Privacy Policy

The controller within the meaning of Article 4 (7) GDPR is:

Controller

CeeYou Art/Media Design, Inhaber Sandro Özköylü

Address

Am Tabakquartier 52, 28197 Bremen, Deutschland

Phone

0174 9249225

E-mail

kontakt@ryvio.me

Data protection contact

kontakt@ryvio.me

RYVIO is a service offered by CeeYou Art/Media Design. No data protection officer has been appointed; there is no obligation to appoint one under Section 38 BDSG for our business. The sole proprietor at the address above is the point of contact for all data protection matters.

For any questions regarding the processing of your data and to exercise your rights, please contact kontakt@ryvio.me.

We process personal data only to the extent necessary to provide a functional website and our services, or where you have given your consent. We do not collect data on a precautionary basis, we do not use any third-party advertising, tracking or analytics services, and we do not pass on data for advertising purposes.

All transmission is encrypted via HTTPS/TLS.

Personal data means any information relating to an identified or identifiable natural person (Article 4 (1) GDPR).

This website and the application are operated on the infrastructure of Vercel Inc. (340 S Lemon Ave #4133, Walnut, CA 91789, USA). Static content is delivered via Vercel's global edge network; server-side execution of the application (serverless functions) is configured to the Frankfurt am Main region (fra1).

When a page is accessed, the hosting provider automatically processes technical access data (server log files):

• IP address of the requesting device (retention follows the hosting provider’s information)
• Date and time of access
• URL or route called and HTTP status code
• Amount of data transferred and response time
• Referrer URL and transmitted user agent (browser and operating system identifier)

This processing is technically indispensable in order to deliver the website, ensure its stability and security, and detect abuse (e.g. automated attacks).

Legal basis: Article 6 (1) (f) GDPR (legitimate interest in secure and uninterrupted operation).

Retention: access logs are retained by the hosting provider for a short period only and are then deleted automatically. We neither store them permanently nor combine them with other data sources.

We have a data processing agreement (Data Processing Addendum) with Vercel under Art. 28 GDPR which incorporates the EU standard contractual clauses for transfers to the USA. Vercel Inc. also declares itself certified under the EU-US Data Privacy Framework; for transfers to the USA see section 13.

All application data (user accounts, company profiles, content, analysis results) is stored in a PostgreSQL database operated by Supabase in region eu-central-1 (Frankfurt am Main, Germany). The data therefore remains within the European Union.

Supabase acts as our processor; a data processing agreement pursuant to Article 28 GDPR is in place.

Legal basis: Article 6 (1) (b) GDPR (performance of a contract or pre-contractual measures) and Article 6 (1) (f) GDPR for technical operation.

A user account is required in order to use the application. During registration we process:

• e-mail address (mandatory; also serves as your login name)
• name or display name (optional)
• password — stored exclusively as a cryptographic hash (bcrypt); we never know your plaintext password and cannot restore it
• time of registration

Authentication is handled by NextAuth using e-mail and password. After a successful login, a signed, strictly necessary session cookie is set (see section 12). We do not offer login to RYVIO via social networks or external identity providers. This is distinct from connecting your social media accounts for publishing, which is described in section 9.

To protect against automated login attempts (credential stuffing, brute force) we limit the number of login, registration and form attempts per IP address and per email address. For this we store a counter in our database whose key is formed only as a hash value (not in plain text) from the IP address or email address and which is deleted after the time window ends, at the latest after 24 hours. Legal basis: Art. 6(1)(f) GDPR (security of the service).

Legal basis: Article 6 (1) (b) GDPR for providing the account; Article 6 (1) (f) GDPR for abuse prevention.

Retention: until the account is deleted. You can delete your account in the application under “Profile → Delete account” or by e-mail to kontakt@ryvio.me; deletion is completed within 30 days. The associated company profiles, content, files and platform connections are deleted together with the account. Statutory retention obligations remain unaffected.

Beta test phase: during a closed test phase we additionally store your confirmation of the beta test terms (version, checksum of the text, time, truncated browser identifier, IP address only as a non-reversible hash) as contractual evidence (Art. 6(1)(b) and (f) GDPR) and your feedback submitted via the feedback button (message, page, time, account ID, truncated browser identifier; Art. 6(1)(b) and (f) GDPR, improvement of the service). Beta metrics are evaluated only as counts without personal reference. Invite codes are stored with an optionally assigned email address until 90 days after the end of the test phase.

Email confirmation and password reset: after registration we send a confirmation link; for “forgot password” a reset link. We store only a hash of the link with its expiry (24 hours or 1 hour, single use). Contract acceptance: at registration and re-confirmations we store version, checksum and text of the Terms and DPA you confirmed, plus time, truncated browser identifier and the IP address as a non-reversible hash (Art. 6(1)(b) and (f) GDPR, contractual evidence) for the contract term and statutory retention periods.

Within the application you create a company profile and content. In doing so we process the information you enter, in particular:

• company name, industry, location, services and offerings
• target audience, goals, tone of voice, no-gos and competitors
• platforms used and existing channels
• brand voice settings (tone, sample texts, rules, default call to action)
• posts, captions, ideas, platform variants, scheduling and status information
• content check results for your content

You determine this information yourself. Please do not enter any special categories of personal data under Article 9 GDPR (such as health, religious or trade union data) and no personal data of third parties for which you have no legal basis.

Where you process personal data of your own customers or employees in the application, you are the controller in that respect and we are the processor (Art. 28 GDPR). For this case the Data Processing Agreement (page "Data processing") applies, which you confirm at registration and which also applies during a free test or beta use.

Legal basis: Article 6 (1) (b) GDPR.

You can upload image and video files. These are stored in Vercel Blob, the object storage of our hosting provider. The storage location of Vercel Blob may be outside the European Union, in particular in the USA; the transfer to Vercel Inc. is based on the EU-US Data Privacy Framework (see section 13).

On upload we process the file itself as well as the file name, file type and time of upload. Image files are re-encoded server-side (converted to WebP, longest edge limited to 2000 px). Metadata embedded in the original file — such as EXIF data containing GPS coordinates, camera details or timestamps — is not carried over. Video files are not re-encoded; any metadata contained in them is therefore retained. Please check videos for personal information before uploading them.

Important note on the accessibility of uploaded files: files are stored with public access in the object storage and can be retrieved via a randomly generated, non-guessable URL. Anyone who knows that URL can open the file without logging in. Please therefore do not upload content that must not be viewable under any circumstances.

If you upload recordings in which people are identifiable, you are responsible for ensuring that a legal basis exists (for example consent of the persons depicted under Article 6 (1) (a) GDPR or Sections 22, 23 KunstUrhG).

Legal basis: Article 6 (1) (b) GDPR.

Retention: until you delete the file, at the latest when the account is deleted.

The core function of RYVIO is the automated checking and improvement of your captions: scoring against the criteria hook, clarity, call to action (CTA), proof, platform fit, audience and media assignment (RYVIO Score), rule-based text suggestions, platform variants, ideas, and niche and profile analyses.

This processing covers the texts you enter, the information from your company profile and brand voice, and the file name and file type of attached media. No content analysis of image or video material (image recognition) takes place; media is stored, attached to posts and published.

The evaluation is carried out by a rule-based, deterministic procedure executed entirely on our own infrastructure. Your content is not transmitted to external providers of generative AI. The integration of an external language or image model is technically blocked unless we expressly release it; before a release we inform you here of the provider, the place of processing and the legal basis and add the provider to the list of recipients (section 13).

Your content is not used to train AI models.

The results of this evaluation are recommendations. No automated individual decision-making, including profiling, within the meaning of Article 22 (1) GDPR takes place that produces legal effects concerning you or similarly significantly affects you; you alone decide whether to use a suggestion.

Legal basis: Article 6 (1) (b) GDPR.

You can connect your business accounts on Instagram, Facebook, LinkedIn, Pinterest, TikTok and YouTube to RYVIO in order to publish posts via the platforms' official APIs and to retrieve reach data. The connection is made via the respective platform's authorisation procedure (OAuth); your platform password is never disclosed to us.

When connecting and using an account we process:

• the platform's access token and, where applicable, refresh token — stored exclusively in encrypted form (AES-256-GCM) and decrypted server-side only at the moment of use
• the permissions (scopes) you granted and the token's expiry time
• account ID, account name or handle and profile picture URL of the connected account
• for Facebook the ID and name of the page, for Pinterest the ID and name of the board that is published to
• connection status and the last error message reported by the platform
• the posts you released for publishing (text, media, time) as well as the post ID and publishing status returned by the platform
• Follower count and reach figures of the connected Instagram or Facebook account; details on daily storage and retention in section 9a.

Purpose: publishing your posts at the scheduled time on the accounts you selected, and displaying reach and follower data. Scheduled publications are triggered by a timed call to our server (see section 13).

Legal basis: Article 6 (1) (b) GDPR (performance of the usage contract). The connection is only established at your express request and can be disconnected by you at any time.

Recipients: when publishing and retrieving data we transmit post content and tokens to the respective platform operator. These operators are independently responsible for the processing on their platforms; their privacy policies apply:

• Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland (Instagram, Facebook) — https://www.facebook.com/privacy/policy
• LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland — https://www.linkedin.com/legal/privacy-policy
• Pinterest Europe Ltd., Palmerston House, 2nd Floor, Fenian Street, Dublin 2, Ireland — https://policy.pinterest.com/privacy-policy
• TikTok Technology Limited, 10 Earlsfort Terrace, Dublin 2, D02 T380, Ireland — https://www.tiktok.com/legal/privacy-policy
• Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (YouTube) — https://policies.google.com/privacy

Statistics (insights): for the collection of page and account statistics by Meta, you as the operator of the page or account are jointly responsible with Meta (Article 26 GDPR; CJEU, judgment of 5 June 2018, C-210/16). RYVIO merely retrieves these aggregated values on your behalf and does not store them.

TikTok: the integration is technically in place; until TikTok has completed its review, posts there are published exclusively as private posts.

YouTube API Services

RYVIO uses YouTube API Services. By connecting a YouTube account you agree to be bound by the YouTube Terms of Service (https://www.youtube.com/t/terms); the Google Privacy Policy (https://policies.google.com/privacy) also applies. We use data obtained via the Google API exclusively for the purposes described in this section and do not pass it on to third parties. You can revoke RYVIO's access to your Google account at any time via the Google security settings at https://security.google.com/settings/security/permissions. Publishing to YouTube is not yet available.

Retention: we store connection data and tokens until you disconnect the account in the application under “Profile → Social accounts” or your account is deleted. Expired tokens that are not renewed are deleted no later than 30 days after expiry. When disconnecting, the granted permission is additionally revoked at the platform where the platform supports this (Facebook); for the other platforms you can revoke access in the settings of your platform account. See the “Data Deletion” page for details.

We retrieve the reach and engagement figures of your connected Instagram and Facebook accounts and store them daily (follower count, reach, profile views, interactions, likes, comments, shares and saves per post) so that you can see trends. Only aggregated figures are stored, no information about individual people.

Legal basis: Art. 6(1)(b) GDPR. Retention: 24 months, then automatic deletion.

With the “Competitors” function you can monitor public Instagram business and creator accounts. For this, RYVIO uses Meta’s “Business Discovery” interface, with the access of your connected account, to retrieve publicly visible metrics (username, display name, profile picture URL, follower count, number of posts, average likes and comments of up to the last 25 posts, address of the most successful post) and stores one measurement per day. A maximum of ten accounts per workspace is possible.

In relation to the monitored accounts you, as our customer, are the controller; we process on your behalf (Art. 28 GDPR). The legal basis is the legitimate interest in market observation (Art. 6(1)(f) GDPR). The data are deleted when you remove a monitored account or your account is deleted, at the latest after 24 months. Monitored data subjects can contact the respective customer or kontakt@ryvio.me.

With the “Inbox” function we show comments under your latest Instagram posts and let you reply to, hide or delete them. The comments (username, text, time, likes) are retrieved live from Meta and are not stored by us; your replies are transmitted to Meta. You, as the customer, are the controller for processing the comments; we process on your behalf. The function is active only if we have enabled it separately.

If you enable push notifications in the application, we store the subscription address (endpoint) generated by the browser, two key values and your browser identifier (user agent) and send notifications through it (e.g. “A post is waiting for you”). The message contains no post titles or names. Delivery is via the push services of your browser or device manufacturer (Apple, Google, Mozilla, Microsoft), which are independently responsible for it.

Legal basis: your consent by enabling (Art. 6(1)(a) GDPR, § 25(1) TDDDG). You can withdraw it at any time in the application or in your browser settings; the subscription is then deleted. Subscriptions that are no longer reachable are deleted automatically.

For notifications (approval requests, publication errors, expiring platform connections) and for automatic PDF reports we send emails via Resend, Inc. (section 13). Email address, message content and, if applicable, the attachment are processed. Legal basis: Art. 6(1)(b) GDPR. You can switch off notifications individually in the account settings.

For traceability we log per workspace who carried out which action and when (email address or label of the actor, type of action, post title or account name, time). The log is visible only to owners and is deleted automatically after twelve months. Legal basis: Art. 6(1)(f) GDPR (security and traceability). When an account is deleted, entries in other people’s workspaces are anonymised.

Via a personal link, clients of our users can review, comment on and approve posts without signing in. The name you enter, your comments, the decision and the time are stored. The agency or company that gave you the link is responsible; RYVIO processes on their behalf. No tracking cookies are set.

With two-factor authentication enabled we store an encrypted secret and hash values of recovery codes. API keys are stored only as hashes. For webhooks we store the target address you specify and the latest delivery logs (event type, content, status). Legal basis: Art. 6(1)(b) GDPR.

You can invite other people into your organisation's workspace. Every membership is linked to a role (owner, editor or approver) that determines which actions the person may perform.

We process the members' name and e-mail address, their role and the time of joining, and for invite links a randomly generated, single-use token, the intended role, the inviting person, the time of creation and — once redeemed — the joining person and the time of joining.

Name and e-mail address are visible to the other members of the same organisation so that roles can be managed and approvals traced. Anyone who opens an invite link sees the organisation's name before joining.

Legal basis: Article 6 (1) (b) GDPR towards the members; Article 6 (1) (f) GDPR (legitimate interest in traceable collaboration within the team) regarding visibility within the organisation.

Retention: memberships until the person leaves the organisation or the user account or organisation is deleted; invite links until they are redeemed or revoked, at the latest until the organisation is deleted. Please pass invite links only to people who are actually meant to join.

You can try out the scoring function on our website without registering. The text you enter is transmitted to our server for this purpose, evaluated there, and the result is returned immediately. The text you enter is not stored.

To prevent abuse, the number of requests is limited per IP address and overall; for this we store counters in our database whose keys are formed only as hashes and which are deleted after the time window, at the latest after 24 hours.

Legal basis: Article 6 (1) (f) GDPR (legitimate interest in presenting our offering and operating it free of abuse).

We use strictly necessary cookies only. A consent banner is therefore not required; we do not set any cookies for advertising, tracking or reach measurement.

__Secure-authjs.session-token

Keeps you signed in (signed session token). Set only after successful sign-in; lifetime 30 days, invalid after sign-out.

__Host-authjs.csrf-token

Protects sign-in and form processes against cross-site request forgery. Session cookie, deleted when the browser is closed.

__Secure-authjs.callback-url

Remembers during sign-in the page you are redirected to afterwards. Session cookie.

ryvio_org

Remembers after sign-in the workspace (organisation) you last selected; contains only its internal identifier. Lifetime 30 days.

ry_social_oauth

Protects the connection process with a social media platform against manipulation (state check). Set only while connecting and invalid after a few minutes.

NEXT_LOCALE

Stores the selected language (German or English); contains only the language code. Lifetime up to twelve months.

Legal basis: Section 25 (2) no. 2 TDDDG (storage strictly necessary to provide a service expressly requested by you) in conjunction with Article 6 (1) (b) or (f) GDPR.

If you enable push notifications in the application, your browser registers a service worker and stores a subscription address; this happens only after your explicit click and your confirmation in the browser dialog (§ 25(1) TDDDG, consent), see section 9d. We do not use other storage on your device (e.g. local storage).

You can delete or block cookies at any time in your browser settings. In that case it will no longer be possible to sign in to the application.

We only pass personal data on to the following recipients:

• Vercel Inc., 340 S Lemon Ave #4133, Walnut, CA 91789, USA — hosting and delivery of the website, server-side execution of the application in the Frankfurt am Main region (fra1) and object storage (Vercel Blob) for uploaded files, whose storage location may be outside the EU. Processor; transfer to the USA on the basis of the EU standard contractual clauses and, per the provider’s self-declaration, the EU-US Data Privacy Framework.
• Supabase Inc., USA — operation of the PostgreSQL database in the eu-central-1 region (Frankfurt am Main). Processor with an agreement under Art. 28 GDPR including the EU standard contractual clauses (Art. 46(2)(c) GDPR) for possible access from third countries.
• Resend, Inc., USA — sending of emails (notifications about approvals, publication errors and expiring connections, automatic PDF reports). Processor; transfer to the USA on the basis of the EU standard contractual clauses and the EU-US Data Privacy Framework (provider’s self-declaration).
• GitHub, Inc., 88 Colin P. Kelly Jr. Street, San Francisco, CA 94107, USA (subsidiary of Microsoft Corporation) — time-controlled call (cron) of our publishing function for scheduled posts; GitHub receives the time and technical status of the call, no user data.
• the push services of browser and device manufacturers (Apple, Google, Mozilla, Microsoft) — only if you enable push notifications; the manufacturers are independently responsible for their service
• TikTok, YouTube and X — when you add an inspiration link, our server retrieves publicly available preview metadata of the address you entered (oEmbed)
• the platform operators named in section 9 (Meta, LinkedIn, Pinterest, TikTok, Google) — when publishing posts and retrieving reach data at your instigation; these operators are independent controllers
• authorities and courts, insofar as we are legally obliged to

We have agreements under Art. 28 GDPR with our processors. A list of sub-processors, also for our customers, is available under “Data processing”.

The database and the server-side execution of the application are configured for Frankfurt am Main. Uploaded files are stored at Vercel Blob; their storage location may be outside the European Union, in particular in the USA. Because Vercel Inc., Supabase Inc., Resend, Inc. and GitHub, Inc. are based in the USA, access from a third country may occur in the course of operation, maintenance and support.

Insofar as a transfer to the USA takes place, we base it on the European Commission's adequacy decision for the EU-US Data Privacy Framework where the recipient is certified thereunder, and otherwise on the European Commission's standard contractual clauses pursuant to Article 46 (2) (c) GDPR together with supplementary safeguards.

You have the right to obtain a copy of these appropriate safeguards; please contact kontakt@ryvio.me.

We store personal data only for as long as necessary for the respective purposes:

• Account and application data: until you delete the account (in the application under “Profile → Delete account” or by email); deletion takes place without delay, at the latest within 30 days; backups of the database provider expire after its retention period
• Uploaded files and generated content: until you delete them, at the latest with deletion of the account
• Connections to social media accounts (tokens, account and target details): until you disconnect or the account is deleted; expired, unrenewed tokens at the latest 30 days after expiry
• Invitation links: until redeemed or revoked, at the latest until the organisation is deleted
• Activity log: twelve months (automatic deletion)
• Stored reach and engagement figures and measurements of monitored competitor accounts: 24 months (automatic deletion)
• Push subscriptions: until revoked; subscriptions that are no longer reachable are deleted automatically
• Server log files: according to the hosting provider’s information
• Counters for abuse prevention: hashed keys, deleted after the time window, at the latest after 24 hours

Beyond that we store data where commercial or tax law retention obligations apply (in particular Section 147 AO and Section 257 HGB — six and ten years respectively). Processing is restricted for the duration of those periods.

We take technical and organisational measures pursuant to Article 32 GDPR to protect your data against loss, manipulation and unauthorised access. These include in particular:

• end-to-end transport encryption (HTTPS/TLS) with HSTS
• passwords stored only as bcrypt hashes; optional two-factor authentication (TOTP) with an encrypted secret
• encryption of access tokens of connected platform accounts at rest (AES-256-GCM); tokens are never sent to the browser; API keys are stored only as hashes
• protection of the platform connection process by signed, short-lived state checks
• access restriction to the data of one’s own workspace and role-based permissions
• rate limiting for sign-in, registration, forms, uploads and AI-related functions; IP and email details in the counters only as hashes
• server-side checking and re-encoding of uploaded images (including detection of the actual format and size limits) and checking of video files for their actual file format
• security headers (Content Security Policy, X-Frame-Options, Referrer-Policy, Permissions-Policy)
• size and length limits for all inputs received

You have the following rights regarding personal data concerning you:

• access to the data processed (Article 15 GDPR)
• rectification of inaccurate data and completion of incomplete data (Article 16 GDPR)
• erasure (Article 17 GDPR)
• restriction of processing (Article 18 GDPR)
• data portability in a structured, commonly used and machine-readable format (Article 20 GDPR)
• objection to processing based on Article 6 (1) (f) GDPR (Article 21 GDPR)
• withdrawal of consent with effect for the future (Article 7 (3) GDPR)

Right to object (Article 21 GDPR)

You have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data concerning you which is carried out on the basis of Article 6 (1) (f) GDPR. We will then no longer process the data concerned unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims.

An informal message to kontakt@ryvio.me is sufficient to exercise your rights. We will respond without undue delay and within one month at the latest.

Access and data portability: in the application under “Profile → Export my data” you can download all data belonging to your account as a JSON file.

Without prejudice to any other remedy, you have the right under Article 77 GDPR to lodge a complaint with a data protection supervisory authority if you consider that the processing of personal data concerning you infringes the GDPR. You may contact the authority of your habitual residence, place of work or the place of the alleged infringement.

The supervisory authority responsible for us is:

Supervisory authority

Die Landesbeauftragte für Datenschutz und Informationsfreiheit der Freien Hansestadt Bremen, Arndtstraße 1, 27570 Bremerhaven, office@datenschutz.bremen.de

Providing your e-mail address and a password is necessary in order to conclude and perform the usage contract. Without this information we cannot provide you with a user account. All other information is voluntary; its absence may, however, reduce the quality of analyses and suggestions.

We adapt this privacy policy whenever the legal situation, our services or the nature of the data processing changes. The version published on this page applies in each case. We additionally inform registered users of material changes in an appropriate manner, for example by e-mail to the address on file.

Version of this privacy policy: 2026-10-19.