Privacy Policy

1. Data Controller

The data controller responsible for processing on this website is:

2. Data We Collect

2.1 When You Visit Our Website

When you visit our website, we automatically collect the following data that your browser transmits to our server:

• IP address
• Date and time of request
• Browser type and version
• Operating system
• Referrer URL (previous page)
• Requested page

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in technical provision and security of the website).

2.2 Lead Form (Project Inquiry)

When you use our inquiry form, we collect the following data to match you with suitable providers:

Legal basis: Art. 6(1)(a) GDPR (consent) for sharing with providers; Art. 6(1)(b) GDPR (pre-contractual measures) for processing your inquiry.

2.3 Agency/Partner Registration

When registering as a provider, we collect: Company name, email, password (stored encrypted), website, city, description, offered services, and industry expertise.

Legal basis: Art. 6(1)(b) GDPR (contract performance).

2.4 Affiliate Application (Partner Program)

When applying for our affiliate partner program, we collect: name, email address, website/main channel (optional), reach/audience size (optional), and your promotion plan. This data is used exclusively for reviewing and managing your affiliate partnership.

As part of affiliate tracking, the following data is processed server-side when clicking an affiliate link: IP address (stored anonymized), user agent, referrer URL, and timestamp. This data is used for fraud prevention and correct commission attribution.

Legal basis: Art. 6(1)(b) GDPR (pre-contractual measures/contract performance) for application data; Art. 6(1)(a) GDPR (consent) for the affiliate tracking cookie.

Retention: Application data is deleted 6 months after rejection. Affiliate data of active partners is retained for the duration of the partnership and 12 months thereafter. Click data is automatically anonymized after 90 days.

3. Double Opt-In Process

We use a double opt-in process for all project inquiries. After submitting the form, you will receive a confirmation email with a link. Only after clicking this link (within 48 hours) will your inquiry be forwarded to matching providers. Unconfirmed inquiries are automatically deleted.

4. Data Sharing

4.1 Lead Sharing with Providers

After your explicit consent (double opt-in), your contact data will be shared with up to 3 matching, verified AI service providers that meet your criteria.

What we share:

• Your name and contact details
• Your project requirements
• Your budget and timeline

What we do NOT share:

• Your data with unrelated third parties
• Your data for advertising purposes
• Your data without your explicit consent

4.2 Service Providers (Processors)

We use carefully selected service providers to operate our platform:

All providers are contractually bound to process data only on our instructions and maintain appropriate security measures.

5. International Data Transfers

As we are a US-based LLC and use US-based services, your data is processed in the United States. We ensure the protection of your data through the following measures:

• EU-US Data Privacy Framework: Use of DPF-certified providers where possible
• Standard Contractual Clauses (SCCs): EU-approved contractual clauses with all processors
• Additional Safeguards: Encryption, access controls, and regular security audits

6. Your Rights

6.1 GDPR Rights (for all users)

You have the following rights:

• Access (Art. 15 DSGVO): Learn what data we store about you
• Rectification (Art. 16 DSGVO): Have inaccurate data corrected
• Erasure (Art. 17 DSGVO): Request deletion of your data
• Restriction (Art. 18 DSGVO): Restrict processing of your data
• Data Portability (Art. 20 DSGVO): Receive your data in a machine-readable format
• Objection (Art. 21 DSGVO): Object to certain processing activities (see highlighted notice below)
• Withdrawal (Art. 7 Abs. 3 DSGVO): Withdraw given consent at any time
• Complaint (Art. 77 DSGVO): Lodge a complaint with a supervisory authority

Right to Object — Art. 21 GDPR

You have the right, on grounds relating to your particular situation, to object at any time to the processing of personal data concerning you that is based on Art. 6(1)(e) or (f) GDPR. This also applies to profiling based on these provisions. After you object, we will no longer process the data concerned, unless we can demonstrate compelling legitimate grounds for processing which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims.

You may exercise your right to object informally by email to [email protected]. For entries in our agency directory, see also Section 10.

6.2 CCPA Rights (California Residents)

6.3 Exercising Your Rights

To exercise your rights, contact us at: [email protected]

We will process your request within 30 days. To verify your identity, we may ask you to confirm your email address.

Deletion requests for partners: Request profile deletion

7. Cookies

We use cookies on our website. Details about the cookies we use:

7.1 Analytics Cookies (Google Analytics 4)

With your consent, we use Google Analytics 4 (Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA) for anonymized analysis of website usage. Measurement ID: G-TZ8TCN1G6W. The cookies _ga and _ga_* are set. IP addresses are anonymized before transmission (IP anonymization enabled). Data is transferred to Google servers in the USA; the legal basis for this transfer are Standard Contractual Clauses (SCCs) pursuant to Art. 46 GDPR. A data processing agreement pursuant to Art. 28 GDPR has been concluded with Google. Data is retained for 14 months and then automatically deleted.

Legal basis: Art. 6(1)(a) GDPR (consent) in conjunction with § 25(1) TDDDG. Google Analytics is only loaded after your explicit consent via the cookie banner. Without consent, no data is transferred to Google (Consent Mode v2).

Objection: You may withdraw your consent at any time via the cookie settings at the bottom of this page. Alternatively, you can install the Google Analytics Opt-Out Browser Add-on. For more information: Google Privacy Policy.

7.2 Affiliate Tracking Cookie (tap_ref)

When you arrive on our website through a referral link from one of our affiliate partners (URL format: /ref/CODE), a cookie named tap_ref is set. This cookie stores only the affiliate partner's code — it does not contain personal data and does not perform cross-site tracking.

Legal basis: Art. 6(1)(a) GDPR (consent) in conjunction with § 25(1) TDDDG. The cookie is only set with your consent. You may withdraw consent at any time via the cookie settings.

Objection: You can delete this cookie at any time in your browser settings. If you reject marketing cookies in the cookie banner, tap_ref will not be set. Registration is also possible without affiliate attribution.

8. Security

We implement technical and organizational measures to protect your data:

• HTTPS: All data transfers are SSL/TLS encrypted
• Password Hashing: Passwords are stored hashed with bcrypt
• Rate Limiting: Protection against brute-force and spam attacks
• Captcha: Cloudflare Turnstile for bot protection
• Access Controls: Role-based access control for all systems
• Security Headers: HSTS, X-Frame-Options, X-Content-Type-Options, CSP

9. Data Retention

10. Listing Database / Agency Directory (Art. 14 GDPR)

Trusted AI Partners operates a publicly accessible directory of AI service providers, agencies, and freelancers (the „Listing“). For this directory we also process data of companies and sole proprietors who have NOT provided this data to us directly. In accordance with Art. 14 GDPR, we inform you as follows:

10.1 Purpose of Processing

Operating a cross-industry directory of available AI service providers, to offer inquirers a structured pre-selection and comparison option.

10.2 Legal Basis

Art. 6(1)(f) GDPR (legitimate interest in informing the public about AI service providers available on the market, and our economic interest in operating the platform). For sole proprietors and freelancers, the public interest in information and the professional social sphere typically outweigh the interest in non-publication, unless you object.

10.3 Data Categories

Company name, legal form, business address, public contact data (email, phone, website), name of authorised representatives (insofar as visible from public sources), services/categories offered, industries, city/region, and where applicable publicly available self-description and logo.

10.4 Data Sources

Publicly available sources — in particular legal notices and privacy policies of agency websites, public business registers (commercial register, partnership register), public industry directories, public social media profiles, and information provided by the agency itself upon inclusion in the directory.

10.5 Retention Period

Until you object (Art. 21 GDPR) or file a deletion request (Art. 17 GDPR). After your objection/request, the entry will be removed within 30 days; where applicable a suppression list (email hash, company name) will be maintained for a maximum of 3 years to prevent accidental re-inclusion.

10.6 Your Rights

Right to Object — Art. 21 GDPR

You have the right, on grounds relating to your particular situation, to object at any time to the processing of your personal data in the context of this directory (Art. 21 GDPR). After your objection, we will no longer process your data, unless we can demonstrate compelling legitimate grounds that override your interests.

To exercise your rights, you have the following options:

• Claim/correct the listing: via an individual claim link sent to the email address listed in your company’s legal notice. From there, you can correct data and take over management of your profile.
• Request deletion: Profile deletion — processed within 72 hours, removed from the live directory within 30 days.
• Objection or access request: informally by email to [email protected].

10.7 Information Duty pursuant to Art. 14(3) GDPR

When we include your company in the directory, we will inform you accordingly no later than one month after inclusion, or at the time of our first contact (listing verification email) — simultaneously with the claim link.

11. Children

Our service is intended for businesses and is not directed at individuals under 16 years of age. We do not knowingly collect data from children. If you believe we have received data from a child, please contact us immediately.

12. Changes to This Policy

We may update this privacy policy from time to time. For significant changes, we will notify you by email or by posting a notice on our website. The date of the last update can be found at the beginning of this document.

13. Contact

For questions about privacy, you can reach us at:

13.1 Supervisory Authority (EU)

If you are located in the EU, you may contact the data protection authority in your country of residence. A list of supervisory authorities can be found at: edpb.europa.eu