ai-toolfinder
ENDE
Submit a tool

Privacy

This privacy policy applies to ai-toolfinder.com, including the German version at ai-toolfinder.com/de. The address ki-toolfinder.de redirects there.

Summary

  • You can use the directory without an account and without cookies.
  • Google Analytics only runs if you agree in the cookie notice. There are no advertising or marketing cookies and no Meta pixel.
  • Accounts, reviews and uploaded files are stored with Supabase in the Frankfurt am Main region.
  • From a review we publish the text, stars, context details, verification level and display name. We never publish your email address.

Controller

Nick Schäfer, Nick's Advisory, An der Mannsfaust 9, 60599 Frankfurt am Main, Germany, email: nick@nicksadvisory.com

Please send any data protection questions to this address as well.

Visiting the website and server logs

The website runs on Vercel. The server functions are located in Frankfurt am Main. Vercel delivers pages, images and scripts through a worldwide server network, usually from the location closest to you.

With every request, Vercel processes the data your browser sends for technical reasons: IP address, time, requested address, previous page (referrer), browser, operating system and technical details such as the status code. This is necessary to deliver the pages, fend off attacks and find errors. The legal basis is our legitimate interest in a secure and working website (Art. 6(1)(f) GDPR).

We only look at the logs in case of faults or attacks. How long Vercel keeps data for its own security purposes is described in Vercel's privacy policy.

Audience measurement with Vercel Web Analytics

To see which pages are used, we use Vercel Web Analytics. It sets no cookies. For each page view it records the time, page address, referrer, approximate location (country, region, city), operating system, browser and device type. To count visits, Vercel creates a hash from the request and discards it after 24 hours. According to Vercel, the data points are not linked to an IP address and cannot be combined across websites. We only see aggregated figures.

The legal basis is our legitimate interest in improving the directory based on how it is used (Art. 6(1)(f) GDPR). You can object (see Right to object).

Error monitoring with Sentry

To notice and fix technical errors quickly, we use Sentry. If an error occurs on the website or on our server, Sentry receives an error report: type and location of the error in the program code, the page viewed without URL parameters, browser, operating system, device type and time. In addition, we measure the loading time for every tenth page view. We do not send names, email addresses, cookies, form contents or URL parameters, and storing IP addresses is switched off in the project settings. Sentry sets no cookies and does not record sessions. Reports go to Sentry via our own domain (ai-toolfinder.com/monitoring) and are stored in Frankfurt am Main. Sentry deletes them automatically after 30 days. The legal basis is our legitimate interest in an error-free and secure website (Art. 6(1)(f) GDPR); sending the error report from your browser is strictly necessary for this operation (Section 25(2) no. 2 TDDDG).

Cookies and browser storage

We only store information in your browser if this is strictly necessary for a function you expressly use (Section 25(2) no. 2 of the German Telecommunications Digital Services Data Protection Act, TDDDG). This mainly concerns signing in: after you log in, Supabase sets a session cookie so that you stay signed in. Alongside it we set the cookie atf_sitzung with the sign-in time and your last activity. Your browser deletes both when you close it. After 30 minutes without activity, or 8 hours after signing in at the latest, we sign you out automatically. The legal basis for the related processing is Art. 6(1)(b) GDPR.

We only set statistics cookies with your consent (see Statistics with Google Analytics). We store your choice in the cookie notice in your browser's local storage (atf-consent) so the notice does not appear on every visit. This is strictly necessary for that function (Section 25(2) no. 2 TDDDG). We do not set advertising or marketing cookies.

Statistics with Google Analytics (only with consent)

If you choose "Accept all" in the cookie notice or switch on statistics under "Settings", we load Google Analytics 4. Without your consent the script is not loaded and no data goes to Google.

Google Analytics sets the cookies _ga and ga followed by an ID. They are stored for up to two years. It records the pages you view, time on page, scroll depth, clicks on links to other websites, the page you came from, device type, browser, operating system, screen size, language setting and approximate location (country, region, city). According to Google, Google Analytics 4 does not store IP addresses. We do not use Google signals or a link to Google Ads. The reports show us which tools, comparisons and guides people need. Google Analytics keeps individual events for two months; after that only aggregated reports remain.

The legal basis is your consent (Section 25(1) TDDDG, Art. 6(1)(a) GDPR). You can withdraw it at any time through the "Cookie settings" link in the footer. We then delete the Google Analytics cookies. Withdrawal does not affect the lawfulness of processing before it.

The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google processes the data on our behalf. Data may also be transferred to Google LLC in the USA (see Transfers outside the EU).

Fonts, logos and links to vendors

We serve fonts from our own server. Your browser does not connect to Google Fonts or any other font service.

We fetch the logos of listed tools server-side from the vendors' websites or through Google's favicon service and serve them from our own server. Your browser does not connect to Google or to the vendors for this. No visitor data is transmitted.

Links to vendors in lists go through our own redirect (/go/ plus the tool's name). On fully researched profiles, the button links directly to the vendor, and when you click it your browser sends a short message to our server. Both count how often a tool was clicked. We store only a daily count per tool and the kind of page the click came from (list or profile, and its language). We do not store the IP address or a user identifier for this, and the count contains no personal data. After the redirect, the vendor's privacy policy applies. As with any link, the vendor's server receives your IP address and the usual browser details.

Searches without results

When a search in the directory finds no tool, we store the search term, the language of the page and the time, so that we can see which tools or terms are missing. We do not store the IP address or a user identifier. Search terms are free text, so please do not enter names or other personal details. We delete the entries after 90 days. The legal basis is our legitimate interest in improving the directory (Art. 6(1)(f) GDPR).

Questions in your own words (Anthropic Claude)

If you type a question of three or more words into the search box on the home page or into the guide search, for example "pre-screen applications for 200 employees in Munich", we send this text to the language model Claude by Anthropic. Claude maps it to the directory's filters (task, country, company size, price, free plan or trial, EU data storage), and we then show the matching list. In the guide search, Claude picks the existing guides that match the question. Before sending, we remove email addresses and phone numbers and shorten the text to 200 characters. We do not send your IP address, cookies or a user ID. We do not store the question. Anthropic processes it on our behalf through its paid API, does not use it to train its models under its commercial terms, and according to Anthropic deletes inputs and outputs within 30 days. Only if automated checks detect a breach of its usage policies does Anthropic keep them for up to 2 years. Please do not enter names or other personal data. Shorter entries only use our own search. The legal basis is our legitimate interest in answering questions in natural language (Art. 6(1)(f) GDPR).

User account and sign-in

You only need an account to write a review, submit a tool or claim a profile as a vendor.

  • Data: email address, a display name if you choose one, an internal user ID, time of registration and of the last sign-in.
  • Sign-in by email link: Supabase creates a link that works only once and sends it to your address through the email service Brevo. There is no password. We store whether you use the site in German or English so the email arrives in your language. Brevo receives your email address and the content of the email and logs the delivery to prove it and to prevent abuse.
  • Sign-in with Google (optional): if you choose "Continue with Google", Google confirms your identity and sends us your email address, your name, the link to your profile picture and an account ID. Supabase stores these details with your account. We use only the email address to identify your account and do not show your name or picture. Google learns that you signed in to ai-toolfinder.com. Only when you click the button does your browser load a script from Google (accounts.google.com) for this, which sends your IP address to Google. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Data may also be processed by Google LLC in the USA, which is certified under the EU-U.S. Data Privacy Framework. You can always use the email link instead.
  • Security logs: Supabase logs sign-ins and database access with IP address, browser details and time in order to detect misuse and find errors.
  • Legal basis: Art. 6(1)(b) GDPR (user agreement under our Terms of use), for the security logs Art. 6(1)(f) GDPR.

You can delete your account at any time under Account or ask us to do so by email. When we delete the account, we also delete your reviews, replies to reviews, submissions and requests to claim a profile. Tool profiles that resulted from your submissions remain, without any reference to you. Entries in the moderation log remain until their retention period ends.

We cannot create an account without an email address. You can use the directory itself without an account.

Sign-in with LinkedIn (if offered)

If we offer sign-in with LinkedIn and you use it, your browser takes you to LinkedIn. After you agree there, LinkedIn sends us your name, your email address, a link to your profile picture, your language setting and an identifier that only applies to our website. We use this data to create your account and sign you in. The legal basis is Art. 6(1)(b) GDPR. LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland, is itself responsible for the processing at LinkedIn. Details are in LinkedIn's privacy policy.

Abuse protection with Cloudflare Turnstile: to stop anyone from requesting sign-in links automatically and in bulk, the sign-in page loads Cloudflare Turnstile when you click "Send sign-in link". No data is sent to Cloudflare before that. It checks in the background whether a human is using the page. Usually you don't need to do anything; occasionally a box appears to click. Cloudflare processes your IP address, details about your browser and device, and technical signals from how the page is used. According to Cloudflare, this data is used only for the check and not for advertising. Turnstile runs only when you sign in with an email link. The legal basis is our legitimate interest in protecting the directory and accounts from abuse (Art. 6(1)(f) GDPR). Where information in your browser is read for this, it is strictly necessary for the service you requested, signing in (Section 25(2) no. 2 TDDDG). The provider is Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA.

Reviews

When you review a tool, we process:

  • stars for the overall rating and the sub-ratings, the title and texts of the review,
  • context details: company size, industry, country, role and length of use,
  • your display name and the language of the review,
  • verification details: whether your email address is confirmed, whether it belongs to a company domain and whether proof of use exists,
  • your statements on whether the vendor invited you and whether you received anything in return,
  • moderation details: status, decision, reasons and timestamps.

We publish the text, stars, context details, display name, verification level and the notes on invitation or incentive. We never publish your email address or your proof of use, and vendors do not receive them either. Please keep in mind that context details and text together may allow colleagues or the vendor to recognize you. Choose your display name and details with this in mind.

For verification, the system compares the domain of your email address with a list of free email providers and with the domain of the reviewed tool. It blocks reviews of your own tool and a second review of the same tool from the same account. It flags domains of competitors and unusually many reviews in a short time for review. Nick decides on publication personally after reading the review. We do not make automated decisions within the meaning of Art. 22 GDPR. If an automatic block affects you wrongly, Nick will look at the case when you contact us.

The legal basis for publishing and displaying your review is Art. 6(1)(b) GDPR. We base the checks for misuse and conflicts of interest on Art. 6(1)(f) GDPR. Our legitimate interest, and that of readers, lies in reliable reviews.

Published reviews can be accessed worldwide and may be indexed by search engines. After deletion, copies may remain visible in search engines for some time. We have no influence on this.

Proof of use (if offered)

If this function is offered, you can upload a screenshot from the tool while signed in to it, or an invoice. The file is kept in non-public storage with Supabase in the Frankfurt am Main region. Only Nick sees it, and only to check the use. We delete the file as soon as we decide on the proof or on the review, including when we publish the review, and at the latest 30 days after the decision. Before uploading, black out anything that is not needed for the check, such as names of other people, bank details or prices.

The legal basis is Art. 6(1)(b) GDPR. For details about other people that are nevertheless included, Art. 6(1)(f) GDPR applies.

Tool submissions

When you submit a tool, we process your details on the tool (name, website, description, category, countries), your relationship to the tool and the link to your account. The system compares the domain of your email address with the tool's website to recognize submissions from vendors. We describe accepted tools in our own profile. Your name and email address do not appear there. The legal basis is Art. 6(1)(b) GDPR.

Profile claims and vendor replies

Anyone taking over a profile for a vendor signs in with an email address at the tool's domain. We process this address, the link to the tool and the status of the request. We publish replies to reviews as replies from the vendor, not under the name of the person who writes them. The legal basis is Art. 6(1)(b) GDPR.

Contact form

If you write to us via the contact form, we process your email address, your name if you provide it, and your message to answer your request. The data is stored in our database with Supabase in the Frankfurt am Main region. We reply by email. The legal basis is Art. 6(1)(f) GDPR, our legitimate interest being to answer your request, and Art. 6(1)(b) GDPR for questions about a contract.

Reports of illegal content

Anyone can report content, also without an account. We process your email address, your name if you provide it, the reported content, the reason and your explanation. We confirm receipt and tell you our decision. The legal basis is Art. 6(1)(c) GDPR in conjunction with Article 16 DSA.

We only tell the person whose content you report your name and email address if this is strictly necessary in an exceptional case (Article 17(3)(b) DSA). In that case we inform you beforehand.

Moderation log

We record every decision on reviews, submissions, requests, replies and reports in a log: the entry concerned, the decision, the ground, the reasons and the time. The log contains no email addresses. This allows us to prove decisions later and to defend ourselves against claims. The legal basis is Art. 6(1)(f) GDPR.

Email contact

When you write to us, we process your email address, your name and the content of your message to handle your request. The legal basis is Art. 6(1)(b) GDPR where it concerns your account or your content, Art. 6(1)(c) GDPR for requests under the DSA or the GDPR, and Art. 6(1)(f) GDPR otherwise. Our mailbox is run by Google (Google Workspace).

Free guides and the AI at Work newsletter

On ai-toolfinder.com/resources you can unlock our free setup guides with your email address. We process your email address, optionally your first name, the guide you signed up through, and the time of signup and confirmation. We use double opt-in: Brevo first sends you a confirmation email, and you only join the list after you click the link in it. With your signup you receive the AI at Work newsletter by Nick, once a week on Fridays, with our video of the week, its written version and new guides. The legal basis is your consent, Art. 6(1)(a) GDPR. You can withdraw it at any time with the unsubscribe link in every email or by writing to us; the lawfulness of processing up to that point is not affected.

After you confirm, we set the cookie atf_guides in your browser. It only stores that the guides are unlocked for you, contains no personal data and expires after one year. This is strictly necessary for the function you requested (Section 25(2) no. 2 TDDDG). If you use "Already subscribed?", we check with Brevo whether your address is confirmed on the list. Brevo measures opens and clicks in the newsletter to show us which content is of interest; this is part of your consent.

If you reach a guide through a link we sent you in an Instagram or Facebook direct message after you commented under one of our videos, Meta processes that comment and message under its own privacy policy. We use the scheduling service Zernio to send that automatic reply. The guide page itself opens without signup.

Badges on other websites

Vendors can add a "Listed on ai-toolfinder.com" badge to their website. If a website loads the badge from our server, Vercel processes the connection data of that website's visitors (IP address, time, page on which the badge is embedded, browser details) in order to deliver the image file. We do not analyse these requests in relation to individuals. The legal basis is Art. 6(1)(f) GDPR. Vendors can also host the image file on their own server. Then no data reaches us.

Recipients and processors

These service providers process data on our behalf and on our instructions, based on a contract under Art. 28 GDPR:

  • Vercel Inc., 440 N Barranca Avenue #4133, Covina, CA 91723, USA: hosting, delivery of the website, audience measurement.
  • Functional Software, Inc. (Sentry), 45 Fremont Street, 8th Floor, San Francisco, CA 94105, USA: error monitoring. The data is stored in the EU (Frankfurt am Main).
  • Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA: protecting sign-in from abuse (Turnstile).
  • Supabase Pte. Ltd., 65 Chulia Street #38-02/03, OCBC Centre, Singapore 049513: database, sign-in and file storage. The data is stored in the Frankfurt am Main region (eu-central-1).
  • Sendinblue SAS (Brevo), 106 boulevard Haussmann, 75008 Paris, France: sending sign-in emails and the newsletter. The data is stored in the EU.
  • Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland: email mailbox (Google Workspace) and, only with your consent, Google Analytics.
  • Anthropic Ireland, Limited, 6th Floor, South Bank House, Barrow Street, Dublin 4, Ireland: questions in your own words (Claude API).

Other recipients:

  • LinkedIn Ireland Unlimited Company, only if you sign in with LinkedIn (see above).
  • Authorities, courts or persons whose rights have been infringed, only if we are legally obliged or permitted to disclose data. Examples: a court order under Section 21 TDDDG, orders under Articles 9 and 10 DSA, a suspected criminal offense that threatens life or safety (Article 18 DSA). The legal basis is Art. 6(1)(c) GDPR, otherwise Art. 6(1)(f) GDPR.

Vendors receive no data from us that is not public anyway. We do not pass anything to advertising networks or data brokers.

Transfers outside the EU

  • Vercel: Vercel Inc. is based in the USA and certified under the EU-US Data Privacy Framework. The basis is the European Commission's adequacy decision of 10 July 2023 (Art. 45 GDPR). Our contract with Vercel also contains the European Commission's standard contractual clauses.
  • Supabase: The data is stored in Frankfurt am Main. Supabase and its subprocessors may access it for operations and support from Singapore, the USA and other countries. The basis is the European Commission's standard contractual clauses (Implementing Decision (EU) 2021/914, Art. 46(2)(c) GDPR).
  • Google: Data may be processed in the USA. Google LLC is certified under the EU-US Data Privacy Framework, and standard contractual clauses also apply.
  • Sentry: The data is stored in Frankfurt am Main. Functional Software, Inc. is based in the USA and certified under the EU-U.S. Data Privacy Framework (adequacy decision of 10 July 2023, Art. 45 GDPR); standard contractual clauses also apply.
  • Cloudflare: Cloudflare, Inc. is based in the USA and certified under the EU-US Data Privacy Framework (adequacy decision of 10 July 2023, Art. 45 GDPR).
  • Anthropic: Requests are also processed by Anthropic PBC in the USA. The basis is the European Commission's standard contractual clauses (Art. 46(2)(c) GDPR).
  • LinkedIn processes data under its own responsibility, also in the USA.

You can request a copy of the standard contractual clauses.

How long we keep data

  • Server logs: available in our Vercel account for 30 days at most, shorter depending on the plan.
  • Audience measurement: Vercel discards the counting hash after 24 hours. After that, the statistics only contain aggregated values.
  • Security logs at Supabase: seven days at most.
  • Account: until you delete it.
  • Published reviews and replies: until you delete them or your account, or until we remove them.
  • Rejected or removed reviews, submissions, requests and replies: six months after the decision, so that you can object during this time.
  • Accepted submissions and confirmed profile claims: until you delete the account or the link ends.
  • Proof of use: when we decide on the proof or the review, at the latest 30 days after the decision.
  • Sentry error reports: 30 days.
  • Google Analytics: cookies up to two years or until you withdraw consent, individual events two months.
  • Searches without results: 90 days.
  • Click counts: 13 months.
  • Reports: six months after the decision.
  • Messages sent via the contact form: six months after the request has been dealt with.
  • Moderation log: three years after the decision.
  • Emails: until your request has been dealt with. Emails about moderation decisions and objections: three years after the decision.

Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16 GDPR), erasure (Art. 17 GDPR), restriction of processing (Art. 18 GDPR) and data portability (Art. 20 GDPR). To exercise them, write to nick@nicksadvisory.com. You can also delete your account yourself.

Right to object

Where we process data on the basis of Art. 6(1)(f) GDPR, you can object at any time on grounds relating to your particular situation (Art. 21(1) GDPR). We will then stop processing the data unless we can demonstrate compelling legitimate grounds which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defense of legal claims.

Right to lodge a complaint

You can lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), in particular in the Member State where you live or work or where the alleged infringement took place. The authority responsible for us is the Hessian Commissioner for Data Protection and Freedom of Information, Postfach 3163, 65021 Wiesbaden, Germany, datenschutz.hessen.de.

Changes

We update this policy when functions of the website or the law change. The version published here applies.

Last updated: October 2026