Privacy Policy

1. Who We Are

Assembr is operated by Kaxtus [Placeholder — full legal entity name (GmbH/UG) and registration number TBD before launch]. Our contact email for privacy matters is privacy@kaxtus.com. Our registered address is in Berlin, Germany [Placeholder — full address TBD].

2. What Data We Collect

When you connect a platform account via OAuth, we request and temporarily store data from that platform's API. The current live integration is LinkedIn; the following describes the data scope for each third-party platform we integrate with (LinkedIn is the current example):

• Your public profile information (name, headline, profile photo URL) from the connected platform
• Follower count and follower demographics (industry, seniority, location — aggregated, as provided by the platform API)
• Post impressions, engagement metrics, and reach data for your content on that platform
• Platform-specific account or page identifier used to associate your data with your Assembr account

LinkedIn specifically: When you connect via LinkedIn OAuth 2.0, we access the data scopes you explicitly authorize. This is governed additionally by LinkedIn's own Privacy Policy and Developer Terms.

We also collect standard web analytics data (pages visited, browser type, approximate geographic region) using privacy-respecting analytics tools. We do not use tracking cookies for advertising.

3. Why We Collect It (Legal Basis)

We process your platform data on the legal basis of contractual necessity (Art. 6(1)(b) GDPR) — the data is required to provide the Assembr dashboard service you requested. We also rely on your explicit consent (Art. 6(1)(a) GDPR) when you authorize each platform's OAuth connection. You may withdraw consent at any time by disconnecting the relevant platform account from your dashboard.

4. Third Parties

Your data is shared with the following third parties solely to operate the service:

• Third-party platforms we integrate with — data flows through each platform's official API (currently LinkedIn; Slack, Discord, X, and Reddit when those integrations ship). Your use of Assembr is additionally subject to each connected platform's own privacy policy and terms of service. LinkedIn Corporation specifically: your LinkedIn data is governed by LinkedIn's Privacy Policy.
• Hosting provider — infrastructure in Germany [Hetzner — Placeholder, confirm provider]. Processes data as our data processor under a DPA.

We do not sell your data. We do not share your data with advertisers.

5. Data Retention

We retain your platform analytics data for up to 12 months to power historical trend views in your dashboard. If you disconnect your account or request deletion, we delete your data within 30 days. Aggregated, anonymized statistics may be retained indefinitely.

6. Security

All data is transmitted over TLS 1.3. Stored data is encrypted at rest. OAuth tokens are stored encrypted and never exposed in client-side code. For our security disclosure policy, see the Security page.

7. Your Rights (GDPR)

Under GDPR, you have the right to:

• Access — request a copy of all personal data we hold about you.
• Rectification — request correction of inaccurate data.
• Erasure — request deletion of your data ("right to be forgotten"). See Data Deletion.
• Portability — request your data in a structured, machine-readable format.
• Objection — object to processing based on legitimate interests.
• Withdraw consent — at any time, by disconnecting any platform account or emailing us.

To exercise any of these rights, email privacy@kaxtus.com. We will respond within 30 days. You also have the right to lodge a complaint with the Berlin Commissioner for Data Protection (BlnBDI).

8. Cookies

We use only essential cookies required to keep you logged in and maintain your session. No third-party advertising cookies. See our Cookie Policy for details.

9. International Transfers

Your data is stored and processed in Germany. Third-party platforms we integrate with (including LinkedIn Corporation, based in the United States) may process data in the US or other countries; such transfers are covered by each platform's own compliance measures (Standard Contractual Clauses or equivalent). We do not otherwise transfer your personal data outside the EU/EEA.

10. Changes to This Policy

We may update this Privacy Policy. We will notify registered users by email of material changes at least 14 days before they take effect. The date at the top of this page reflects the most recent revision.

11. Governing Law

This policy is governed by the laws of the Federal Republic of Germany and the General Data Protection Regulation (GDPR). Disputes shall be subject to the exclusive jurisdiction of the courts of Berlin, Germany.