Privacy Policy

Last updated: October 20, 2026 · applies to this website, the newsletter, purchases, onboarding and the customer portal

1. Who is responsible?

AVVEN, owner Artjom Wagner
Krokusweg 3
77731 Willstätt
Germany
Email: hello@avvenai.com

This website is operated from Germany. We process personal data in accordance with the EU General Data Protection Regulation (GDPR) and German data protection law, regardless of where you are located.

We are not required to appoint a data protection officer. If you have any questions about data protection, just write to the address above.

2. Visiting the website

The website is hosted by Cloudflare (Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA). When you visit the site, Cloudflare automatically processes technical data sent by your browser: IP address, date and time, the page visited, browser and operating system. This is necessary to display the site and keep it secure. The legal basis is our legitimate interest in a functioning and secure website (Art. 6(1)(f) GDPR). We have a data processing agreement with Cloudflare that includes the EU Standard Contractual Clauses; Cloudflare is also certified under the EU-U.S. Data Privacy Framework.

To understand which pages are used, we count page views without cookies and without storing your IP address. For this, we process the page visited, the referring website, device type (phone or computer) and country. To avoid counting the same visitor twice on one day, we create a short, irreversible value from the IP address and browser identifier that changes every day; we do not store the IP address itself. The data stays with us (Cloudflare, see above) and is not shared with third parties. The legal basis is our legitimate interest in designing our website according to need (Art. 6(1)(f) GDPR). We delete the entries after 24 months at the latest.

Fonts are hosted on our own server; no data is transferred to Google Fonts. We only set advertising cookies with your consent (see Meta Pixel).

3. Plan request

If you send a request through our plan request page, we store your chosen plan, your name, your email address and, if you wish, the link to your store, so that we can send you the payment and onboarding link. The legal basis is pre-contractual measures taken at your request (Art. 6(1)(b) GDPR). The data is stored in a spreadsheet with Google (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland) as part of Google Workspace or Google Drive. A transfer to the USA may occur; Google is certified under the EU-U.S. Data Privacy Framework. If no contract is concluded, we delete the data after 12 months at the latest.

4. Purchase and payment

Orders and payments are handled by Stripe (Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland). At checkout, you enter your name, email address, billing address, your VAT ID if applicable, and your payment details. Stripe processes this data to handle the payment, manage the subscription, create invoices and prevent fraud. The legal basis is the performance of the contract (Art. 6(1)(b) GDPR) and our legal obligations regarding invoicing and record keeping (Art. 6(1)(c) GDPR). Stripe is partly responsible itself for fraud prevention. Stripe may transfer data to the USA; Stripe is certified under the EU-U.S. Data Privacy Framework and additionally uses the EU Standard Contractual Clauses. More information: stripe.com/privacy.

We never see your full card details. In the Stripe customer portal, you can download invoices, update your payment details and cancel your subscription.

5. Onboarding and files

After your purchase, you answer questions about your brand, your product and your target audience during onboarding and upload files, for example product photos, logos or existing ads. We need this information and these files to create your ads (Art. 6(1)(b) GDPR). They are stored with Cloudflare (Cloudflare D1 database, Cloudflare Workers KV file storage), see section 2. So that you can continue later, your browser remembers a random identifier for your onboarding in local storage (localStorage); this is strictly necessary for the service you requested (Section 25(2) of the German Telecommunications Digital Services Data Protection Act, TDDDG).

When you complete onboarding, we receive a short notification with your name, email and plan in our Google spreadsheet (see section 3). We use AI tools to create the ads and only share the information needed for the respective concept, for example product photos. On the Growth and Scale plans, we use the performance metrics of your ads to further develop the most successful ones. During onboarding, you decide whether to give us read-only partner access in your Meta Business portfolio for this purpose or to upload an export every month. With partner access, we see the performance data of your ad account, for example spend, clicks and purchases per ad, but no data about individual people, and we cannot change anything. You can revoke access at any time in your Meta settings. We delete onboarding data and files no later than 12 months after your subscription ends, unless retention obligations require otherwise.

When you log in to the customer portal with your email address and a code, we send you the code by email and then set a technically necessary cookie so that you stay logged in for 30 days. It contains only a random identifier for your session. The legal basis is the performance of the contract (Art. 6(1)(b) GDPR); no consent is required because the cookie is strictly necessary for the service you requested (Section 25(2) TDDDG). Clicking "Log out" deletes the session.

If you sign up for our newsletter, we send you ad learnings and offers from AVVEN by email and create 3 free static ads for your brand one time. The legal basis is your consent (Art. 6(1)(a) GDPR). We use the double opt-in process: you are only subscribed after you click the link in our confirmation email. To be able to prove your sign-up, we store the time of sign-up and confirmation, the wording of your consent and a shortened, irreversible hash of your IP address.

For the 3 static ads, you answer questions about your brand, product and target audience after confirming and upload product photos. We process and store this information as described in the section "Onboarding and files." You can unsubscribe at any time via the link in every email or by writing to hello@avvenai.com. We delete your data after you unsubscribe, unless we need it as proof of your earlier consent.

6a. Information emails to customers and offers for newsletter subscribers

If you have bought a plan from us, we occasionally send information about similar services of our own to the email address used for the purchase, including after your subscription has ended (Section 7 (3) German Unfair Competition Act, Art. 6 (1)(f) GDPR). You can object at any time via the link in each of these emails or by emailing us, without any costs other than the transmission costs at basic rates.

Newsletter subscribers receive, within the scope of their consent (see above), a few emails with tips after the free ads and a one-time personal offer. To prevent an offer from being used more than once, we store the email address, website domain and the code issued.

7. Email delivery

We send emails such as confirmations and notifications from the customer portal through the service Resend (Resend, Inc., USA) as a processor. This involves processing your email address and the content of the email. Data is transferred to the USA on the basis of the EU Standard Contractual Clauses. We only send you requests for a review by email if you agreed to this during onboarding.

8. Meta Pixel (only with your consent)

If you click "Accept" in the cookie banner, we load the Meta Pixel from Meta Platforms Ireland Limited (Merrion Road, Dublin 4, D04 X2K5, Ireland). It sets cookies and transfers data such as pages visited, time, browser information and your IP address to Meta. This lets us measure how our advertising performs and show relevant ads on Facebook and Instagram to people who have visited our website. The legal basis is your consent (Section 25(1) TDDDG, Art. 6(1)(a) GDPR).

We and Meta are joint controllers for the collection and transfer of the data (Art. 26 GDPR); the agreement is available at facebook.com/legal/controller_addendum. Meta alone is responsible for any further processing. Meta may transfer data to the USA and is certified under the EU-U.S. Data Privacy Framework. Without your consent, the pixel is not loaded. You can withdraw your consent at any time via "Cookie settings" in the page footer. We store your choice in your browser's local storage.

9. Contact by email

If you write to us, we use your information only to respond to your request (Art. 6(1)(b) or (f) GDPR) and delete it once the request has been handled, unless retention periods require otherwise.

10. Retention

We keep invoices and accounting records for as long as German commercial and tax law requires, usually eight to ten years (Section 147 of the German Fiscal Code (AO), Section 257 of the German Commercial Code (HGB), Section 14b of the German VAT Act (UStG)).

11. Your rights

You have the right to access, rectification, erasure, restriction of processing, data portability and objection (Art. 15 to 21 GDPR). You can withdraw any consent at any time with effect for the future. To do so, write to hello@avvenai.com. You also have the right to lodge a complaint with a data protection supervisory authority, for example the State Commissioner for Data Protection and Freedom of Information of Baden-Württemberg (Landesbeauftragter für den Datenschutz und die Informationsfreiheit Baden-Württemberg).