Privacy notice

Controller

Sharif Wurz

Niederzeller Str. 13 A

78479 Reichenau

Deutschland

E-Mail: kontakt@sichtindex.de

Accounts, orders and contact

We process your email, account identifier, ordering business name, plan, order and payment status, and confirmation of business status and contract terms. Sign-in uses a one-time link; Sichtindex stores no sign-in password.

For contact, support and voluntary feedback we process your message, contact details and, where relevant, the associated business or report. Please do not submit health information, private customer data or other sensitive information.

Stripe processes payment and invoice details, including a card or IBAN where applicable. Sichtindex receives payment status and customer/order identifiers, not complete card details or bank login credentials.

Businesses, goals and results

Checks process business name, location, category, website, aliases, customer questions, competitors and public sources. Names and contact details of sole traders may be personal data.

When you use the relevant features, we store confirmed business facts (such as services, address, telephone and hours), goals, interview answers, completed steps, corrections and agency branding. We retain check results, AI answers, sources and reports so findings and changes remain traceable.

The website check retrieves the homepage, robots.txt, the sitemap and further public pages of the same website (up to 12 in the free website check, up to 25 in the weekly check and the Audit). Those raw pages are not permanently stored as such; derived findings, titles, page addresses and results may be stored in checks and reports. The result of the free website check is cached for two hours so that you can then request fixes by email.

The free website check and the Audit ask DataForSEO which search terms the domain ranks for in Google's top 100. Only the domain is sent; the result is cached for up to seven days and stored in the Audit. The free AI check also puts its questions to Google's AI Mode through DataForSEO.

The website check, the weekly check and the Audit also ask Google, through DataForSEO, how the homepage appears in search results: the website check with the domain, the weekly check and the Audit with the business name and town. The result (title, description, address of the hit) is cached for up to seven days and stored in checks and reports.

AI processing and public sources

Unbranded visibility measurements use customer questions with service and location, without inserting your business name. Names are compared with the resulting answer afterwards. Custom configured questions may differ.

For question suggestions, analysis, drafts and actions, Anthropic (Claude) in particular may receive business facts, goals, confirmed details and interview text you supply. This is not limited to initial setup. Other AI/search providers receive the questions and location information necessary for their respective requests. Personal account information is not an intended part of measurement questions.

Public business profiles, sources and competitor facts come from websites, search services and public directories. Individuals can request access to information and sources concerning them. Publication online does not remove their data protection rights.

Fixes by email

After the free website check you can request one fix a week by email, at most six, each with a note about our paid plans. For this we store your email address, the website checked, the town given, the prepared fixes, and the wording and time of your consent and confirmation. The legal basis is your consent (Art. 6(1)(a) GDPR).

We send nothing until you confirm your address through the link in our confirmation email and the button on our page (double opt-in). Unconfirmed sign-ups are deleted after seven days, finished series thirty days after the last email. You can withdraw consent at any time with effect for the future, through the link in every email or your email program's unsubscribe function; your address is then deleted at once. Sent through Resend.

Sharing and hand-off links

An enabled report share is accessible to anyone holding the link and remains available until revoked. Hand-off links share the selected snapshot and expire after 60 days. Share links only with authorised recipients; a link is not a confidentiality agreement.

For agencies, data protection roles depend on the data and instructions involved. Processing personal client data solely on your instructions requires a data processing agreement. We remain the controller for our own account administration, billing and security purposes.

Operation and abuse prevention

Access processes technical connection data such as IP address, time and requested route. IP-based limits protect free and other API endpoints against abuse. The application does not use IP identifiers for advertising; limit counters expire according to the endpoint, within seven days at most. Hosting and security providers also process their own technical logs.

The language hint uses the hosting country code and the request's HTTP language header. The application does not store a visitor profile for this purpose.

Cloudflare Turnstile protects sign-in and public forms against automated abuse, processing IP address and technical browser/connection characteristics. Sichtindex receives the verification result and uses it only for that protection.

Purposes and legal bases

Art. 6(1)(b) GDPR: requested pre-contractual steps and performance of a contract with you as an individual, including account, checks, reports, payment and support. Communication with a business's employees or representatives relies on Art. 6(1)(f) GDPR (our interest in administering the contract).

Art. 6(1)(f) GDPR: secure operation, abuse prevention, general enquiries, voluntary feedback and analysis of public business information for traceable visibility checks. We consider the professional/public nature of the information and the rights of individuals concerned.

Art. 6(1)(c) GDPR: statutory retention of invoices and business records. Separately given consent (Art. 6(1)(a) GDPR) can be withdrawn for the future at any time. The contract is not conditional on advertising consent.

Recipients and international processing

Netlify: hosting and delivery (USA). Supabase: sign-in and database (Frankfurt database region; current provider DPA: Supabase Pte. Ltd., Singapore; international support/subprocessor processing). Anthropic: AI analysis and drafts (USA). DataForSEO: AI/search results and public business profiles (Estonia; underlying services may operate internationally).

OpenAI and Perplexity: optional AI queries (USA). SerpApi: fallback for certain Google queries (USA). Resend: service emails (USA). Upstash: API limit counters (EU/US connections). Cloudflare: Turnstile and abuse prevention (USA/international).

Stripe Payments Europe/Stripe: payment and billing (Ireland/USA); Stripe also processes certain data for its own legal and security purposes. IONOS: our contact mailbox (Germany). Messages to that mailbox are currently also forwarded to the owner's Gmail mailbox (Google; international processing including the USA).

International processing may make data accessible outside the EEA. An adequacy decision under Art. 45 GDPR applies only to covered recipients; otherwise appropriate safeguards, particularly standard contractual clauses under Art. 46 GDPR, are required. You can request information and a copy of the safeguards used for each recipient from the contact above. A Frankfurt database does not mean all processing occurs exclusively in Germany.

Your device

We use no analytics or advertising trackers. The session necessary for sign-in is stored in the browser. An explicitly chosen light/dark preference is stored for up to 365 days; choosing System removes it. This storage supports the sign-in or display you request (§25(2) no. 2 TDDDG).

Animation, language-hint and feedback markers are not persistently stored on your device. Explicitly checked items in the setup checklist are stored locally until you uncheck them. Security checks are limited to protecting the requested function. Server processing and Cloudflare are described above.

Retention and required information

Account, business and result data are retained for use of the service and a meaningful check history. Cancellation does not automatically erase your account. You can request erasure through our contact address; data and associated report files are deleted unless a retention ground applies. Backups may remain until their regular expiry and are not used for ongoing operations.

Enquiries and feedback are kept as long as needed for handling, traceable support or resolving claims, then erased or anonymised. Accounting vouchers and invoices are normally retained for eight years, other business correspondence for six years and certain books for ten years; statutory extensions may apply. Records subject to legal retention are restricted to that purpose.

Email and business/order details are required for the requested service; without them sign-in, checks or ordering are not possible. Interview text, feedback and additional business facts are voluntary. We do not make exclusively automated decisions with legal or similarly significant effects under Art. 22 GDPR.

Your rights

You can request access, rectification, erasure, restriction and portability under Arts. 15–20 GDPR at kontakt@sichtindex.de. You can object to legitimate-interest processing on grounds relating to your situation (Art. 21 GDPR), and to direct marketing at any time. Consent can be withdrawn for the future.

You may complain to a supervisory authority, including the State Commissioner for Data Protection and Freedom of Information Baden-Württemberg (www.baden-wuerttemberg.datenschutz.de). Updated: 3 October 2026.