Privacy policy

1. Controller

The controller responsible for processing personal data under the GDPR is:

Octon Holding GmbH
represented by: Mio McQueen (Managing Director)
Paul-Ehrlich-Straße 7
79106 Freiburg im Breisgau
Email: team@octonholding.de

Where the platform processes personal data of third parties (such as the user's customers, leads or contacts) on the user's behalf, the user is the controller under the GDPR and the platform is the processor. The applicable terms are set out in the Data Processing Agreement (DPA).

2. Collection and storage of personal data

2.1 When visiting the website

When you visit our website, your browser automatically sends information to our server, which is temporarily stored in a log file:

• IP address of the requesting device
• Date and time of access
• Name and URL of the requested file
• Website from which access originated (referrer URL)
• Browser used and, where applicable, operating system

Log file retention period: 30 days.

2.2 Registration and use

When you register, we collect:

• Name
• Email address
• Time of acceptance and version of the accepted Terms, Privacy Policy and DPA

Sign-in uses a one-time magic link or code sent by email, without a password. Session cookies are HttpOnly and necessary for sign-in.

When you use the platform, we store business information (business details, offers, pages, contacts, invoices and payment data) to provide the service.

2.3 Language and country suggestions

We store a language you explicitly select in the bestride_locale cookie for up to twelve months and, when signed in, in your account to provide the requested language (Article 6(1)(b) GDPR; section 25(2)(2) TDDDG). You can change the language or delete the cookie through your browser. When country detection is enabled, your connection IP is matched against a local country database. This function creates no additional IP history and makes no request to an external IP service. The result is a suggestion you can correct; you confirm your business location yourself. The lookup supports country selection (Article 6(1)(f) GDPR).

3. Purposes of processing

We process your personal data for the following purposes:

• Providing the website and its functions
• Creating and managing your user account
• Providing our SaaS services
• Processing payments
• Communicating with you (support, updates and task notifications)
• Improving the service
• Meeting statutory retention obligations

4. Legal bases

Processing is based on the following legal grounds:

• Article 6(1)(a) GDPR – consent (optional analytics and marketing cookies)
• Article 6(1)(b) GDPR – performance of a contract (providing the service)
• Article 6(1)(c) GDPR – legal obligation (tax record retention)
• Article 6(1)(f) GDPR – legitimate interests (security, abuse prevention and anonymised analysis)

5. Cookies

We use cookies on our website. Cookies are small text files that your browser stores on your device.

Types of cookies:

• Essential cookies: Required for basic functions (sign-in session and a language setting explicitly requested by you)
• Analytics cookies: Help us understand usage (with consent only)
• Marketing cookies: For advertising measurement (with consent only)
• Other preference cookies: Store optional settings (with consent only)

You can change cookie settings at any time in your browser or through our cookie banner.

The founders' user websites (subdomain sites) count visits on the server without cookies; this counter does not require cookie consent.

5a. Web analytics and marketing tracking

We use the following analytics and marketing services. They are loaded only after your express consent through our cookie banner (legal basis: Article 6(1)(a) GDPR and section 25(1) TDDDG). No data is sent to these providers before consent. You may withdraw your consent at any time with effect for the future.

• Google Analytics 4 (Google Ireland Ltd.): Audience and usage analysis. IP anonymisation is enabled. Transfers to the USA are safeguarded by EU Standard Contractual Clauses (SCCs) and the EU–US Data Privacy Framework (DPF).
• Meta Platforms Ireland Ltd. (Meta Pixel): Measurement and optimisation of advertising campaigns. Transfers to the USA (SCCs/DPF).
• LinkedIn Ireland Unlimited Company (Insight Tag): Conversion tracking for LinkedIn advertising. Transfers to the USA (SCCs/DPF).
• PostHog (PostHog EU B.V./Ltd.): Product analytics to improve the application. Hosted in the EU (eu.posthog.com).

6. AI functions

The platform includes AI functions that analyse business information to create offers, pages, text and recommendations.

• AI processing takes place when the corresponding function is used
• Data is not used to train our own or third-party AI models. A Data Processing Addendum with Anthropic includes a no-training provision
• Processing takes place partly on servers in Frankfurt (EU) and partly through Anthropic PBC (USA), safeguarded by SCCs
• AI-generated content is identified as such in the platform (Article 50 of the EU AI Act)

6a. Uploaded and generated images

Uploaded and generated images are stored in your business document management system. When you ask the agent to review or place an image, the image and its instructions may be sent to the AI service used for visual analysis. For image generation, we send the image description and output parameters to the OpenAI API; the result may then be visually reviewed by the AI agent. Processing provides the function you request (Article 6(1)(b) GDPR).

OpenAI documents that API data is not used for training by default unless explicitly shared. Abuse monitoring logs may generally be retained for up to 30 days, or longer in justified exceptional cases. No Zero Data Retention commitment is made here. OpenAI: API data controls

7. Data security

We use technical and organisational measures to protect data against manipulation, loss, destruction and unauthorised access:

• TLS encryption for data transfers
• AES-256-GCM encryption of sensitive credentials and tokens
• Servers in German data centres (AWS Frankfurt, EU)
• Daily encrypted backups, retained in S3 for 30 days
• Strict separation of tenant data in database access
• Access controls and logging of sensitive operations
• No passwords stored (passwordless magic-link authentication)

Details of the technical and organisational measures are provided in the DPA (section 7).

8. Disclosure of data and service providers

Personal data is disclosed to third parties only with express consent, for contract performance, where legally required, or to subprocessors listed in the DPA as part of processing on our behalf.

Service providers:

• Amazon Web Services EMEA SARL (hosting, data storage and email delivery via SES) — server location: Frankfurt am Main, EU
• Stripe Payments Europe Ltd. (payment processing) — based in Ireland (EU data region)
• Anthropic PBC (AI processing) — based in the USA; DPA with no-training provision and SCCs in place
• OpenAI (API image generation; image descriptions and output parameters). Processing outside the EU is possible; applicable processing and international transfer terms must be observed.
• Lexware GmbH / lexoffice (accounting integration, only when connected) — based in Germany
• Openprovider B.V. (domain registrar, only when a domain is purchased through the platform) — based in the Netherlands (EU). If you buy a domain through BeStride AI, we use the billing address provided during payment as the domain registrant's details and pass it to Openprovider and the relevant registry (such as DENIC eG for .de domains). The same information may be used to prefill your legal notice.
• Google Analytics 4 / Meta Platforms / LinkedIn / PostHog (with consent only; see section 5a)

For transfers to third countries (USA), protection is provided through EU Standard Contractual Clauses (SCCs) and, where applicable, the EU–US Data Privacy Framework (DPF).

9. Your rights

You have the following rights in relation to your personal data:

• Access (Article 15 GDPR): Information about the data we store about you
• Rectification (Article 16 GDPR): Correction of inaccurate data
• Erasure (Article 17 GDPR): Deletion of your data
• Restriction (Article 18 GDPR): Restriction of processing
• Data portability (Article 20 GDPR): Export of your data (JSON / CSV / PDF)
• Objection (Article 21 GDPR): Objection to processing
• Withdrawal of consent: At any time with effect for the future

Contact: team@octonholding.de. Access, rectification, erasure and export are also available directly in the platform's account settings.

9a. Automated decisions (Article 22 GDPR)

The platform includes functions that carry out automated classifications, particularly:

• Receipt scanning: Incoming receipts are automatically categorised (tax rate and cost centre). You can correct the classification manually at any time.
• Contact scoring: Form submissions are assessed against quality criteria. The assessment is visible and can be overridden manually.

These classifications are not legally binding automated decisions within the meaning of Article 22 GDPR; a person confirms the decision. You may review and correct each decision at any time.

If you have questions about automated decisions, contact team@octonholding.de.

10. Retention periods

• Account data: Until the account is deleted
• Business data: Until deleted by the user or upon account deletion
• Invoice and accounting records: For the applicable statutory retention period; accounting vouchers are generally retained for eight years under section 147(3) AO. Other record types and special statutory circumstances may require different periods.
• Log files: 30 days
• Grace period after the contract ends: 30 days to export data, followed by permanent deletion
• Backup rotation: Complete removal from backups within a maximum of 90 days

11. Right to complain

You have the right to lodge a complaint with a data protection supervisory authority.

For users based in Germany:

State Commissioner for Data Protection and Freedom of Information Baden-Württemberg
Königstraße 10a, 70173 Stuttgart
www.baden-wuerttemberg.datenschutz.de

For users based in Austria:

Austrian Data Protection Authority
Barichgasse 40–42, 1030 Wien
www.dsb.gv.at

For users based in Switzerland:

Federal Data Protection and Information Commissioner (FDPIC)
Feldeggweg 1, 3003 Bern
www.edoeb.admin.ch

12. Changes

We may update this Privacy Policy to reflect changes in law or our service. The current version is available on this page. We will notify you of material changes in good time by email or through the software.