Privacy policy

This English version is provided for convenience. The German version is legally binding.

1. Controller

Wojcik Beratungs und Beteiligungs UG (haftungsbeschränkt), Schönhauser Allee 169a, 10435 Berlin, Germany, represented by its managing director Dominik Wojcik. Email: dominik [at] wojcik [dot] de. Full company details are in the imprint. AffiliateAI is a product of evnxt, which is run by the same company.

This policy covers the website affiliateai.evnxt.de (home page, pricing, docs, request form) and the AffiliateAI control center for customers. Price comparison sites that our customers run with AffiliateAI on their own hosting have their own privacy policy, and the customer is the controller there.

2. In short

• No tracking, no analytics, no advertising cookies, no social media plugins.
• Fonts and scripts are served from our own server. Loading the website does not contact any third party.
• We only use your details from the request form to answer your request.

3. Hosting

The website and the control center run on a server of Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany, in a data centre in Germany. Hetzner processes data on our behalf under a data processing agreement (Art. 28 GDPR).

4. Server log files

Each time a page is requested, the web server records: IP address, date and time, requested address, HTTP status, transferred data volume, referring page and browser identification (user agent). We need this data to deliver the website and to detect and defend against attacks and errors. Legal basis: Art. 6 (1) (f) GDPR (our legitimate interest in a secure and stable operation). Log files are deleted after 14 days, unless an individual entry is needed to investigate a security incident.

5. Cookies

The website sets only technically necessary cookies: a session cookie (affiliateai-steuerzentrale-session) and a security cookie against cross site request forgery (XSRF-TOKEN). They protect the request form and the sign-in and expire after 120 minutes of inactivity. Storing them is permitted without consent under § 25 (2) no. 2 TDDDG, the processing is based on Art. 6 (1) (f) GDPR. There are no other cookies.

6. Request form

When you request access, we process your name, company (optional), email address, domain or topic, chosen plan, message (optional) and the time of the request. We use them to answer your request and to prepare a possible contract. Legal basis: Art. 6 (1) (b) GDPR (pre-contractual measures at your request) and Art. 6 (1) (f) GDPR (answering business enquiries).

The request is stored in the database of the control center and sent to us by email. If the request looks normal, you receive a confirmation by email. Emails are sent through the mail server of our email provider ALL-INKL.COM, Neue Medien Münnich, Hauptstraße 68, 02742 Friedersdorf, Germany. To limit abuse we store a keyed hash of your IP address instead of the address itself and count requests per connection for one hour.

We delete requests twelve months after the last contact unless a contract has been concluded or statutory retention periods apply.

7. Customer accounts in the control center

If you use AffiliateAI as a customer, we process the data needed to provide the service (Art. 6 (1) (b) GDPR):

• Account: name, email address, password (only as a hash), optional second factor, role. Sign-ins, failed sign-ins and important actions are recorded in an audit log with IP address and time.
• Sites: domain, settings and the access data you provide for your hosting (SSH or SFTP, database), for Amazon (partner tag, Creators API credentials). Secrets are stored encrypted and only written into the configuration of your site.
• Deploy and cron service: the control center connects to your hosting via SSH or SFTP to deploy, and calls your site with signed requests to run jobs. Visitor data of your site is not transferred to us.
• AI and Amazon gateway: for page copy, product data extraction and images we send topic descriptions, product data and instructions to AI models from Anthropic PBC and OpenAI, L.L.C. (USA), and product queries to the Amazon Creators API (Amazon Europe Core S.à r.l., Luxembourg). These requests do not normally contain personal data. Transfers to the USA are based on the EU-US Data Privacy Framework or standard contractual clauses. Do not enter personal data into topic descriptions or prompts.
• MCP and OAuth: if you connect AI assistants, we store access tokens only as SHA-256 hashes, together with name, permissions, expiry and last use. Every tool call is recorded in the audit log (tool, parameters in summarised form, result, duration).
• Emails: sign-in links, invitations and alerts are sent through ALL-INKL.COM (see above).

We store account data for the duration of the contract and delete it afterwards, unless statutory retention periods apply. Where we process personal data on your behalf, we conclude a data processing agreement with you.

8. Your rights

You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and the right to object to processing based on legitimate interests (Art. 21 GDPR). Write to dominik [at] wojcik [dot] de. You may also lodge a complaint with a supervisory authority, for example the Berlin Commissioner for Data Protection and Freedom of Information (Berliner Beauftragte für Datenschutz und Informationsfreiheit).

We do not use automated decision making or profiling.