Privacy Policy
This policy explains what personal data we process, why, on what legal basis, and what rights you have. It covers this website and the operating portals listed in section 2. We have deliberately kept it specific to what our systems actually do rather than generic.
1. Controller and contact
The controller responsible for data processing described here is:
AI Stock UG (haftungsbeschränkt)
Represented by Valentin Klein
Drächslstraße 3
81541 München
Germany
Email: [email protected]
We have not appointed a Data Protection Officer, as we do not meet the thresholds of Art. 37 GDPR / § 38 BDSG. Please direct all data protection enquiries to the address above.
2. Scope
This policy applies to:
- aistockmedia.com (and www) — this public website
- review.aistockmedia.com — Image Review portal
- trace.aistockmedia.com — Human Trace portal
- partner.aistockmedia.com — Partner Portal
- stats.aistockmedia.com — Statistics Portal
- aistockug.de — our former domain, which redirects here
The portals are internal working tools. They are not open to the general public and are accessible only to people we have given an account to.
3. Hosting and infrastructure
Our applications and stored data run on a dedicated server in a data centre in Germany. Traffic to the domains listed above is delivered through a content delivery and security provider acting as a processor on our behalf under Art. 28 GDPR, which also provides TLS encryption, protection against attacks, and the sign-in gate in front of our internal portals.
This necessarily involves processing connection data such as your IP address, the requested address, the time of the request and your browser identification. Legal basis: Art. 6(1)(f) GDPR — our legitimate interest in operating our services securely and reliably. This provider is based outside the EU; see section 11.
4. Visiting this website
When you open a page, your browser transmits technical data that is processed to deliver the page and to keep the service secure: IP address, date and time, requested address, referrer, browser and operating system identification, and transferred data volume.
Legal basis: Art. 6(1)(f) GDPR (legitimate interest in a functioning, secure website).
5. Contact form
If you use the contact form, we process the name, email address, company (optional) and message you enter, together with your IP address and browser identification, which are recorded to prevent abuse of the form.
The submission is stored as a record on our server in Germany and is used solely to handle your enquiry. The form includes a hidden anti-spam field and a rate limit per IP address.
Legal basis: Art. 6(1)(b) GDPR where your message concerns a contract or pre-contractual steps; otherwise Art. 6(1)(f) GDPR (legitimate interest in answering enquiries addressed to us).
6. Email
Mail sent to addresses at aistockmedia.com is delivered and stored using external email service providers acting on our behalf, some of which are based outside the EU (see section 11). Your sender address, the content of your message and any attachments are processed for the purpose of receiving and answering it.
If you would prefer your message not to be handled this way, please write to the postal address in section 1. Legal basis: Art. 6(1)(b) and Art. 6(1)(f) GDPR.
7. Portal accounts and sign-in
This section applies to people who have an account with us — partners, reviewers, tracing staff and freelancers.
Account data
We store a username, a cryptographic hash of your password (never the password itself), your role, and — where you have linked one — the email address of your Google account. We also record the IP addresses used to reach the portals, for access control and abuse prevention.
Signing in
Access to the Partner and Statistics portals is restricted to a list of authorised email addresses and requires either a one-time PIN sent by email or a Google account. Our security provider processes your email address and the outcome of the sign-in for this purpose.
Where you choose to sign in with Google, Google processes the sign-in and transmits to us your email address, name, profile picture and Google account identifier. We never receive your Google password and have no access to anything else in your Google account. Google's own processing is governed by Google's privacy policy. Signing in with Google is optional — password sign-in remains available.
Legal basis: Art. 6(1)(b) GDPR (performance of our agreement with you) and Art. 6(1)(f) GDPR (legitimate interest in securing access to internal systems).
8. Work records in the portals
To operate our production chain and to pay people correctly, the portals record work-related data about account holders, including:
- which work packages you claimed and completed, with timestamps
- the results and quality indicators of your work
- volumes completed, amounts payable and payments made
- sign-in events and IP addresses
Quality checks are embedded into ordinary work packages and are not announced individually, because announcing them would defeat their purpose. Their existence and use are disclosed here.
Legal basis: Art. 6(1)(b) GDPR (performance of the agreement with you), Art. 6(1)(c) GDPR (retention obligations under commercial and tax law) and Art. 6(1)(f) GDPR (legitimate interest in quality assurance and in the security of our systems).
9. Automated decisions
We use automated processing that can affect your account. The Image Review portal evaluates quality indicators automatically. If defined thresholds are not met, the system can automatically pause your ability to take on further work, or suspend your account.
Where such a decision is taken solely by automated means and has a significant effect on you, you have the right under Art. 22(3) GDPR to obtain human intervention, to express your point of view and to contest the decision. Write to [email protected] and a person will review the decision. Suspensions can be and are lifted on review.
10. Cookies
We use only cookies that are strictly necessary to provide the service you requested. We set no analytics, advertising or profiling cookies, which is why this site shows no cookie banner.
| Cookie | Purpose | Duration |
|---|---|---|
| Portal session cookie | Keeps you signed in to a portal; signed, so it cannot be tampered with | Up to 30 days, or until you sign out |
| Sign-in gate cookie | Proves you passed the sign-in gate in front of a protected portal | Up to 24 hours |
Legal basis: § 25(2) no. 2 TDDDG — strictly necessary for a service you expressly requested; and Art. 6(1)(b)/(f) GDPR for the associated processing.
11. Transfers outside the EU/EEA
Some of the providers described above are based in the United States and may process data there. These transfers are safeguarded by the EU–US Data Privacy Framework and/or the European Commission's Standard Contractual Clauses under Art. 46(2)(c) GDPR, together with data processing agreements under Art. 28 GDPR. Despite these safeguards, we note that US authorities may in principle be able to access such data and that the level of protection may not in every respect correspond to that within the EU.
On request we will tell you which specific providers we use.
12. Retention
- Contact form messages: kept as long as needed to handle the enquiry and any follow-up, then deleted — usually within 24 months.
- Account and work data: kept for the duration of our working relationship and afterwards only where required.
- Payment and invoicing records: retained for the statutory periods under German commercial and tax law (generally 6 or 10 years, §§ 257 HGB, 147 AO).
- Security and connection logs: short-lived; our providers' retention is governed by their own policies.
13. Your rights
You have the right to:
- Access the personal data we hold about you (Art. 15 GDPR)
- Rectification of inaccurate data (Art. 16 GDPR)
- Erasure (Art. 17 GDPR)
- Restriction of processing (Art. 18 GDPR)
- Data portability (Art. 20 GDPR)
- Object to processing based on legitimate interests (Art. 21 GDPR)
- Withdraw consent at any time, with effect for the future, where processing is based on consent
- Human review of automated decisions — see section 9
To exercise any of these, write to [email protected].
You also have the right to lodge a complaint with a supervisory authority. The authority responsible for us is the Bayerisches Landesamt für Datenschutzaufsicht (BayLDA), Promenade 27, 91522 Ansbach, Germany.
14. Changes
We will update this policy when our services or the way we process data change. The version and date at the top always show the current state.