Privacy

Who is responsible

Matthias Deusch, trading as Jobsite Creative (sole proprietorship), In den Gruben 139, 84489 Burghausen, Germany. Email: hello@jobsitecreative.com. We are the controller for the personal data described on this page.

We have not appointed a data protection officer. We are not required to have one, and we would rather say that than leave the question open.

What we collect

• When you visit this site: the technical data every web server receives — IP address, date and time, the page requested, the referring page and your browser type. This site sets no cookies, runs no analytics and loads no tracking pixels. Fonts, images and videos come from our own domain, not from Google or any other third party.
• When you ask for a free ad at /start: company name, company website, your name and role, work email, main business phone, business ZIP code, service area, trade and, if you add one, your logo. With the request we store the IP address and browser type it was sent from, and the result of the checks described below.
• When you confirm a request or fill in one of our forms — the confirmation link we email you, the intake form for the free ad, or the plan form we send after your first payment: the details you confirm there, such as the company name as the ad says it, service area, phone number, services, offers with their fine print and end date, license number and state, brand details and notes for our writer, and the logo and pictures you upload. Each answer is stored with the name of the person who confirmed it and the date, together with the version and fingerprint of our terms that were in force when you agreed to them.
• When you buy a plan or an extra ad: the payment itself is handled by Stripe (see below). We receive and keep your company name, billing address, tax ID if you enter one, the email address you paid with, the plan, the amounts and the state of your subscription and invoices — never your full card number.
• When you email us: your message, your address and the thread it belongs to.
• When we write to you first: the business email address published on your company’s own website, together with the page, the date and the sentence we found it in, plus your company name, trade, city and state. We write to companies in construction, remodeling, the skilled trades and home services, and to real estate agents, brokerages and property managers. Our crawler is described at /bot.

If we wrote to you first

You did not give us your address — we found it. This section tells you exactly what we hold, where it came from, and how to end it in one click. It is the information we owe you under Article 14 GDPR, and we would rather you read it here than have to ask for it.

• What we hold: the business email address published on your company’s own website, the page we found it on, the date we found it, the sentence it appeared in, your company name and trade, the city and state, and — only if your website publishes it — the name and role of the person the address belongs to. Nothing else. We do not buy address lists, we do not guess at addresses, and we do not track what you do after you open our email.
• Where it came from: your company’s own public website, read by our crawler, JobsiteCreativeBot. Every email we send names the website and the date. How the crawler behaves, and how to keep it out, is at /bot.
• Why: to offer you a free video ad for your business, and, if you want one, to sell you a monthly plan.
• On what basis: our legitimate interest in finding customers — Art. 6(1)(f) GDPR. We weighed that against your interests before we started: the address is a business address you published yourself, we send at most three emails, we never call, we never sell or rent your details, we pass them only to the services named in the next point, and one click ends it for good. We wrote that assessment down and we will show it to you if you ask.
• Who receives it: only the services listed under Who processes it for us. For your address that means Supabase (our database), Google Workspace (the mailbox we write from) and Vercel (our email relay). Anthropic, whose model Claude runs our search for businesses, sees only business names and website addresses from web search results; it does not open your pages and never sees your email address — our own crawler reads the pages.
• How long: if we never write to you, we delete the address 90 days after we found it. If we write and you never reply, we delete everything 12 months after the last email. If you unsubscribe, we keep your address alone, on a do-not-contact list, without a time limit, so that we never write to it again.
• How to stop it: the link in any of our emails, one click, no reason needed. Or reply with the word stop. Either way you are off the list for good, and we never ask why.

You can object to this processing at any time under Art. 21(2) GDPR. That is the same thing as the unsubscribe link — we just have to name the article too.

How we check a request for a free ad

Anyone can type a company’s name into a form. Before a confirmation link goes out, we check that the request really comes from the company it names. This protects the company from ads ordered in its name, and the owner of the email address from mail they never asked for.

• The website you entered: our crawler, JobsiteCreativeBot, reads the website’s robots.txt and, where it is allowed to, up to four public pages: the home page and contact or about pages. It compares the company name, phone number and email address with the request. We keep the result, the page address and an excerpt of at most 160 characters — never a copy of the page. How the crawler behaves is described at /bot.
• Public DNS: we look up whether the domain of your email address can receive mail and which internet address the website points to, through the public DNS-over-HTTPS resolvers of Cloudflare and Google. These services see the domain names we ask about, not your name or your full email address. We run the same mail-domain check before we write to an address we found ourselves.
• Domain registration date: we ask the public registration data service for domains (RDAP) when the website’s domain was registered, and keep only the date.
• Our own records: we compare the request with companies we already know, to spot lookalike domains and requests for a company that already works with us.

Depending on the result, the confirmation link goes out automatically, or we review the request by hand first. A request that fails the basic checks — for example because the website does not exist or the email domain cannot receive mail — is dropped without a reply.

Why, and on what legal basis

• To answer your request, to produce and deliver your ads, to run your plan and to answer your emails — Art. 6(1)(b) GDPR.
• To check that a request for a free ad really comes from the company it names, and to keep our forms and our email from being misused — Art. 6(1)(f) GDPR, our legitimate interest in preventing fraud (Recital 47 GDPR).
• To be able to show later who confirmed which claim and which terms, and to keep this site secure and working — Art. 6(1)(f) GDPR, our legitimate interest.
• To offer businesses our ads, using business addresses published on their own websites — Art. 6(1)(f) GDPR. You can object at any time under Art. 21(2) GDPR; one click on the unsubscribe link in any of our emails is enough, and no reason is needed.
• To keep invoices and accounting records — Art. 6(1)(c) GDPR, German commercial and tax law.

Who processes it for us

We use these companies. Each receives only what its task needs and handles it under its own terms for business customers and its own privacy terms, which are linked from its website.

• Supabase — our database, the storage for the logos you upload, and our server functions. Supabase Pte. Ltd., Singapore; our project runs in Frankfurt, Germany.
• Vercel — this website and our email relay. Vercel Inc., United States.
• Google Workspace — both of our mailboxes (Gmail), the sending and receiving of all our email, and Google Drive, where we keep the finished files and share them with you by link. Google LLC, United States. A Drive link we send you opens the folder for anyone who has the link, so treat it like the files themselves.
• BytePlus — produces the video. BytePlus Pte. Ltd., 1 Raffles Quay, Singapore; the video model runs in its region in Johor, Malaysia. It receives the script and picture instructions for an ad, which contain your company name and the claims you confirmed — not your logo, not your photos and not your email address. By its terms it does not use this data to train models, and it deletes it within 180 days after our contract with it ends at the latest.
• Anthropic — drafts scripts, picture instructions, monthly plans and replies to emails with its model Claude, and runs our search for businesses. Anthropic PBC, United States. It receives the details needed for the task: your company’s confirmed answers; for a reply, the email you sent us; and for the search for businesses, the business names and website addresses in web search results — it does not open company websites and never sees the email addresses we find. We use Claude through an individual subscription, so there is no data processing agreement with Anthropic: Anthropic handles these inputs under its own terms and privacy policy, not on our instructions alone.
• Stripe — takes payments, runs the checkout page and the customer portal and sends our invoices. Stripe Payments Europe, Limited, Dublin, Ireland, with Stripe, Inc., United States. Stripe processes card and payment data partly as its own controller, under its own privacy policy, for example to prevent fraud and to meet financial regulation.

Some of these companies are based outside the European Union — in the United States, Singapore or Malaysia — so data about you can be processed there. Vercel, Google and Stripe are certified under the EU–US Data Privacy Framework. For the others, and for Anthropic in particular, their own terms apply.

We do not sell or rent your details to anyone, and we do not use them to train any model. What Anthropic may do with the inputs under its own terms is set out in its entry above.

Where it is stored

Your answers and your logo live in a Supabase project hosted in Frankfurt, Germany, inside the EU. The finished files are kept on our own computer in Germany and in Google Drive. Our email lives in Google Workspace. A nightly backup of the database is kept on our own computer in Germany.

While you fill in one of our forms, your answers are kept in your own browser on that device, for up to 30 days, so a reload or a lost connection does not cost you what you have typed. They stay on that device: nothing reaches us until you send the form, and they are deleted as soon as you do. The consent box and your logo file are never kept this way.

How long we keep it

Customers: we keep your answers, your logo and the files as long as we work together, and for two years afterwards — because a confirmation has to be provable later. Then we delete them. Details that go stale, such as a phone number, an offer or a price, expire after 90 days and we ask again rather than reuse an old answer.

Requests for a free ad: the IP address and browser type are deleted after 30 days. A request that goes no further — because it fails our checks, we decline it, it is cancelled as not yours, or its confirmation link expires — is anonymized 90 days later: we replace the personal details and keep only a one-way hash of the email address, so the same address cannot be used to flood our form. When a request is confirmed, the check result stays with the confirmation as proof of how it came about.

Addresses we found ourselves: if we found an address and never wrote to it, we delete it 90 days after we found it. If we wrote and you never replied, we delete the address, the company record and the emails 12 months after the last one. If you unsubscribe, we keep the address by itself on a do-not-contact list, without a time limit, and delete the rest — keeping that one line is the only way we can be sure we never write to you again.

Invoices and accounting records are kept for as long as German law requires, currently eight years for invoices. Server logs are kept by our host only briefly, for operation and security.

Your rights

You can ask for access to your data, correction, deletion, restriction of processing and a copy in a portable format. You can object to any processing based on our legitimate interest — and to email outreach at any time, without giving a reason.

Write to hello@jobsitecreative.com. We answer quickly, and we act within one month at the latest, as the GDPR requires.

You also have the right to lodge a complaint with a data protection supervisory authority. For us, that is the Bavarian State Office for Data Protection Supervision (BayLDA), Promenade 18, 91522 Ansbach, Germany.

Automated decisions

The checks described above are run by a machine, and a request that fails the basic ones is dropped without a reply. Some routine replies to emails — questions about prices, plans, the process and deadlines, or a request for a form or a link — are drafted and sent automatically; anything about money, disputes, cancellation, legal questions, privacy or complaints is read by a person first. None of this is a decision with a legal effect on you as a person — you can always write to us and have a person look at it. We do not profile you and we do not score you.

Do you have to give us anything?

No. Without the required fields we cannot check your request or build your ad — but leave an optional question blank and that subject simply does not appear in it. The conditions for the free ad and for a plan are on Terms; what we do about AI is on AI and ownership.