Privacy policy

01Controller

The controller within the meaning of Art. 4(7) GDPR is:

A data protection officer is not required by law and has not been appointed. For questions about data protection, please use the contact details above.

02Principles of processing

As a rule, we process our users' personal data only to the extent necessary to provide a functioning website and our content and services. We process personal data only where there is a legal basis under Art. 6 GDPR. Which one applies is stated in each section.

Personal data is any information relating to an identified or identifiable natural person (e.g. name, address, email address, IP address).

Possible legal bases are in particular: consent (Art. 6(1)(a) GDPR), performance of a contract or pre-contractual measures (point b), legal obligation (point c) and legitimate interest (point f).

03Hosting & server log files

This website is provided as a static site via GitHub Pages, a service of GitHub, Inc., 88 Colin P. Kelly Jr. Street, San Francisco, CA 94107, USA (part of Microsoft).

When you visit the website, GitHub as the host automatically collects information that your browser transmits and stores it in so-called server log files. This may include in particular:

• IP address of the requesting device
• date and time of access
• page or file requested and amount of data transferred
• referrer URL (previously visited page)
• browser type, language and operating system

This data serves the technical provision, security and stability of the website and is not combined with other data sources.

As GitHub may process data in the USA, data is transferred to a third country. GitHub bases this on appropriate safeguards (e.g. EU standard contractual clauses / EU-US Data Privacy Framework). For more information, see GitHub's privacy statement: GitHub Privacy Statement.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in secure, efficient provision)

04Fonts (self-hosted)

To display fonts consistently, this website uses fonts (including Archivo, Fraunces, Hanken Grotesk, JetBrains Mono) that are delivered locally from our own server (self-hosting).

No connection to Google servers is made for this. The font files are loaded exclusively from our server; your IP address or other personal data is therefore not transmitted to Google or to the USA.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in consistent, data-minimising display)

05Audience measurement (own count, without cookies)

To understand which content is in demand, we count page views with our own, very data-minimising measurement. No cookies are set, no identifiers are assigned and no IP addresses are stored. Recognising individual people is therefore technically impossible.

Only three items are stored per view: the page visited (e.g. "/preise/"), the name of the referring website (e.g. "instagram.com" – never the full address or search terms) and the rough device class ("mobile" or "desktop"). All other information is discarded on receipt.

In the request form we count in the same way which of the five steps was shown and whether the request was sent – without your entries and without an identifier. This shows us where the form is too complicated.

The evaluation takes place on our own infrastructure (Cloudflare D1, location EU); there is no disclosure to third parties and no combination with other data sets. If your browser signals "Do Not Track", nothing is counted at all.

As no personal data is processed and there is no access to your device within the meaning of § 25 TDDDG, neither consent nor a cookie banner is required.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in designing the website according to demand)

06Onboarding form

If you contact us or submit your details via our onboarding form after a purchase, we process the data you enter to handle our collaboration and answer your request. Depending on the form fields, this may include:

• name or contact person
• email address
• phone number
• company / brand / business
• information on your goals, social media channels, reach and plans

Purpose: carrying out pre-contractual measures and performing the contract or the commissioned services, contacting you and individual support as part of our social growth offer.

The information is transmitted directly to our internal CRM (see "Client portal & internal CRM"); no external form service is involved.

Legal basis: Art. 6(1)(b) GDPR (contract / pre-contractual measures); additionally point a (consent) for voluntary additional information

07Discovery call request (form)

Via the free preview on start.social2scale.com (choice "Someone who does it for me"), prospects can request a discovery call without obligation; the former "request a discovery call" page redirects there. We process the data provided solely to handle your request, call you back personally and check whether working together is a good fit. We collect:

• name
• email address
• phone number (for the call-back)
• business / role, topic and – if provided – Instagram name
• information on your status quo, goals, budget range and desired start (where filled in)
• optionally: how you heard about us
• where you came to the form from: an identifier in our own links (e.g. "bio" for the link in our Instagram profile) and the domain name of the previously visited page, without the full path. Nothing is stored in your browser for this.

Purpose: handling the contact request and carrying out pre-contractual measures (discovery call). Technical transmission and storage take place via Cloudflare and Brevo (see the following sections).

Legal basis: Art. 6(1)(b) GDPR (pre-contractual measures) and point f (legitimate interest in handling contact requests); voluntary additional information point a (consent)

08Free preview

On start.social2scale.com you can have a free preview of your Instagram presence built. For this we process your email address, your name or Instagram name, your details on your work and topic and, if you upload one, your profile photo. We first send you a confirmation email; the preview is only created after you confirm. We delete unconfirmed requests after 30 days.

The post texts are written from your details by an AI language model from Anthropic (Claude). An uploaded profile photo is first checked by an AI model from Anthropic for obviously inadmissible content; if it is rejected, we show the preview without the photo. We store your details, photo and preview with Cloudflare (D1, R2, see No. 13) for as long as you use the preview and we are in contact with you about working together. You can request deletion at any time (No. 16). If you voluntarily allow it, we show your preview without your name as an example; you can withdraw this consent at any time by messaging info@social2scale.com.

Legal basis: Art. 6(1)(b) GDPR (creating the requested preview); Art. 6(1)(a) GDPR (permission to show as an example); Art. 6(1)(f) GDPR (abuse prevention by checking the photo)

09Appointment booking (Calendly)

After you have sent a discovery call request, you can book an appointment directly via a link; the same link is in the confirmation email. It leads to the booking calendar of Calendly, Inc., 115 E Main St., Ste A1B, Buford, GA 30518, USA. Calendly is not embedded in our pages: a connection to Calendly is only made when you click the link. So that you do not have to type anything twice, the link passes your name and email address from the request to the booking form.

We process the information you provide when booking (name, email address, chosen appointment, note if any) and technical connection data such as the IP address. Calendly processes this data on our behalf (data processing terms: calendly.com/dpa). Processing in the USA is possible; Calendly is certified under the EU-US Data Privacy Framework. Calendly's cookie settings also apply on the booking page.

More information: Calendly privacy.

Legal basis: Art. 6(1)(b) GDPR (pre-contractual measures — arranging the discovery call)

10Bot protection (Cloudflare Turnstile)

To protect our request form against automated abuse (spam, bots), we use Cloudflare Turnstile, a service of Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA. Turnstile checks in the background whether the input comes from a human.

Information such as IP address, browser and device data and interaction signals may be processed; Turnstile may use a technically necessary token or cookie for this. A transfer to the USA is possible; Cloudflare bases this on appropriate safeguards (EU standard contractual clauses / EU-US Data Privacy Framework).

More information: Cloudflare privacy.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in security and protection against abuse)

11Transmission & contact management (Cloudflare Worker & Brevo)

When the request form is submitted, the data is transmitted to a processing function (Cloudflare Worker, Cloudflare, Inc., USA) that checks and forwards the entries. For abuse prevention (rate limit), your IP address is also processed.

To notify us of and manage the request, we use Brevo (Sendinblue GmbH, Koepenicker Strasse 126, 10179 Berlin, or Brevo SAS, 106 boulevard Haussmann, 75008 Paris, France). Brevo creates a contact from your information and sends us the request by email.

Data processing agreements under Art. 28 GDPR are in place with Cloudflare and Brevo. Privacy notices: Brevo · Cloudflare.

Legal basis: Art. 6(1)(b) GDPR (pre-contractual measures) and point f (secure, efficient handling of requests)

12Payment processing (Digistore24)

Our services are purchased before reaching this website via the payment and sales service provider Digistore24 (Digistore24 GmbH, St.-Godehard-Strasse 32, 31139 Hildesheim, Germany). Digistore24 acts as reseller / payment processor.

The data required for payment (e.g. name, email address, billing and payment data) is collected directly by Digistore24 and processed there under its own responsibility. We receive from Digistore24 the information necessary for order and client management.

Details on data processing by Digistore24 can be found in its privacy policy: Digistore24 privacy.

Legal basis: Art. 6(1)(b) GDPR (contract processing); point c (statutory retention obligations)

13Client portal & internal CRM

To handle our collaboration, we operate a password-protected client portal (Social Hub) at mein.social2scale.com and an internal client management system (CRM) at closing.social2scale.com. Both run on the infrastructure of Cloudflare (Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA); the data is stored in a database (Cloudflare D1) and – where you upload files – in an object store (Cloudflare R2).

We process there the information you submit via our forms (onboarding, briefing, discovery call request, feedback) as well as the status and history of our collaboration. Depending on the process, this may include:

• name, email address and phone number
• company / brand, industry and information on goals, channels and plans
• files you upload (e.g. logo) in the object store
• status, notes and history of support and your feedback
• technical data for abuse prevention (e.g. IP address for rate limits)

Purpose: organisation, performance and documentation of the commissioned services, internal client management and provision of your personal area (e.g. presentations / decks).

AI assistance

We use AI language models from Anthropic (Claude, Anthropic PBC, USA) for two purposes: (1) to prepare conversations, we summarise the information stored about a client in the CRM; (2) in the free preview, the model writes the post texts and checks an uploaded profile photo (see No. 08). No AI makes a decision about you with legal effect within the meaning of Art. 22 GDPR.

Data processing agreements under Art. 28 GDPR are in place with Cloudflare and Anthropic; for transfers to the USA, appropriate safeguards (EU standard contractual clauses / EU-US Data Privacy Framework) are used. Privacy notices: Cloudflare · Anthropic.

Legal basis: Art. 6(1)(b) GDPR (contract / pre-contractual measures) and point f (legitimate interest in efficient client management)

14Community (Skool)

For exchange with us and among members, we run a community on the Skool platform of Skool.com, Inc., USA. Members are clients of social2scale and prospects who are just getting to know us. Taking part is voluntary. Your contractual services do not depend on it.

Who is responsible?

We are responsible for the group: for its settings, admitting and removing members, the joining questions and recordings. According to its own statements, Skool processes the group's content on our behalf. Skool does not publicly offer a data processing agreement under Art. 28 GDPR; we have requested one. For your Skool account itself (sign-up, profile, use of other groups), Skool is responsible under its own terms.

Which data?

Name, profile picture and profile information, posts, comments and reactions, your activity in the group, participation in live calls and your answers to the joining questions (consent, Instagram name). If you consent via your Social Hub, we also store your decision there: time, your answers and the version of the text you saw.

Who sees what?

All members see your name, profile picture, posts and activity. This may reveal that you are in contact with us. As operator, we also see your answers to the joining questions. We use the Instagram name to match members to our client directory (No. 13).

Transfer to the USA

Skool processes the data in the USA. Skool is not certified under the EU-US Data Privacy Framework (official list checked on 1 November 2026), and no EU standard contractual clauses have been agreed between us and Skool. We therefore base the transfer on your explicit consent (Art. 49(1)(a) GDPR). The risk: in the USA your data is not protected to an equivalent level. US authorities can access it without you having the same legal remedies as in the EU.

Live calls

We only record a live call if we announce it in advance, and only people who have given separate consent. Anyone who has not consented takes part without camera and microphone during the recording, or we pause the recording. We make recordings available to all members in the group on Skool. We keep a copy ourselves (Cloudflare R2, No. 13, and a backup on our own computers), where we also create the subtitles. We delete all copies, including the one on Skool, no later than 12 months after the call. After a withdrawal, we cut you out of existing recordings; where that is not fully possible, we delete the recording.

How long?

We keep your decisions about the community (consent, change, exit) as evidence until the end of the 3rd year after you leave. We delete your answers to the joining questions and the match to our client directory when you leave. When you leave, we also delete your posts and comments in the group; if you want them to stay, tell us when you leave. Your membership lasts until you leave or we close the group. You delete your Skool account yourself at Skool.

Withdrawal and leaving

You can leave at any time and withdraw any consent with effect for the future: in the Social Hub using the leave or change button, or with an informal message to info@social2scale.com. We remove you from the group without undue delay. Prospects without a Social Hub send a message to Phil in Skool or to info@social2scale.com.

More information: Skool privacy.

Legal basis: Art. 6(1)(a) GDPR (membership); Art. 49(1)(a) GDPR (transfer to the USA); separate consent under Art. 6(1)(a) GDPR and § 22 KUG (recordings); Art. 6(1)(f) GDPR (evidence of consent, Art. 7(1) GDPR)

15Storage period

We process and store personal data only for as long as necessary to achieve the respective purpose or as required by statutory retention periods (e.g. commercial and tax retention periods of up to 10 years).

Server log files are regularly deleted or anonymised by the host after a short time. We delete request data from the form as soon as it is no longer needed to handle your request or perform the contract and no statutory retention obligations apply.

16Your rights

As a data subject, you have in particular the following rights under the GDPR:

• right of access (Art. 15 GDPR)
• right to rectification (Art. 16 GDPR)
• right to erasure / "right to be forgotten" (Art. 17 GDPR)
• right to restriction of processing (Art. 18 GDPR)
• right to data portability (Art. 20 GDPR)
• right to object to processing (Art. 21 GDPR)
• right to withdraw consent with effect for the future (Art. 7(3) GDPR)

To exercise your rights and for any questions about data protection, an informal message to info@social2scale.com is sufficient.

17Right to lodge a complaint

Without prejudice to any other remedy, under Art. 77 GDPR you have the right to lodge a complaint with a data protection supervisory authority if you consider that the processing of your personal data infringes the GDPR.

The competent authority is usually the supervisory authority of your habitual residence or that of the controller. For the controller this is the Bavarian State Office for Data Protection Supervision (BayLDA), Promenade 18, 91522 Ansbach (www.lda.bayern.de).

18Automated decision-making & updates

No automated decision-making, including profiling, within the meaning of Art. 22 GDPR takes place.

We reserve the right to amend this privacy policy so that it always meets current legal requirements or to reflect changes to our services. The version current at the time of your visit applies.