Privacy policy

Controller

The controller within the meaning of Art. 4(7) GDPR responsible for the processing of personal data on this website and in the qoyaa application is:

reamote Hauptstr. 35 Themar Germany Represented by: Dennis Schott Email: hey@reamote.com

For questions about data protection and to exercise your rights, you can reach us at Dennis Schott.

Further information can be found in the legal notice.

Accessing the website and server log files

When you access our website or the application, your browser transmits data to our server for technical reasons. In doing so, we process:

• the IP address of the requesting device,
• the date and time of access,
• the requested address (URL), HTTP method and status code,
• the amount of data transferred,
• the referrer URL, if your browser transmits it,
• browser type, operating system and version (user agent).

This processing is necessary to deliver the website, to ensure its stability and security and to detect attacks or errors. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in secure and uninterrupted operation. Server log files are deleted after 14 days at the latest, unless they are needed for longer to investigate a specific security incident.

We record technical errors of the application with a self-hosted instance of the Sentry software, hosted by Sentry. An error report contains the error message, the stack trace, the requested address, the time and browser and server characteristics, but no IP addresses, cookies or form input. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in stable and secure operation. Error reports are deleted after 90 days.

The website and the application are operated by Hetzner, which acts on our behalf (see Recipients and processors). All connections are encrypted using TLS.

Cookies, local storage and fonts

We only use technically necessary cookies:

In the application, we additionally store your display preference (light or dark) in your browser’s local storage. This information does not leave your device.

Storing this information on your device is strictly necessary for the service you have expressly requested (§ 25(2) no. 2 TDDDG). The subsequent processing is based on Art. 6(1)(b) GDPR insofar as it serves the use of your customer account, and otherwise on Art. 6(1)(f) GDPR. Consent is not required for this.

On the public pages, we also store your choice regarding reach measurement (qoyaa-analytics-consent) in your browser’s local storage so that we do not ask you again on every page. This is also strictly necessary (§ 25(2) no. 2 TDDDG).

Apart from the consent-based reach measurement described below, we do not use any tracking or marketing tools on the website and do not embed any third-party content such as videos, maps or social media plugins. The fonts used are downloaded once when the application is built and are subsequently served exclusively from our own server. No connection to third-party servers is established for this purpose when you access the website.

Reach measurement with Rybbit

On the public pages of our website, not in the application after signing in and not in shared reports, we measure reach with the open-source software Rybbit. We run it ourselves on our own server; the data is not transferred to third parties. We record the page visited, the referring page, browser, operating system, device type, screen size, language setting and the country or region derived from the IP address.

Rybbit is only loaded after you click “Accept” in the cookie notice. Rybbit does not set cookies, but stores a random visitor ID (rybbit-visitor-id) in your browser’s local storage to recognise returning visits. The IP address is not stored; to count visits, an identifier derived from the IP address and browser identifier is only used in hashed form with a daily rotating key. It is not combined with your customer account.

The legal basis for storing and reading the visitor ID is your consent under § 25(1) TDDDG, and for the subsequent processing Art. 6(1)(a) GDPR. Consent is voluntary. You can withdraw it at any time with effect for the future via “Cookie settings” in the website footer; we then delete the visitor ID from your browser.

Contacting us

If you contact us by email, we process your email address, your name and the content of your message in order to respond to your enquiry. The legal basis is Art. 6(1)(b) GDPR insofar as your enquiry is aimed at concluding a contract or relates to an existing contractual relationship, and otherwise Art. 6(1)(f) GDPR; our legitimate interest lies in responding to enquiries. We delete the data as soon as the enquiry has been fully dealt with and no statutory retention obligations prevent deletion.

Registration and customer account

To use qoyaa, you create a customer account. In doing so, we process:

• name and email address,
• password, which we store exclusively as a cryptographic hash,
• the time at which your email address was verified,
• optionally the secret and recovery codes for two-factor authentication (stored in encrypted form),
• optionally passkeys; for these we only store the public key and technical identifiers, never biometric data,
• for signed-in sessions, the IP address, the user agent and the time of the last activity.

We use this data to provide your account, to sign you in securely and to perform the contract. The legal basis is Art. 6(1)(b) GDPR. To protect against misuse, we briefly limit sign-in attempts based on email address and IP address (Art. 6(1)(f) GDPR; legitimate interest: account security).

You can delete your account in the settings at any time. We delete account data together with the account, unless statutory retention obligations apply.

Teams, roles and invitations

Projects and subscriptions belong to a team. For each team member, we store the membership and the role (Owner, Admin, Analyst, Member, Read only or Billing) in order to enforce access rights. When a team member invites another person, we process the invited person’s email address, the intended role and the name of the inviting team, and send an invitation email. The legal basis is Art. 6(1)(b) GDPR in relation to the team and Art. 6(1)(f) GDPR in relation to the invited person; the legitimate interest lies in the collaboration requested by the team. The team can withdraw pending invitations at any time.

Projects, domain verification and website analysis

In a project, you enter your domain, your brand, competitors and the questions that are to be measured regularly (“prompts”). This information is business data of your company. It should not contain any personal data.

When you enter a domain in the form for a new project, we retrieve its home page, even if the project is not created afterwards. From its page title, meta description, Open Graph data and main heading, we have suggestions for the product category and short profile phrased; if no language model is available, we only use the meta description as the profile suggestion. Each team can do this at most 10 times per day. It is a single page request without domain verification that does not consult robots.txt; we do not store the page content in this step.

If a domain is entered in a project, we also retrieve the home page of the entered domain each time prompt suggestions (during onboarding, after a website import or via “Generate suggestions”) or competitor suggestions (automatically in the competitor step of onboarding or via “Suggest competitors”) are generated and read its page title, meta description, Open Graph data and main heading. This also happens before the domain is verified. It is a single page request that does not consult robots.txt; we do not store the remaining page content in this step.

You verify your domain via a DNS TXT record. After verification, our crawler retrieves publicly accessible pages of your own domain (robots.txt, sitemap and up to 30 pages) in order to generate suggestions for your brand profile and your prompts. If these pages contain personal data, such as names in a legal notice or on team pages, we process them only as part of the page content. We delete raw website content after 30 days.

The legal basis is Art. 6(1)(b) GDPR. Insofar as page content contains personal data of third parties, we process it on behalf of the customer in accordance with the data processing agreement.

You can export project data as CSV at any time. Export files are available for download for 24 hours. A requested project deletion is carried out after a waiting period of 24 hours and can be cancelled until then.

AI measurements via OpenRouter

When you request an implementation proposal for an optimisation task, we also transmit the relevant task, measurement findings, source references and selected excerpts from captured pages of your website, content drafts and AI answers via OpenRouter. If these contents include personal data, that data is processed as part of the relevant excerpt. Account and billing data are not included as such.

The core of qoyaa is measuring whether AI assistants mention or recommend your brand. To do this, we send the text of your prompts with web search enabled to the API of OpenRouter (OpenRouter, Inc., USA). OpenRouter forwards each request to the language model of the respective AI assistant. Depending on the assistants enabled in the project, these are models from OpenAI, Google, Perplexity, Anthropic, Meta, xAI, DeepSeek or Alibaba Cloud (Qwen); they are run by these providers or by data centre operators that OpenRouter uses for this purpose. OpenRouter may also use a search service for the web search.

For measurements, only the prompt text and technical parameters such as the language and country of the search are transmitted. We do not send names, email addresses or other account data. With every request, we instruct OpenRouter to use only providers that do not store requests for their own purposes, such as training models. The providers process the requests in accordance with their own terms; under these terms, requests may be stored for a limited period, in particular for abuse detection.

We store the full answers, the detected mentions of the brand and competitors, cited sources and measurement metadata. Answers from the AI assistants are third-party content and may contain names of people who are publicly mentioned there.

qoyaa also has a language model phrase prompt suggestions via OpenRouter (during onboarding, after a website import or via “Generate suggestions”). For this, we transmit the product category, company profile, the names of the tracked brands, existing prompts of the project and the meta data of the entered domain’s home page mentioned above, again without any account or personal data and with the same instruction not to store requests for the providers’ own purposes. Each team can make at most 3 such requests per day. For the product category and short profile suggestions when creating a project, we transmit only the home page meta data in the same way. For competitor suggestions, we transmit your brand name, product category, company profile, the names and spellings of the tracked brands, the domain and the home page meta data in the same way; each team can make at most 3 such requests per day.

The legal basis is Art. 6(1)(b) GDPR. Please do not enter any personal data in prompts, brand fields or competitor fields. We delete full answers, raw responses and citation URLs after 90 days. Before that, a daily summary with counts and source domains is created, which is deleted after 13 months.

Public report links

Teams can create a read-only report link for a project and share it with third parties. The link shows aggregated visibility figures, but no individual AI answers. It expires after 7, 30 or 90 days and can be revoked at any time. For each link, we store the team member who created it, its validity, the number of views and the time of the last view, but no data about the people viewing it. The information on server log files applies to views. The legal basis is Art. 6(1)(b) GDPR; the respective team decides whether to share the link.

Notifications and emails

We send you emails that are necessary for using the service, for example to verify your email address, to reset your password and for team invitations (Art. 6(1)(b) GDPR). Optionally, a team can enable email notifications about significant changes in visibility for a project. Depending on the setting, recipients are all team members or only owners and admins, in each case with a verified email address. The setting can be changed or switched off in the project at any time (Art. 6(1)(b) GDPR; in relation to individual team members Art. 6(1)(f) GDPR, legitimate interest: information requested by the team). We do not send newsletters or advertising. We use an email delivery service as a processor for sending emails (Brevo).

Payment processing via Stripe

Paid subscriptions are concluded and billed via Stripe Managed Payments. Stripe acts as the merchant of record and processes payment, invoicing and tax data such as name, billing address, email address, VAT identification number and payment method as an independent controller. We do not receive payment method data such as card numbers.

We receive from Stripe the information required to manage your subscription, in particular the plan, status, billing period and identifiers of the customer, subscription and payment. We transmit to Stripe the internal identifier of your team and the selected plan. The legal basis is Art. 6(1)(b) GDPR and, insofar as statutory retention obligations apply, Art. 6(1)(c) GDPR. Information on data processing by Stripe can be found in Stripe’s privacy policy.

We store who has used the trial budget of 10 free measurements as a hash value of account and domain, so that the trial budget is granted only once per account and domain (Art. 6(1)(f) GDPR; legitimate interest: prevention of abuse).

Integrations

You can optionally connect qoyaa to your own systems. You are the controller for the data transmitted from your systems in this context; we process it as a processor in accordance with our data processing agreement. You decide whether and which integrations you enable and can disconnect any connection at any time.

Odoo, WooCommerce and Shopware

The modules for Odoo, WooCommerce and Shopware only transmit data that you release for this purpose:

• Product data of expressly released products, such as name, description, SKU, price and product page address,
• paid orders with order identifier, time of payment, amounts, currency, line items and refunds, but without names, addresses or email addresses of your customers,
• visits from AI assistants with a pseudonymous session identifier, landing page, source and time, and only after your consent management has reported the visitor’s consent.

We delete visit events and session references on orders after 30 days, and derived order and refund data after 13 months. We store connection keys in encrypted or hashed form.

Google Analytics 4

When you connect a Google Analytics 4 property, you authorise us via OAuth with the read-only scope analytics.readonly. Every day, we retrieve aggregated report figures for the last 90 days, in particular sessions, sessions with key events, purchases and purchase revenue. We store access tokens in encrypted form. When you disconnect, we delete the tokens and imported figures; otherwise, the figures expire after 13 months at the latest.

Google Search Console

When you connect Google Search Console, you authorise us via OAuth with the read-only scope webmasters.readonly and select a verified property for your project. Every day, we retrieve search performance data for the last 28 final days, grouped by date, query, page, country and device: clicks, impressions, click-through rate and average position. We never write to your Search Console. We store access tokens in encrypted form. When you disconnect, we revoke access at Google and delete the tokens and imported figures; otherwise, the figures expire after 13 months at the latest.

Use of data received from Google APIs

We use data received from Google APIs solely to display it to you and your team in the respective project. We do not use it for advertising, do not sell it, do not transfer it to third parties except as necessary to provide this feature, for security purposes or to comply with applicable law, and do not use it to train AI models. Our staff only read this data with your explicit consent, for security purposes or where required by law. qoyaa's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. You can disconnect at any time in qoyaa or revoke access at myaccount.google.com/permissions.

Logging and security

We log security-relevant and billing-relevant actions in the team, such as role changes, deletion requests, exports or the creation of report links, together with the acting team member and the time. We delete these logs after 90 days. We store payment events from Stripe in encrypted form and delete them after 90 days. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in the traceability of changes and the security of the platform.

We back up the database regularly in encrypted form. Backups are overwritten after 35 days at the latest. Deletions that have already been carried out are reapplied when restoring from a backup.

Recipients and processors

We only disclose personal data insofar as this is necessary for the purposes stated. Service providers acting on our behalf are contractually bound by our instructions pursuant to Art. 28 GDPR.

Beyond this, we only disclose data if we are legally obliged to do so, for example to authorities, or if this is necessary to enforce our rights.

Transfers to third countries

OpenRouter, the model providers and Stripe also process data in the USA. Depending on the chosen AI assistant, requests may also be processed in other third countries, for example in China if OpenRouter routes a request to a DeepSeek or Alibaba Cloud model on their own infrastructure. The European Commission has determined an adequate level of data protection for companies certified under the EU-US Data Privacy Framework (Art. 45 GDPR). Where a recipient is not certified, we base the transfer on the European Commission’s standard contractual clauses (Art. 46(2)(c) GDPR) and, where applicable, supplementary measures. You can obtain a copy of the safeguards on request at Dennis Schott.

Retention period

We only store personal data for as long as is necessary for the respective purpose or as statutory retention obligations apply. We retain billing-relevant records for up to ten years in accordance with § 257 HGB and § 147 AO (Art. 6(1)(c) GDPR).

Your rights

You have the following rights vis-à-vis us with regard to personal data concerning you:

• right of access (Art. 15 GDPR),
• right to rectification (Art. 16 GDPR),
• right to erasure (Art. 17 GDPR),
• right to restriction of processing (Art. 18 GDPR),
• right to data portability (Art. 20 GDPR),
• right to object to processing (Art. 21 GDPR).

Where processing is based on your consent, you can withdraw it at any time with effect for the future (Art. 7(3) GDPR). To do so, please contact Dennis Schott. If your request concerns data that we process on behalf of a customer, for example from a shop integration, we will forward your request to the responsible customer.

Right to lodge a complaint

You have the right to lodge a complaint with a data protection supervisory authority if you believe that the processing of your personal data infringes the GDPR (Art. 77 GDPR). In particular, you can contact the supervisory authority of your place of residence, your place of work or the place of the alleged infringement.

Provision of data and automated decision-making

Providing the data required for the customer account is necessary to conclude the contract. Without this data, we cannot provide qoyaa to you. Automated decision-making, including profiling within the meaning of Art. 22 GDPR, does not take place. The automated evaluation of AI answers concerns the visibility of brands and not natural persons.

Changes to this privacy policy

We update this privacy policy when our services, the service providers we use or the legal requirements change. The version published on this page at any given time applies. We will additionally inform you by email of material changes affecting your customer account.