Privacy notice

1. Controller and privacy contact

lol.marketing LLC, 30 N Gould St Ste N, Sheridan, WY 82801, USA. Send privacy requests to hello@lol.marketing; your contact is Manuel Streit.

No data-protection representative has been appointed in Germany. You can exercise your privacy rights directly with lol.marketing LLC using the contact above.

2. Website, hosting and technical logs

Delivery through Firebase Hosting and Google Cloud may involve your IP address, time, requested URL including parameters, referrer, browser and device information, response status and technical identifiers. The purposes are delivery, security, failure analysis and abuse prevention under Article 6(1)(f) GDPR.

Our application does not write form answers, names, companies or email addresses to its logs. Infrastructure logs may still contain IP and connection data. Firebase specifies retention of a few months for its own Hosting IP data. Configuration of other technical logs: In the Werkverstand project, logs stored in the Cloud Logging _Default bucket are retained for 30 days; required audit logs stored in the locked _Required bucket for 400 days. These periods refer to these two project buckets.

Configured region: Firestore europe-west3 (Frankfurt, Germany); Functions europe-west3. Hosting and App Check: global Google infrastructure; technical data may also be processed outside the EEA. The Firestore region does not restrict these services to Germany.

3. AI System Check and personal enquiry handling

When you request a report, we process name, company, business email, optional phone and 17 selected answers. The answers concern workflow, frequency, weekly effort, people, documentation, repeatability, data access, data quality, system environment, data sensitivity, controls, ownership, timing, role, company size, primary market and investment range. There are no file uploads or free-text fields for confidential content.

The data are used for your requested assessment, report delivery and personal handling of your business enquiry. The legal basis is Article 6(1)(b) GDPR for pre-contractual requests by a prospective contracting party, or Article 6(1)(f) for company contacts and our interest in handling the specifically requested business service. Acknowledging this notice is not consent to advertising.

Name, company, email and the selected answers are required for the enquiry; phone is optional. Fixed scoring rules calculate readiness, component scores, possible system paths, a suggested starting point and internal commercial priority. The assessment does not send your information to a generative AI model. It prepares a personal review and makes no solely automated decision with legal or similarly significant effect.

4. Abuse prevention and retention

Submitting the report form is designed to use Firebase App Check with reCAPTCHA Enterprise. Technical browser, device, interaction and connection information may be processed to assess abuse risk. Origin checks, a honeypot, minimum completion time, size limits, rate limits and unique request identifiers also protect the endpoint under Article 6(1)(f) GDPR. Firebase states that App Check tokens consumed for replay protection are kept for at most 30 days; reCAPTCHA is subject to its applicable Google terms.

For rate limiting, the application stores IP and email only as hashes created with an additional secret value. These pseudonymous counters are scheduled for deletion within 48 hours. System Check information, assessment, acknowledgement of the privacy version, request identifier and delivery status of the report and operator notice are scheduled for deletion from Firestore after 30 days. The case is no longer sent after expiry. Physical TTL deletion can be delayed.

These 30 days apply to our Firestore cases. They are not a uniform deletion period for infrastructure logs, email-provider data or copies in the recipient’s mailbox. Replies to reports and later business correspondence are processed to handle the relevant enquiry; statutory retention duties may also apply.

5. Recipients, email delivery and international transfers

Google contracting entity for Firebase: Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. Google publishes the Cloud Data Processing Addendum. Its European appendix describes standard contractual clauses and alternative transfer solutions, each subject to specific conditions. The configured Firestore region does not mean that all Hosting, security, support and service data are processed exclusively in Germany.

The requested report is delivered by email through the delivery service Brevo from hello@lol.marketing. It creates neither CRM contacts nor mailing-list subscriptions. Brevo publishes its data-processing terms in Appendix 3 of its Terms of Service. The publicly displayed version is dated 1 October 2025.

Brevo receives the recipient address, the text report containing the 17 selected answers, scores, assessment and next steps, plus a random delivery identifier. Names, company, phone, IP address, UTM data and internal commercial priority are excluded from both the report and the Brevo request.

Brevo adds invisible images to delivered emails to measure opens. If your email application loads these images, technical connection data are transmitted to Brevo. Our account is configured to anonymise transactional open and click statistics: the provider states that events are counted but not linked to specific contacts. The images remain in the email. We do not supply additional company details or System Check answers for this measurement; the answers described above form part of your report. Your Google Analytics choice for this website does not control these images in your email application.

A separate operator notice only says that a new System Check is available and the protected Firebase records should be checked. It contains no requester contact details or answers, no assessment and no case identifier. Its delivery uses its own random technical identifier. Authorised staff access the actual case in the protected records.

Brevo retention for transactional logs and email previews: transactional logs are automatically deleted after one month; deletion can take up to 24 additional hours. Storage of content previews is disabled for new emails. These provider periods are independent of Firestore deletion.

Google and Brevo may process data outside the European Economic Area. The providers publish information about their international transfers and subprocessors in the data-processing terms linked below. You can request information about the recipients and transfer arrangements relevant to your data and, where applicable, a copy of the safeguards at hello@lol.marketing.

6. Privacy settings and audience measurement

We use Google Analytics 4 to measure website usage only with your consent. Only then do we load the Google tag and allow analytics cookies. Before consent and after rejection, the website sends no Analytics events or consent pings. The legal bases are Article 6(1)(a) GDPR and section 25(1) of the German TDDDG. The website and System Check also work without this consent.

We measure page views and general System Check steps, such as starting, completing a step and submitting. The application sends only the language, a general form or step category and the canonical page address without query parameters or fragment. Referrers are not sent as analytics parameters. Answers, names, company, email, phone and case identifiers are not sent to Analytics. When a connection is established, Google receives technical data such as IP address and browser information; cookies associate visits pseudonymously.

The website tag disables Google Signals and advertising personalisation. Google Signals is also disabled in the property. The property is not linked to Google Ads; advertising personalisation is disabled. Sharing for Google products and services is disabled. Modeling contributions and benchmarking, technical support and recommendations for our business are enabled. Google describes modeling and benchmarking contributions as aggregated; support and recommendations can involve access to Analytics account data.

Analytics cookies are set for at most 60 days, and our tag configuration does not extend them on new activity. User and event data retention is set to two months; reset on new activity is disabled. The user and event retention selected in Analytics does not limit retention of aggregate standard reports; Google deletes expired user and event data in its monthly deletion cycle.

Google provides the analytics service. Google publishes separate Ads Data Processing Terms for Analytics. Technical data may also be processed in the United States and other countries outside the EEA. Information about Google’s processing and published transfer terms is available in the provider sources below.

You can withdraw consent at any time using “Privacy settings” in the footer. The application then stops further analytics events and removes analytics cookies set by this integration that are accessible in your browser. Withdrawal does not affect processing that has already occurred. Your choice is stored locally for at most 180 days so we can respect it on subsequent visits.

7. Newsletter and advertising

Newsletter subscription is not currently offered. Requesting a System Check report does not start a marketing sequence or add you to a mailing list.

8. Rights and complaints

Subject to applicable data-protection law, rights include access, rectification, erasure, restriction, portability and objection. You may withdraw consent for future processing. Contact: hello@lol.marketing. You may in particular complain to an authority where you habitually live or work, or where the alleged infringement occurred.

9. Effective date and changes

Effective date: 2026-09-10. The privacy version recorded by the System Check is 2026-09-10.1. We update this notice when services, recipients, legal bases, transfers or retention periods change.