Privacy Policy

General Information

Data Controller

The controller within the meaning of the GDPR and other national data protection laws of the member states as well as other data protection provisions is:

Justaddsugar GmbH

Data Protection Officer (external):
Nelly Born
Tel.: 030 467 240 6-55
Email: n.born@pagestreet.de

Website: www.sugarlens.de

Legal Bases for Processing Personal Data

We process some of your personal data on the basis of the following legal bases:

Consent of the data subject

Where we obtain the consent of the data subject for specific purposes, Art. 6(1)(a) GDPR is the legal basis.

Performance of contractual obligations

Where processing is necessary for the performance of a contract to which you are a party, Art. 6(1)(b) GDPR is the legal basis. This also applies to processing operations necessary for carrying out pre-contractual measures.

Legal requirements and obligations

Where processing is necessary to comply with a legal obligation, Art. 6(1)(c) GDPR is the legal basis.

Protection of legitimate interests

Where processing is necessary to protect our legitimate interests or those of a third party, and your interests, fundamental rights and freedoms do not override the former interest, Art. 6(1)(f) GDPR is the legal basis.

Storage Period and Deletion of Personal Data

Personal data is deleted or blocked as soon as no purpose continues to provide a legal basis for the processing.

Recipients of Personal Data

Internally, only those departments process personal data that need it to fulfil their processing purposes. This also applies to the processors, service providers and vicarious agents engaged by us. All bodies and persons working with personal data are obliged to maintain data secrecy and have been instructed to handle such data sensitively.

Personal data is only disclosed to third parties where this is in compliance with data protection regulations. In particular, persons engaged to conduct our business operations (e.g. banks, tax advisors, providers of EDP and IT services) as well as state bodies/authorities may receive your personal data where this is necessary to fulfil a legal obligation.

Data Processing in Third Countries

Our services may require the processing of personal data in countries outside the EU/EEA (“third countries”) by our processors. Where personal data is processed and no level of data protection corresponding to the European standard exists in the country — as confirmed by an adequacy decision of the EU Commission pursuant to Art. 45(3) GDPR — we have concluded EU Standard Contractual Clauses with the relevant processors in order to establish appropriate safeguards within the meaning of Art. 46 GDPR. A copy of the EU Standard Contractual Clauses can be found here. Where third-country processing takes place, we indicate this below.

Data Subject Rights

If your personal data is processed, you are a data subject within the meaning of the GDPR and you have the following rights vis-à-vis us as the controller:

Right of access

Pursuant to Art. 15 GDPR you have the right to request information about the personal data we process. In particular, you may request information about:

• the purposes of processing,
• the category of data,
• the categories of recipients to whom your data has been or will be disclosed, as well as information on whether the personal data is transferred to a third country or to an international organisation (in this context you may request to be informed of the appropriate safeguards pursuant to Art. 46 GDPR),
• the planned storage period,
• the existence of a right to rectification, erasure, restriction of processing or objection,
• the existence of a right to lodge a complaint, and the origin of your data where it was not collected by us,
• as well as the existence of automated decision-making including profiling pursuant to Art. 22(1) and (4) GDPR and — at least in these cases — meaningful information about the logic involved as well as the scope and intended effects of such processing for the data subject.

Right to rectification

Pursuant to Art. 16 GDPR you have the right to the rectification and/or completion of your personal data where it is inaccurate or incomplete. We must carry out the rectification without undue delay.

Right to restriction of processing

Pursuant to Art. 18 GDPR you have the right to request the restriction of the processing of your data, in particular where you contest the accuracy of the data or the processing is unlawful. Where processing has been restricted, you will be informed by us before the restriction is lifted.

Right to erasure

Pursuant to Art. 17 GDPR you have the right to the erasure of your personal data, unless processing is necessary for exercising the right of freedom of expression and information, for compliance with a legal obligation, for reasons of public interest, or for the establishment, exercise or defence of legal claims.

Right to notification

If you have asserted the right to rectification, erasure or restriction of processing against us, we are obliged to notify all recipients to whom the personal data was disclosed of the rectification, erasure of the personal data or restriction of processing, unless this proves impossible or involves disproportionate effort.

Right to data portability

Pursuant to Art. 20 GDPR you have the right to receive the personal data you have provided to us in a structured, commonly used and machine-readable format, or to request its transmission to another controller.

Right to object

Pursuant to Art. 21 GDPR you have the right to object to the processing where the processing is based on Art. 6(1)(e) or (f) GDPR.

Right to withdraw the data protection consent declaration

Pursuant to Art. 7(3) GDPR you have the right to withdraw your data protection consent declaration at any time. The withdrawal of consent does not affect the lawfulness of the processing carried out on the basis of the consent up to the withdrawal.

Right to lodge a complaint with a supervisory authority

Pursuant to Art. 77 GDPR you have the right to lodge a complaint with a data protection supervisory authority about our processing of your personal data.

Supplementary Information on Data Processing When Visiting Our Website

We are responsible for our website www.sugarlens.de and its sub-pages (the “website”). Personal data is processed through the use of our website. Below we provide detailed information about the processing that takes place.

Provision of the Website and Creation of Log Files

When our website is accessed, we automatically collect data and information from the user’s device (so-called log files).

Information & duration of processing

The following information is processed when the website is visited:

• information about the browser type and version used
• the operating system of the device
• referrer URL
• date and time of the server request
• IP address (anonymised after 24 h)
• website visited
• amount of data in bytes
• access log files
• error log files

The log files are deleted within two days at the latest.

Purpose of processing & legal basis

The data is required to display the website on the user’s device, to ensure its functionality, and to analyse any malfunctions. The data also serves to optimise the website and to ensure the security of our information technology systems.

The legal basis is Art. 6(1)(f) GDPR. The collection of log files is strictly necessary for the operation of the website. There is consequently no option for the user to object.

Processor

To provide our website we use the service of Alfahosting GmbH, Edmund-von-Lippmann-Straße 13–15, 06112 Halle (Saale), Germany, with whom we have concluded a data processing agreement and who processes the personal data exclusively on our behalf.

Cookies and Local Storage

Cookies

We only set cookies on our website if you have consented to the “Analytics” category via the consent banner (see “Optional services”). Without that consent no cookies are set.

Local storage

To provide the website we use exclusively technically necessary information in the local storage of your browser: login and session data (only in the logged-in area), language setting, interface settings, and your consent decision. This information is strictly necessary for the operation of the website and is stored without consent pursuant to Sec. 25(2)(2) TDDDG. Any processing of personal data is based on Art. 6(1)(f) GDPR. The duration of storage depends on when you delete the data stored in local storage.

Optional services

Via our consent banner you can agree to optional services. You can withdraw your consent at any time via “Cookie settings” in the footer.

Google Analytics 4

With your consent we use the web analytics service Google Analytics 4 of Google Ireland Ltd., Gordon House, Barrow Street, D04 Dublin E5W5, Ireland, on the public website (landing page and Resources). Google Analytics sets cookies and processes your truncated IP address, device and browser information, the pages visited and interactions on the page so that we can evaluate the use of the website in aggregated form. The service is only loaded after you have consented to the “Analytics” category; without consent no processing takes place. The legal basis is your consent pursuant to Art. 6(1)(a) GDPR and Sec. 25(1) TDDDG. Google may transfer the data to the USA; Google LLC is certified under the EU-US Data Privacy Framework, and in addition we have concluded the EU Standard Contractual Clauses with Google. The data is deleted after 14 months. Further information: policies.google.com/privacy. The logged-in area of sugarLENS is not measured with Google Analytics.

Demo Request Form

When you request a demo via our form, we process your name, your email address, your company name, and an optional message exclusively to handle your request. The legal basis is your consent pursuant to Art. 6(1)(a) GDPR. The data is deleted as soon as your request has been conclusively handled.

Supplementary Information on the Use of Our sugarLENS Platform

The following information applies to the processing of personal data when using the sugarLENS platform.

Data Processing During Registration

When registering on our platform, the following personal data is processed:

• Name
• Email address

Data Processing When Using the Platform

When using the customer portal, the following data may be processed:

• Name
• Email address
• User ID
• Usage metadata (timestamps, session data, requests)
• Asset metadata and creator data
• Profile data you enter yourself (display name, team, avatar) and, if you use it, your own personal dashboard configuration (“MySpace”)

Data From Connected Advertising and Social Media Accounts

The platform retrieves data from the advertising and social media accounts that our customers connect to it, via the official interfaces of the respective platforms (Meta, Google/YouTube, TikTok, Snapchat, Reddit and, once approved, LinkedIn). This comprises:

• Advertising performance data: names and IDs of campaigns, ad sets and ads, status and objective, daily performance figures (spend, impressions, reach, clicks, video views, conversions and their value) and aggregated audience breakdowns by country or region, age group and gender. We do not receive or store any data about individual end users from the advertising accounts.
• Organic performance data: page and account level statistics, performance data of individual posts and videos, follower counts and aggregated audience information of the customer’s own Facebook pages, Instagram accounts and TikTok accounts.
• Comments on the customer’s content (“Community”): public comments left under the customer’s ads and organic posts, including the comment text and its time stamp. The commenter’s name and account are not stored; to recognise the customer’s own replies, the commenter’s identifier is only compared at retrieval and not stored. We use AI to classify the sentiment of these comments in aggregated form and, where the customer has enabled it, allow authorised users to reply to, hide or moderate comments through the platform interface. Comments are processed on behalf of the customer as the operator of the respective page or account; the legal basis for our processing is the data processing agreement with the customer. Commenters may exercise their data subject rights against the customer or against us; we forward requests to the customer.
• Creatives: preview images of the advertising creatives; during AI supported analysis a video may temporarily be processed as a file.

Access is read only, except for the comment moderation actions described above, which an authorised user of the customer triggers deliberately. Connected accounts can be disconnected by the customer at any time in the respective platform, after which no further data is retrieved.

Competitor Intelligence and Market Data

For the “Competitor Intel” and “Market Pulse” functions we retrieve publicly available information about accounts and advertisers that a customer names as competitors: public profile statistics and public posts of Instagram business accounts and YouTube channels, ads published in public ad libraries (TikTok Commercial Content Library), search interest data (Google Trends) and, for the weekly market read, web search results retrieved through Google’s grounding service. Only public business information is processed; we do not create profiles of individual persons. The legal basis is our and our customers’ legitimate interest in market observation pursuant to Art. 6(1)(f) GDPR. Where a public account belongs to a natural person, that person may object to the processing at any time.

Optional Connections You Establish Yourself

• Google Drive: if you connect your Google account, sugarChat can read the documents you link (read only scope). We store the technical authorisation on the server; you can revoke it at any time in the platform or in your Google account. The legal basis is your consent pursuant to Art. 6(1)(a) GDPR.
• Slack notifications: if your organisation uses Slack with us, alerts and weekly reports can be delivered to a Slack channel or as a direct message. For direct messages we look up your Slack user via your email address. The legal basis is the performance of the contract, Art. 6(1)(b) GDPR.
• MCP connector: you can connect sugarLENS to external AI assistants (for example Claude) via the Model Context Protocol. For this you create a personal access token or authorise the assistant via OAuth. The token is stored in hashed form, is time limited and can be revoked at any time in the platform. Queries the assistant makes on your behalf are processed like your own requests and are subject to the same access restrictions; the content of your conversation with the external assistant is processed by its provider under that provider’s privacy terms.
• Voice input: dictation in sugarChat uses the speech recognition built into your browser. No audio leaves your device to us.

Usage Analytics in the Platform

To understand which functions are used and to ensure the reliability of the platform, we record usage events of logged in users (page and function opened, time stamp, user ID). Raw events are deleted after 13 months; afterwards only daily aggregates per user and function remain. The legal basis is our legitimate interest in the operation and further development of the platform pursuant to Art. 6(1)(f) GDPR. Technical errors are logged with the affected request and user ID for fault analysis. The platform does not use Google Analytics or any other third party analytics service.

Country Map Flags

The country map in the platform loads small flag images from the content delivery network flagcdn.com (Flagpedia). When these images are loaded, your IP address is transmitted to the operator of that network. The legal basis is our legitimate interest in a functional and comprehensible presentation pursuant to Art. 6(1)(f) GDPR.

Demo Access

Prospective customers may receive a time limited demo access. For this we process your name, email address and company for the duration of the demo; the access expires automatically. The legal basis is the initiation of a contract pursuant to Art. 6(1)(b) GDPR.

AI Assistant (“sugarChat”)

When using sugarChat, the following data is processed and stored:

• Chat history: your inputs (messages/prompts) and the assistant’s responses are stored in order to continue the conversation and to make your chat history available to you.
• Document uploads: files you upload (e.g. PDF, DOCX, PPTX, TXT, CSV, JSON, MD), the text extracted from them, and any generated summaries are stored so that the assistant can respond on the basis of the content.
• Context/notes: notes about your preferences saved by the assistant, as well as shared team knowledge.
• Saved skills: question templates you save for reuse.
• Feedback and briefs: feedback you give on creatives and brand briefs you enter are stored and used to ground the AI analysis for that brand.

This content is assigned exclusively to you or to authorised users and is protected by access restrictions (row-level security). Within the platform, nobody, including administrators, can view other users’ conversations. Chat histories and uploaded documents are stored until you delete the respective conversation or file, or until your user account is terminated.

Access by JUSTADDSUGAR. Technically, the people who operate the database can view stored content. We restrict this access as follows:

• A small group of authorised people: Only a few named administrators of Justaddsugar GmbH have direct access to the database and the server credentials. These permissions are reviewed regularly and withdrawn as soon as they are no longer needed.
• Only for defined purposes: An individual conversation is opened only (a) when you or your organisation report a problem with an answer to us and the conversation is needed to analyse it (Art. 6(1)(b) GDPR), (b) to investigate a security incident or misuse (Art. 6(1)(f) GDPR), or (c) where we are legally obliged to do so (Art. 6(1)(c) GDPR). Conversations are not routinely read, evaluated or used to train AI models.
• Documented: Every such access is documented with the date, the reason, the conversation concerned and the person accessing it, and is limited to what the purpose requires.

Purposes, Legal Basis and Duration of Processing

The data is processed for the proper performance of the contract in order to provide and use the platform. The legal basis is Art. 6(1)(b) GDPR. The data is deleted upon termination of the contractual relationship, insofar as no other purposes for its processing remain.

Backup copy. In addition to the infrastructure provider’s daily backups, a nightly copy of the non refetchable platform data (for example feedback, briefs, chat content and account settings, without password hashes) is written to a second database operated by us in the EU. The copy is overwritten every night, so deleted data leaves the copy in the following cycle.

Processors

To provide the platform we use the services of the following processors, with each of whom we have concluded a data processing agreement:

• Database, authentication and file storage: Supabase (Supabase Inc.); data held in the EU (Frankfurt am Main region). As Supabase is based in the USA, we have concluded the EU Standard Contractual Clauses with them.
• Application hosting and runtime environment (backend): Railway (Railway Corp.); hosting in the EU (EU-West region, Amsterdam, Netherlands). As Railway is based in the USA, an adequacy decision of the EU Commission applies to this company, which is certified under the Data Privacy Framework.
• Hosting of the web interface (frontend): Vercel (Vercel Inc.); delivery via data centres in the EU (Frankfurt am Main and Stockholm). As Vercel is based in the USA, an adequacy decision of the EU Commission applies to this company, which is certified under the Data Privacy Framework.
• AI application (analysis of creatives and creators, sentiment classification of comments, competitor and market reads, the integrated assistant “sugarChat”, generation of text embeddings for semantic search): Google Vertex AI / Gemini, Google Ireland Ltd., Gordon House, Barrow Street, D04 Dublin E5W5, Ireland; configured for the EU (Europe-West4 region or EU multi-region). If the European configuration is unavailable, a similar provider may be used as a substitute. This provider is also hosted in the EU.
• Notifications: Slack Technologies Limited, Salesforce Tower, 60 R801, North Dock, Dublin, Ireland, for alerts and reports delivered to Slack. Slack may process data in the USA; Salesforce is certified under the EU-US Data Privacy Framework and we have in addition concluded the EU Standard Contractual Clauses.

The advertising and social media platforms (Meta Platforms Ireland Ltd., Google Ireland Ltd., TikTok Technology Ltd., Snap Inc., Reddit Inc., LinkedIn Ireland Unlimited Company) are not our processors. They provide data via their interfaces on the basis of the authorisation granted by the customer and process it under their own privacy terms.

Supplementary Information on Communication With Us

The following information applies to any communication with us. Where the communication takes place within a contractual relationship or another contractual connection, the data processing is also governed by the supplementary information under 5.

Telephone

You can contact us by telephone.

Information processed & duration of processing

In addition to your telephone number, we process the personal data that you provide to us during the call. The data is deleted — unless there is another reason for the processing — as soon as the matter has been resolved with you.

Purpose of processing & legal basis

The personal data is processed by us exclusively for the purpose of handling the enquiry and in case of follow-up questions. Where the communication is aimed at concluding a contract, the legal basis for the processing is Art. 6(1)(b) GDPR. In all other cases, Art. 6(1)(f) GDPR is the legal basis. Your interest does not override our interest in responding to your enquiry; since you are contacting us, a response is also in your interest and you are aware that we must process your personal data in order to respond to your enquiry.

Email

You can contact us via email. We would like to point out that there are possibilities for third parties to gain insight into email communication. If it is important to you that the information you provide is not exposed to the risk of unlawful third-party access, we therefore recommend another means of communication. However, if you contact us via email, we assume that the further exchange via this communication channel is also in your interest.

Processor

As an email service provider we use the service “Google Workspace” of Google Ireland Ltd., Gordon House, Barrow Street, D04 Dublin E5W5, Ireland, as our processor, with whom we have concluded a data processing agreement.

Information processed & duration of processing

In addition to your email address, we process the personal data that you make available to us within the email communication. The data is deleted — unless there is another reason for the processing — as soon as the matter has been resolved with you.

Purpose of processing & legal basis

The personal data is processed by us exclusively for the purpose of handling the enquiry and in case of follow-up questions. Where the communication is aimed at concluding a contract, the legal basis for the processing is Art. 6(1)(b) GDPR. In all other cases, Art. 6(1)(f) GDPR is the legal basis. Your interest does not override our interest in responding to your enquiry; since you are contacting us, a response is also in your interest and you are aware that we must process your personal data in order to respond to your enquiry.

Video Telephony

We also use video telephony for communication.

Processor

To carry out video telephony we use the service “Google Meet” of Google Ireland Ltd., Gordon House, Barrow Street, D04 Dublin E5W5, Ireland, with whom we have concluded a data processing agreement. The processor may process personal data in the USA in order to ensure smooth video telephony. The processor has therefore concluded the EU Standard Contractual Clauses with its sub-processors in order to establish appropriate safeguards within the meaning of Art. 46 GDPR.

Information processed & duration of processing

During video telephony the following communication data is processed:

• master personal data (if you provide it of your own accord)
• contents of the online meeting (if you appear in a personally identifiable manner with contributions in spoken and/or written form)
• authentication data
• log files, protocol data
• metadata (e.g. IP address, time of participation, etc.)
• profile data (e.g. your username, if you provide it of your own accord)

The personal data is deleted as soon as the matter has been resolved with you and provided there is no other reason for the processing.

Purpose of processing & legal basis

The personal data is processed by us exclusively for the purpose of handling the enquiry and in case of follow-up questions. Where the communication is aimed at concluding a contract, the legal basis for the processing is Art. 6(1)(b) GDPR. In all other cases, Art. 6(1)(f) GDPR is the legal basis. Your interest does not override our interest in responding to your enquiry; since you are contacting us, a response is also in your interest and you are aware that we must process your personal data in order to respond to your enquiry.

Supplementary Information for Contractual Partners (incl. Creators)

In addition, the following information applies to you where we are in a contractual relationship with one another (incl. creators).

Information Processed & Duration of Processing

Which data is processed in detail depends on the tasks within the contractual relationship. We use the personal information exclusively for the purpose for which it was provided to us. This includes, for example, personal particulars (name, address and other contact details, date and place of birth). In addition, this may also include order data (e.g. payment order), data from the performance of our contractual obligations (e.g. turnover data in payment transactions), information about your financial situation (e.g. creditworthiness data), advertising and sales data, as well as other data comparable to the categories mentioned.

If you are a creator, we process your performance data on the booked services for the purpose of analysis and statistics.

The personal data is deleted as soon as the contractual relationship with you has ended and provided there is no other reason for the processing.

Purpose, Legal Basis and Duration of Processing

The processing is carried out predominantly for the purpose of establishing and performing the contractual relationship; the legal basis is Art. 6(1)(b) GDPR.

In addition, we also process your data in part on the basis of our overriding legitimate interest, namely for the purpose of contact and communication management, profitability controls, contract and project management, and to ensure the operation of information and telecommunications systems. The legal basis is Art. 6(1)(f) GDPR.

Furthermore, as a company we are bound by various legal obligations that must be complied with on the basis of applicable laws and regulations. The legal basis for processing to comply with legal requirements and obligations is Art. 6(1)(c) GDPR. These include, among other things, tax retention obligations.

Recipients

If you are active for us as a creator, we forward your data — including the analysis of performance data on the booked services — to the respective advertising client for the purpose of performing the contract.

Processors

If you are active for us as a creator, your performance data on the booked services is processed via the Vertex service of Google Ireland Ltd., Gordon House, Barrow Street, D04 Dublin E5W5, Ireland, with whom we have concluded a data processing agreement.

— End of the data protection information —