feinwerk campaigns
Book a demo Request a pilot DE EN
Legal

Platform privacy policy

This policy applies to the Feinwerk Campaigns platform at app.campaigns.feinwerk.io. The website has its own policy.

1. Controller and scope

Peter Boehlke, feinwerk, Carl-von-Linde-Straße 32, 85716 Unterschleißheim, Germany, e-mail: info@feinwerk.io

Data protection officer: Wolfgang Evers, DSZ GmbH, Brandlweg 5, 83543 Rott am Inn, Germany, phone: +49 152 2951 7648, e-mail: wolfgang.evers@dsz365.de

This policy applies to the Feinwerk Campaigns platform at app.campaigns.feinwerk.io, to the e-mails the platform sends, and to the platform's short links and QR codes. The Feinwerk Campaigns website has its own privacy policy.

2. On whose behalf we process data

The platform is used by companies, their teams and the agencies they invite. This gives us two roles:

  • On behalf of the company: everything in a workspace is processed on behalf of the company that runs the workspace: campaigns, links, QR codes, check results, tracking inventory, requests, comments, uploaded files, results from web analytics, the change history, and memberships and roles. That company is the controller; we conclude a data processing agreement with it (Art. 28 GDPR). Please address questions about this content and your rights to the company; we support it in this.
  • As controller ourselves: running and securing the platform, your user account as far as it is needed for sign-in, protection against misuse and the contractual relationship, and e-mails about your account. This policy applies to these directly.

3. Hosting and server log files

The platform runs on a server of Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany, in the Nuremberg data centre. A data processing agreement with Hetzner is in place (Art. 28 GDPR). The platform's backups are also kept at Hetzner, encrypted.

When the platform is accessed, the web server automatically processes log files (IP address, date and time, requested address, user agent, referrer) to keep the service running and to fend off attacks (Art. 6(1)(f) GDPR). The log files are deleted after 30 days at the latest, unless a security incident requires keeping them longer.

The platform can only be reached encrypted (HTTPS with TLS 1.2 or 1.3).

4. User account and sign-in

For your account we process your name, your e-mail address, your language, the time your e-mail address was confirmed, and your credentials:

  • Password: stored only as a hash (bcrypt), never in plain text. When you set it, the platform checks whether the password appears in known data breaches. Only the first five characters of a hash of the password are sent to the "Have I Been Pwned" service, never the password, your e-mail address or anything else.
  • Passkeys (optional): we store only the public key and the name you give the passkey; the private key stays on your device.
  • Two-factor sign-in (optional): we store the secret and the recovery codes encrypted.

To protect against password guessing, the platform counts sign-in attempts per e-mail address and IP address for one minute at a time.

For invitations we store the invited person's e-mail address, who invited them and when. Your settings also include whether, and for what, you receive the weekly summary by e-mail.

The legal basis is providing the platform: Art. 6(1)(b) GDPR where you are our contractual partner yourself, otherwise our legitimate interest and that of the company that invited you in giving you secure access (Art. 6(1)(f) GDPR), together with the data processing agreement with that company.

You can delete your account yourself in the settings. Your memberships then end. Entries in a workspace's change history remain and still contain your user ID, so the company can trace who changed what.

5. Sessions and cookies

The platform only sets cookies that are strictly necessary for it to work (section 25(2) no. 2 TDDDG):

  • "feinwerk-campaigns-session": your session. On the server, the session includes your user ID, your IP address and your browser's identifier (user agent). The session expires after 120 minutes without activity.
  • "XSRF-TOKEN": protects forms against misuse, for the duration of the session.
  • "remember_web_…": only if you choose "Remember me" when signing in; keeps you signed in for up to 400 days until you sign out.
  • "appearance" and "sidebar_state": your display settings (light or dark mode, sidebar).

The platform contains no web analytics and no advertising, and your browser loads no third-party services: we deliver fonts and scripts from our own server.

6. E-mails

The platform sends e-mails to confirm your e-mail address, to reset your password, with invitations to workspaces and, if you want it, the weekly summary of your campaigns. You can unsubscribe from the weekly summary in the settings and via the link in every mail. The mails go through our own mail server on the same server; they are transferred to the recipients' mail servers encrypted if those servers support it.

7. Connection to a company's web analytics

If a company connects its Matomo installation, the platform uses the company's access token to fetch summarised reports (visits, goals, events and revenue per campaign and link) and the configuration of goals, events and Tag Manager. It neither fetches nor stores data about individual visitors of the website. We store the access token encrypted and do not show it again after saving.

8. Checking landing pages

The platform checks the landing pages of links: it fetches the pages and follows redirects (with the user agent "FeinwerkCampaignsCheck/1.0"). For the check in a browser, our own scan service opens up to five public pages of a link in an isolated browser environment (user agent "FeinwerkScanner"). It intercepts tracking requests to Matomo instead of sending them, stores no results and keeps no request logs. The checked website sees the requests as ordinary page views, recognisable by the user agent.

The platform's short links and dynamic QR codes are in preparation. When someone opens a short link or scans a dynamic QR code, our redirect service forwards them to the target address. It counts opens and scans per link and day, separated into people and suspected bots. It neither stores nor logs IP addresses, user agents, referrers or cookies, and the web server's access logs are switched off for the short link domain. After a contract ends, short links and dynamic QR codes keep redirecting for 12 months and then show a neutral notice page with the original target address.

10. Demo without an account

At app.campaigns.feinwerk.io/demo you can try the platform without an account. When you start the demo we ask for neither your name nor your e-mail address. You get your own copy of a fictional workspace and are signed in at once.

  • To prevent misuse, the platform counts how many demos are started from one IP address (for IPv6 the /64 network). For this it stores only a hash formed with a secret key of the platform, not the address itself. The counter lasts one hour and is then deleted.
  • The demo uses a normal session with the cookies and session data from section 5.
  • Your copy is deleted when it has not been used for two hours, at the latest 24 hours after the start. Everything you entered, the session and the change history of the copy are deleted with it.
  • The demo sends no e-mails, calls no real websites or Matomo installations and uses no checking service.

The legal basis is running the demo you start yourself (Art. 6(1)(b) GDPR) and our legitimate interest in protecting the platform against misuse (Art. 6(1)(f) GDPR). Please do not enter real personal data in the demo.

11. Access by our support

To help, our support opens a workspace only with a stated reason, read-only and for at most 60 minutes. The access is recorded in the change history, which the workspace's members can see.

12. Recipients

Apart from us, only Hetzner receives your data, as processor for running the servers. We do not pass it on to third parties, do not use it for advertising and do not transfer it to countries outside the EU. The check of passwords against data breaches (section 4) transfers no personal data.

13. Retention

  • User account: until you delete it.
  • Workspaces: when a company's contract ends, we delete its workspace's data within 30 days, including the change history, except the short link and target address for the notice page (section 9).
  • Demo: the copy until two hours after its last use, at the latest 24 hours after the start; the misuse counter one hour.
  • Sessions: until 120 minutes after your last activity; "Remember me" up to 400 days.
  • Server log files: at most 30 days.
  • Backups: until they are overwritten by their regular rotation; until then we do not use them.

Statutory retention obligations, for example for invoices, remain unaffected.

14. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on Art. 6(1)(f) GDPR (Art. 21). Contact us informally at the e-mail address above or our data protection officer. If your request concerns workspace content that we process on behalf of a company (section 2), we forward it to that company.

Right to object (Art. 21 GDPR): where we process your data on the basis of a legitimate interest (Art. 6(1)(f) GDPR), you may object at any time on grounds relating to your particular situation. We will then no longer process the data unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims.

You also have the right to lodge a complaint with a data protection supervisory authority, for example the Bavarian Data Protection Authority (BayLDA), Promenade 18, 91522 Ansbach, Germany.

Last updated: November 2026