Privacy Policy

Last Updated

02.10.2026

1. Who Is Responsible

The controller responsible for processing your personal data under the EU General Data Protection Regulation (GDPR) is: Bartsch und Büyükkakac GbR Max-Bill-Str. 3 67061 Ludwigshafen Germany Email: info@finlight.me

2. What We Process, Why, and on What Legal Basis

For each case we name the data, the purpose, the legal basis under the GDPR and how long we keep the data.

• Visiting our websites: When you open our pages, our servers process your IP address, browser and device information, the pages you request and the page you came from. We need this to deliver the pages and to keep them secure (Art. 6(1)(f) GDPR, our legitimate interest in a working and secure service). Server logs are deleted after 30 days.
• Account: When you register, we process your name and email address. If you sign in with Google, we receive your name and email address from Google. We need this to create and manage your account (Art. 6(1)(b) GDPR, performance of a contract). We keep it until your account is deleted.
• Using the API and the dashboard: We process your API keys, the requests you send (including query parameters, time and IP address), your usage counts, and the webhooks and settings you configure. We need this to provide the service, apply plan limits and prevent abuse (Art. 6(1)(b) and (f) GDPR).
• Subscriptions and payments: Payments are handled by Stripe. We receive and store your Stripe customer ID, your plan, the status of your subscription and your invoice data. We do not receive your full card details. We need this to perform the contract (Art. 6(1)(b) GDPR). We keep invoice records for up to ten years, as German tax and commercial law requires (Art. 6(1)(c) GDPR). Invoice data includes your billing address and, if you buy as a business, your company name and VAT ID. If you choose a payment method such as PayPal, Klarna or SEPA Direct Debit, Stripe passes the payment data needed to that provider.
• Emails: We send you service emails about your account, billing and changes to the service (Art. 6(1)(b) GDPR). As a registered user you also receive occasional product news about finlight (Art. 6(1)(f) GDPR, our legitimate interest in informing our users about our own services). You can object to product news at any time through the unsubscribe link in every email or by writing to info@finlight.me.
• Contact and forms: If you email us or use a form on our site, such as the custom feed request form, we process what you send us together with your IP address, browser information, the page you came from and campaign parameters. We use this to answer your request (Art. 6(1)(a) and (b) GDPR). We delete it once the matter is closed, unless the law requires us to keep it.
• Error monitoring: We use Sentry to find and fix errors in the dashboard. Sentry receives technical details about the error, your browser and your IP address (Art. 6(1)(f) GDPR, our legitimate interest in a stable service). This data is stored in the EU.
• Analytics and advertising (only with your consent): If you accept in our cookie notice, we use Google Tag Manager, Google Analytics and Google Ads. Google Analytics shows us how our sites are used. Google Ads lets us measure whether our advertising leads to sign-ups and show our ads to people who have visited our sites. To measure conversions, we may send Google a hashed version of your email address when you sign up or subscribe. These tools set cookies and receive your IP address, device information and usage data. The legal basis is your consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG). Google Analytics data is deleted after 14 months.
• Session recording (only with your consent): If you accept in the cookie notice of the dashboard, we use Hotjar and Sentry Session Replay to record how the dashboard is used, for example clicks, scrolling and the pages you open. Text you type is masked. The legal basis is your consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG).
• Attribution: With your consent we store in your browser the first page you visited and the campaign parameters of the link that brought you to us, so that we can see which channels lead to sign-ups (Art. 6(1)(a) GDPR, Section 25(1) TDDDG). Campaign parameters that are present when you sign up are saved with your account (Art. 6(1)(f) GDPR, our legitimate interest in understanding where our users come from).
• People mentioned in news content: The news metadata we collect from publicly available sources, such as titles, summaries and links, can contain personal data of people who are reported on, for example the names of executives or politicians. We process this data to provide a search and delivery service for publicly available news (Art. 6(1)(f) GDPR, our legitimate interest and that of our customers in access to published information). We keep it as long as the news item is part of our index. If you are mentioned and want an entry corrected or removed, write to info@finlight.me.

3. Withdrawing Your Consent

You can withdraw your consent at any time, with effect for the future, under Cookie Settings in the footer of our website and in the dashboard. The tools named above are then stopped and their cookies are deleted. Details on the individual cookies are in our Cookie Policy.

4. Who Receives Your Data

We use the following service providers. They process data on our behalf and on our instructions:

• Amazon Web Services (Amazon Web Services EMEA SARL, Luxembourg): hosting, database, sign-in (Amazon Cognito) and content delivery (CloudFront). Our data is stored in Frankfurt, Germany.
• Stripe (Stripe Payments Europe, Ltd., Ireland): payment processing. Stripe also processes payment data as a controller in its own right, see stripe.com/privacy.
• Brevo (Sendinblue SAS, France): sending emails and managing our contact list.
• Google (Google Ireland Limited, Ireland): Google Tag Manager, Google Analytics and Google Ads, only with your consent, and Google Sign-In if you choose it.
• Hotjar (Hotjar Ltd., Malta): session recording in the dashboard, only with your consent.
• Sentry (Functional Software, Inc., USA): error monitoring, and session replay only with your consent. The data is hosted in the EU.
• Sanity (Sanity AS, Norway): content management for our blog. Blog images are delivered through the Sanity network, which receives your IP address.

Beyond that, we pass on data only when the law requires it or when it is necessary to establish, exercise or defend legal claims.

5. Transfers Outside the EU and the EEA

Some of these providers are based in the United States or use sub-processors there, in particular Google, Stripe, Sentry, Sanity, and sub-processors of Hotjar and Brevo. Where the recipient is certified under the EU-US Data Privacy Framework, the transfer relies on the adequacy decision of the European Commission. In all other cases it relies on the EU Standard Contractual Clauses.

6. How Long We Keep Your Data

The storage periods are stated with each purpose above. In short: server logs for 30 days, Google Analytics data for 14 months, account data until your account is deleted, and invoice records for up to ten years. We complete a request to delete your account within 30 days. All other data is deleted as soon as it is no longer needed for its purpose.

7. Your Rights Under the GDPR

• Access: Request access to the personal data we hold about you.
• Rectification: Request correction of inaccurate or incomplete personal data.
• Erasure ("Right to be Forgotten"): Request the deletion of your personal data.
• Restriction of Processing: Request that we limit the processing of your data.
• Data Portability: Receive your personal data in a structured, commonly used, machine-readable format and request the transfer of that data to another controller.
• Objection: Object to our processing of your personal data, including for direct marketing purposes.
• Withdraw Consent: If we rely on your consent, you may withdraw it at any time without affecting the lawfulness of prior processing.
• Complaint: Lodge a complaint with a data protection supervisory authority, in particular in the EU member state where you live or work. The authority responsible for us is the State Commissioner for Data Protection and Freedom of Information of Rhineland-Palatinate (Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Rheinland-Pfalz), Mainz, Germany.

To exercise these rights, please contact us at info@finlight.me. We will respond to your requests in accordance with applicable data protection laws.

8. Required Data and Automated Decisions

You need to provide an email address to create an account, and payment details to Stripe to subscribe to a paid plan. Without them we cannot provide these services. All other information is optional. We do not use automated decision-making or profiling that has legal or similarly significant effects on you.

9. Account Deletion

You can request the deletion of your account by sending an email to info@finlight.me. We will process your request and delete your account data unless we are required to retain it for legal or compliance purposes.

10. Children's Privacy

Our Services are not intended for use by individuals under the age of 16. We do not knowingly collect personal data from children. If you believe we have accidentally processed data of a child, please contact us immediately.

11. Updates to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes to our practices, technologies, legal requirements, or other factors. When we make changes, we will update the "Last Updated" date at the top of this document. We encourage you to review this Privacy Policy periodically.

12. Contact Us

If you have any questions, concerns, or requests related to this Privacy Policy or our handling of your personal data, please contact us at: info@finlight.me