Privacy Policy

Last updated: 14 October 2026

This is a translation of our German privacy policy (Datenschutzerklärung). The German version prevails.

This privacy policy informs you about the processing of personal data when you use Applytix (hereinafter “the platform”) in accordance with the General Data Protection Regulation (GDPR).

1. Controller

The controller responsible for data processing on this platform is:
Speakz Media GmbH
Kantstraße 127
10625 Berlin
Germany
Email: hello@speakzmedia.de

2. General information on data processing

We process personal data only to the extent necessary to provide a functioning platform and our content and services. Processing is generally based on the performance of a contract (Art. 6(1)(b) GDPR), your consent (Art. 6(1)(a) GDPR) or our legitimate interests (Art. 6(1)(f) GDPR).

3. Hosting & processors

To operate the platform, we use external service providers who act as processors (Art. 28 GDPR) exclusively on our instructions:

  • Supabase (Supabase Pte. Ltd, Singapore) — Database, authentication and server-side functions. This is where your account data and the marketing and revenue metrics retrieved from connected data sources are stored. Data is stored in the EU region Frankfurt. Transfer to a third country on the basis of the following safeguard: EU Standard Contractual Clauses (Art. 46 GDPR).
  • Vercel (Vercel Inc., USA) — Hosting and delivery of the web application and cookie-free audience measurement (Vercel Web Analytics). When you access the platform, Vercel processes technically necessary server log data such as IP address, time and requested resource. Transfer to a third country on the basis of the following safeguard: Adequacy decision of the European Commission on the EU-US Data Privacy Framework (Art. 45 GDPR), under which Vercel is certified.
  • Sentry (Functional Software, Inc. d/b/a Sentry, USA) — Error and crash reports from browser and server, so that malfunctions are noticed. The reports are stored in Sentry's EU region. If an error occurs, a short recording of the last interactions is also transmitted; texts are masked and media hidden in it. Transfer to a third country on the basis of the following safeguard: Adequacy decision of the European Commission on the EU-US Data Privacy Framework (Art. 45 GDPR), under which Sentry is certified.
  • PostHog (PostHog, Inc., USA) — Product analytics: which features are used and where users drop off. Processed are the pseudonymous identifier (without consent formed anew on the server every day, with consent stored in the browser, see section 7), pages visited, time and technical information about browser and device. Transfer to a third country on the basis of the following safeguard: Adequacy decision of the European Commission on the EU-US Data Privacy Framework (Art. 45 GDPR), under which PostHog is certified.
  • Stripe (Stripe Payments Europe, Limited, Ireland) — Processing of paid plans: payment, invoicing and management of running subscriptions. You enter your payment details directly with Stripe; we do not see them.
  • Anthropic (Anthropic Ireland, Limited, Ireland) — Generating the text recommendations and answering your questions in the chat. Your input and the metrics from your account needed for it are transmitted. Data is stored in the USA. Transfer to a third country on the basis of the following safeguard: EU Standard Contractual Clauses (Art. 46 GDPR).
  • Resend (Plus Five Five, Inc., USA) — Sending our emails: confirmation and sign-in emails as well as the daily report, which you can unsubscribe from in the settings. Your email address and the content of the email are transmitted; sending runs through Resend's EU region in Ireland. Transfer to a third country on the basis of the following safeguard: Adequacy decision of the European Commission on the EU-US Data Privacy Framework (Art. 45 GDPR).
  • Firecrawl (SideGuide Technologies, Inc. d/b/a Firecrawl, USA) — Retrieval of publicly accessible websites that you specify for competitor monitoring. Transfer to a third country on the basis of the following safeguard: EU Standard Contractual Clauses (Art. 46 GDPR).
  • AppFollow (AppFollow.fi Oy, Finland) — Retrieval of the public ratings and reviews of your app from the app stores.
  • Applyra (Aurélien Weiss (Einzelunternehmen), France) — Retrieval of public store metrics for search terms (app store optimization). Search terms and app identifiers are transmitted, no account data.

Where these providers process personal data on our behalf, they do so on the basis of a contract under Art. 28 GDPR. Where a safeguard is named above, processing takes place wholly or partly outside the EU or the EEA; the transfer is then based on the basis under Chapter V GDPR stated in each case.

4. Registration & user account

Using the platform requires creating a user account. In doing so, we process the data you provide (in particular name, email address and authentication data) as well as the information about your app that you give in the setup dialog. The legal basis is the performance of a contract (Art. 6(1)(b) GDPR). If you sign in via “Continue with Google”, we receive from Google the email address stored for your account and your name.

5. Connected data sources (advertising and analytics accounts)

The core of the platform is bringing together your marketing and revenue data. For this, you can connect your own accounts with various third-party providers to Applytix. We only retrieve the data required to provide the analytics and optimization features:

  • Apple — App Store Connect and Apple Search Ads: download, revenue and campaign metrics of your app.
  • Google — Google Ads and Google Play Console: campaign, cost and install metrics. The connection runs via Google OAuth, see section 6.
  • Meta — Meta Ads for Facebook and Instagram: campaign and cost metrics.
  • TikTok — TikTok Ads: campaign and cost metrics.
  • RevenueCat — Subscription and revenue data of your app.
  • Adjust — Attribution data, if you connect an Adjust account.
  • AppsFlyer — Attribution data, if you connect an AppsFlyer account.

These providers’ own privacy policies and your contractual relationship with them apply; we access data only within the permission you have granted.

Each connection is made at your request. The legal basis for retrieving and processing this data is the performance of a contract (Art. 6(1)(b) GDPR) or your consent given in the connection process (Art. 6(1)(a) GDPR). You can remove a connection at any time in the settings.

Content your browser loads directly from third parties. Some content is not delivered through our own servers; your browser loads it directly from the respective provider. The provider receives your IP address and processes it under its own responsibility:

  • Apple (Apple Distribution International Limited, Ireland) — App search: When you search for an app or a competitor or add one via a store link, your browser queries Apple's search interface directly. In doing so, Apple receives your IP address, the search term, the time and technical information about your browser. According to Apple, it usually stores this data with Apple Inc. in the USA. Transfer to a third country on the basis of the following safeguard: EU Standard Contractual Clauses (Art. 46 GDPR).

The legal basis is our legitimate interest in finding your apps and those of your competitors for you and showing them in a recognizable way (Art. 6(1)(f) GDPR).

6. Use of Google user data (Google Ads API)

When you connect your Google Ads account via “Connect with Google”, you grant Applytix access to your Google Ads account through Google’s OAuth procedure (OAuth scope https://www.googleapis.com/auth/adwords). We access campaign, ad group, keyword, cost and performance data of your advertising account.

Applytix’s processing and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. In particular:

  • We use the Google data we retrieve solely to provide you, within the platform, with analyses, reports and optimization recommendations for your own advertising accounts.
  • We do not transfer Google user data to third parties, except as necessary to provide the platform to the respective user (e.g. to our processors), as required by law, or as you have expressly requested.
  • We do not sell Google user data and do not use it for advertising or for profiling that extends beyond you.
  • We do not allow humans to read Google user data unless you have expressly consented, the data is necessary to maintain security or to comply with legal requirements, or the data is aggregated and anonymized.

The access tokens granted via OAuth are stored encrypted. You can revoke access at any time, either by disconnecting in the platform settings or via your Google account (third-party access).

7. Cookies, storage on your device & product analytics

The platform stores information on your device, partly as cookies, partly in the browser’s local storage or session storage. In detail:

  • Required for operation. Your sign-in token in local storage, so you stay signed in; the selected language as the session cookie NEXT_LOCALE; settings such as the last selected project or the theme; your choice in the consent banner as the entry applytix-consent-v1 in local storage, so the banner does not reappear on every page. The platform does not work without this information. Legal basis: Section 25(2) no. 2 TDDDG (German Telecommunications Digital Services Data Protection Act), Art. 6(1)(b) GDPR.
  • Product analytics (PostHog), only with your consent. If you agree in the banner, PostHog sets cookies and stores information in local storage to recognize you, such as a random identifier (ph_<project>_posthog) and the record of your consent (__ph_opt_in_out_<project>), plus session data in session storage, such as session and window (ph_<project>_window_id) and, if you arrive via a campaign link, its origin (utm parameters); these expire when you close the tab. This lets us recognize your browser over several days. PostHog’s cookies expire after twelve months; the other entries are removed when you withdraw consent. When we speak of cookies in the banner, we mean all entries a page stores in your browser, including in local storage and session storage. Legal basis: your consent (Section 25(1) TDDDG, Art. 6(1)(a) GDPR).
  • Error reports (Sentry). Sentry keeps the last interactions in the tab’s memory and stores session data of the recording in session storage, such as a random identifier and timestamps. The interactions are only transmitted if an error occurs; text input is masked and images are hidden. Both expire as soon as you close the tab.

Product analytics without consent. Even without your consent, and after you have declined, we use PostHog to count which pages are visited and which features are used. PostHog then stores no identifier on your device and reads none from it; local storage then only holds your choice once you have made one (applytix-consent-v1, see above). The same information is transmitted as with consent, including your IP address. On its server, PostHog forms a hash from a random daily value, your IP address, the domain visited and the browser identifier. The daily value is deleted at the end of the day; after that, the hash can no longer be traced back to IP address and browser, and a new one is formed on another day. We therefore recognize you within one day at most. The legal basis is our legitimate interest in learning how the platform is used and where users drop off (Art. 6(1)(f) GDPR).

If you are signed in, PostHog assigns the events in both cases to your user account, via its internal identifier, not via your name or email address.

You can change or withdraw your choice in the banner at any time: the “Privacy settings” link at the bottom of every page and the button here reopen the banner. After you withdraw, the platform removes PostHog’s cookie and entries from your browser and counts again without an identifier in the browser.

Privacy settings

You can object to product analytics without consent at any time (Art. 21 GDPR), with the switch below or informally via the contact address in section 1. If your browser sends the “Global Privacy Control” or “Do Not Track” signal, this also counts as an objection. Product analytics then does not start at all, not even without an identifier, and the banner does not appear. Your browser remembers the objection in the entry applytix_analytics_opt_out in local storage; it contains no identifier and is deleted when you withdraw the objection. The platform then remains fully usable. We do not set cookies for advertising purposes and do not integrate advertising networks.

8. Storage period

We store personal data only as long as necessary for the respective purposes or as required by statutory retention obligations. When you delete your account, the associated data is deleted unless statutory obligations prevent this. Invoice and payment data are subject to the retention periods of up to ten years under German commercial and tax law.

9. Your rights

As a data subject, you have the following rights:

  • Access (Art. 15 GDPR)
  • Rectification (Art. 16 GDPR)
  • Erasure (Art. 17 GDPR)
  • Restriction of processing (Art. 18 GDPR)
  • Data portability (Art. 20 GDPR)
  • Objection to processing (Art. 21 GDPR)
  • Withdrawal of consent given, with effect for the future

You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). To exercise your rights, a message to the contact address in section 1 is sufficient.

10. Changes to this privacy policy

We reserve the right to amend this privacy policy so that it always meets current legal requirements or to reflect changes to our services. The version current at the time of your next visit applies.