Privacy policy

1. Controller

WERBUNGMACHER.DE UG (haftungsbeschränkt)

Zeynep Oezcelik
Bahnhofstraße 13A
77767 Appenweier, Germany

Email: info@clickonb.io

2. Data we collect

When you use ClickOnBio, we collect the following data:

• Email address and password (when you register)
• Profile information (name, bio, avatar and links)
• Visitor statistics (views, clicks, pseudonymised visitor identifiers, device type, referring domain and campaign parameters)
• Security and change logs may contain account and transaction identifiers. In our application and administration logs, IP addresses are shortened before storage (IPv4 to /24 and IPv6 to /48). This shortening does not automatically make the other log data anonymous.
• Billing address, billing status and payment references (section 4)
• Support requests, messages and files you submit
• Levels, points, streaks, milestones and goals that we calculate from the numbers of your page (section 3d)
• Daily identifiers (hash values) that protect the statistics against manipulation (section 5)
• Consents and settings: your cookie consents (section 5), your account settings, for example for email notifications, and your Territory settings (section 3d)
• Unsent entries in the editor and settings on your device (section 5b)

2a. Where the data comes from

You provide most of the data yourself, for example when you register, in your profile, in your content and in support requests. Visitor statistics arise when visitors open your page and click links (section 5). We calculate levels, points, streaks and milestones from the numbers of your page (section 3d). The payment service provider named in section 4 tells us the status of your payments.

3. Purposes of processing

• Providing bio pages and link management
• Measuring the reach of your bio page (clicks, views and visitor identifiers)
• Billing
• Showing your progress with levels, points, streaks and milestones (section 3d)
• Protecting the statistics against manipulation (section 5)
• Running ClickWinner if you participate (section 3b)
• Reviewing your application and running the Influencer Programme (section 3c)
• Sending email notifications (opt-in under Article 21 GDPR). Since 19 May 2026, all marketing and weekly report notifications (such as weekly statistics, forwarded contact forms and newsletter subscriber alerts) have been disabled by default. They are sent only after you explicitly enable them in your account settings. Transactional emails (verification, password resets and invoice confirmations) remain active because they are necessary to perform the contract (Article 6(1)(b) GDPR).

3a. Legal bases (Article 6 GDPR)

We process personal data on the following legal bases:

3b. ClickWinner

While ClickWinner is paused and no version of the participation terms has been published, we do not accept entries.

• Purpose: running ClickWinner if you participate.
• Data: your confirmations that you are at least 18 years old and resident in the EU, the version of the participation terms, the times of joining and leaving, and, where necessary, a fixed exclusion code (for example, multiple accounts). We record an exclusion and its reversal in the change log using a fixed reason code.
• Legal basis: Article 6(1)(b) GDPR (managing your participation under the participation terms).
• Recipients: Supabase (database) as a processor; see section 4.
• Retention period: we will announce this when the participation terms are released.
• Your rights: Your rights under section 6 also apply here. Your data export includes your participation.

3c. Influencer Programme

When you apply for the Influencer Programme, we process your main platform, one to three links to your public profile, your approximate follower count, your optional message, the time of submission and the version of the programme terms you accepted. We also process our decision, a message from the team and, if you are accepted, the start and end of your access. The purpose is to review your application and run the programme.

We email your account address to confirm receipt and send our response, a reminder 14 days before your access ends, and notices about extensions and the end of your access. We only send an invitation to apply if you have consented to marketing emails. Emails are sent through Resend (see section 4).

Application data remains stored while your account exists and is deleted when your account is permanently cleaned up. We also record decisions about applications and access in our change logs.

3d. Levels, points and milestones (gamification)

We calculate levels, points, streaks and milestones from the numbers of your page and your setup. The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest is to show you your progress in a motivating way and thereby to retain you as a user of ClickOnBio.

For this we process when your page was public, the daily values of your page (views, clicks, sources, device types, times of day, items and campaigns), weekly, monthly and total sums, the milestones, points and goals you have reached, your channel links, entries when you share your page or copy its link, and your Territory settings. These values are numbers and states of your page; they do not contain identifiers of your visitors. For existing accounts, we award setup steps that your page already meets from its current state at the start; the counters for views and clicks start at zero. To protect points against abuse, we check the clicks on your page for anomalies. If something stands out, we store a review entry with aggregated numbers of your page and the measured value that stood out; it does not contain identifiers or IP addresses of your visitors. We delete review entries no later than 14 months after they are created and archive them after 90 days. When your page is deleted, we delete its review entries with it. If our team handles an entry, we remove the identifier of the person who handled it when their account is deleted.

We delete daily values after the periods in section 7. We keep sums, the milestones, points and goals you have reached and your channel links until your account is deleted. We delete sharing entries after 90 days; we keep the first entry per channel until your account is deleted. The recipient is Supabase (database) as processor; see section 4.

Your right to object: You can object to this processing at any time, in the app and on the web under Customize Territory, or by email to info@clickonb.io. We will then hide levels, points, streaks and milestones for your account, stop calculating them and delete your points, milestones and goals.

3e. Content reports

Using “Report page”, you can report content that you consider illegal or in breach of our terms. For this, we process the reason, your description, the reported page, the time and your statement that you are acting in good faith. Your name and email address are optional. If you give an email address, we confirm receipt and tell you our decision. Emails are sent through Resend (see section 4). Our own sending log contains only the report reference instead of your address. Resend records the delivery in its own log with your address.

In the app, you report content through “Report content” while you are signed in. We then store the report with your account and use your account’s email address for the confirmation of receipt and our decision. We don’t ask for a name there. The link to your account stays with the report, at most until your account is deleted.

The legal basis is Article 6(1)(c) GDPR in conjunction with Article 16 of the Digital Services Act. We delete your name and email address from the report no later than 30 days after our decision. This period applies to the report in our database, not to the Resend log. If you reply to one of our emails, your reply is kept with your name and address in our support inbox. The report text and the decision remain stored. We only give your name to the person whose content you report if this is strictly required by law.

4. Hosting and processors (subprocessors)

ClickOnBio is a web app that you can use in a browser and install as a Progressive Web App (PWA) on supported devices. This information also applies to the native iOS and Android apps. We use Supabase for the database, authentication and file storage, and IONOS for the web server. Customer records, invoices and support cases are managed in our Odoo backend. The following overview lists the providers, their purposes and their contractual status. Optional providers that creators configure for their profiles are described in section 5a:

For payments relating to your account, we use Mollie B.V. (Netherlands) as payment service provider. It receives the information that the payment requires (the name and email address of your account). Legal basis: Article 6(1)(b) GDPR (performance of a contract). Invoices, payment references and associated business transactions are retained separately from the deleted profile (section 7).

Business users may request a separate data processing agreement with Werbungmacher.de UG (contact: info@clickonb.io).

5. Visitor statistics and browser diagnostics

On public profile pages, we record views and clicks for our own pseudonymised visitor statistics without an analytics cookie. A hashed visitor identifier is derived from the IP address, browser identifier and UTC date. We also process a browser hash that does not change daily, the device type, referring domain and limited campaign values (source, medium and campaign). The statistics do not store the raw IP address or raw browser identifier as separate data fields. This processing is not anonymous. For embedded profiles, we do not record profile views through this mechanism; clicks may use the same click counter.

Our server counts views when the page is requested. No script runs on your device for this, and we store nothing there. We take the source from the information your browser sends with the request (referer) and the campaign values from the requested address. The server filters out views by bots and preview services.

So that views and clicks are not distorted by repeats or scripts, we create a daily identifier (hash value) from your IP address (IPv4 in full, IPv6 the first 64 bits), the calendar day (German time), the identifier of the page you visit and a secret key. It applies only to the page you visit and to one day, and we delete it together with the raw events after 30 days. It is pseudonymised, not anonymous. The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest is protecting the statistics and the leaderboards against manipulation.

Your right to object: You can object to this processing at any time. To do so, write to info@clickonb.io and tell us your IP address and the time period. We will then delete the daily identifiers calculated from it. If several people use the same IP address, this also affects their identifiers.

If you open your own page while signed in, we store hashed identifiers of your IP address (daily identifier and network range) for 30 days so that your own views do not count as visitors.

Eligible creators may additionally configure Google Analytics 4 and/or Meta Pixel. These providers require separate consent on the relevant profile page (section 5a). ClickOnBio’s general browser diagnostics settings do not control these providers or our own profile statistics.

On our own pages, you can allow optional browser diagnostics with Sentry. They start only after your current, explicit choice. Sentry receives limited technical error types and code positions. Form contents, user profiles, page addresses, breadcrumbs and screen recordings are not sent as diagnostic content. Sentry receives your IP address when your browser connects. This browser SDK does not start on public creator pages or embedded profiles. After you navigate to a creator page, diagnostics remain stopped for the current document. Server-side error diagnostics are independent of this choice.

In the iOS and Android app, optional error diagnostics with Sentry are initially switched off. You can enable them separately in the privacy settings and switch them off again at any time. The decision applies to your signed-in account on this device and is reset when you sign out or change accounts. Previous consent to statistics in the browser or app does not activate these diagnostics. After you give permission, the app sends limited technical information about JavaScript errors, code positions, the app version and build number. User profiles, form contents, screen recordings and native crash reports are not sent through these app diagnostics. The account ID is used only locally to associate your decision with your account. When you withdraw consent, the app stops new transmissions and aborts diagnostic requests still in progress; data already transmitted is not retrieved. Your public visitor statistics work independently of this permission.

Your diagnostics decision is saved in local browser storage and sent to our server to document it. The record contains a consent identifier, categories, version and timestamps, together with hashes of the IP address and browser identifier. For signed-in users, it may be linked to the account. These records are not anonymous. The local decision remains valid until you change it, the consent version changes or you clear browser storage.

You can change or withdraw browser diagnostics permission through “Browser diagnostics settings” in the footer of our information pages or under Account → Privacy in this browser. In the workspace, the dialog opens only when you request it. An earlier statistics, marketing or preference choice does not activate this new diagnostics decision. Necessary login and security features remain available. Language and appearance are set independently of this diagnostics choice. For details, see our cookie policy.

5a. Optional Google and Meta integrations configured by a creator

An eligible creator can configure a Google Analytics 4 measurement ID and/or a Meta Pixel ID for their public profile. We do not load either integration before you give consent for that profile, purpose and current provider configuration. These integrations are not active for embedded or age-restricted profiles. A changed configuration requires a new valid choice.

• Google Analytics 4 (statistics): after your permission, we send a page-view event with the canonical profile address without URL parameters, the fixed page title “Creator page” and a consent identifier. Advertising storage, advertising user data and ad personalisation remain disabled.
• Meta Pixel (marketing): after your permission, we send a page-view event to the pixel ID configured by the creator. The integration does not pass additional user or contact data for advanced matching and does not use the Conversions API.

The providers are loaded in a separate measurement document. They therefore receive a connection from your browser, including your IP address. Our integration does not pass form contents, email addresses, phone numbers or other contact fields. We do not load an unrestricted tag manager container for this purpose. On our own pages, we do not operate a global Google Ads, Google Tag Manager or Meta Pixel integration through this choice.

Your creator-specific choice is saved on the server for the relevant profile. A signed cookie links your browser to this decision. Both the choice and the cookie expire after 180 days. We store the profile ID, configuration revision, permitted purposes and timestamps. This decision does not contain an account ID or IP or browser hashes. Local blocking and withdrawal markers coordinate the decision between open tabs.

You can change your choice through “Creator privacy” on the relevant profile page. Withdrawal stops the measurement document immediately, even if saving the decision fails. Data already transmitted is not retrieved. The general browser diagnostics settings do not change this profile-specific decision.

The providers are Google Ireland Ltd. / Google LLC and Meta Platforms Ireland Ltd. / Meta Platforms Inc. Processing in the USA is possible. Information about the providers’ further processing is available in the Google privacy policy and the Meta privacy policy. For questions about a specific provider configuration, contact the relevant creator. For questions about processing by ClickOnBio, contact us at info@clickonb.io.

5b. Storage on your device

If your connection or session in the editor ends, we store your unsent entries (for example legal notice, bio and the items on your page) on your device: in the browser in IndexedDB, in the Android app in a local database, in the iOS app in the keychain. We do not encrypt them additionally and do not store passwords. When you sign out or switch accounts, we delete them immediately. If 14 days have passed since your last activity or the session was revoked from another device, the app and the website delete them the next time they are opened, without sending them; until then they stay on the device. This also applies if you are still signed in on the device. After the 14 days, the only exception is a browser tab that currently has these entries open: it keeps them until it releases them, for example when it is closed; after that, the website deletes them at its next check, at the latest the next time it is opened. If the deletion fails, the device remembers this and repeats it at the next start. On iPhone, keychain entries can outlast deleting the app. The legal basis is Section 25(2) No. 2 TDDDG, for your own details Art. 6(1)(b) GDPR, and for details of third parties in your items (for example testimonials) Art. 6(1)(f) GDPR.

In addition, the website and the app store settings such as language and appearance, your diagnostics decision and markers for notices. The app stores the following on your device:

Swipe sideways to see all columns.

Section 3.2 of the cookie policy describes which entries the website stores in the browser.

6. Your rights (Articles 15–21 GDPR)

• Access to stored data
• Rectification of inaccurate data
• Erasure of your data
• Data portability (export)
• Withdrawal of consent
• Lodging a complaint with the supervisory authority

You can request a data export and account deletion in the app or in the web studio under Account.

Our competent supervisory authority is (Article 13(2)(d) GDPR):

The State Commissioner for Data Protection and Freedom of Information of Baden-Württemberg (LfDI BW)
Lautenschlagerstraße 20
70173 Stuttgart, Germany
www.lfdi-bw.de

This does not affect your right to lodge a complaint with a supervisory authority in the place of your habitual residence or work (Article 77 GDPR).

7. Retention periods

We delete raw visitor statistics events with hash values, including the daily identifiers from section 5, once they are older than 30 days (720 hours). We delete daily evaluations (views, clicks, sources, device types, times of day, items, campaigns, online times) after 30 days, or after 14 calendar months if statistics over 14 calendar months are part of your account. Before that, we turn them into monthly and total sums without visitor identifiers for levels, milestones and leaderboards. We keep these sums, the milestones and goals you have reached and your channel links until your account is deleted. We delete hashed identifiers of your own views (section 5) after 30 days. Cleanup takes place in recurring runs.

When you delete your account, your profile is initially deactivated. You can cancel the deletion in your account settings within 14 days. Permanent cleanup of the account, its content and associated files then begins. Any outstanding payment transactions must first be resolved.

Invoices, payment references and associated business transactions are retained separately from the deleted profile. A central customer record and transactions relating to other WERBUNGMACHER.DE services are not automatically deleted when you delete your ClickOnBio account. Account deletion therefore does not mean that all personal data held by us and our service providers is removed at the same time. You can contact us to request access or further erasure.

8. Contact

For privacy questions, contact: info@clickonb.io

Last updated: 10 October 2026