Privacy

1. Controllers

Paul Hölzl and Ben Braunsperger (Pipeline AI Solutions, a civil-law partnership under Austrian law) are joint controllers pursuant to Art. 26 GDPR. Data subjects may exercise their rights against either of them. Contact point: [email protected]

Paul Hölzl
Edholz 10
4115 Kleinzell im Mühlkreis
Austria
Phone: +43 681 2076 4203

Ben Braunsperger
Pöchtragerweg 9
4113 St. Martin im Mühlkreis
Austria
Phone: +43 677 64163557

2. General information

We process personal data only to the extent necessary to provide this website and the Pipeflow application, to handle enquiries, or to meet contractual and legal obligations. The relevant rules are in particular the General Data Protection Regulation (GDPR) and the applicable Austrian data protection provisions.

3. Hosting and technical access data

This website is provided via Railway (Railway Corporation, 548 Market St PMB 68956, San Francisco, CA 94104, USA). When you visit the website, technically necessary data may be processed, in particular IP address, date and time, the page requested, browser and device information as well as error and security logs.

The processing is based on Art. 6(1)(f) GDPR. Our legitimate interest lies in the secure and reliable provision of the website. Data may be transferred to the USA. The transfer relies on the European Commission adequacy decision on the EU-US Data Privacy Framework (Art. 45 GDPR), under which Railway states that it is certified; in addition, Railway’s data processing agreement provides for the European Commission’s standard contractual clauses (Implementing Decision (EU) 2021/914, Art. 46 GDPR). Further information can be found in Railway’s privacy policy.

4. Contacting us and the contact form

If you contact us by email, phone or through the contact form, we process the details you send us, i.e. name, email address and message, to handle your enquiry and for possible follow-up questions. By submitting, your details are processed in order to handle your enquiry.

If you use the contact form, your details and the page you are writing from are sent to our contact service, which is also operated at Railway. From there the message is sent to [email protected] via the email delivery service Resend (Resend, Inc., USA; sent via servers in Ireland). To protect against abuse, your IP address is briefly held in memory to limit the number of requests; it is not stored permanently. Data may be transferred to the USA at Railway and Resend (see section 10).

Our mailbox is operated by Hostinger (Hostinger International Ltd., Cyprus). The legal basis is Art. 6(1)(b) GDPR for pre-contractual or contractual enquiries and otherwise Art. 6(1)(f) GDPR (legitimate interest in handling your enquiry efficiently). We store enquiries only as long as necessary for handling them and any follow-up communication; statutory retention obligations remain unaffected.

5. Chat assistant and logging

You can ask an AI assistant questions via the contact window. It is labelled “AI assistant”; you are not writing with a human. Only when you send a message are your message and the most recent messages of the conversation forwarded via our server (Railway) and an intermediary service for AI interfaces to an AI model that generates the answer. Models from the providers DeepSeek (China), Anthropic (USA) and Google (USA) are used; which model answers depends on availability (see section 10). Please do not enter confidential data, credentials or special categories of personal data in the chat. Use is voluntary; you can always write to us via the contact form instead.

For quality assurance, to improve the answers and to detect abuse, we log chat messages in an internal evaluation system that we operate at Railway: time, your message, the assistant’s reply, your IP address, the approximate origin (country, where determinable), browser and device type, the page you were on, the language, the model used, the response time and a technical conversation ID. Only our team has access, and login is password-protected. These logs are deleted automatically after 90 days; on request we delete entries relating to your IP address or conversation earlier. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in securing and improving the service); you can object to this processing at any time (see section 11). No cookies are set for this.

6. Post idea generator and image creation

For the free post idea generator, your input (business, topic, channel) is sent to our contact service at Railway and forwarded from there, as with the chat, via an intermediary service for AI interfaces to an AI model (providers: see section 10) that generates the suggestions. The suggestions and images are labelled “created with AI”. We do not store your input or the suggestions.

For Instagram, the image service fal.ai (USA) also creates an image. Only a short image description derived from your input is transmitted for this. [TODO: state the concrete storage period of the images at fal.ai]

To protect against abuse, your IP address is briefly held in memory to limit the number of requests; it is not stored permanently. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in providing and protecting the free service).

7. Connecting social media accounts

If you use the Pipeflow application at app.pipeflow.at, you can connect your Instagram account (business or creator account, platform: Meta) and your personal LinkedIn profile. The connection runs through the official authorisation dialogs of Meta and LinkedIn. Pipeflow does not receive any passwords. You can withdraw access at any time in the settings of your Instagram or LinkedIn account.

For the connection, Pipeflow stores the access tokens issued by Meta and LinkedIn. They are used only to publish posts you have approved and to show you statistics about your posts. [TODO: add exact permissions, storage location (provider, region) and encryption of the tokens]

If you disconnect or cancel your account, we delete the stored access tokens immediately. TODO: verify in the app or implement] The legal basis is performance of the user agreement (Art. 6(1)(b) GDPR). Posts that have already been published remain in your own account. How to request deletion of your data is explained under [Data deletion.

8. Data of Pipeflow customers

When you use Pipeflow, we process on your behalf the content of your website, the posts and images created by Pipeflow, the approval status of your posts and the statistics on published posts. The details are governed by the data processing agreement. Sign-in is done with your Google or Microsoft account; we receive the details that the respective provider releases at sign-in (such as name and email address).

We store this data until your access is cancelled and delete it automatically 30 days afterwards. [TODO: verify automatic deletion in the app or implement] The legal basis is performance of the user agreement (Art. 6(1)(b) GDPR).

9. Cookies, analytics and external media

This website does not set any cookies. In the post idea generator, your browser stores a small counter (name pf-ideen, local storage) of how many rounds you have done on the same day. It stays in your browser for 24 hours, is not sent to us and only serves to limit free use to two rounds per day. It is technically necessary to protect the service against abuse (§ 165(3) Austrian Telecommunications Act 2021, Art. 6(1)(f) GDPR). Otherwise the website stores no data in your browser. No analytics, marketing or tracking services from third parties are used (for chat logging see section 5). There is no audience measurement and no cross-device tracking. Images and fonts are loaded from our own web server; no content from third-party servers is embedded.

The fonts are loaded directly from our own web server. No data is transmitted to Google or other font providers.

10. Recipients, service providers and third-country transfers

Only Paul Hölzl and Ben Braunsperger and the following service providers have access to personal data, to the extent required for the respective purpose:

Railway (Railway Corporation, USA): hosting of the website and the contact service, operation of the internal chat log. Data: access data, form and chat content passed through, chat logs (90 days). Legal basis: Art. 6(1)(f) GDPR.

Resend (Resend, Inc., USA; sent via servers in Ireland): delivery of messages from the contact form. Data: name, email address, message. Legal basis: Art. 6(1)(b) and (f) GDPR.

Hostinger (Hostinger International Ltd., Cyprus, EU): mailbox. Data: emails to [email protected]. Legal basis: Art. 6(1)(b) and (f) GDPR.

Intermediary service for AI interfaces: forwards requests to the respective AI model. [TODO: confirm name, seat and data processing agreement of the intermediary service]

Anthropic (Anthropic, PBC, USA) and Google (Google LLC, USA): AI models for the chat and the post idea generator. Data: chat messages or input in the generator. Legal basis: Art. 6(1)(f) GDPR.

DeepSeek (China): AI model for the chat and the post idea generator, as above. There is no European Commission adequacy decision for transfers to China. [TODO: clarify the legal basis for the transfer or remove DeepSeek from the model order]

fal.ai (USA): creation of images in the generator. Data: short image description. Legal basis: Art. 6(1)(f) GDPR.

Meta (Instagram) and LinkedIn: only if you connect your accounts in the application and have posts published. The platforms process the data as independent controllers under their own privacy policies.

Google and Microsoft: only for signing in to the application, if you sign in with your account there.

Transfers to the USA rely on the European Commission adequacy decision on the EU-US Data Privacy Framework (Art. 45 GDPR) where the provider is certified, and otherwise on the European Commission’s standard contractual clauses (Art. 46 GDPR). [TODO: confirm for Resend, Anthropic, Google and fal.ai whether DPF certification or standard contractual clauses apply]

11. Your rights

Where the legal requirements are met, you have the right of access, rectification, erasure, restriction of processing, data portability and objection. You can withdraw any consent given at any time with effect for the future.

To exercise your rights, write to [email protected]. You also have the right to lodge a complaint with a data protection supervisory authority. In Austria this is the Austrian Data Protection Authority (www.dsb.gv.at), Barichgasse 40–42, 1030 Vienna.

12. Data security and updates

We use appropriate technical and organisational measures to protect data against loss, misuse and unauthorised access. We will update this privacy policy if the website, the services used or legal requirements change.

Last updated: 24 October 2026