Privacy policy

1. Controller

WERBUNGMACHER.DE UG (haftungsbeschränkt)

Zeynep Oezcelik
Bahnhofstraße 13A
77767 Appenweier, Germany

Email: info@clickonb.io

2. Data we collect

When you use ClickOnB.io, we collect the following data:

• Email address and password (when you register)
• Profile information (name, bio, avatar and links)
• Visitor statistics (views, clicks, pseudonymised visitor identifiers, device type, referring domain and campaign parameters)
• Security and change logs may contain account and transaction identifiers. In our application and administration logs, IP addresses are shortened before storage (IPv4 to /24 and IPv6 to /48). This shortening does not automatically make the other log data anonymous.
• Billing address, subscription status and payment references. Mollie processes payments; we process the associated billing data and documents.
• Support requests, messages and files you submit

3. Purposes of processing

• Providing bio pages and link management
• Measuring the reach of your bio page (clicks, views and visitor identifiers)
• Billing and subscription management
• Running ClickWinner if you participate (section 3b)
• Reviewing your application and running the Influencer Programme (section 3c)
• Sending email notifications (opt-in under Article 21 GDPR). Since 19 May 2026, all marketing and weekly report notifications (such as weekly statistics, forwarded contact forms and newsletter subscriber alerts) have been disabled by default. They are sent only after you explicitly enable them in your account settings. Transactional emails (verification, password resets and invoice confirmations) remain active because they are necessary to perform the contract (Article 6(1)(b) GDPR).

3a. Legal bases (Article 6 GDPR)

We process personal data on the following legal bases:

3b. ClickWinner

ClickWinner is a free random draw among all accounts that explicitly opt in through their account on the web or in the app. While ClickWinner is paused and no version of the participation terms has been published, we do not accept entries.

• Data: your confirmations that you are at least 18 years old and resident in the EU, the version of the participation terms, the times of joining and leaving, and, where necessary, a fixed exclusion code (for example, multiple accounts). The draw record contains the random seed, the list of participating profile identifiers and its checksum, the profile identifiers of the selected person and reserve persons, the entry deadline and the response deadline, but no names. We record an exclusion and its reversal in the change log using a fixed reason code.
• Purpose: running the draw, documenting its result and notifying the selected person by email to their account address and within their account.
• Legal basis: Article 6(1)(b) GDPR (managing your participation under the participation terms). We do not publish real names. Identifying the selected person, for example through an award on their own page, requires their explicit consent (Article 6(1)(a) GDPR), which they may withdraw at any time.
• Recipients: Supabase (database) and Resend (notification delivery) as processors; see section 4. If handing over a prize requires additional recipients, we will name them together with the prizes in the participation terms.
• Retention period: we will announce this when the participation terms are released. Draw records remain unchanged after you leave or delete your account so that the result can be verified.
• Your rights: You can end your participation at any time in your account. This applies to all subsequent draws. Your rights under section 6 also apply here. Your data export includes your participation and entries in the draws.

All rules are set out in the participation terms.

3c. Influencer Programme

When you apply for the Influencer Programme, we process your main platform, one to three links to your public profile, your approximate follower count, your optional message, the time of submission and the version of the programme terms you accepted. We also process our decision, a message from the team and, if you are accepted, the start and end of your access. The purpose is to review your application and run the programme.

We email your account address to confirm receipt and send our response, a reminder 14 days before your access ends, and notices about extensions and the end of your access. We only send an invitation to apply if you have consented to marketing emails. Emails are sent through Resend (see section 4).

Application data remains stored while your account exists and is deleted when your account is permanently cleaned up. We also record decisions about applications and access in our change logs.

4. Hosting and processors (subprocessors)

ClickOnB.io is a web app that you can use in a browser and install as a Progressive Web App (PWA) on supported devices. This information also applies to the native iOS and Android apps. We use Supabase for the database, authentication and file storage, and IONOS for the web server. Customer records, invoices and support cases are managed in our Odoo backend. Payments are processed through Mollie. The following overview lists the providers, their purposes and their contractual status. Optional providers that creators configure for their profiles are described in section 5a:

Business users may request a separate data processing agreement with Werbungmacher.de UG (contact: info@clickonb.io).

5. Visitor statistics and browser diagnostics

On public profile pages, we record views and clicks for our own pseudonymised visitor statistics without an analytics cookie. A hashed visitor identifier is derived from the IP address, browser identifier and UTC date. We also process a browser hash that does not change daily, the device type, referring domain and limited campaign values (source, medium and campaign). The statistics do not store the raw IP address or raw browser identifier as separate data fields. This processing is not anonymous. For embedded profiles, we do not record profile views through this mechanism; clicks may use the same click counter.

Eligible creators may additionally configure Google Analytics 4 and/or Meta Pixel. These providers require separate consent on the relevant profile page (section 5a). ClickOnB.io’s general browser diagnostics settings do not control these providers or our own profile statistics.

On our own pages, you can allow optional browser diagnostics with Sentry. They start only after your current, explicit choice. Sentry receives limited technical error types and code positions. Form contents, user profiles, page addresses, breadcrumbs and screen recordings are not sent as diagnostic content. Sentry receives your IP address when your browser connects. This browser SDK does not start on public creator pages or embedded profiles. After you navigate to a creator page, diagnostics remain stopped for the current document. Server-side error diagnostics are independent of this choice.

In the iOS and Android app, optional error diagnostics with Sentry are initially switched off. You can enable them separately in the privacy settings and switch them off again at any time. The decision applies to your signed-in account on this device and is reset when you sign out or change accounts. Previous consent to statistics in the browser or app does not activate these diagnostics. After you give permission, the app sends limited technical information about JavaScript errors, code positions, the app version and build number. User profiles, form contents, screen recordings and native crash reports are not sent through these app diagnostics. The account ID is used only locally to associate your decision with your account. When you withdraw consent, the app stops new transmissions and aborts diagnostic requests still in progress; data already transmitted is not retrieved. Your public visitor statistics work independently of this permission.

Your diagnostics decision is saved in local browser storage and sent to our server to document it. The record contains a consent identifier, categories, version and timestamps, together with hashes of the IP address and browser identifier. For signed-in users, it may be linked to the account. These records are not anonymous. The local decision remains valid until you change it, the consent version changes or you clear browser storage.

You can change or withdraw browser diagnostics permission through “Browser diagnostics settings” in the footer of our information pages or under Account → Privacy in this browser. In the workspace, the dialog opens only when you request it. An earlier statistics, marketing or preference choice does not activate this new diagnostics decision. Necessary login and security features remain available. Language and appearance are set independently of this diagnostics choice. For details, see our cookie policy.

5a. Optional Google and Meta integrations configured by a creator

An eligible creator can configure a Google Analytics 4 measurement ID and/or a Meta Pixel ID for their public profile. We do not load either integration before you give consent for that profile, purpose and current provider configuration. These integrations are not active for embedded or age-restricted profiles. A changed configuration requires a new valid choice.

• Google Analytics 4 (statistics): after your permission, we send a page-view event with the canonical profile address without URL parameters, the fixed page title “Creator page” and a consent identifier. Advertising storage, advertising user data and ad personalisation remain disabled.
• Meta Pixel (marketing): after your permission, we send a page-view event to the pixel ID configured by the creator. The integration does not pass additional user or contact data for advanced matching and does not use the Conversions API.

The providers are loaded in a separate measurement document. They therefore receive a connection from your browser, including your IP address. Our integration does not pass form contents, email addresses, phone numbers or other contact fields. We do not load an unrestricted tag manager container for this purpose. On our own pages, we do not operate a global Google Ads, Google Tag Manager or Meta Pixel integration through this choice.

Your creator-specific choice is saved on the server for the relevant profile. A signed cookie links your browser to this decision. Both the choice and the cookie expire after 180 days. We store the profile ID, configuration revision, permitted purposes and timestamps. This decision does not contain an account ID or IP or browser hashes. Local blocking and withdrawal markers coordinate the decision between open tabs.

You can change your choice through “Creator privacy” on the relevant profile page. Withdrawal stops the measurement document immediately, even if saving the decision fails. Data already transmitted is not retrieved. The general browser diagnostics settings do not change this profile-specific decision.

The providers are Google Ireland Ltd. / Google LLC and Meta Platforms Ireland Ltd. / Meta Platforms Inc. Processing in the USA is possible. Information about the providers’ further processing is available in the Google privacy policy and the Meta privacy policy. For questions about a specific provider configuration, contact the relevant creator. For questions about processing by ClickOnB.io, contact us at info@clickonb.io.

6. Your rights (Articles 15–21 GDPR)

• Access to stored data
• Rectification of inaccurate data
• Erasure of your data
• Data portability (export)
• Withdrawal of consent
• Lodging a complaint with the supervisory authority

You can request a data export and account deletion in the web app settings.

Our competent supervisory authority is (Article 13(2)(d) GDPR):

The State Commissioner for Data Protection and Freedom of Information of Baden-Württemberg (LfDI BW)
Lautenschlagerstraße 20
70173 Stuttgart, Germany
www.lfdi-bw.de

This does not affect your right to lodge a complaint with a supervisory authority in the place of your habitual residence or work (Article 77 GDPR).

7. Retention periods

For our own visitor statistics, we regularly clean up raw events older than 30 days (720 hours), regardless of the plan. Aggregated daily statistics are cleaned up after 14 calendar months. The period you can view in your statistics depends on your plan (Free: the last 7 completed days); this does not change the retention period. Cleanup takes place in recurring runs.

When you delete your account, your profile is initially deactivated. You can cancel the deletion in your account settings within 14 days. Permanent cleanup of the account, its content and associated files then begins. Any outstanding payment transactions must first be resolved.

Invoices, payment references and associated business transactions are retained separately from the deleted profile. A central customer record and transactions relating to other WERBUNGMACHER.DE services are not automatically deleted when you delete your ClickOnB.io account. Account deletion therefore does not mean that all personal data held by us and our service providers is removed at the same time. You can contact us to request access or further erasure.

8. Contact

For privacy questions, contact: info@clickonb.io

Last updated: 8 October 2026