Privacy policy
This policy explains how we process personal data on spokenof.io and when providing our services “GEO Audit Basic”, “GEO Audit Plus” and “GEO Monitoring” (together “Spoken Of”). It applies under the EU General Data Protection Regulation (GDPR), the German Federal Data Protection Act (BDSG) and the German Telecommunications Digital Services Data Protection Act (TDDDG).
1. Controller
magiclabs GmbH
Rosengarten 9
49456 Bakum
Germany
Managing director: Mike Koene
Email: hello@spokenof.io
We have not appointed a data protection officer. There is no obligation to do so, because fewer than 20 people are regularly engaged in the automated processing of personal data (§ 38(1) BDSG) and our core activities involve neither large-scale regular and systematic monitoring of individuals nor special categories of data (Art. 37(1)(b) and (c) GDPR). For all privacy requests, please use the email address above.
2. Overview
We only process personal data as far as necessary to provide this website, answer enquiries, perform the services you book and invoice them. This website sets no cookies, uses no JavaScript, no tracking, analytics or advertising services and no external fonts or CDNs. All files are delivered from our own hosting.
3. What data we process and why
| Purpose | Data | Legal basis | Retention |
|---|---|---|---|
| Providing this website, security (server log files) | IP address, date/time, URL requested, referrer, user agent, status code | Art. 6(1)(f) GDPR (legitimate interest in secure and stable operation) | At our host Vercel, usually a few days depending on the plan; not combined with other data |
| Email contact (e.g. to hello@spokenof.io) | Email address, name, content of the message, time. Emails to our contact address are received via Resend and forwarded to the internal mailbox we use to handle our correspondence | Art. 6(1)(b) GDPR where the enquiry relates to a contract or its preparation, otherwise Art. 6(1)(f) GDPR (legitimate interest in answering enquiries) | Until the matter is resolved; business correspondence up to 6 years (§ 257 HGB) |
| Order and invoice (via Stripe) | Name/company, billing address, email, VAT ID, service booked; payment data is processed directly by Stripe | Art. 6(1)(b) and (c) GDPR (contract; tax and commercial law obligations) | Invoices and accounting records 8 years, books and annual accounts 10 years, business letters 6 years (§ 147 AO, § 257 HGB), each from the end of the calendar year |
| Intake form (magiclabs-geo-intake.vercel.app, stored in our database); matched to the order by hand via the email address | Order email, contact person (name, optional), website address, market/location, report language, competitors named, optional notes | Art. 6(1)(b) GDPR (contract) | Up to 12 months after delivery of the report or end of monitoring (defect period), then deleted unless a retention duty applies |
| Querying AI engines (see section 4) | Buyer questions containing the business name, industry, location and website of the customer or competitors; the answers and cited sources | Art. 6(1)(b) GDPR; where competitors or persons named in answers are concerned, Art. 6(1)(f) GDPR (legitimate interest in performing the analysis) | Raw data (answers, scores) as for intake; reports as business correspondence up to 6 years |
| Website check (readiness check) | Publicly accessible content of the customer's website (e.g. source code, robots.txt, structured data, imprint details to compare name, address and phone), Google Business Profile, review platforms | Art. 6(1)(b) GDPR; for third-party personal data on these pages Art. 6(1)(f) GDPR | As for intake |
| Delivery of report and walkthrough | Email address, report (self-generated PDF, sent by email), walkthrough video (Plus only) | Art. 6(1)(b) GDPR | As for intake; report as business correspondence up to 6 years |
The intake form sets no cookies and uses no analytics or tracking services. Form submissions are not automatically linked to Stripe; we match them to the order by hand using the email address. Providing the data marked as required is necessary to perform the contract; without it we cannot deliver the service.
We only access publicly available pages and do not log in to protected areas. There is no automated decision-making including profiling under Art. 22 GDPR. We assess the visibility of a business, not of individuals.
4. Input into AI engines
To perform the service we enter public buyer questions that name your business and your competitors (business name, industry, location, website) into the following services:
- ChatGPT – OpenAI, USA
- Google Search / AI Overviews – Google, USA
- Perplexity – Perplexity AI, Inc., USA
- Grok – xAI (X.AI LLC), USA
We do not enter any personal data of our customers into these services, in particular no names, email addresses or other contact details of individuals and no intake content other than the business details named above. The operators process the input under their own privacy terms as independent controllers. Where possible we use them logged out or in neutral sessions.
5. Recipients and processors
We use the following service providers. Where they act as processors, we have data processing agreements with them under Art. 28 GDPR.
- Hosting of this website: Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA. Vercel processes the server log files. Static pages are delivered via Vercel's global network. The function that receives our contact emails runs in the region fra1 (Frankfurt am Main, Germany).
- Intake form (magiclabs-geo-intake.vercel.app) – hosting and functions: Vercel Inc., USA (address as above). The form's server functions run in the Vercel region iad1 (Washington, D.C., USA), so intake details are processed in the USA. Transfers rely on the EU-US Data Privacy Framework (Art. 45 GDPR) and EU Standard Contractual Clauses (Art. 46(2)(c) GDPR).
- Intake form – storage of intake details (database): Supabase Inc., USA; database hosted on AWS in region eu-central-1 (Frankfurt am Main, Germany). Transfers in connection with support and operations from the USA rely on EU Standard Contractual Clauses (Art. 46(2)(c) GDPR).
- Receiving and sending email (contact address, report delivery, correspondence): Resend (Plus Five Five, Inc., USA), EU region eu-west-1 (Ireland). Resend processes email addresses, content and technical delivery data (e.g. delivery status).
- Internal mailbox: emails to our contact address are forwarded to the mailbox we use to handle our correspondence.
- Walkthrough video (GEO Audit Plus only): we produce it locally on our own machines (ffmpeg and local text-to-speech) and send it as an MP4 by email or as a download link. No additional service provider is involved.
- Software assistants for analysis and report writing: Cursor (Anysphere Inc., USA).
- Payments and invoices: Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland. Payment takes place on a checkout page hosted by Stripe. Stripe processes payment data partly as an independent controller (e.g. fraud prevention, regulatory duties), see stripe.com/privacy. Where Stripe acts as our processor (e.g. invoicing and subscription management), Stripe's data processing agreement applies.
We only pass data to other third parties where we are legally obliged to (e.g. to tax authorities) or you have consented.
6. Transfers to third countries
Vercel, Supabase and Resend are based in the USA; Stripe may transfer data to Stripe, Inc. (USA). Even where databases and functions run in the EU, access from the USA (e.g. for support and operations) cannot be ruled out. Where a provider is certified under the EU-US Data Privacy Framework, transfers rely on the European Commission's adequacy decision (Art. 45 GDPR); otherwise, and in addition, on EU Standard Contractual Clauses (Art. 46(2)(c) GDPR) that form part of the respective data processing agreements.
7. Cookies and local storage
This website sets no cookies and does not access information on your device beyond what is technically necessary to deliver the page (§ 25(2) TDDDG). A cookie banner is therefore not needed. On Stripe's checkout page, Stripe's cookie notice applies.
8. Your rights
Under the GDPR you have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to withdraw any consent with effect for the future (Art. 7(3)).
Right to object (Art. 21 GDPR): where we process data on the basis of legitimate interests (Art. 6(1)(f) GDPR), you can object at any time on grounds relating to your particular situation. Competitors named in a report can object to the processing of their details at the email address above.
An email to hello@spokenof.io is enough to exercise your rights.
Right to lodge a complaint (Art. 77 GDPR): you can complain to a data protection supervisory authority, in particular in the member state of your residence, place of work or the place of the alleged infringement. The authority responsible for us is Die Landesbeauftragte für den Datenschutz Niedersachsen, Prinzenstraße 5, 30159 Hannover, Germany, www.lfd.niedersachsen.de.
9. Security
This website is delivered only over encrypted connections (HTTPS/TLS). Incoming webhooks from our email provider are verified by signature. To protect against forged senders we use SPF, DKIM and DMARC for our email domain. Receiving mail servers send us aggregated DMARC reports; they contain technical details of mail servers that sent in our name (e.g. server IP addresses, number of messages) but no content or recipient addresses. Legal basis: Art. 6(1)(f) GDPR (protection against abuse).
10. Changes
We update this policy when the service or the law changes. The version published here applies. In case of doubt, the German version (Datenschutzerklärung) prevails.