Privacy policy.

The controller within the meaning of the General Data Protection Regulation (GDPR) is:

Email: info@movawerk.de · Website: www.movawerk.de

MovaScope is a product of MovaWerk, not a separate company. MovaWerk is therefore your contractual partner and contact for all data protection questions about MovaScope. An informal message to the email address above is sufficient.

MovaScope is software for agencies and freelancers. It analyses prospective clients' websites, documents improvement opportunities, creates design concepts and prepares outreach. We distinguish three groups of people:

• Visitors to this website — here we are the controller (sections 3 to 5).
• Customers with a MovaScope account and their team members — we are the controller for account, contract and usage data (sections 6 and 7).
• People whose data our customers process with MovaScope — such as contacts at researched companies, recipients of campaign emails, or people who open a private concept preview. Here we process data as a processor on behalf of the respective customer (sections 8 to 13).

When you visit movascope.app, technical access data sent by your browser is processed automatically: IP address, date and time, requested address, referrer URL, browser type and version, operating system, HTTP status code and amount of data transferred.

This is necessary to deliver the website, keep it stable and secure, and detect attacks or errors. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is secure and reliable operation.

Our hosting provider is Vercel Inc., USA. Vercel processes the data as our processor (Art. 28 GDPR) and keeps server logs only for a limited period unless they are needed to investigate a specific security incident. For transfers to the USA, see section 15.

Fonts are served directly from movascope.app. No connection to Google Fonts or any other font service is made when you load a page.

We only use strictly necessary cookies and storage technologies. We do not use analytics, tracking or advertising cookies on movascope.app, which is why we do not show a consent banner.

MOVASCOPE_LOCALE

Stores your chosen language (German or English). Lifetime: 12 months.

Sign-in and session cookies

Set by our authentication service Clerk to keep you signed in and protect your account from misuse. Lifetime: until you sign out or the session expires.

Preview session

Set when a private concept preview is opened. Limited to the preview area (HttpOnly) and short-lived.

Session storage

Keeps reply drafts and newly created preview links available in the open dashboard tab. Cleared when the tab is closed.

The legal basis for storing and reading this information on your device is Section 25(2) no. 2 TDDDG, because it is strictly necessary for the service you have explicitly requested. Subsequent processing is based on Art. 6(1)(b) GDPR (account use) or Art. 6(1)(f) GDPR (language preference, security).

If you email us, we process your email address, your name, the content of your message and the times of communication to handle your request. The legal basis is Art. 6(1)(b) GDPR where your request relates to a contract, and Art. 6(1)(f) GDPR otherwise. We delete the data once your request is resolved, unless retention obligations apply.

An account is required for the dashboard. When you register, we process your first and last name, business email address, password (stored by the authentication service only as a cryptographic hash), the verification code sent by email, sign-in times and security-relevant device and session information.

We use Clerk (Clerk, Inc., USA) for registration, sign-in, session management and verification emails. To protect against automated sign-ups, Clerk embeds Cloudflare bot detection (Cloudflare Turnstile, Cloudflare, Inc., USA), which evaluates technical browser and connection characteristics.

You can optionally sign in with your Google account. Google Ireland Limited, Ireland, then shares your name, email address and, where applicable, your profile picture with us after you approve it. We do not receive your Google password.

The legal basis is Art. 6(1)(b) GDPR (providing the account and performing the contract) and, for misuse and bot protection, Art. 6(1)(f) GDPR. Your name and email address are required to create an account; without them we cannot create one. We keep account data for the duration of the user relationship and delete it after the account is deleted, unless statutory retention obligations apply.

In your workspace we process the data you create yourself: agency profile and sender details (such as name, role, agency name, contact email, website, phone, address, signature and booking link), campaign and project settings, plan and usage quotas, and activity and notification data.

Credentials for your own sending and mailbox services — API keys, IMAP app passwords and webhook secrets — are stored encrypted only (AES-256-GCM). They are never returned to the browser.

The legal basis is Art. 6(1)(b) GDPR. Data is stored in the database of Supabase (Supabase, Inc., USA); short-lived check data, quotas and rate limits are stored with Upstash (Upstash, Inc., USA). Both act as our processors.

Billing for paid plans is not yet enabled. Once plans can be purchased, we will process the data required for the contract and invoicing (Art. 6(1)(b) and (c) GDPR) and retain invoices and accounting records under Section 147 AO and Section 257 HGB. We will name any payment provider here before we start using it.

With MovaScope, our customers research companies, analyse their websites, create concepts and prepare outreach. The respective customer decides on the purposes and means of this processing. The customer is the controller under the GDPR; we process the data only on the customer's instructions and on the basis of a data processing agreement under Art. 28 GDPR.

The people concerned are mainly owners, managing directors and contacts at the researched companies, and recipients of campaign emails. Sections 9 to 13 below describe which data is processed technically.

If you want to exercise your rights regarding such processing — for example access, erasure or an objection to advertising — please contact the company that contacted you. If your request reaches us directly, we forward it to the responsible customer without delay and support them in responding.

The respective customer is responsible for ensuring that contacting you is lawful, in particular under Section 7 of the German Unfair Competition Act (UWG) and Art. 6 GDPR.

For company search, MovaScope sends the search terms chosen by the customer (such as industry and location) to the Google Places API (Google Ireland Limited, Ireland; processing also by Google LLC, USA). We receive public business listings in return, such as name, address, website, phone number, category and rating.

To find a contact, MovaScope reads the publicly visible contact and legal-notice pages of the company website and takes the email addresses published there. It stores the address, where it was found and an assessment of the evidence quality. Customers can also add contacts manually (name, role, email address, phone number, profile URL).

During an analysis, MovaScope retrieves publicly accessible pages of the website on the server — including the home page, robots.txt, sitemap and selected internal pages — and evaluates them automatically against fixed criteria such as positioning, user guidance, technical foundation and trust signals. The raw HTML is not stored permanently; the result and the findings derived from it are. Short-lived check records are normally deleted after 24 hours.

To measure loading performance, the checked address is sent to the Google PageSpeed Insights API (Google Ireland Limited / Google LLC).

The assessment concerns websites, not people, and does not lead to decisions within the meaning of Art. 22 GDPR.

For a concept, MovaScope uses the name, logo, colours, images and selected texts of the analysed website, as well as screenshots. The draft is built in an isolated environment without internet access (Vercel Sandbox). Results are stored in private object storage — Vercel Blob (Vercel Inc., USA) or Cloudflare R2 (Cloudflare, Inc., USA).

Customers can share a concept through a private link. The link contains a random access token, of which we store only a cryptographic hash. Anyone who opens the preview generates the server log data described in section 3 and receives the short-lived preview session cookie. Previews contain no analytics or tracking tools, no forms and no connections to third parties. They remain available until the customer revokes them, replaces them with a newer version or deletes them.

MovaScope can optionally refine design concepts with an AI language model. This function is disabled by default; without it, MovaScope creates the complete concept using rules.

When it is enabled, MovaScope sends a limited dossier to DeepSeek (Hangzhou DeepSeek Artificial Intelligence Co., Ltd., People's Republic of China): company name, industry, description and location, general business phone number and email address, public ratings, selected website texts, colours and fonts, the saved findings, and screenshots and images of the public website and of the draft.

Account data and credentials, manually added contacts, campaign emails and mailbox contents are not sent. We do not store the model's raw responses. There is no EU Commission adequacy decision for the People's Republic of China; see section 15.

MovaScope sends campaign emails exclusively through the customer's own account with a sending service — currently Resend (USA) or Brevo (France). The customer contracts with this service directly. Recipient address, subject, content, send time and delivery status are processed.

If a customer connects their mailbox via IMAP, MovaScope imports only replies to the customer's own campaign emails (from the last 90 days on first import). Sender, recipient, subject, date and text content are stored. Attachments remain in the customer's mailbox; messages in the mailbox are never deleted or moved.

Customers can enable open tracking in their sending service. MovaScope then stores only that and when an open was reported, plus a flag for automated retrievals — no IP addresses and no browser information. The customer is responsible for whether open tracking is lawful towards recipients and which consents it requires.

Images embedded in emails may be loaded from movascope.app; this generates the server log data described in section 3.

We only share personal data where necessary for the purposes described, where required by law, or where you have consented. We use the following service providers:

Vercel Inc., USA

Hosting, delivery, server logs, background jobs, isolated draft builds and private file storage

Clerk, Inc., USA

Registration, sign-in, sessions and verification emails

Cloudflare, Inc., USA

Bot protection at sign-up; optional private object storage for concept files

Supabase, Inc., USA

Database for workspaces, companies, analyses, concepts and campaigns

Upstash, Inc., USA

Short-lived check data, quotas and rate limiting

Google Ireland Limited, Ireland

Sign-in with Google (optional), company search and performance measurement

Hangzhou DeepSeek Artificial Intelligence Co., Ltd., China

Only when AI-assisted design is enabled

Data may also be disclosed to tax advisers, legal advisers or authorities where required by law or to enforce legal claims. Customers' sending services and mailboxes are not MovaWerk's service providers; they are engaged by the respective customer.

Some service providers are based outside the EU and EEA. For the USA, the EU-US Data Privacy Framework provides an EU Commission adequacy decision (Art. 45 GDPR). Where a recipient is certified under it, we rely on that decision; otherwise on the EU Commission's standard contractual clauses (Art. 46(2)(c) GDPR).

There is no adequacy decision for the People's Republic of China. Data is only transferred there when the optional AI-assisted design is enabled, and only to the extent described in section 12. Any transfer takes place exclusively under the conditions of Art. 44 et seq. GDPR. You can request a copy of the relevant safeguards.

We keep personal data only as long as necessary for the respective purpose or required by statutory retention obligations:

Server logs

A limited period at the hosting provider; longer only to investigate a security incident

Language cookie

12 months

Short-lived check data

24 hours

Account and workspace

Until deleted by the customer or until the end of the contract, as set out in the data processing agreement

Private previews

Until revoked, replaced by a newer version or deleted

Email correspondence

Until resolved; commercial and business letters six years (Section 257 HGB)

Invoices and accounting records

Eight to ten years (Section 147 AO, Section 257 HGB)

We protect data with technical and organisational measures, including encrypted connections throughout (HTTPS), strict separation of workspaces at database level, encrypted storage of credentials, hashed preview access tokens, and draft builds in isolated environments without internet access.

Subject to the statutory requirements, you have the following rights:

• Access to the data we process about you (Art. 15 GDPR)
• Rectification of inaccurate data (Art. 16 GDPR)
• Erasure (Art. 17 GDPR) and restriction of processing (Art. 18 GDPR)
• Data portability (Art. 20 GDPR) — customers can also export their workspace at any time in the settings
• Withdrawal of consent with effect for the future (Art. 7(3) GDPR)
• Objection to certain processing (Art. 21 GDPR, see below)

To exercise your rights, a message to info@movawerk.de is sufficient.

You may lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), in particular in the Member State of your habitual residence, place of work or the place of the alleged infringement. The authority responsible for us is:

There is no automated decision-making, including profiling, within the meaning of Art. 22 GDPR. Scores in MovaScope concern websites and serve our customers as a working basis; a human always decides whether to make contact.

We update this policy when MovaScope, the services we use or the legal situation change. The version published on movascope.app applies.

When MovaWerk contacts potential business customers about its own services, MovaWerk acts as controller. We may process names, companies, professional roles, business email addresses, company websites and other publicly available professional or business contact details. Sources include official company websites, public contact and legal-notice pages, and public business listings researched through the Google Places API.

The purposes are B2B business development, relevant direct outreach and offering MovaWerk services to potentially relevant businesses. Where the applicable conditions are met, the legal basis is Article 6(1)(f) GDPR. Our legitimate interest is to identify and contact potentially relevant business customers about services reasonably connected with their business or professional activities. We balance this interest against the interests and fundamental rights of the individuals concerned; the separate legal requirements for the marketing channel must also be met.

You may object at any time to the processing of your personal data for direct marketing. You can use the unsubscribe link in the email or contact info@movawerk.de. After an objection, we no longer use the data for marketing outreach. Minimal suppression information, such as the normalized email address, time and reason for the opt-out, may be retained for as long as necessary to continue respecting your objection.

We retain prospect information only for as long as necessary for the relevant purpose. We regularly review whether it is still needed and delete unnecessary data, subject to statutory retention obligations and necessary suppression records. The existing sections on recipients, processors and international transfers apply, including those concerning Supabase and the configured sending account with Resend or Brevo. At first contact, we explain the public source of the contact data and link to the full privacy notice.