Privacy Policy

1. Who We Are

This Privacy Policy explains how DigifyNow GbR, Grenzweg 9a, 57648 Unnau, Germany (represented by its managing partners Jesper Schmidt and Christian Schiebel; “we,” “us,” or the “Provider”), the operator of the software-as-a-service platform “EmailFlow OS” (the “Service”), handles personal information in connection with the Service.

If you have any questions about this Policy or our data practices, you can contact us at info@digifynow.de or +49 2662 5004345.

2. What We Process

Depending on how the Service is used, we process the following categories of data:

• Account data — information you provide when registering and managing your account, such as your name, email address, and phone number, along with authentication and billing-related details.
• Customer-uploaded recipient / lead data — the recipient and lead data our customers upload and process on their own behalf to run their campaigns (for example, business contact names, email addresses, and company information).
• Campaign and tracking events — data generated when campaigns run, such as sending status and, where the customer enables it, open and click events.
• Uploaded videos — the videos and related media that customers upload or generate for personalization within the Service.

3. Roles: Controller and Processor

(1) For recipient and lead data uploaded and used within campaigns, the customer is the controller and EmailFlow OS acts as a processor, processing that data only on the customer’s documented instructions and on the customer’s behalf.

(2) For account data relating to our own customers (the account holders), the Provider acts as the controller and processes that data to provide, secure, bill for, and improve the Service.

4. Sub-Processors

We use carefully selected third-party providers (sub-processors) to operate the Service. These currently include:

• Railway — application hosting and infrastructure.
• Brevo — email sending, through the customer’s own connected Brevo account.
• OpenAI — AI-assisted generation of email text.
• Pitchlane — personalized video generation.
• Stripe — payment processing.

Each sub-processor processes data only to the extent needed to provide its respective function.

5. Tracking

Open and click tracking is optional and is controlled by the customer on a per-campaign basis. Tracking is only enabled when the customer explicitly turns it on for a given campaign; when it is off, we do not generate open or click events for that campaign. Clicks on tracked booking links are recorded as booking-link click events on behalf of the sending customer.

5a. Cookies, Meta Pixel and Google Analytics (Consent-Based)

(1) The Service uses strictly necessary cookies and storage (session cookie for login, CSRF protection, language preference, and the stored record of your cookie choice). These are required to operate the Service and do not need consent.

(2) With your consent only, we use the Meta Pixel (Meta Platforms Ireland Ltd., Merrion Road, Dublin 4, Ireland) on our public pages and, once you are logged in, inside the application itself, to measure and optimize our advertising. Inside the application it mainly reports a completed sign-up. Pages whose address may contain personal data (such as unsubscribe, invitation or password links) are excluded. The pixel may transmit connection data (including IP address and browser information) and events (such as page views or sign-ups) to Meta, including transfers to the United States (safeguarded by EU Standard Contractual Clauses and/or an adequacy decision such as the EU-U.S. Data Privacy Framework). Automatic events such as button clicks and automatic matching of form entries are turned off. The pixel does not load unless you accept it, and you can change your decision at any time via the “Cookie settings” link in the page footer.

(3) With your consent only, our public pages (home page, blog, legal pages, login and sign-up) use Google Analytics 4 (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland) to understand which pages are visited and how visitors find us, so we can improve the website. Google Analytics sets cookies (_ga and _ga_…, kept for up to two years) and processes usage data under a pseudonymous identifier: pages viewed, time and duration of the visit, where the visit came from, approximate location (country, region), and device and browser details. According to Google, Google Analytics 4 does not store IP addresses. Google signals and ad personalization are turned off. Google deletes event data after two months and the user data stored under the pseudonymous identifier 14 months after your last visit. Google processes the data on our behalf as a processor (Art. 28 GDPR) under Google’s data processing terms, and sharing the data with Google for its own purposes, such as product improvement or benchmarking, is turned off. Data may be transferred to Google LLC in the United States, which is certified under the EU-U.S. Data Privacy Framework; EU Standard Contractual Clauses apply in addition. We do not use Google Analytics inside the logged-in application. It does not load unless you accept it, and if you decline via “Cookie settings”, we delete the analytics cookies in your browser.

6. Data Retention & Deletion

(1) We retain personal data for the duration of the service relationship and as needed to provide the Service.

(2) On request, and subject to applicable law, customer data is deleted or returned to the customer. For data processed on the customer’s behalf, we act on the customer’s instructions.

(3) Unsubscribe and opt-out suppression information is retained as necessary to continue honoring opt-out requests and to comply with applicable law.

7. Your Rights & Choices

(1) If you received an outreach email sent through the Service and no longer wish to be contacted, you can unsubscribe using the link included in that email. The unsubscribe request is directed to the sending customer, who is the sender and controller of that communication.

(2) Under the GDPR you have the right to access (Art. 15), rectify (Art. 16), and erase (Art. 17) your personal data, to restrict processing (Art. 18), to data portability (Art. 20), and to object to processing based on legitimate interests (Art. 21). Consent can be withdrawn at any time with future effect. You also have the right to lodge a complaint with a supervisory authority (Art. 77 GDPR); the authority responsible for us is the State Commissioner for Data Protection and Freedom of Information of Rhineland-Palatinate, Mainz, Germany. Depending on where you live, additional rights under state privacy laws (e.g. CCPA/CPRA) may apply.

(3) You may contact us at info@digifynow.de with any such request, and we will route it appropriately, including to the relevant customer where they act as controller.

8. International Note

The Service is operated from Germany, and data may be processed in Germany, the European Union, and other countries where our sub-processors operate. U.S. state privacy laws (for example, the California Consumer Privacy Act / California Privacy Rights Act, “CCPA/CPRA”) may apply to the personal information of California residents where the applicable thresholds are met, and other state privacy laws may apply as well. Each customer is responsible for its own privacy compliance toward its recipients, including providing any required notices and honoring individual rights requests.

9. Contact & Updates

(1) We may update this Privacy Policy from time to time to reflect changes in our practices or applicable law. The “Last updated” date above indicates when it was most recently revised.

(2) Questions about this Policy can be sent to info@digifynow.de. For our contractual terms, see our Terms of Service.