Privacy Policy
Last updated: November 4, 2026
This is a translation of our German privacy policy (Datenschutzerklärung). In case of doubt, the German version prevails.
1. Controller and contact
Daniel Lassak
Stark mit Daniel
Montfortstr. 6
88515 Langenenslingen
Germany
Email: mail@starkmitdaniel.de
This policy applies to Stark Social at cockpit.starkmitdaniel.de and to all instances we operate for our customers. We have not appointed a data protection officer because we are not required to. If you have questions, simply send us an email.
2. Who is responsible for what?
Stark Social is a social media cockpit for small businesses and freelancers. Every customer gets a separate instance with its own database and its own login.
- We are the controller for the public pages (offer, legal texts), for emails you send us and for handling the contract with our customers.
- We are a processor (Art. 28 GDPR) for the data a customer processes in their instance: connected accounts, statistics, posts and reports. The customer is the controller for this data. We process it only on the customer’s instructions and under a data processing agreement (template).
The following sections nevertheless also describe the processing within the instances, so that everyone involved can read what happens to their data.
3. Hosting and server logs
All public pages and all instances run on a server operated by Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany, in its data center in Nuremberg, Germany. Hetzner is our processor.
A reverse proxy (Nginx Proxy Manager) on the same server sits in front of the pages. For every request it logs:
- IP address,
- date and time,
- requested address and status code,
- amount of data transferred,
- referrer (the previously visited page, if your browser sends it),
- user agent (browser and operating system).
This serves secure and stable operation, for example to detect and fend off attacks. The legal basis is our legitimate interest under Art. 6(1)(f) GDPR. Access logs are rotated weekly and deleted after five weeks at the latest, error logs after eleven weeks at the latest.
4. Cookies
We only set cookies that are strictly necessary (Section 25(2) no. 2 of the German TDDDG). That is why there is no cookie banner. The public pages set no cookies at all.
| Name | Purpose | Duration |
|---|---|---|
| smd_sitzung | Keeps you signed in to the cockpit. Signed and not readable by scripts (HttpOnly). | 30 days or until you sign out |
| smd_tiktok_status | One-time value that protects the TikTok login against forgery (CSRF). Only set when you click “Mit TikTok verbinden” (Connect with TikTok). | 10 minutes |
5. No analytics, no external services on the public pages
We use no trackers and no analytics tools. Fonts and all other files are served from our own server; no external fonts or CDNs are loaded.
6. Contact by email and “Request access”
There is no contact form. “Request access” opens your email program. When you write to us, we process your address and the content of your message to answer your request and, where applicable, to prepare an offer. The legal basis is Art. 6(1)(b) GDPR (pre-contractual measures), otherwise Art. 6(1)(f) GDPR (our interest in answering requests). We keep the emails until your request has been dealt with and afterwards only as far as statutory retention periods require, for example for business letters.
7. Signing in to the cockpit
Every instance has its own password. After you sign in, the cockpit sets the cookie smd_sitzung (see section 4). To slow down attacks, the cockpit briefly keeps failed sign-in attempts per IP address in memory and temporarily blocks further attempts after several failures. The legal basis is the contract with the customer (Art. 6(1)(b) GDPR) and our interest in secure operation (Art. 6(1)(f) GDPR).
8. Connected platforms
In the cockpit, a customer can connect their own accounts. We then retrieve statistics and posts through the platforms’ official interfaces. We only collect numbers and the account’s own posts, no comments and no data about individual followers.
8.1 TikTok
We only process TikTok data after the account owner clicks “Mit TikTok verbinden” (Connect with TikTok) on the page “Kanäle” (Channels) and authorizes the app on TikTok. We use TikTok’s Login Kit and Display API with these scopes:
| Scope | Data | Purpose |
|---|---|---|
| user.info.basic | open_id, union_id, avatar_url, display_name | Identify the account, show avatar and name in the cockpit |
| user.info.profile | username, profile_deep_link, bio_description, is_verified | Show the username and a link to the profile |
| user.info.stats | follower_count, following_count, likes_count, video_count | Statistics and trends; we store daily snapshots for this |
| video.list | public videos with id, create_time, title, video_description, share_url, duration, view_count, like_count, comment_count, share_count and cover_image_url | Post table and reports. We only display the cover image (cover_image_url) and do not store it; TikTok lets the link expire after six hours. |
- Credentials: We store TikTok’s access and refresh tokens encrypted (AES-256-GCM) in the instance’s database. The cockpit refreshes them automatically.
- Who sees the data: only the account owner and the people they give access to their instance. The data appears in the cockpit and in their reports.
- What we never do: sell TikTok data, share it with third parties, use it for advertising or use it to train AI.
- No AI: TikTok data is never sent to an AI service, even if the AI assessment is switched on for the instance (see section 10).
- Disconnect: “Trennen” (Disconnect) on the page “Kanäle” revokes access at TikTok and deletes the tokens. If you wish, the cockpit also deletes all stored TikTok data of this account at the same time. You can also revoke access at any time in the TikTok app: Settings → Security → Manage app permissions. After that, the cockpit no longer retrieves any new data.
8.2 Facebook and Instagram (Meta)
For a Facebook Page and an Instagram professional account, we retrieve the following through Meta’s Graph API: account statistics (reach, views, interactions, followers), the account’s own posts (text, link, type, date) and their statistics. We use the access the customer grants in their Meta business portfolio. Here, too, we only collect numbers and no personal data about individual followers.
8.3 Legal basis and platforms as separate controllers
We process this data on behalf of the customer (Art. 28 GDPR). For the customer, the legal basis is usually their legitimate interest in evaluating the success of their social media work (Art. 6(1)(f) GDPR) or the contract with us (Art. 6(1)(b) GDPR). With every request, TikTok and Meta learn that the connected account is being queried through our application. The platforms’ own privacy policies apply to their processing: TikTok, Meta.
9. Reports and email delivery
The cockpit creates reports from the statistics for a week, a month or a freely chosen period (HTML, PDF, Markdown). They are stored in the customer’s instance. On request, the cockpit sends them by email to the addresses the customer specifies. For delivery we use the SMTP service of Forward Email (Forward Email LLC, USA, forwardemail.net). The email contains a short summary, the key figures and the report as a PDF.
10. AI assessment (optional)
Only if it is switched on for the instance does an AI service write an assessment for the report. For this we transmit aggregated statistics, shortened post texts and the brand’s style guidelines, only from Facebook and Instagram. TikTok data is excluded. We never transmit credentials, tokens or data about individual followers. The assessment is labeled as AI-generated in the report.
Depending on the instance’s settings, we use:
- Command Code (Langbase, Inc., San Francisco, USA), an interface to language models, currently with the model Claude by Anthropic, or
- Anthropic’s Claude API directly (Anthropic PBC, San Francisco, USA).
The customer can switch off the AI assessment at any time. Then no data goes to an AI service, and the report only contains the rule-based short summary.
11. Storage location and security
All instance data is stored on the server in Nuremberg, Germany. Every instance runs in its own container with its own database and its own login. Connections are encrypted with TLS, and platform tokens are additionally encrypted in the database. The server is protected by a firewall, receives security updates automatically and can only be administered with an SSH key. The databases are backed up daily.
12. Retention and deletion
- We store data in an instance for as long as the customer uses it. The customer can delete individual connections including their data on the page “Kanäle” or ask us to delete data.
- When the contract ends, we delete the instance with all its data within 30 days. Daily database backups are kept for 14 days and then overwritten, so at the latest 14 days after deletion.
- Server logs: see section 3. Email requests: see section 6.
13. Recipients and processors
We only pass data on to service providers we need for operation:
| Provider | Task | Location |
|---|---|---|
| Hetzner Online GmbH | Server and data center | Germany |
| Forward Email LLC | Delivery of report emails | USA |
| Langbase, Inc. (Command Code) | AI assessment, only if switched on | USA |
| Anthropic | AI model Claude, only if switched on | USA |
TikTok and Meta are not recipients in this sense: we retrieve data from them and only send the information needed for the request.
14. Transfers to third countries
When report emails are sent and when the AI assessment is switched on, data may reach the USA. For these transfers we rely on the providers’ data processing agreements, which incorporate the European Commission’s Standard Contractual Clauses. All other data stays in Germany.
15. Your rights
Under the GDPR you have the right to
- access your stored data (Art. 15),
- rectification (Art. 16) and erasure (Art. 17),
- restriction of processing (Art. 18),
- data portability (Art. 20),
- object to processing based on our legitimate interest (Art. 21), on grounds relating to your particular situation.
To do so, write to mail@starkmitdaniel.de. If your request concerns data in a customer’s instance, the customer is your contact. We forward requests that reach us to the customer and support them in responding.
16. Right to lodge a complaint
You can lodge a complaint with a data protection supervisory authority. The authority responsible for us is the State Commissioner for Data Protection and Freedom of Information of Baden-Württemberg (www.baden-wuerttemberg.datenschutz.de).
17. Changes
We update this policy when the offer or the legal situation changes. The version published here applies.