ai-toolfinder
ENDE
Submit a tool

Privacy

This privacy policy applies to ai-toolfinder.com, including the German version at ai-toolfinder.com/de. The address ki-toolfinder.de redirects there.

Summary

  • You can use the directory without an account and without cookies.
  • We use no advertising or marketing cookies, no Google Analytics and no Meta pixel.
  • Accounts, reviews and uploaded files are stored with Supabase in the Frankfurt am Main region.
  • From a review we publish the text, stars, context details, verification level and display name. We never publish your email address.

Controller

Nick Schäfer, Nick's Advisory, An der Mannsfaust 9, 60599 Frankfurt am Main, Germany, email: nick@nicksadvisory.com

Please send any data protection questions to this address as well.

Visiting the website and server logs

The website runs on Vercel. The server functions are located in Frankfurt am Main. Vercel delivers pages, images and scripts through a worldwide server network, usually from the location closest to you.

With every request, Vercel processes the data your browser sends for technical reasons: IP address, time, requested address, previous page (referrer), browser, operating system and technical details such as the status code. This is necessary to deliver the pages, fend off attacks and find errors. The legal basis is our legitimate interest in a secure and working website (Art. 6(1)(f) GDPR).

We only look at the logs in case of faults or attacks. How long Vercel keeps data for its own security purposes is described in Vercel's privacy policy.

Audience measurement with Vercel Web Analytics

To see which pages are used, we use Vercel Web Analytics. It sets no cookies. For each page view it records the time, page address, referrer, approximate location (country, region, city), operating system, browser and device type. To count visits, Vercel creates a hash from the request and discards it after 24 hours. According to Vercel, the data points are not linked to an IP address and cannot be combined across websites. We only see aggregated figures.

The legal basis is our legitimate interest in improving the directory based on how it is used (Art. 6(1)(f) GDPR). You can object (see Right to object).

Cookies and browser storage

We only store information in your browser if this is strictly necessary for a function you expressly use (Section 25(2) no. 2 of the German Telecommunications Digital Services Data Protection Act, TDDDG). This concerns signing in: after you log in, Supabase sets a session cookie so that you stay signed in. It remains stored until you sign out, delete it or it expires. The legal basis for the related processing is Art. 6(1)(b) GDPR.

We do not set advertising, marketing or statistics cookies.

Fonts, logos and links to vendors

We serve fonts from our own server. Your browser does not connect to Google Fonts or any other font service.

We fetch the logos of listed tools server-side from the vendors' websites or through Google's favicon service and serve them from our own server. Your browser does not connect to Google or to the vendors for this. No visitor data is transmitted.

Links to vendors go through our own redirect (/go/ plus the tool's name). It counts how often a tool was clicked and stores only the tool, the place on our website where the click came from, and the time. We do not store the IP address or a user identifier for this, and the count contains no personal data. After the redirect, the vendor's privacy policy applies. As with any link, the vendor's server receives your IP address and the usual browser details.

User account and sign-in

You only need an account to write a review, submit a tool or take over a profile as a vendor.

  • Data: email address, a display name if you choose one, an internal user ID, time of registration and of the last sign-in.
  • Sign-in by email link: Supabase sends you an email with a link that works only once. There is no password.
  • Security logs: Supabase logs sign-ins and database access with IP address, browser details and time in order to detect misuse and find errors.
  • Legal basis: Art. 6(1)(b) GDPR (user agreement under our Terms of use), for the security logs Art. 6(1)(f) GDPR.

You can delete your account at any time under Account or ask us to do so by email. When we delete the account, we also delete your reviews, replies to reviews, submissions and requests to take over a profile. Tool profiles that resulted from your submissions remain, without any reference to you. Entries in the moderation log remain until their retention period ends.

We cannot create an account without an email address. You can use the directory itself without an account.

Sign-in with LinkedIn (if offered)

If we offer sign-in with LinkedIn and you use it, your browser takes you to LinkedIn. After you agree there, LinkedIn sends us your name, your email address, a link to your profile picture, your language setting and an identifier that only applies to our website. We use this data to create your account and sign you in. The legal basis is Art. 6(1)(b) GDPR. LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland, is itself responsible for the processing at LinkedIn. Details are in LinkedIn's privacy policy.

Reviews

When you review a tool, we process:

  • stars for the overall rating and the sub-ratings, the title and texts of the review,
  • context details: company size, industry, country, role and length of use,
  • your display name and the language of the review,
  • verification details: whether your email address is confirmed, whether it belongs to a company domain and whether proof of use exists,
  • your statements on whether the vendor invited you and whether you received anything in return,
  • moderation details: status, decision, reasons and timestamps.

We publish the text, stars, context details, display name, verification level and the notes on invitation or incentive. We never publish your email address or your proof of use, and vendors do not receive them either. Please keep in mind that context details and text together may allow colleagues or the vendor to recognise you. Choose your display name and details with this in mind.

For verification, the system compares the domain of your email address with a list of free email providers and with the domain of the reviewed tool. It blocks reviews of your own tool and a second review of the same tool from the same account. It flags domains of competitors and unusually many reviews in a short time for review. Nick decides on publication personally after reading the review. We do not make automated decisions within the meaning of Art. 22 GDPR. If an automatic block affects you wrongly, Nick will look at the case when you contact us.

The legal basis for publishing and displaying your review is Art. 6(1)(b) GDPR. We base the checks for misuse and conflicts of interest on Art. 6(1)(f) GDPR. Our legitimate interest, and that of readers, lies in reliable reviews.

Published reviews can be accessed worldwide and may be indexed by search engines. After deletion, copies may remain visible in search engines for some time. We have no influence on this.

Proof of use (if offered)

If this function is offered, you can upload a screenshot from the tool while signed in to it, or an invoice. The file is kept in non-public storage with Supabase in the Frankfurt am Main region. Only Nick sees it, and only to check the use. We delete the file 30 days after the decision. Before uploading, black out anything that is not needed for the check, such as names of other people, bank details or prices.

The legal basis is Art. 6(1)(b) GDPR. For details about other people that are nevertheless included, Art. 6(1)(f) GDPR applies.

Tool submissions

When you submit a tool, we process your details on the tool (name, website, description, category, countries), your relationship to the tool and the link to your account. The system compares the domain of your email address with the tool's website to recognise submissions from vendors. We describe accepted tools in our own profile. Your name and email address do not appear there. The legal basis is Art. 6(1)(b) GDPR.

Profile takeover and vendor replies

Anyone taking over a profile for a vendor signs in with an email address at the tool's domain. We process this address, the link to the tool and the status of the request. We publish replies to reviews as replies from the vendor, not under the name of the person who writes them. The legal basis is Art. 6(1)(b) GDPR.

Reports of illegal content

Anyone can report content, also without an account. We process your email address, your name if you provide it, the reported content, the reason and your explanation. We confirm receipt and tell you our decision. The legal basis is Art. 6(1)(c) GDPR in conjunction with Article 16 DSA.

We only tell the person whose content you report your name and email address if this is strictly necessary in an exceptional case (Article 17(3)(b) DSA). In that case we inform you beforehand.

Moderation log

We record every decision on reviews, submissions, requests, replies and reports in a log: the entry concerned, the decision, the ground, the reasons and the time. The log contains no email addresses. This allows us to prove decisions later and to defend ourselves against claims. The legal basis is Art. 6(1)(f) GDPR.

Email contact

When you write to us, we process your email address, your name and the content of your message to handle your request. The legal basis is Art. 6(1)(b) GDPR where it concerns your account or your content, Art. 6(1)(c) GDPR for requests under the DSA or the GDPR, and Art. 6(1)(f) GDPR otherwise. Our mailbox is run by Google (Google Workspace).

Badges on other websites

Vendors can add a "Listed on ai-toolfinder.com" badge to their website. If a website loads the badge from our server, Vercel processes the connection data of that website's visitors (IP address, time, page on which the badge is embedded, browser details) in order to deliver the image file. We do not analyse these requests in relation to individuals. The legal basis is Art. 6(1)(f) GDPR. Vendors can also host the image file on their own server. Then no data reaches us.

Recipients and processors

These service providers process data on our behalf and on our instructions, based on a contract under Art. 28 GDPR:

  • Vercel Inc., 440 N Barranca Avenue #4133, Covina, CA 91723, USA: hosting, delivery of the website, audience measurement.
  • Supabase Pte. Ltd., 65 Chulia Street #38-02/03, OCBC Centre, Singapore 049513: database, sign-in, file storage and sending of sign-in emails. The data is stored in the Frankfurt am Main region (eu-central-1).
  • Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland: email mailbox (Google Workspace).

Other recipients:

  • LinkedIn Ireland Unlimited Company, only if you sign in with LinkedIn (see above).
  • Authorities, courts or persons whose rights have been infringed, only if we are legally obliged or permitted to disclose data. Examples: a court order under Section 21 TDDDG, orders under Articles 9 and 10 DSA, a suspected criminal offence that threatens life or safety (Article 18 DSA). The legal basis is Art. 6(1)(c) GDPR, otherwise Art. 6(1)(f) GDPR.

Vendors receive no data from us that is not public anyway. We do not pass anything to advertising networks or data brokers.

Transfers outside the EU

  • Vercel: Vercel Inc. is based in the USA and certified under the EU-US Data Privacy Framework. The basis is the European Commission's adequacy decision of 10 July 2023 (Art. 45 GDPR). Our contract with Vercel also contains the European Commission's standard contractual clauses.
  • Supabase: The data is stored in Frankfurt am Main. Supabase and its subprocessors may access it for operations and support from Singapore, the USA and other countries. The basis is the European Commission's standard contractual clauses (Implementing Decision (EU) 2021/914, Art. 46(2)(c) GDPR).
  • Google: Data may be processed in the USA. Google LLC is certified under the EU-US Data Privacy Framework, and standard contractual clauses also apply.
  • LinkedIn processes data under its own responsibility, also in the USA.

You can request a copy of the standard contractual clauses.

How long we keep data

  • Server logs: available in our Vercel account for 30 days at most, shorter depending on the plan.
  • Audience measurement: Vercel discards the counting hash after 24 hours. After that, the statistics only contain aggregated values.
  • Security logs at Supabase: seven days at most.
  • Account: until you delete it.
  • Published reviews and replies: until you delete them or your account, or until we remove them.
  • Rejected or removed reviews, submissions, requests and replies: six months after the decision, so that you can object during this time.
  • Accepted submissions and confirmed profile takeovers: until you delete the account or the link ends.
  • Proof of use: 30 days after the decision.
  • Reports: six months after the decision.
  • Moderation log: three years after the decision.
  • Emails: until your request has been dealt with. Emails about moderation decisions and objections: three years after the decision.

Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16 GDPR), erasure (Art. 17 GDPR), restriction of processing (Art. 18 GDPR) and data portability (Art. 20 GDPR). To exercise them, write to nick@nicksadvisory.com. You can also delete your account yourself.

Right to object

Where we process data on the basis of Art. 6(1)(f) GDPR, you can object at any time on grounds relating to your particular situation (Art. 21(1) GDPR). We will then stop processing the data unless we can demonstrate compelling legitimate grounds which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims.

Right to lodge a complaint

You can lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), in particular in the Member State where you live or work or where the alleged infringement took place. The authority responsible for us is the Hessian Commissioner for Data Protection and Freedom of Information, Postfach 3163, 65021 Wiesbaden, Germany, datenschutz.hessen.de.

Changes

We update this policy when functions of the website or the law change. The version published here applies.

Last updated: September 2026