Privacy
1. Controller
Avolang Vermittlung UG (haftungsbeschränkt)Pacelliallee 514195 Berlininfo@avolang.de+49 157 83777722Managing director: Zino Lang
2. Website and restricted pilot
This notice covers the public ALWISR website and its access-restricted pilot. Authorised users may sign in and use enabled connections. Meta review uses a separate workspace with dedicated test accounts. Features not released for customers are unavailable. The public TikTok demonstration runs locally and is not an active TikTok connection.
3. Hosting and recipients
We host the website and pilot with IONOS Cloud GmbH, Elgendorfer Str. 57, 56410 Montabaur, Germany, in the Germany/Berlin data centre. The ALWISR server has been matched to our Cloud contract. The current IONOS Cloud subprocessor list dated October 2026 names IONOS SE for technical support and Cloud/data-centre operations. IONOS provides infrastructure; we configure application access and deletion. Connecting Microsoft and Meta requires exchanging data with those providers. We do not claim that no data leaves Germany when these integrations are used.
4. Website, logs and local preferences
Delivery of the website requires technical processing including IP address, time, requested address and browser information. The public web server does not maintain its own visitor access log. Application operational/error logs may contain time, function path, error code and request identifier. Credentials, passwords and OAuth codes are protected by redaction filters. Container logs are limited to two 5 MB files per service and overwritten on rotation; this is not a fixed deletion period in days. The website has no advertising trackers. The selected colour scheme is stored locally as alw-theme.
5. Sign-in
Microsoft authenticates pilot users. ALWISR receives identity attributes such as account identifier and display name, together with required sign-in tokens. It does not store the Microsoft password. Necessary protected session cookies and sign-in/form security values support the requested service and its security. Workspace membership and permissions are verified on the server.
6. Facebook and Instagram
Following an explicitly authorised Meta sign-in, ALWISR processes authorised account/Page identifiers and names, linked professional Instagram accounts and encrypted access tokens. Workspace selection limits usable resources. On request, posts, comments and available post metrics are retrieved from Meta and displayed. This Meta pilot does not persistently collect these read results for AI training or external AI analysis.
7. Publishing
Enabled pilot users may prepare text, a destination and an uploaded image. Drafts, approvals, expiry and publishing receipts are processed; drafts and images are encrypted at rest. Content is sent to Meta only after a preview, explicit approval and a separate publication action. Meta temporarily fetches an image using a hard-to-guess, expiring URL. Published content is processed by Meta under its own terms. This pilot does not automatically reply to comments or train AI on Meta data.
8. Meta pilot retention
Meta connection flows expire after ten minutes. Uploaded images and their retrieval URLs expire after 24 hours. Cleanup runs every ten minutes and removes expired flows/images as well as publication drafts, approvals and their stored content 30 days after creation. Small replay-prevention receipts are removed after 90 days; for receipts already present on 27 October 2026, this period starts when the timestamp was introduced. Erased or expired publication jobs cannot be executed again. Disconnect removes access without immediately removing all receipts; confirmed local data erasure removes them earlier. A daily encrypted pilot database backup is verified in a completely isolated restore database. Backups are retained for seven days and pruned during the daily run. They are not available to normal application access. Any restored copy remains quarantined; Meta connections and content are removed before possible reuse and require fresh authorisation, preventing deleted Meta data from being silently reactivated. Outages may delay physical cleanup. The pilot backup currently resides on the same server; a separate failure-domain backup for customer operation is not yet verified.
9. Ending access and deletion
Socials → Konten → Meine Meta-Daten löschen opens a separate confirmation. Confirming permanently removes this workspace’s Meta connection, drafts, approvals, uploads and publication receipts. Existing Meta posts remain and must be deleted at Meta. Access can also be removed in Meta account settings. Provider-wide revocation can affect several ALWISR workspaces belonging to the same Meta user, so it is blocked for the isolated reviewer; workspace-local deletion remains available. Send data/deletion requests to info@avolang.de.
10. Roles and legal bases
We are controller for service security, sign-in and our own contact enquiries. Processing supports requested service delivery and contractual purposes under Article 6(1)(b) GDPR where applicable, and legitimate interests in security and abuse prevention under Article 6(1)(f). When processing a company’s content on its instructions, that company determines the legal basis and we act under an Article 28 agreement. OAuth authorisation is a technical access permission, not a substitute for assessing the legal basis.
11. External services and international processing
Microsoft and Meta process sign-in and platform data under the agreements and privacy notices applicable to the account. Processing outside Germany and the EEA may occur. The applicable services and transfer mechanisms, such as adequacy decisions or standard contractual clauses, must be assessed. The application’s automated Meta runtime does not forward retrieved content to external AI providers. Separately, AI-assisted tools used for development and review preparation may process selected test views. This is therefore not a guarantee that all development and support processing takes place exclusively in Germany; the complete service-provider assessment will be concluded before customer release. Other connections or AI functions require their own release and description.
12. Your rights
You may request access, rectification, erasure, restriction and portability under Articles 15–20 GDPR, and object to legitimate-interest processing under Article 21. Consent may be withdrawn prospectively. Applicable statutory exceptions and retention duties remain relevant. When acting as processor, we assist the responsible company. Contact enquiries are kept for their handling and any applicable statutory duties.
13. Complaints and changes
You may complain to a supervisory authority, including the Berlin Commissioner for Data Protection and Freedom of Information, Alt-Moabit 59–61, 10555 Berlin, Germany. We update this notice to reflect actual operation. Updated: 29 October 2026.
14. LinkedIn company Pages in the pilot
After confirmed LinkedIn authorization, ALWISR stores the member identifier, display name, expiry time and encrypted access token, bound to the user and workspace. Personal profile and Community connections remain separate. On request, the Community connector reads administered Pages, posts, comments and organic statistics and displays them in ALWISR. It does not permanently collect these query results or use them for AI training, advertising or sales profiling, and does not send them to external AI providers. The current Community pilot cannot publish or modify LinkedIn content. The separate LinkedIn reviewer workspace inherits no business connections; it requires its own LinkedIn authorization.
LinkedIn connection retention
OAuth transactions are valid for ten minutes. Connections are stored until disconnected; expired tokens cannot be used for further requests. Disconnecting the Community connection deletes its token and pending authorization transactions for that user and workspace. Personal profile connections and content held by LinkedIn remain unchanged. Provider access can additionally be revoked in LinkedIn account settings. Access and deletion requests may be sent to info@avolang.de. Encrypted pilot database backups are retained for seven days. Restores initially remain network-isolated; Community credentials and pending authorization transactions are removed before reuse, requiring fresh authorization.
15. Google connection in the restricted pilot
Authorized pilot users may request a Google connection for Google Ads, Google Analytics and Search Console. Products can be authorized separately. ALWISR processes verified account identifiers, email address, granted permissions and encrypted access and, where applicable, refresh tokens, bound to the user, membership and workspace. Intended manual reads display accessible advertising accounts, Analytics properties, verified sites and aggregate performance reports. The pilot enables no advertising changes, Gmail or YouTube features, or automatic transfer of these Google reports to AI providers. Customer access requires verification and real acceptance tests for the respective features.
Limited Use of Google data
ALWISR’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements: https://developers.google.com/terms/api-services-user-data-policy. Google data is used only for explicitly requested, visible features; it is not sold, used for personalized advertising, or used to train general-purpose or other AI models. The current Google pilot invokes no external AI services for this data.
Ending Google access and provider processing
On disconnect, ALWISR first requests revocation at Google, then removes the stored tokens for the connection. A failed revocation is shown as an error, not reported as successful disconnection. Technical connection and security records may remain; access and further deletion requests may be sent to info@avolang.de. Pilot database backups use the seven-day retention described above and are unavailable to the running application. Google connections are separate from Microsoft sign-in. Google and LinkedIn integrations exchange data with those providers, which may process data outside Germany and the EEA. German ALWISR hosting does not promise exclusively German processing by Google or LinkedIn.
Last updated: