Privacy Policy

1. Controller

SYNCON Labs GmbH Adalbertstraße 56 80799 Munich Germany

Email: reach@theconsumer.ai

2. Scope

This privacy policy explains how we process personal data when you visit our website www.theconsumer.ai, contact us, request a demo, or subscribe to our newsletter.

We comply with the EU General Data Protection Regulation (GDPR) and the German Federal Data Protection Act (BDSG).

3. Hosting (Vercel)

Our website is hosted by Vercel Inc. (USA). Server-side processing, such as submitting forms, takes place in data centres in Frankfurt. Static content is delivered via Vercel's global content delivery network, usually from the location closest to you.

Vercel processes data on our behalf under a Data Processing Agreement (DPA) in compliance with Art. 28 GDPR. Where data is transferred to the USA, this is secured by EU Standard Contractual Clauses (SCCs).

Vercel may log technical data to ensure secure and efficient website delivery:

• IP address
• Browser type and version
• Operating system
• Date and time of access
• Referrer URL

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in website functionality and security).

4. Fonts (Google Fonts)

This website uses Google Fonts, self-hosted via our own infrastructure. No connection to Google servers is established when you visit our website.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in consistent visual presentation).

5. Web Analytics (PostHog)

We use PostHog for web analytics. The provider is PostHog Inc. (USA). Data is stored in PostHog's EU cloud in Frankfurt and transmitted via our own subdomain t.theconsumer.ai. We have a Data Processing Agreement (DPA) with PostHog in accordance with Art. 28 GDPR.

Data collected:

• Page URLs visited
• Clicks on the page
• Session data
• Browser and device information
• Web performance metrics

Data explicitly not collected:

• Form input values
• Session recordings (disabled)
• Keystroke data

PostHog sets session cookies (ph_*) to distinguish between visitors.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in improving our website).

You can opt out by enabling Do-Not-Track in your browser settings or by contacting us at reach@theconsumer.ai.

6. Spam Protection (Cloudflare Turnstile)

We use Cloudflare Turnstile to protect our forms against spam and abuse. When you submit a form, Turnstile may collect:

• IP address
• Browser user agent
• Behavioral and interaction data

Cloudflare is based in the USA. Data transfer is secured by EU Standard Contractual Clauses (SCCs).

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in fraud prevention and website security).

7. Contact Form

When you contact us via our online form, we collect:

• Name
• Email address
• Company (optional)
• Message content

We use this data solely to respond to your inquiry. Your message is delivered via Resend (see section 10) and our team is notified via Slack (see section 11).

Legal basis: Art. 6(1)(b) GDPR (pre-contractual communication).

We delete your data 24 months after our last contact with you, or earlier if you ask us to.

8. Demo Request

When you request a demo, we collect:

• Name, email address, company, phone (optional)
• Your role
• Your goals and your first test idea

We use this data to prepare your demo. It is sent to our team by email via Resend (see section 10), and our team is notified via Slack (see section 11).

Legal basis: Art. 6(1)(b) GDPR (pre-contractual steps).

We delete your data 24 months after our last contact with you, or earlier if you ask us to.

9. Event Request (/reach)

On theconsumer.ai/reach, which we link via QR code at events, you can leave us your contact details. We collect:

• Name, email address, company
• Your use case
• Your question for us (optional)

We use this data to contact you after the event. It is sent to our team by email via Resend (see section 10), and our team is notified via Slack (see section 11).

Legal basis: Art. 6(1)(b) GDPR (pre-contractual steps).

We delete your data 24 months after our last contact with you, or earlier if you ask us to.

10. Email Delivery (Resend)

We use Resend Inc. to deliver emails for internal notifications about contact, demo and event requests, and for newsletter messages.

Resend processes the following data on our behalf:

• Email address
• Name
• Message content

Resend is based in the USA. Data transfer is secured by EU Standard Contractual Clauses (SCCs).

Legal basis: Art. 6(1)(b) GDPR (contract fulfilment) and Art. 6(1)(f) GDPR (legitimate interest in reliable email delivery).

11. Internal Notifications (Slack)

When you submit a contact, demo or event request, we send an internal notification to our team via Slack.

The notification contains the data you provided in the form. Only our team has access to these messages — no third parties.

Slack (Salesforce) is based in the USA. Data transfer is secured by EU Standard Contractual Clauses (SCCs).

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in efficient internal communication).

12. Newsletter (Double Opt-In)

When you subscribe to our newsletter, we collect your email address only.

We use a double opt-in process:

• You enter your email address
• We send a confirmation email with an encrypted link (AES-256-CBC)
• Your subscription is activated only after you click the confirmation link
• The confirmation link expires after 24 hours

Newsletter emails are delivered via Resend (see section 10). Your contact record is managed through Resend.

Legal basis: Art. 6(1)(a) GDPR (consent).

You can withdraw your consent at any time by contacting reach@theconsumer.ai.

For privacy protection, our system does not disclose whether an email address is already registered.

13. Cookies

Our website uses the following cookies:

• Cloudflare Turnstile (__cf_bm) — necessary for bot detection and spam prevention
• PostHog (ph_*) — analytics session tracking

We do not use a cookie consent banner. Analytics cookies are set based on our legitimate interest in improving our website (Art. 6(1)(f) GDPR).

You can block or delete cookies at any time through your browser settings.

14. Your Rights under the GDPR

You have the following rights:

• Access to your personal data (Art. 15 GDPR)
• Rectification of inaccurate data (Art. 16 GDPR)
• Erasure ("right to be forgotten", Art. 17 GDPR)
• Restriction of processing (Art. 18 GDPR)
• Data portability (Art. 20 GDPR)
• Objection to processing (Art. 21 GDPR)
• Withdrawal of consent (Art. 7(3) GDPR)

To exercise your rights, please contact: reach@theconsumer.ai

If you believe we have processed your data unlawfully, you have the right to lodge a complaint with a supervisory authority, e.g. the Bavarian Data Protection Authority (BayLDA) — https://www.lda.bayern.de

15. Data Security

We implement the following security measures to protect your data:

• SSL/TLS encryption for all data transmission
• AES-256 encryption for newsletter confirmation tokens
• Masked input fields in analytics (no form data recorded)
• Role-based access control for internal systems

16. International Data Transfers

Some of our data processors are based in the USA. All international data transfers are secured by EU Standard Contractual Clauses (SCCs) in accordance with Art. 46(2)(c) GDPR.

17. Changes to this Policy

We may update this privacy policy from time to time. The current version will always be available on our website.