trendstalkr
Start free trial

Privacy Policy

Last updated: 15 October 2026.

This policy explains how personal data is processed when you use Trendstalkr at trendstalkr.com. It is written for the product as it actually runs.

Controller

Marco Pollmann
Schwalenbergstraße 7
33428 Marienfeld
Germany
Email: info.twoclouds@gmail.com

No data protection officer is appointed. A small service of this kind is not required to appoint one.

Account

When you create an account we process your email address and the login secret stored by our authentication provider. If you sign in with Google, we receive the name and email address Google shares for that login. Legal basis: contract, Art. 6 (1) (b) GDPR. An email address is required to open an account.

Workspace

We store what you save in the product so you can continue the work: chats, briefs, overviews, creator lists, posts, songs, ads, notes, product URLs and scheduled routines. Legal basis: contract, Art. 6 (1) (b) GDPR.

If you enter a website or app-store link, our server reads the public page to pick up a title, description, visible text and an icon. For an icon we may send that domain to Google’s favicon service. For an App Store link we may send the public app id to Apple. Legal basis: contract, Art. 6 (1) (b) GDPR.

Research

A search sends your phrases and the platforms you selected to ScrapeCreators, which returns publicly available social profiles and videos. The prompt, and the public text needed to answer it, is sent to OpenAI so the product can write the answer or brief you asked for. We ask OpenAI not to store the request for later retrieval. OpenAI may still keep content for a short time to detect abuse, under its own rules. Legal basis: contract, Art. 6 (1) (b) GDPR. Without the prompt we cannot run the search.

Payments

Stripe processes the payment. We do not store the full card number. We store the Stripe customer and subscription reference, the plan, status, search quota and the end of the paid period, so we can unlock the product and count searches. Legal basis: contract, Art. 6 (1) (b) GDPR, and legal duty to keep accounting records, Art. 6 (1) (c) GDPR.

To stop the same payment method from starting another free trial, we store a fingerprint of the card or SEPA method. That is not the card number. We keep it after you delete your account. Legal basis: legitimate interest in preventing repeat trials, Art. 6 (1) (f) GDPR. You can object. If we grant the objection, that payment method can start another trial.

Security and logs

The host and the authentication provider process connection data such as IP address, time and browser data in order to deliver the site, keep you signed in and block abuse. We also count request rates per account for the same reason. Legal basis: legitimate interest, Art. 6 (1) (f) GDPR.

Website analytics

On the public pages of trendstalkr.com (not inside the signed-in app) we measure reach with PostHog, hosted in the EU. We record which pages are viewed, how long, which links and buttons are clicked, where a visit came from, browser, device type and page load times. PostHog runs in cookieless mode: it sets no cookies and stores nothing on your device. To count a visit, PostHog forms a hash from the IP address and browser data with a salt that changes every day, so the same visitor cannot be recognised on a later day. The IP address is then removed; it is neither stored nor used to look up a location. We do not record sessions and do not use the data for advertising. Legal basis: legitimate interest in understanding and improving our website, Art. 6 (1) (f) GDPR. You can object at any time by email. PostHog processes the data on our behalf under a data processing agreement.

Cookies

We use essential cookies to keep the session signed in. We do not use advertising or analytics cookies; website analytics run without cookies or device storage. Essential cookies do not need consent under § 25 of the German Telecommunications Digital Services Data Protection Act (TDDDG).

Who receives data

  • Supabase, for the account and the saved workspace, hosted in the EU (Ireland).
  • Netlify, for hosting the website.
  • PostHog, for cookieless website analytics, hosted in the EU.
  • Stripe, for payments and invoices.
  • OpenAI, for answers and briefs.
  • ScrapeCreators, for lookups of public social data.
  • Google, if you choose Google sign-in, and when a site icon is loaded from Google.
  • Apple, when you submit an App Store link and we read the public listing.

We do not sell personal data.

Transfers outside the EU

Supabase keeps the database in the EU. Netlify, Stripe, OpenAI, ScrapeCreators and Google may process data in the United States. Where the provider is certified under the EU-US Data Privacy Framework, we rely on that decision. Where it is not, we rely on the European Commission’s standard contractual clauses.

How long we keep it

Account and workspace data stay until you delete the account in Settings, or until you ask us to delete it. Deletion removes the login and the saved workspace. Stripe keeps invoices for as long as tax law requires. In Germany that is generally ten years for accounting records. The payment-method fingerprint used against repeat trials stays after deletion. Host logs follow the provider’s own short retention for security.

Your rights

You can ask for access, correction, deletion, restriction or a copy of your data, and you can object to processing that is based on legitimate interest. Where a step is based on consent, you can withdraw that consent. Write to info.twoclouds@gmail.com. You also have the right to lodge a complaint with a data protection supervisory authority, in particular in the EU member state where you live, work or where the alleged infringement took place (Art. 77 GDPR).

Automated decisions

The model writes the research you ask for. It does not decide access to a plan, a price or a legal result. We do not make decisions based solely on automated processing that produce legal effects, Art. 22 GDPR.

Children

Trendstalkr is not directed at children under 16.