This is a convenience translation; only the German version is legally binding. Read the German version (Datenschutzerklärung)

Privacy Policy

This privacy policy applies to the website sendalo.de and to the application at app.sendalo.de, insofar as we are the controller there. Last updated: 19.10.2026.

1. Controller

Daniel Schenk, trading as QLYX Media, Goethestr. 10, 15831 Blankenfelde-Mahlow
Phone: +49 173 6609830
Email for data protection enquiries: datenschutz@sendalo.de

We have not appointed a data protection officer because the legal requirements for doing so (Art. 37 GDPR, § 38 BDSG) are not met.

2. Legal bases

We process personal data on the basis of Art. 6(1) GDPR: to perform a contract or take pre-contractual steps (point b), to comply with legal obligations (point c), on the basis of legitimate interests (point f) and, where expressly stated, with your consent (point a). We need the details marked as mandatory for registration and the contract in order to conclude and perform the contract; without them, Sendalo cannot be used. All other details are voluntary.

3. Hosting

The website and application are operated on servers of STRATO AG in data centres in Germany. STRATO processes the data as a processor under Art. 28 GDPR. The legal basis is our legitimate interest in secure and reliable operation (Art. 6(1)(f) GDPR) or the performance of the contract (point b). We keep daily, encrypted backups for 30 days.

4. Visiting the website and the application, server log files

When you visit sendalo.de and app.sendalo.de, your IP address, date and time, the page visited, referrer, amount of data transferred and browser identifier are processed in order to deliver the page and fend off attacks (Art. 6(1)(f) GDPR). Log files are deleted after 7 days unless they are needed to investigate a security incident.

Without your consent, the website sets no analytics or marketing cookies and does not load content from third parties (consent and services: sections 4a to 4c). Fonts are served from our own server. When loading, the website asks our application (app.sendalo.de) whether the website chat is switched on, whether sign-up is already open, which platform connections are already available and which of the services named in sections 4b and 4c are set up; without consent, nothing is stored in your browser for this. If you switch between light and dark mode, we store your choice in your browser’s local storage (localStorage); this is strictly necessary for the function you requested (§ 25(2) no. 2 TDDDG). We likewise store your language choice (German or English) there. If you open the website chat, it is loaded from app.sendalo.de and stores a random chat ID so that the conversation is preserved when the page is reloaded (also § 25(2) no. 2 TDDDG); before the first message, we point out the AI assistant and this privacy policy.

4a. Consent and cookie settings

On your first visit to sendalo.de and the public pages of app.sendalo.de, a notice asks for your consent – separately for the categories “Statistics” (section 4b) and “Marketing” (section 4c). With buttons of equal weight you can accept all categories, allow only what is necessary or choose individually under “Settings”, where the services are listed with provider, purpose and storage period. Until you have agreed, we load no statistics or marketing services. The notice does not block any content; the imprint and this privacy policy remain accessible at all times.

We store your choice in the cookie “sendalo_consent” (version of the settings, chosen categories, time) jointly for sendalo.de and app.sendalo.de, so that you are not asked again on every page. The cookie is valid for 12 months; after that – or when we add new services or change purposes – we ask again. The legal basis is § 25(2) no. 2 TDDDG and Art. 6(1)(c) in conjunction with Art. 7(1) GDPR (proof of consent).

Withdrawal: You can change or withdraw your consent at any time with effect for the future – via the “Cookie settings” link in the footer of every page of sendalo.de, on the sign-in and sign-up pages and in the profile menu of the application. When you withdraw, we remove the services’ scripts and delete their cookies under sendalo.de as far as technically possible; cookies that a provider sets under its own domain can only be deleted by the provider or by you in your browser. If your browser sends the “Global Privacy Control” signal, marketing services stay switched off; browsers with “Do Not Track” enabled are not counted by the statistics.

Where which services run: statistics on the website, in the application and in the client portal at app.sendalo.de; marketing services only on the website and on the sign-in, sign-up and beta pages of the application – never in the application after signing in, in the client portal or on pages that our customers publish via Sendalo (e.g. booking pages, link-in-bio pages, chat windows on customer websites, approval and calendar links). We do not use any of these services on our customers’ own domains.

Necessary cookies and storage are set without consent because they are strictly necessary for the function you requested (§ 25(2) no. 2 TDDDG; Art. 6(1)(b) or (f) GDPR):

We protect against forged requests (CSRF) without any cookie by checking the origin of every request.

4b. Statistics with Umami

With your consent (category “Statistics”) we measure the use of the website, application and client portal with the open-source software Umami. We run Umami ourselves on our server in Germany (section 3); the data is not passed on to third parties and not transferred to third countries. We record the page visited (in the application and client portal without IDs in the address and without the page title), the referring page if you come from another site, time, browser, operating system, device type, screen size and language, country, region and city (roughly derived from the IP address) and, on our public pages, clicks on key buttons (e.g. “Request beta access”, choosing a plan, the plan finder) and form submissions – without their content. We do not record user IDs or content from the application.

Umami sets no cookies and does not store the IP address. To count visits, Umami derives an identifier (hash) from the IP address, browser identifier, a secret key and the current month; the IP address cannot be recovered from it, and the identifier changes every month. We delete the measurement data automatically after 13 months. The purpose is to improve our offering and its usability and to see which content is used. The legal basis is your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG).

4c. Marketing services: Meta Pixel, Google Ads, LinkedIn Insight Tag

Only with your consent (category “Marketing”) and only on the website and the sign-in, sign-up and beta pages do we use the following services, provided we have set them up; you can see which services are active in the “Cookie settings” – we do not load services that are not listed there. The purpose is to measure the success of our ads (e.g. whether an ad led to a click on “Request beta access”, a beta request or a sign-up) and to show relevant ads to people who have visited our pages. Your IP address, browser and device information, the page visited, the referring page, the time, cookie identifiers and the events mentioned are transmitted to the respective provider. If you are signed in with the provider, it may link the visit to your account and also use the data for its own purposes. We switch off automatic analysis of page content where the service allows this.

• Meta Pixel – Meta Platforms Ireland Ltd., Merrion Road, Dublin 4, Ireland. Cookies “_fbp” and “_fbc”, storage period up to 90 days. Privacy policy: facebook.com/privacy/policy.
• Google Ads conversion tracking – Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland. Cookies “_gcl_au”, “_gcl_aw” and similar, storage period up to 90 days. Privacy policy: policies.google.com/privacy.
• LinkedIn Insight Tag – LinkedIn Ireland Unlimited Company, Wilton Plaza, Wilton Place, Dublin 2, Ireland. Cookies “li_fat_id”, “li_sugr” and similar, storage period up to 90 days. LinkedIn only provides us with aggregated reports (e.g. by industry or job title). Privacy policy: linkedin.com/legal/privacy-policy.

The providers also process data in the USA. Meta Platforms, Inc., Google LLC and LinkedIn Corporation are certified under the EU-US Data Privacy Framework; the transfer is based on the European Commission’s adequacy decision (Art. 45 GDPR). For the collection during your visit to our pages and the transmission to the provider, we may be joint controllers with the respective provider (Art. 26 GDPR); the provider alone is responsible for any further processing. The legal basis is your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG), which you can withdraw at any time via “Cookie settings”.

5. Contact by email

If you write to us, we process your details to handle your enquiry (Art. 6(1)(b) or (f) GDPR). We delete the data once the enquiry has been dealt with and no retention obligations apply.

Requesting beta access. While Sendalo is in beta, you can request access at app.sendalo.de/beta. We process your name, email address and the details you provide voluntarily (company, website, message) in order to review the request and inform you when you are given access (Art. 6(1)(b) GDPR). We do not use this to send you advertising. We delete decided requests after 6 months and open ones after 12 months at the latest.

6. Appointment booking and video calls

To book a demo appointment, we process your name, email address, company, optionally your phone number and message, as well as the selected time slot. The purpose is to arrange and hold the conversation (Art. 6(1)(b) GDPR). You receive a confirmation by email. Video calls run on our own video server in the same data centre in Germany (Sendalo Meeting using the LiveKit software at rtc.sendalo.de or Jitsi Meet at meet.sendalo.de); when you join, technical connection data (IP address, device data, chosen display name) is processed only for the duration of the call. We delete the name from the waiting room after 2 days at the latest. Calls are not recorded. We delete booking data 12 months after the appointment unless a contract is concluded.

7. Chat assistant on sendalo.de and AI help in the application

Our website chat is an AI assistant and identifies itself as such; on request, a human from our team takes over. The chat is only loaded when you open it. It runs on our own server (app.sendalo.de) and stores a random visitor ID and your acknowledgement of the notice text in your browser’s local storage so that your conversation history can be assigned (§ 25(2) no. 2 TDDDG). We process your messages, any name you choose to provide and, if you book an appointment in the chat, the details from section 6.

Your input is transmitted to our AI provider in order to answer it: the contracting party is Anthropic Ireland, Limited (Dublin, Ireland); the data is also processed by Anthropic PBC (USA) as a sub-processor. Under its commercial terms, Anthropic does not use this data to train its models. The transfer to the USA is based on appropriate safeguards under Art. 46(2)(c) GDPR, namely the EU Standard Contractual Clauses (Modules 2 and 3) in Anthropic’s data processing agreement. The legal basis is Art. 6(1)(b) GDPR (enquiry about our offer) or point (f) (legitimate interest in answering quickly). Please do not enter any sensitive data in the chat. We delete chat histories 90 days after the last message unless they lead to a contract.

The AI help in the application and in the client portal answers questions about how to use it. For this, your question and the page you are on are transmitted to Anthropic (as above). For each question, we log the time, user ID and cost in order to enforce the daily limit (Art. 6(1)(b) and (f) GDPR).

8. Registration, customer account and use of the application

When you register, we process your company, name, email address and password (only as a secure hash), your confirmation that you are acting on behalf of a business, as well as the time, IP address and version of the accepted terms as proof that the contract was concluded. If you state an interest in a plan or add-on, we store it in order to give you relevant tips. If the email address is not confirmed within 7 days, we delete the registration automatically.

For your account we also process your role, settings, optionally a profile picture and two-factor login data (encrypted), as well as usage and log data (Art. 6(1)(b) and (f) GDPR). We log security-relevant events (e.g. logins, permission changes, publications, support access) and delete the entries after 2 years. To log you in, we use a technically necessary session cookie, and when connecting a channel, briefly another cookie to secure the login with the platform (§ 25(2) no. 2 TDDDG; overview in section 4a). We delete accounts on the Free plan that nobody has logged into for twelve months 30 days after announcing this by email.

Content that customers process in Sendalo – such as posts, comments and messages from third parties from social networks, chats, emails and calls, bookings made by their customers, link-in-bio pages and link clicks, or client portal data such as files, messages and records of electronic signatures (name, signature image, time, IP address) – is processed by us on behalf of the respective customer. In this respect, the customer is the controller; the basis is the Data Processing Agreement. If you have questions about this data, please contact the respective business first.

9. Connecting social networks

When you connect a profile, you log in directly with the respective network (Meta, TikTok, Google/YouTube, LinkedIn, Pinterest, Bluesky, X). In doing so, we receive an access token, which we store encrypted, and the data needed for publishing, analytics and replies. This also includes the profile’s most recent posts that were published directly on the network (text, link, preview and metrics), so that the feed and analytics show the whole profile. Profile pictures and preview images of connected channels and profile pictures of commenters are loaded in the application directly from the respective network’s servers; the network receives your IP address in the process. You can disconnect at any time in Sendalo or in the network’s settings. When you disconnect in Sendalo, we delete the access token, the assignment of scheduled posts, and retrieved comments and metrics for this profile; the posts themselves and chat histories remain with the customer until they or the customer are deleted. The networks’ own privacy notices apply to their processing.

Mentions & hashtags (social listening): If a customer has Sendalo monitor Instagram hashtags or RSS feeds (e.g. Google Alerts), Sendalo retrieves public posts or feed entries every hour and stores the text, link, date, metrics and – for feeds – the stated author in order to show them to the customer. Instagram does not provide usernames in this case. The results are deleted after 90 days (saved results when the source is removed); the legal basis is the customer’s legitimate interest in monitoring public statements about its brand (Art. 6(1)(f) GDPR).

For YouTube, Sendalo uses the YouTube API Services. The YouTube Terms of Service and the Google Privacy Policy also apply. You can revoke access at any time at myaccount.google.com/permissions. Sendalo’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

10. WhatsApp, direct messages, email inboxes and AI phone

If a customer connects an email inbox, Sendalo retrieves new emails via IMAP and sends replies via SMTP through the customer’s email provider; we store login details encrypted. Reply drafts may be generated by Anthropic; unless the customer configures otherwise, nothing is sent until a human has checked it. If a customer connects a WhatsApp number, messages are received and sent via the WhatsApp Business Platform of Meta Platforms Ireland Ltd.; Instagram and Facebook direct messages run through Meta’s interfaces. Meta may also process data in the USA (Meta Platforms, Inc. is certified under the EU-US Data Privacy Framework). If the AI assistant is switched on, it replies automatically, identifies itself as AI and hands over to a human on request.

If a customer uses the AI phone, calls are received via sipgate AI Flow of sipgate GmbH, Gladbacher Straße 74, 40219 Düsseldorf, Germany. sipgate provides the phone number and line and converts speech to text and back to speech (hosted in the EU according to sipgate; where sipgate uses sub-processors for this, they are covered in the data processing agreement with sipgate). The replies and a summary of the call are generated by Anthropic. We store the caller’s phone number, time, duration and the transcript. If the customer’s line forwards calls to this number (e.g. when nobody answers), the forwarding is carried out by the customer’s telephone provider. Callers are informed at the start that they are talking to an AI and that the call is being transcribed. This processing takes place on behalf of the respective customer.

11. Payment processing

Subscriptions and credit packs are processed via Stripe Payments Europe, Limited (Dublin, Ireland). Stripe processes payment, address and billing data as well as any VAT ID provided under its own responsibility, partly also in the USA (Stripe, Inc. is certified under the EU-US Data Privacy Framework; EU Standard Contractual Clauses also apply). We do not receive complete card or account numbers from Stripe. To ensure that each plan can only be tried for free once, we store the payment method fingerprint supplied by Stripe (an identifier, not the card number) until the account is deleted (Art. 6(1)(f) GDPR, protection against misuse). The legal basis for payment processing is Art. 6(1)(b) and (c) GDPR. We keep billing data for up to 10 years in accordance with commercial and tax law retention periods.

12. AI features in the application

For AI features (e.g. text suggestions, alt texts, reply suggestions, auto-replies, chat and phone assistant, reports), the content required in each case is transmitted to Anthropic. The information in section 7 applies. If a customer adds their own Claude API key, we transmit the content under that customer’s own contract with Anthropic. No decision based solely on automated processing within the meaning of Art. 22 GDPR takes place.

13. Sending emails

We send system emails such as confirmation and password links, invitations, booking confirmations, notifications and trial reminders via the mail servers of STRATO AG.

13a. Tips and offers by email

If you expressly agree when registering or later in the settings, we will send you tips on setting up Sendalo and offers on Sendalo plans and add-ons by email. Your consent only becomes effective once you confirm your email address via the confirmation link (double opt-in); we store the time, IP address and wording of the consent as proof. The legal basis is your consent (Art. 6(1)(a) GDPR, § 7(2) no. 2 UWG). You can withdraw it at any time with effect for the future – via the unsubscribe link in every email or in the settings.

For all accounts, we record which plan limits an account reaches and which locked features are opened (type of event and date, no content). This serves to develop our offer and to keep an overview of usage (Art. 6(1)(f) GDPR). We only use this information for promotional emails if you have consented. We delete the event data after 90 days.

14. Retention period

We delete data as soon as the purpose no longer applies and no statutory retention obligations exist; the periods for individual processing operations are stated in the sections above. We automatically delete files in the client portal after the period set by the customer (default 90 days), except contracts, invoices and signatures. If a paid subscription ends, the account remains on the Free plan with all its data. Customers can export their data at any time; if a customer deletes their account, the data is deleted immediately and backups after 30 days at the latest. How to have data from connected platforms (e.g. Facebook, Instagram, WhatsApp) deleted is explained under Data deletion.

15. Your rights

You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20 GDPR). You can withdraw consent you have given at any time with effect for the future (Art. 7(3) GDPR) – for statistics and marketing via “Cookie settings” (section 4a); this does not affect the lawfulness of processing carried out before the withdrawal. You can lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), for example the authority responsible for us, the State Commissioner for Data Protection and for the Right of Access to Files of Brandenburg (LDA Brandenburg), Stahnsdorfer Damm 77, 14532 Kleinmachnow, Germany.

Right to object (Art. 21 GDPR): Where we process data on the basis of legitimate interests (Art. 6(1)(f) GDPR), you can object at any time on grounds relating to your particular situation. We will then no longer process the data unless we can demonstrate compelling legitimate grounds that override your interests, or the processing serves to establish, exercise or defend legal claims. You can object to the use of your data for direct marketing at any time without giving reasons. An informal message to datenschutz@sendalo.de is sufficient.