Privacy Policy

1. Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) is:

Eslam Sabry
Niedereschbacher Stadtweg 15
60437 Frankfurt am Main
Email: eslam.sabry@sabtred.de

2. General information on data processing

We process personal data of our users only to the extent necessary to provide a functional website and our content and services. Processing generally takes place only with the user's consent (Art. 6(1)(a) GDPR) or on the basis of legitimate interests (Art. 6(1)(f) GDPR).

3. Hosting by Vercel

This website is hosted by Vercel Inc., 340 S Lemon Ave #4133, Walnut, CA 91789, USA. When you visit the website, Vercel automatically collects so-called server log files transmitted by your browser (including IP address, date/time of the request, browser type, referrer URL). This processing is based on our legitimate interest in a secure and stable provision of the website (Art. 6(1)(f) GDPR).

When our domains are accessed, a cookie named "sabtred-lang" (storage period one year) is set via Vercel's infrastructure, identifying the language of the respective domain. It is necessary for the website to be displayed correctly (Section 25(2) No. 2 TDDDG).

As Vercel Inc. is a US company, data is transferred to the USA. Vercel is certified under the EU-U.S. Data Privacy Framework (DPF). The transfer is based on the corresponding adequacy decision of the EU Commission (Art. 45 GDPR). A data processing agreement pursuant to Art. 28 GDPR is in place with Vercel.

4. Database and storage at Supabase

To store requests and savings quiz results, for the content of this website (texts, blog posts, images) and for logging in to the administration area, we use Supabase, a service of Supabase, Inc., USA. Our project's database is operated in Frankfurt am Main (region eu-central-1).

When you visit our pages, your browser retrieves content from this database. In the process, your IP address is transmitted to Supabase. The legal basis is our legitimate interest in a functional and efficient provision of the website (Art. 6(1)(f) GDPR).

A data processing agreement pursuant to Art. 28 GDPR is in place with Supabase. As Supabase, Inc. is a US company, access from a third country cannot be completely ruled out. The transfer is based on the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR), which form part of the data processing agreement.

5. Cookies, local storage, Google Analytics and Sentry

On your first visit we ask for your consent in a cookie banner. Without your consent, no analytics cookies are set and no data is sent to Google. You can change or withdraw your choice at any time via the "Cookie settings" link in the footer of the website.

The following are technically necessary (Section 25(2) No. 2 TDDDG, no consent required): the "sabtred-lang" cookie (see section 3), your language setting in your browser's local storage (localStorage, entry "sabtred-lang"), your cookie banner choice (localStorage, entry "sabtred-cookie-consent", stored for 12 months) and, when logging in to the administration area, a login token from Supabase. These entries contain no information that directly identifies you.

To be able to demonstrate your consent (Art. 7(1) GDPR), we record every choice you save in the cookie banner in our database (Supabase, Frankfurt): date and time, your choices, the version of the banner and this privacy policy, your language and a random ID that is also kept in your browser (localStorage, entry "sabtred-consent-id"). We do not store your IP address, name or email address with it. The legal basis is our legal obligation to demonstrate consent (Art. 6(1)(c) GDPR). We keep the records for as long as needed to be able to demonstrate consent. If you contact us about your consent, we can find your record using the random ID.

Only if you allow "Analytics" in the cookie banner do we use Google Analytics 4, a web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. This sets the cookies "_ga" and "_ga_*" (storage period up to two years) and transmits usage data (e.g. pages viewed, time on page, approximate location, device and browser information) and your IP address to Google. We use the analysis to improve our offering. The legal basis is your consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG). Google LLC is certified under the EU-U.S. Data Privacy Framework (DPF); the transfer to the USA is based on the corresponding adequacy decision of the EU Commission (Art. 45 GDPR). If you withdraw your consent, we delete the Google Analytics cookies and no longer load the script.

Only if you separately allow "Error monitoring" in the cookie banner do we use the error monitoring service Sentry, a service of Functional Software, Inc. (dba Sentry), 45 Fremont Street, 8th Floor, San Francisco, CA 94105, USA. If an error occurs, Sentry receives technical information (e.g. error message, page address, browser and device type, operating system) and your IP address, and measures page load performance on a sample of visits. Sentry sets no cookies and does not record your inputs or screen contents. The data is stored on servers in the EU (Germany). We use it to detect and fix technical problems. The legal basis is your consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG). A data processing agreement under Art. 28 GDPR is in place with Sentry. Access from the USA cannot be ruled out. Functional Software, Inc. is certified under the EU-U.S. Data Privacy Framework (DPF); the transfer is based on the corresponding adequacy decision of the EU Commission (Art. 45 GDPR), with the EU Standard Contractual Clauses as a fallback. If you withdraw your consent, the Sentry script is no longer loaded.

6. Audit request

If you request a free audit via our request form, we process the information you enter: salutation, first and last name, position, company, email address, phone number (optional), your message and a preferred appointment (optional). In addition, we store the time of the request, the language and the page from which the request was sent.

We use this data to process your request and to contact you. The legal basis is your consent, which you give by ticking the checkbox (Art. 6(1)(a) GDPR), and, insofar as the request is aimed at concluding a contract, Art. 6(1)(b) GDPR. You can withdraw your consent at any time with effect for the future.

The data is stored in our database at Supabase (see section 4). The storage period is governed by section 9.

After you submit it, your request is automatically forwarded to our automation system n8n, which we operate ourselves on our own hardware in Germany. n8n notifies us of your request and sends you an email confirmation of receipt via Google Workspace (see section 8). The connection to n8n runs through Cloudflare, a service of Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA, which receives and forwards the data in encrypted form but does not store it. A data processing agreement under Art. 28 GDPR is in place with Cloudflare. The legal basis is the same as stated above.

7. Savings quiz

In the savings quiz, you answer several questions about your company (industry, team size, departments, number and cost of your tools, duplicate work, biggest problem, start date and budget). From your answers we calculate an estimated monthly saving. If you enter and submit your contact details at the end, we store your answers, the estimate and your contact details to process your request. Legal basis, recipients and storage period are the same as in the section "Audit request".

8. Communication by email (Google Workspace)

For our email communication, in particular for answering your requests, we use Google Workspace, a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland ("Google"). If you write to us by email or we reply to a request, your email address, your name and the content of the messages are processed on Google servers.

The legal basis is Art. 6(1)(b) GDPR insofar as your request is aimed at concluding a contract, and otherwise our legitimate interest in answering requests efficiently (Art. 6(1)(f) GDPR).

A data processing agreement pursuant to Art. 28 GDPR is in place with Google. A transfer of data to Google LLC in the USA cannot be ruled out. Google LLC is certified under the EU-U.S. Data Privacy Framework (DPF). The transfer is based on the corresponding adequacy decision of the EU Commission (Art. 45 GDPR).

9. Storage period

We store personal data only for as long as is necessary for the respective purpose. We delete requests, quiz submissions and the related email correspondence 12 months after the last contact, unless statutory retention obligations apply. We retain invoice-related data in accordance with statutory requirements.

10. Recipients and transfers to third countries

Depending on how you use the website, recipients of your data are: Vercel Inc. (hosting), Supabase, Inc. (database, Frankfurt), Google Ireland Limited (email and, only with your consent, web analytics), Functional Software, Inc. / Sentry (only with your consent, error monitoring) and Cloudflare, Inc. (forwarding requests to our automation system). Insofar as data is transferred to the USA or access from the USA is possible, this takes place for Vercel, Google, Sentry and Cloudflare on the basis of the adequacy decision under the EU-U.S. Data Privacy Framework and for Supabase on the basis of the EU Standard Contractual Clauses.

11. Your rights as a data subject

You have the following rights at any time:

  • Access to your stored data (Art. 15 GDPR)
  • Rectification of inaccurate data (Art. 16 GDPR)
  • Erasure of your data (Art. 17 GDPR)
  • Restriction of processing (Art. 18 GDPR)
  • Data portability (Art. 20 GDPR)
  • Objection to processing (Art. 21 GDPR)
  • Withdrawal of consent given, with effect for the future (Art. 7(3) GDPR)
  • Lodging a complaint with a data protection supervisory authority (Art. 77 GDPR)

12. SSL/TLS encryption

For security reasons, this website uses SSL/TLS encryption. You can recognize an encrypted connection by "https://" in your browser's address bar.

13. Changes to this privacy policy

We reserve the right to amend this privacy policy so that it always complies with current legal requirements.

Last updated: 25 September 2026

Request an Audit