Privacy policy

This privacy policy provides the information required under Articles 13 and 14 of the General Data Protection Regulation (GDPR). It explains which personal data we process when you visit this website and when you request a free store review, for what purposes and on what legal basis we do so, and which rights you have.

1. Controller and contact

The controller within the meaning of Article 4(7) GDPR is:

Company: 1337 Werk UG (haftungsbeschränkt)
Address: Obere Wöhrstraße 29, 73431 Aalen, Germany
Represented by: Enes Yaman (managing director)
Register: Amtsgericht Ulm, HRB 746887 (Ulm Local Court)
E-mail: care@qante.ai

"Qante Assist" is a service offered by 1337 Werk UG (haftungsbeschränkt). The full provider information is set out in the Imprint.

Please send data protection enquiries to: care@qante.ai.

2. Scope and note for visitors from Turkey

This policy applies to all language versions of this website (Turkish, German, English), to the "Get a free store review" form and to the communication that follows from it.

It does not apply to data that we process on behalf of our clients in their stores and systems; see section 8.

For persons whose data is subject to Turkish Law No. 6698 on the Protection of Personal Data (KVKK), the information required under that law is provided in addition on the page Notice under the Turkish Data Protection Law (KVKK). Rights under the GDPR remain unaffected.

3. What data we process and why

3.1 Visiting the website (server log files)

The website is operated on the infrastructure of a hosting provider (section 5). Each time a page is requested, that infrastructure processes connection data that is technically necessary:

IP address of the requesting device
date and time of the request
address requested (URL), HTTP method and status code
volume of data transferred
previously visited page (referrer), where your browser transmits it
browser type, operating system and language setting (User-Agent, Accept-Language)

The purpose is to deliver the website, to select the appropriate language version, to ensure stability and security, and to investigate faults and attacks. This data is not combined with other data and is not analysed for advertising purposes.

3.2 "Get a free store review" form

When you submit the review form, we process:

store address (URL) or, if you do not have a store yet, what you sell and where
e-mail address
phone number
name (optional)
your answers to two questions after submitting (optional): who does this work today, and what takes most of your time
which plan button you pressed on the website and how you reached the form (for example the field at the top of the page), where applicable
language version of the page, origin of the visit (the "utm_source" parameter or the referring page), time of submission and the time taken to fill in the form (the latter only to ward off abuse, section 3.3)

The sole purpose is to prepare a free, non-binding review for you (what your store needs and which plan fits), to send it to you by e-mail, as a rule within 24 hours on working days, and to answer any questions about it. Immediately after submission you receive an automatic acknowledgement of receipt by e-mail.

We use your phone number only to call you or send you a message about the review. It is stored in our CRM (see 5) and is not passed to measurement tools.

The information relates predominantly to your business. It is personal data to the extent that it allows conclusions to be drawn about a natural person, for example your name, an e-mail address that contains a name, or the store address of a sole trader.

Providing the information is voluntary. Without the store address (or, without a store, what you sell and where), the e-mail address and the phone number, however, we cannot accept your request. You will not be added to a newsletter, and your details will not be used for advertising, without your separate consent.

3.3 Protecting the form against abuse

To ward off automated submissions, we check a control field that is invisible to humans and the time taken to complete the form when it is submitted. We also limit the number of submissions per IP address (no more than five per hour). For this purpose the IP address is held only in the server's volatile memory for no longer than one hour; it is not stored permanently and is not linked to your request.

3.4 E-mail correspondence

If you write to us by e-mail or reply to our review, we process your e-mail address, your name where provided, the content of the message and the technical transmission data (time, mail servers involved). The purpose is to deal with your enquiry and, where it comes to that, to initiate and perform a contract.

Please note that unencrypted e-mails are not fully protected against access by third parties while in transit.

3.5 Audience measurement without cookies (OpenPanel)

To understand how the website is used, we run the open-source software OpenPanel on our own server, hosted with Google Cloud in Frankfurt am Main. OpenPanel stores no cookies or similar identifiers on your device and reads none from it.

The data processed is: pages and page sections viewed, how long a section was visible, how far the page was scrolled, the target of a clicked link (for links to other websites, only the domain), which form fields were touched (the field's name, not what you typed), the domain of the referring website, campaign parameters (utm), browser, operating system, device type, and the country or city derived from the IP address. To tell visits within a day apart, the software generates a non-reversible hash from the IP address and browser details with a value that changes daily; the IP address itself is not stored. What you type into forms, your name and your e-mail address are not passed to this measurement; the only exception is the profile details described in 3.6.

3.6 Cookies and measurement with your consent

On your first visit the website shows a cookie window. If you allow "Analytics":

Google Tag Manager and Google Analytics 4 are loaded (Google Ireland Limited, Dublin, Ireland). Google Analytics uses cookies to measure page views and interactions on the website (for example clicks, choices on the pricing page, forms started and sent). According to Google, Google Analytics 4 does not log IP addresses;
a random visitor id is stored in your browser, under which your visits on different days are brought together in OpenPanel. If you send a request, this id is linked to your record in our CRM, so that we see your visits before and after the request together with it. If you requested a review, your name, your e-mail address, your company's name and the link to your CRM record are also added to your profile in OpenPanel, so that our team sees your visits together with your request. We run OpenPanel on our own server (3.5); these details are not passed to any other measurement tool, Google Analytics included.

Without your consent, no visitor id is stored, and Google Analytics sets no cookies and reads no information from your device. Google Tag Manager is still loaded, and only cookieless signals without an identifier go to Google: the page viewed, the type of event, the time, browser details and the approximate location derived from the IP address. From these, Google estimates the number of visitors without consent in aggregate (Google's "Consent Mode"). The full list of cookies and browser storage, with how long each is kept, is in the cookie policy. You can change or withdraw your choice at any time via the "Cookie settings" link at the bottom of the page; withdrawing deletes the visitor id from your browser.

We do not currently use advertising tools (for example Google Ads, Meta or TikTok pixels). Should we use them in future, this will happen only with your separate "Marketing" consent, and this policy will be updated beforehand. Fonts are loaded from our own server; no social media plug-ins are integrated.

3.7 Contract initiation and client relationship

If a contract is concluded on the basis of the review, we additionally process the contact details of your contact persons, contract and billing data (plan, term, extra-work budget, invoices, payment status) and the communication that takes place in the course of providing the services. The purpose is to perform the contract, to handle billing and to comply with statutory retention obligations.

Payments by card or SEPA direct debit, and payments made through separate payment links, are handled by Stripe (Stripe Payments Europe, Ltd., Dublin, Ireland); this also applies to clients in Turkey. Where payment is made on invoice, the client transfers the amount to our bank account. Full card or account details are processed by the respective payment service provider under its own responsibility; we receive only the details needed to allocate the payment and for bookkeeping.

3.8 Content in return for your e-mail address (rule calendar, sample review)

To send you the rule calendar by e-mail or let you open a sample review on the website, we ask for your e-mail address. It is stored in our CRM (see 5) as a prospect record, together with the content you asked for, the language version, the time and how you reached the form, and is used only to send you this content and to write to you about it. We add you to a newsletter only if you tick the separate box for new rules and confirm your e-mail address.

When you open the sample review, OpenPanel (3.5) measures which page you look at and for how long, whether you download it and whether you create a link to share it. If you allowed "Analytics", this measurement is linked to your CRM record through the random visitor id described in 3.6. Your e-mail address is never passed to measurement tools. If you arrive through a shared link, the random id of the person who shared it is also stored with your record, so that we can see through whom the review reached you.

3.9 Contact form and partner form

When you write to us through the form on the contact page, we process your name (optional), your e-mail address, your message and the page from which you sent the form.

When you use the form on the partner page to host a workshop, become a partner or get a referral link, we process the type of request, your name, your e-mail address, your phone number (for workshop and partnership requests), the name, type and city of your organisation, the expected number of participants and the timing, your store address (for the referral link) and your note.

For both forms we also record the language version of the page, the time of submission and how you reached the form. The information, including the details of your organisation, is stored in our CRM (see 5) and used only to answer your request and to write to you about it. Protection against abuse works as described in 3.3.

4. Legal bases

Review form and subsequent communication: Article 6(1)(b) GDPR (steps taken at your request prior to entering into a contract). Where you make the request on behalf of a company and would not yourself become the contracting party, we base the processing on Article 6(1)(f) GDPR; our legitimate interest lies in handling business enquiries.
Server log files and protection of the form against abuse: Article 6(1)(f) GDPR; our legitimate interest lies in the secure and uninterrupted operation of the website.
Audience measurement without cookies (OpenPanel): Article 6(1)(f) GDPR; our legitimate interest lies in a data-minimising, statistical evaluation in order to improve the website.
Google Tag Manager, Google Analytics, the visitor id and linking your OpenPanel profile to your request (3.6): your consent (Article 6(1)(a) GDPR); for storing and reading information on your device, section 25(1) TDDDG.
Cookieless signals to Google without your consent: Article 6(1)(f) GDPR; our legitimate interest lies in counting visitors without consent in aggregate as well.
Content in return for your e-mail address: Article 6(1)(b) GDPR (sending the content you requested); for news about new rules, your consent (Article 6(1)(a) GDPR). Storing the shared link: Article 6(1)(f) GDPR; our legitimate interest lies in knowing how the review reached you.
Contact form and partner form: Article 6(1)(b) GDPR where your request is directed at a contract, otherwise Article 6(1)(f) GDPR (our legitimate interest lies in answering questions and cooperation requests).
E-mail correspondence: Article 6(1)(b) GDPR where it is directed at a contract, otherwise Article 6(1)(f) GDPR (responding to enquiries).
Contract, billing and payment: Article 6(1)(b) GDPR.
Retention under commercial and tax law: Article 6(1)(c) GDPR.
Establishment, exercise or defence of legal claims: Article 6(1)(f) GDPR.

You may withdraw your consent at any time with effect for the future via the "Cookie settings" link at the bottom of the page. This does not affect the lawfulness of processing carried out before the withdrawal.

5. Recipients and processors

Within our company, access to your data is given only to those persons who need it to handle your request or to perform the contract. We do not sell data and do not pass it on to third parties for advertising purposes.

We use the following service providers. Where they act as processors, contracts under Article 28 GDPR are in place with them:

Hosting and server logs: Vercel Inc., Covina, California, USA. Delivery of the website, processing of connection data and technical receipt of the form. Server region: Frankfurt am Main.
Transactional e-mail: Resend (Plus Five Five, Inc.), San Francisco, California, USA. Sending the acknowledgement of receipt to you and the notification containing your form details to our team.
CRM and storage of requests: Twenty CRM, operated by us on Google Cloud (Google Cloud EMEA Limited, Dublin, Ireland), server region Frankfurt am Main. Receipt of the request through our connector service (connect.qante.ai) and storage in the CRM (crm.qante.ai).
Audience measurement without cookies (OpenPanel): our own server on Google Cloud (Google Cloud EMEA Limited, Dublin, Ireland), server region Frankfurt am Main.
Measurement with your consent: Google Ireland Limited, Dublin, Ireland (Google Tag Manager, Google Analytics 4).
E-mail mailboxes: ALL-INKL.COM – Neue Medien Münnich, Friedersdorf, Germany; servers in Germany.
Payment processing (clients only): Stripe Payments Europe, Ltd., Dublin, Ireland.
Bookkeeping (clients only): Lexware Office, Haufe Service Center GmbH, Freiburg, Germany.

Beyond this, we disclose data only where we are legally obliged to do so (for example to tax authorities or courts) or where this is necessary to enforce legal claims.

6. Transfers to third countries

Vercel and Resend have their registered offices in the USA, as does Google LLC, the parent company of Google Ireland Limited. As a result, personal data may be processed outside the European Union and the European Economic Area.

The transfer is safeguarded as follows:

Where the recipient is certified under the EU-U.S. Data Privacy Framework, the transfer takes place on the basis of the European Commission's adequacy decision of 10 July 2023 (Article 45 GDPR).
Otherwise, and in addition, we have agreed the European Commission's standard contractual clauses (Implementing Decision (EU) 2021/914) with the recipients (Article 46(2)(c) GDPR).

Team members or an affiliated company established in Turkey have access to request and client data. There is no adequacy decision for Turkey; the transfer is safeguarded by standard contractual clauses.

You can obtain a copy of the agreed safeguards on request, using the contact address given in section 1.

7. Retention periods

We store personal data only for as long as is necessary for the purpose in question:

Server log files: 30 days, followed by deletion or anonymisation; longer only where this is necessary to investigate a specific security incident.
IP address used to limit submissions: no longer than one hour in volatile memory, no permanent storage.
Review requests that do not lead to a contract: deleted 6 months after the last contact.
Requests for content in return for your e-mail address: deleted 6 months after the last contact; if you allowed news about new rules, until you withdraw your consent.
Contact form and partner form: deleted 6 months after the last contact if no contract results.
Review requests that lead to a contract: for the duration of the contractual relationship and thereafter in accordance with the statutory retention periods.
Delivery logs held by the e-mail service provider: 30 days.
E-mail correspondence unrelated to a contract: deleted 6 months after the matter has been closed.
Contract, invoice and payment records and commercial and business correspondence: in accordance with the retention periods under commercial and tax law (in Germany currently six to ten years, section 257 of the German Commercial Code (HGB), section 147 of the German Fiscal Code (AO)).
Audience measurement without cookies (OpenPanel): 14 months; then deleted.
Google Analytics: event data 14 months; the cookies' lifetimes are listed in the cookie policy.
Visitor id: in your browser until you withdraw consent.

Once these periods have expired, the data is deleted unless further retention is necessary for the establishment, exercise or defence of legal claims.

8. Processing on behalf of our clients

In the course of our services we work in our clients' stores, marketplace accounts and systems and may thereby gain access to personal data of their customers (such as order, shipping and communication data). In this respect we act as a processor under Article 28 GDPR, solely on the instructions of the respective client; where we work for agencies under their brand, we act as their sub-processor.

The controller for this data is the respective store operator. What applies is that operator's privacy policy and the data processing agreement concluded with us, not this privacy policy. Data subjects are asked to contact the respective store operator; we forward any requests that reach us to that operator.

9. Your rights

Subject to the statutory requirements, you have the right to:

access to the data processed about you and a copy of that data (Article 15 GDPR)
rectification of inaccurate data and completion of incomplete data (Article 16 GDPR)
erasure (Article 17 GDPR)
restriction of processing (Article 18 GDPR)
notification of recipients regarding rectification, erasure or restriction (Article 19 GDPR)
data portability (Article 20 GDPR)
withdrawal of any consent given, with effect for the future (Article 7(3) GDPR)

Right to object (Article 21 GDPR): Where we process data on the basis of Article 6(1)(f) GDPR, you may object to the processing at any time on grounds relating to your particular situation. We will then no longer process the data unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims. You may object to processing for direct marketing purposes at any time without giving reasons.

To exercise your rights, an informal message to care@qante.ai is sufficient. We respond within one month of receipt (Article 12(3) GDPR). In individual cases we may ask for further information in order to confirm your identity.

Right to lodge a complaint (Article 77 GDPR): You may lodge a complaint with a data protection supervisory authority, in particular in the Member State of your habitual residence, your place of work or the place of the alleged infringement. The authority competent for us is: the State Commissioner for Data Protection and Freedom of Information of Baden-Württemberg (Die Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg), Lautenschlagerstraße 20, 70173 Stuttgart, Germany.

The rights under the Turkish KVKK and the option of lodging a complaint with the Turkish Personal Data Protection Authority are described on the page Notice under the Turkish Data Protection Law (KVKK).

10. No automated decision-making

No decision-making based solely on automated processing, including profiling, within the meaning of Article 22 GDPR takes place. The details from the form are received and filed by technical means, but their content is reviewed by our team. The review, plan and price are a non-binding proposal which you are free to accept or decline.

11. Data security

The website and the form are transmitted exclusively over an encrypted connection (TLS). We take technical and organisational measures under Article 32 GDPR to protect your data against loss, alteration and unauthorised access, restrict access to what is necessary, and contractually bind our service providers to a corresponding level of protection.

12. Changes to this privacy policy

We update this privacy policy when the website, the service providers used or the legal position changes. The version published on this page at any given time applies. We give notice by e-mail of material changes that affect a request already submitted or an existing client relationship.

Last updated: 26 October 2026