§ 1 Data Controller
The data controller within the meaning of the General Data Protection Regulation (GDPR) is: Rabieb Al Khatib, Ridlerstraße 29F, 80339 Munich, Germany, email: mail(at)matbakh(dot)app.
For any questions regarding data protection, you may contact us at any time by email.
§ 2 Data Collected
(1) Depending on the product surface used, we process contact and identity data, business-related inputs (such as business name, website, category/subcategory context and location), session/state data, technical data, and analysis/result data where required for the relevant function.
(2) The visibility analysis processes lawfully usable public, official, or licensed business and context data as evidence. In the currently evidenced path this includes Google Places/Google Business Profile signals, Foursquare OS Places, and national-holiday data from Calendarific.
(3) To identify relevant business data, business-related search and context information, in particular location and category context, may be transmitted to the relevant data provider. In the Foursquare OS Places path, the matbakh.app user's account email and session ID are not part of those request details. For Calendarific, the country/year context required for the holiday request is transmitted; account email, session ID, business name, and street address are not part of the evidenced Calendarific request.
(4) Data obtained from third-party providers is processed within the matbakh.app analysis and combined with Matbakh-owned business context. Provider identifiers are not used as customer-facing product identity.
(5) Business data may in individual cases relate to an identifiable person, in particular for sole proprietors or businesses named after individuals.
§ 3 Purposes and Legal Bases
(1) We process data to provide and perform the service used and to conduct the AI-powered visibility analysis. Where processing is necessary to perform a requested service or contract, Art. 6(1)(b) GDPR is used as the drafting basis; the final legal classification of individual provider processing remains subject to the final Legal review.
(2) Consent-dependent browser storage and web analytics are controlled through the cookie/consent mechanism. Google Consent Mode may, however, transmit cookieless consent/measurement signals to Google while analytics storage is denied; therefore “no analytics cookies” does not mean “no technical communication with Google.”
(3) Technical security, abuse-prevention, and integrity processing may rely on legitimate interests where the statutory requirements are met.
§ 4 AI-Powered Processing
(1) The visibility analysis uses AI-assisted processing. The currently evidenced paths include AWS Bedrock with EU georouting and Google Vertex AI with a European request location.
(2) The AI-assisted analysis processes business-related context and a limited set of relevant business signals where required for the relevant analysis. Email and session identifiers are not transmitted to the analysis models under the evidenced model-input path.
(3) Business data originating from external sources is kept distinct from interpretation generated by matbakh.app or AI. Model-generated market, benchmark, comparison, or positioning statements are not presented as measurements, confirmations, or recommendations made by an underlying data provider unless supported by a specific source basis.
(4) AI-generated conclusions, syntheses, and recommendations may be inaccurate, incomplete, or outdated. A recommendation is not an automatic execution or modification of the business.
§ 5 Processors and Recipients
(1) Amazon Web Services (AWS) is used for currently evidenced infrastructure and processing services, including hosting/compute, database, email delivery, and AI-related processing within the evidenced service boundaries.
(2) Google services are used in distinct roles: Google Places/Google Business Profile to retrieve public business evidence, Google Vertex AI for market-intelligence processing, and Google Analytics 4/Consent Mode for the separate browser analytics path.
(3) Foursquare OS Places is used as an external source of public business and place data. Customers are not provided with Foursquare raw datasets, provider IDs, or a dataset/export service. A matbakh.app analysis may show the public name of a relevant comparison business where this is necessary to make a governed comparison understandable.
(4) Calendarific (operated by HATCHSQUARE Technologies LLC) is used as an active source of national-holiday data. Holiday information is used as temporal context in the analysis. Account email, session ID, business name, and street address are not transmitted to Calendarific in this evidenced path.
(5) The specific legal roles, recipients, contractual basis, and transfer classification for the Google, Foursquare, and Calendarific paths will be finally reviewed against the evidenced provider basis before this version becomes effective.
§ 6 Data Transfers to Third Countries
(1) We do not state that all processing takes place exclusively on AWS servers in Frankfurt. EU georouting is evidenced for AWS Bedrock; europe-west4 (Netherlands) is evidenced as the request location for Vertex.
(2) An EU request location does not by itself prove the complete provider-side processing chain or an account-specific third-country/transfer basis. The applicable contractual, recipient, and transfer mechanisms will be finally reviewed before this version becomes effective.
(3) When Foursquare OS Places data is retrieved, the technical and business-related request information necessary for that data request is transmitted to Foursquare. We do not make a stronger statement about recipient role, processing location, or possible third-country relevance until the provider/counsel review is complete.
(4) Calendarific is operated by HATCHSQUARE Technologies LLC in the United States. The country/year context required for the holiday-data request and ordinary technical connection data are transmitted to Calendarific; the specific privacy role and transfer classification will be finally reviewed before this version becomes effective.
(5) Google Analytics/Consent Mode may transmit cookieless consent/measurement signals to Google before consent or while analytics storage is denied. We therefore do not state that no data is transmitted to Google or to third countries without analytics consent.
§ 7 Cookies and Storage Technologies
(1) We use browser storage technologies including localStorage for technical or session-related purposes. The legal classification depends on the specific purpose and surface.
(2) For Google Analytics/Consent Mode, the technically evidenced behavior is: before consent or after rejection, optional analytics/ad storage remains denied and no _ga* cookies are set. Cookieless consent/measurement signals may nevertheless be transmitted to Google.
(3) After explicit consent, the approved optional storage states are enabled and _ga cookies are set. Consent can be changed or withdrawn for the future through the cookie settings.
§ 8 Retention Period
(1) Personal data and analysis data are not subject to one universal deletion period; retention depends on purpose and storage area. The internally decided 30-day non-reconstructability value is a target and is not proof that fully automated deletion is already implemented.
(2) Business evidence obtained from Foursquare OS Places may be stored internally on a temporary basis where needed for the current analysis, traceability, and reasonably current reuse. It is not offered as a customer-retrievable dataset.
(3) Specific retention, deletion, and statutory preservation periods will be finally reconciled against the active runtime before this version becomes effective.
§ 9 Your Rights
You have the following rights regarding your personal data: right of access (Art. 15 GDPR), right to rectification (Art. 16 GDPR), right to erasure (Art. 17 GDPR), right to restriction of processing (Art. 18 GDPR), right to data portability (Art. 20 GDPR), right to object (Art. 21 GDPR).
To exercise your rights, please contact us by email at: mail(at)matbakh(dot)app.
You also have the right to lodge a complaint with a data protection supervisory authority. The competent authority is the Bavarian State Office for Data Protection Supervision (BayLDA), Promenade 18, 91522 Ansbach, Germany.
§ 10 Withdrawal of Consent
(1) Where the processing of your data is based on consent, you have the right to withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out prior to the withdrawal.
(2) You may withdraw your consent to web analytics via the cookie settings on our website.
(3) You may withdraw other consents by email to mail(at)matbakh(dot)app.
§ 11 Changes to This Privacy Policy
We reserve the right to update this privacy policy as needed to reflect changes in the legal framework or changes to the service. The current version is always available on our website at matbakh.app/datenschutz.