. Supabase cookies starting with sb- support authentication and sessions. The current library sets a maximum session-cookie lifetime of 400 days, renewed on updates; signing out deletes the application’s corresponding authentication cookies.
These items support the language or access function explicitly requested by you under section 165(3) Austrian TKG 2021. The reviewed application code contains no advertising pixels, analytics scripts or session recordings. Optional services require a separate assessment and prior consent where required before activation. Third-party sign-in pages also have their own privacy notices.
7. Transfers outside the EEA
Infrastructure and identity services may process data outside the European Economic Area, including in the United States. The regions, recipients and safeguards applying to this project still require final verification. An EU storage location alone does not rule out access from other countries.
Such transfers require an applicable basis under Chapter V GDPR, such as an adequacy decision or appropriate safeguards with any necessary additional measures. This working version does not claim that all necessary agreements have already been concluded. Targeted customer operations in mainland China additionally require assessment of the applicable local privacy duties.
8. Retention and deletion
Retention depends on purpose: account data on the period the account is needed, case data on processing and necessary protection of claims, and security data on necessary investigation of errors or abuse. Public availability does not justify indefinite retention.
Tax-relevant records and supporting documents generally require seven years’ retention, possibly longer for relevant ongoing proceedings under section 132 Austrian BAO. This does not apply indiscriminately to all account or review data. Operational deletion and backup periods will be defined before customer operations.
9. Your rights
Subject to the applicable legal conditions, you may request access, correction, erasure, restriction and data portability. You may object to processing based on legitimate interests for reasons relating to your particular situation. Consent may be withdrawn for the future without affecting the lawfulness of earlier processing.
Contact us using the details above. We may request information necessary to verify identity. You may also complain to a competent supervisory authority, including the Austrian Data Protection Authority.
10. Credit and payment records
For credits and billing, we store package and payment references, purchased units, case-specific reservations, usage, releases, invoice references and confirmed price or card-charge authorizations. This supports contract performance, prevention of duplicate charges and statutory recordkeeping. The legal bases in section 3 and purpose-related retention rules in section 8 apply.
Stripe is the intended provider for the prepared card integration. When enabled, company, billing, payment and technical transaction data will be sent to the payment provider. The platform stores provider identifiers, payment status, card brand and last four digits, not full card numbers or security codes. Card and credit-purchase functions are not enabled yet; specific provider roles, transfer grounds and notices will be completed before activation.