Privacy Policy

Our company is not legally required to appoint a data protection officer. For any data protection questions, contact us at the e-mail address above.

• When you just visit: technical access data (server logs) and cookie-free audience measurement.
• Only with your consent: Google Analytics 4 and measurement of Google Ads clicks.
• When you contact us, book an appointment, subscribe to the newsletter or use a tool: the data you provide for that purpose.
• We do not sell data and do not use social media pixels.

We use Vercel Web Analytics and Vercel Speed Insights. These services count page views and measure loading times without setting cookies or storing data in your browser. They record, among other things, the page viewed, referrer, device type, browser and country. IP addresses are not stored, visitors are not tracked across sites, and results are only evaluated in aggregate.

Purpose

Measure reach and loading speed, improve the website

Legal basis

Art. 6(1)(f) GDPR

Provider

Vercel Inc. (see hosting)

With your consent, we use Google Analytics 4 by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google Analytics is only loaded after you agree to the “Analytics” category in the cookie banner. Without consent, no connection to Google Analytics is made.

Google Analytics then sets the cookies “_ga” and “_ga_<ID>”, stored for up to 2 years, and records how you use the website: pages viewed, time on page, approximate location, device and browser, and events such as clicks on the phone number or submitted forms. Google Analytics 4 does not store IP addresses. Usage data is kept for at most 14 months.

Legal basis

Consent, Art. 6(1)(a) GDPR and Section 165(3) TKG 2021

Withdrawal

At any time via “Cookie settings” at the bottom left of every page

Third country

Google may process data in the USA. Google LLC is certified under the EU-US Data Privacy Framework.

More information

policies.google.com/privacy

We advertise with Google Ads by Google Ireland Limited. If you arrive through an ad, the link contains campaign tags (UTM parameters such as source, campaign and search term). These do not identify you and are stored with an enquiry so we can see which ads lead to enquiries.

Only if you agree to the “Marketing” category in the cookie banner do we also store the click identifier Google adds to the link (gclid, gbraid or wbraid) and the time of the click in your browser’s local storage for up to 90 days. If you then send an enquiry, book an appointment or request a tool result, we store the identifier with your enquiry. When the enquiry arrives, a tool result is requested, the enquiry is qualified or becomes an order, we transmit the identifier, the stage, the time and an estimated value to Google Ads (offline conversion import). We do not transmit your name, e-mail address or phone number.

If you tap our phone number after clicking an ad, we record a possible call from an ad in our customer system: time, page, campaign tags and, only with your consent, the click identifier. Your phone number is not recorded.

If you arrive through an ad, we measure that one visit without cookies: landing page, campaign tags, device class (smartphone, tablet or computer), pages viewed, active time on site, scroll depth and whether the phone number, e-mail address or a form was used. Nothing is stored in your browser; a random ID exists only in the memory of the open page. To connect several pages of the same visit, our server derives a hash from your IP address and browser identifier using a key that changes daily. When you open another page, it uses this hash to check whether a visit from an ad is in progress; otherwise nothing is stored. We delete the hash after two hours at the latest. We do not store your IP address, browser identifier or click identifier; on its own, the record therefore cannot be linked to a person. This shows us whether an ad landing page helps or whether visitors leave straight away.

If, during such a visit, you send an enquiry, book an appointment or request a result from the AI potential check or the time savings calculator, we link this enquiry to the ad visit, again without cookies: the open page sends the random visit ID along, or our server recognises the running visit by the hash described above. With your enquiry we then store the note “via a Google ad”, the search term, campaign and landing page of the ad, and the visit ID; the visit record is thereby linked to your enquiry. We do not transmit anything to Google in this step. A report to Google Ads is only made if a click identifier is present, i.e. only with your marketing consent.

Purpose

Measure and improve the effectiveness of our ads

Legal basis

Click identifier: consent, Art. 6(1)(a) GDPR and Section 165(3) TKG 2021. Campaign tags, call record and visit measurement: Art. 6(1)(f) GDPR

Withdrawal

At any time via “Cookie settings”; the stored identifier is then deleted from your browser.

Retention

Click identifier in the browser up to 90 days; click identifier and ad attribution with the customer record as long as the enquiry itself; visit measurement 90 days

Third country

Google LLC is certified under the EU-US Data Privacy Framework.

When you contact us through a form (including the process check), by e-mail or by phone, we process:

• Name and e-mail address, optionally phone number, company and your message
• the page you send the enquiry from and the landing page
• campaign tags from the link, if present, and where applicable the link to an ad visit (see Google Ads)
• the time of the enquiry and its processing status

After a phone call, we note your name, phone number and what was discussed in our customer system, as far as needed for further support.

Your enquiry is stored in our customer system. We receive an e-mail notification and you receive a confirmation of receipt. While we work on it, we send you e-mails about the status of your enquiry, for example when we have contacted you or sent an offer, and a reminder for open offers. You can object to these e-mails at any time. To answer enquiries faster, we sort them by simple rules, such as whether a business e-mail address was given. This only sets the internal order; decisions are always made by a person.

Purpose

Handling your enquiry, preparing offers and customer care

Legal basis

Art. 6(1)(b) GDPR (pre-contractual measures and contract); status e-mails, reminders and analysing which pages lead to enquiries: Art. 6(1)(f) GDPR

Required data

Name and e-mail address. Without them we cannot answer your enquiry.

Retention

Without an order up to 3 years after the last contact; with an order the statutory retention period of 7 years (Section 132 BAO)

When you book an initial meeting through the website, we process your name, e-mail address, optionally phone number, company and message, as well as date, time, language and meeting type. The appointment is added to our Google Calendar. For online meetings, Google automatically creates a Google Meet link. Your e-mail address is added to the appointment as a guest so that Google sends you the calendar invitation. You then receive a confirmation e-mail and two reminders, one the day before and one an hour before the appointment.

Provider

Google Ireland Limited (Google Calendar, Google Meet)

Legal basis

Art. 6(1)(b) GDPR

Retention

As for enquiries

Third country

Google LLC is certified under the EU-US Data Privacy Framework.

We occasionally contact companies by e-mail when we see a specific reason on their website where we can help. For this we process the company name, domain, the general company e-mail address (e.g. office@ or info@), for management the name from the legal notice, and our notes on publicly available content of the website. Austrian addresses are checked against the RTR ECG list before sending; Swiss companies are contacted only if their directory entry carries no advertising opt-out mark. Every e-mail contains an unsubscribe link; anyone who unsubscribes or objects is added to a block list and not contacted again.

The link in these e-mails contains a lead number. If you open it in a browser, we store the time and the page visited with that lead so we can follow up appropriately. No cookies are set and no third parties are involved for this; an enquiry or booking afterwards is assigned to the same outreach.

Sending service

Resend, Inc.

Legal basis

Art. 6(1)(f) GDPR (direct marketing to businesses); object at any time via the unsubscribe link or by e-mail

Retention

Discarded companies 30 days; block-list entries permanently so that the objection is respected

For the newsletter, we store your e-mail address, optionally your first name, where you signed up, the language of the sign-up page (German or English, for the matching edition) and when you gave and confirmed your consent. Sign-up uses double opt-in: you only receive the newsletter after clicking the link in the confirmation e-mail. Requests for a checklist or another download use the same sign-up.

We measure whether a newsletter is opened and which links in it are clicked. Each issue contains an invisible image and links that redirect through our server. This tells us which content is of interest. If you do not want this, you can disable image loading in your e-mail program or unsubscribe.

Legal basis

Consent, Art. 6(1)(a) GDPR and Section 174 TKG 2021; proof of consent: Art. 6(1)(c) GDPR

Unsubscribe

Via the link in every issue or by e-mail to us

Retention

Until you unsubscribe; we keep proof of your consent for up to 3 years afterwards. Unconfirmed sign-ups do not receive the newsletter.

You can use the AI potential check and the time savings calculator without providing any data. The result is calculated in your browser; we store nothing. If you download the result as a PDF, your browser sends the result page to our server, which creates the PDF and does not store it.

If you have the result sent to you by e-mail, we store your e-mail address, optionally your first name, your answers and the result, the page and the time, as well as campaign tags and ad attribution where present (see Google Ads) in our customer system. You receive the result with a PDF by e-mail, and we are notified so we can answer questions. If there is already a record for your address, we add to it.

The same applies if you have the result of the PHP check, e-mail check, SEO check or GEO check sent to you as a PDF: we store your e-mail address, optionally your first name, the address checked and a short form of the result. So that the result cannot be altered, our server returns it to your browser with a signature valid for 24 hours; it is not stored in the process. You only receive the newsletter if you tick it separately and confirm the subscription by e-mail.

We only send follow-up e-mails about your result (three e-mails over about ten days, the last one offering a call) if you tick the separate box and confirm via the link in a confirmation e-mail (double opt-in). As proof we store the time you ticked the box, the time of confirmation and the wording and version of the consent text, but no IP address. For the content we also store the tool and a short summary of your result. Every e-mail contains an unsubscribe link. The series ends immediately if you unsubscribe, book an appointment, we are in contact with you or your enquiry is being handled.

PHP watch: if you activate it in the PHP check result, we store your e-mail address, the website, the language and the time, wording and version of your consent (no IP address). Only after you click the link in the confirmation e-mail (double opt-in) do we load the start page of your website once a month, exactly like the PHP check, read the SSL certificate and the public DNS records for e-mail protection (SPF, DMARC) and send you the result; if action is needed, with the offer to do the update for you, and we are notified. For this we only store the time, result and reported PHP version of the last check. Unconfirmed sign-ups are deleted after 30 days, ended watches 180 days after unsubscribing. Every e-mail contains an unsubscribe link.

Purpose

Sending the result you requested; follow-up e-mails and PHP watch if you wish

Legal basis

Result by e-mail and customer record: Art. 6(1)(b) GDPR; follow-up e-mails and PHP watch: consent, Art. 6(1)(a) GDPR and Section 174 TKG 2021; proof of consent: Art. 6(1)(c) GDPR

Withdrawal

Via the unsubscribe link in every follow-up or watch e-mail or by e-mail to us

Retention

Result and customer record as for enquiries. Unconfirmed sign-ups for follow-up e-mails are deleted automatically after 30 days, the proof of consent 3 years after the series ends.

You can use some of our free online tools and the EA Apps without an account. So that we can limit the number of free uses, we store a cookie with your credit balance (see cookies).

For a user account, we store your name, e-mail address, optionally company, your password only as a secure hash, the time of your consent, credit balance, tool usage statistics and, if applicable, a referral code. If you sign in with Google, we receive your name, e-mail address and profile picture from Google. For app support requests, we store your details and message.

What you enter into a tool, such as a website address, text or uploaded files, is processed to produce the result. Some tools use AI services for this (see use of AI services). Please do not enter confidential or particularly sensitive personal data. For this the e-mail check only queries public DNS records of the domain entered; if you enter an e-mail address, we only use and store the domain behind it. The security header check loads the start page once via https:// and once via http:// and reads the TLS certificate; the AI crawler check only loads /robots.txt and /llms.txt; the llms.txt generator reads robots.txt, the sitemap and up to 25 public pages and stores no page content. For the load time check we send the address entered to Google PageSpeed Insights (Google LLC), which loads and measures the page itself; we do not pass on your IP address. The readability check and the photo check run entirely in your browser: texts, images and their metadata are not sent to us or to third parties; the map for a location found opens OpenStreetMap only when you click it. Each voucher code can be redeemed only once per IP address; for that we store the IP address with the code.

For the check and generator tools (PHP check, e-mail check, load time check, security header check, AI crawler check, llms.txt generator, SEO checker, GEO checker, OG preview, redirect checker, meta generator, schema generator, content brief, website mockup) we keep a log of every successful check: the tool, the address checked without parameters (the keyword for the content brief), the domain, a short form of the result and the time. If you have unlocked the tools with a confirmed e-mail address, we store that address with it. We do not store an IP address. We use the log to improve the tools and to see which companies might need their website reworked; we may contact a company about our services on that basis. We only send advertising by e-mail where Section 174 TKG 2021 permits it. You can object to this use at any time by e-mail to us.

Legal basis

Art. 6(1)(b) GDPR (use of the tools and the account); abuse prevention for credits and vouchers and the log of checks: Art. 6(1)(f) GDPR (legitimate interest in improving the tools and in winning customers)

Google sign-in

Google Ireland Limited; Google LLC is certified under the EU-US Data Privacy Framework.

Retention

Account data until your account is deleted, which you can request by e-mail at any time; IP addresses for vouchers until the code is deleted; log of checks 90 days, then deleted automatically

We use AI services for some features. Only what is necessary for the feature is transmitted:

• Anthropic PBC, San Francisco, USA: Input to tools such as the content brief and meta generator and to the EA Apps, including uploaded documents. We also have draft replies prepared when answering enquiries; the content of your enquiry may be transmitted for this. Every reply is checked by a person before it is sent.
• Google Ireland Limited (Gemini): Input and images for AI image editing in the mockup tool.

Under Anthropic’s business terms, data from API use is not used to train its models.

Legal basis

Tools and apps: Art. 6(1)(b) GDPR; draft replies: Art. 6(1)(f) GDPR (efficient handling of enquiries)

Third country

Transfer based on the EU-US Data Privacy Framework where the provider is certified, otherwise the EU Standard Contractual Clauses

When you apply for our partner programme, we process your contact details, company name, industry, website and a description of your activities. As a partner with access to the partner portal, we also store your profile: name, company, location, phone number, skills, short bio, profile picture and links to LinkedIn or your website. We set a session cookie for sign-in.

Legal basis

Art. 6(1)(b) GDPR

Retention

Rejected applications up to 6 months; partner data for the duration of the cooperation and up to 3 years afterwards

Cookies and entries in your browser’s local storage that are strictly necessary for a function you request are set without consent (Section 165(3) TKG 2021). Everything else only with your consent. You can change your choice at any time via “Cookie settings” at the bottom left of every page.

In the internal admin area, we additionally set a sign-in cookie for logged-in staff. Website visitors are not affected.

Only we and the following service providers, who process data on our behalf and are contractually bound, receive your data:

Beyond that, we only pass on data where we are legally obliged to, for example to authorities, or where it is necessary for an order, for example to our tax advisers.

We delete personal data as soon as the purpose no longer applies and no statutory retention obligation exists. The specific periods are listed with each processing activity above. We keep invoices and contract documents for 7 years under Section 132 of the Austrian Federal Fiscal Code (BAO).

Under the GDPR, you have the right at any time to:

• Access to your stored data (Art. 15 GDPR)
• Rectification of inaccurate data (Art. 16 GDPR)
• Erasure (Art. 17 GDPR), unless a retention obligation applies
• Restriction of processing (Art. 18 GDPR)
• Data portability (Art. 20 GDPR)
• Withdraw consent with effect for the future (Art. 7(3) GDPR)

No decision based solely on automated processing within the meaning of Art. 22 GDPR takes place. To exercise your rights, an informal message to office@ea-digitalsolutions.at is sufficient. We respond within one month.

If you believe we are not processing your data lawfully, you can lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). In Austria this is:

We update this privacy policy when our website, our service providers or the legal situation change. The version published here applies.