LocalizeASO Logo LocalizeASO

Privacy Policy

Last updated: September 8, 2026

We take data protection seriously and process personal data in accordance with the GDPR.

1. Data Controller

Wotaso GmbH
Bostonring 5
71686 Remseck am Neckar
Germany
Email: [email protected]

Represented by the Managing Director: Lucas Damian Orzan
Registered office: Remseck am Neckar
Commercial Register: HRB 801744
Register Court: District Court of Stuttgart
VAT ID: DE457485481

2. What Data We Collect

Account Data

  • Name (if provided)
  • Email address
  • Account ID

Service Data

  • App metadata you enter or generate
  • Locale settings
  • Keyword data
  • Usage actions in the dashboard

Technical Data

  • IP address (temporarily in server logs)
  • Device/browser information

Error Monitoring

With your optional monitoring consent, our browser uses the Sentry SDK to send technical error reports to our self-hosted GlitchTip service. This helps us diagnose failures (Art. 6(1)(a) GDPR). Browser monitoring does not start before consent. Necessary server-side security and error logs are separate and rely on our legitimate interest in operating a secure service (Art. 6(1)(f) GDPR).

Hosted AI Data

When you choose a hosted AI feature, LocalizeASO sends the minimum content needed to OpenAI through our server-side proxy. This can include App Store metadata, locale and keyword context, your instructions, and validation feedback. App Store Connect private keys are not sent to OpenAI.

We store the generated proposal and an access-controlled, append-only audit record containing the actual provider and model, time, prompt/policy/workflow versions, and cryptographic input/output hashes. Human edits and approval are recorded separately. The audit record does not store a second copy of the raw prompt solely for provenance.

3. Payment Data

Where a checkout is provided through Paddle, Paddle acts as merchant of record and processes contact, transaction, billing and payment information under its own privacy notice. We receive information needed to provide access, reconcile payments and meet accounting duties, but do not store full card details. The legal bases are contract performance (Art. 6(1)(b) GDPR) and applicable legal obligations (Art. 6(1)(c) GDPR). Test or sandbox checkouts do not constitute a live payment service. Paddle browser code is loaded when a pricing preview or checkout requires it.

4. How We Use Data

We process data to:

  • Provide and operate the Service
  • Authenticate users
  • Store metadata drafts
  • Generate and review AI-assisted metadata when you request it
  • Communicate with users
  • Improve stability and performance
  • Ensure security

Legal basis: contract performance (Art. 6(1)(b) GDPR) and legitimate interest (Art. 6(1)(f)).

Hosted AI processing is necessary to perform the feature you request (Art. 6(1)(b) GDPR). Security, abuse prevention, and compliance audit records rely on our legitimate interest (Art. 6(1)(f) GDPR), balanced against data minimization and access controls.

5. Optional Website Analytics and Browser Storage

Only after you allow optional processing do we use AnalyticsCLI to measure page views, navigation, signup and checkout events. It uses pseudonymous device and session identifiers and may include campaign parameters (UTM), the referring page without its query string, landing paths and general browser/device information. These data are not described as anonymous because identifiers can link visits. We do not send form contents or payment card details.

Website analytics and campaign storage rely on Art. 6(1)(a) GDPR and, for access to or storage on your device, § 25(1) TDDDG. Before consent or after withdrawal, optional website analytics events are not sent and campaign attribution is not stored. Campaign attribution expires after 30 days and is removed when consent is withdrawn. Withdrawing also clears the website analytics identifiers in this browser.

The privacy choice itself is stored to remember your decision. Storage strictly necessary for a service you request, such as authentication and checkout, is covered by § 25(2) TDDDG; subsequent personal data processing uses the applicable contract or security basis. You can use the website with optional processing disabled.

Select “Privacy settings / withdraw consent” at the bottom of any page to immediately withdraw optional analytics and browser monitoring consent and reopen the choice. Withdrawal does not affect the lawfulness of processing before withdrawal.

6. Product Analytics (Authenticated Users)

Within our authenticated dashboard and plugin, we use AnalyticsCLI custom events and custom properties to understand feature usage and improve product quality.

Data processed:

  • Feature usage events
  • Generalized technical metadata (browser/device category)
  • Initial acquisition properties (UTM/referrer/path, if available)

We do not process:

  • Email addresses
  • Names
  • Content created within the product
  • Uploaded files or design data

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in product improvement and system security).

Users can opt out of product analytics at any time in account settings.

7. Hosting & Subprocessors

Provider Purpose Location
Wotaso GmbH (using PostgreSQL / Better Auth) Database & authentication Germany
Hetzner Backend hosting Germany
AnalyticsCLI Web + product analytics EU
GlitchTip (self-hosted) Error monitoring EU
OpenAI Ireland Ltd. Hosted AI metadata generation and localization EEA and other locations used by its approved subprocessors
Cloudflare, Inc. Website delivery, reverse proxy/CDN and protection against abuse; connection data such as IP address, request and browser information Global network; see Cloudflare privacy information
Paddle Pricing and checkout infrastructure; merchant of record where a purchase is offered International processing under Paddle’s privacy notice

Website requests necessarily disclose connection data, including IP address, request path, time and browser information, to our hosting and delivery infrastructure. We use Hetzner hosting and Cloudflare to serve pages, maintain availability and investigate abuse (Art. 6(1)(f) GDPR). These necessary requests occur even if you reject optional analytics. PostgreSQL and Better Auth are software used in our infrastructure, not separate recipients.

8. Data Retention

We retain account data as long as your account exists. You may request deletion at any time.

Optional analytics are retained only for evaluating usage and improving the service, and deleted or aggregated when identifiable event history is no longer needed. You may request deletion of data relating to you. The 30-day lifetime above applies to browser campaign attribution, not to data already sent to the analytics service.

AI proposals, human review records, and AI-origin export manifests are retained while your account exists so you can audit what was generated and approved. They are deleted through our controlled account-deletion process unless legal retention duties apply. Under the current API project settings, OpenAI retains Responses API application state for at least 30 days by default and may retain abuse-monitoring data for up to 30 days. A shorter, Modified Abuse Monitoring, or Zero Data Retention setting would apply only if it is separately approved and activated for our project.

Connection and error records are kept for operation, troubleshooting and investigation of specific security incidents, and removed when that purpose ends. Support correspondence is kept for handling your request and, where necessary, establishing or defending claims. Invoices and other legally required records are retained for the applicable statutory period. Deletion requests do not override those legal obligations.

9. Security

We use encryption, access controls, and secure infrastructure to protect data.

10. Your Rights (GDPR)

You have the right to:

  • Access your data
  • Correct data
  • Delete data
  • Restrict processing
  • Data portability
  • Object to processing based on legitimate interests for reasons arising from your particular situation
  • Withdraw consent at any time with effect for the future
  • Lodge a complaint with a supervisory authority

11. Data Transfers

Our analytics stack is self-hosted in the EU. Cloudflare, Paddle and OpenAI may process data outside the EEA. Such transfers require an applicable adequacy decision or safeguards under Chapter V GDPR, such as EU Standard Contractual Clauses and any necessary supplementary measures. Contact us for information about the safeguards applicable to your data and how to obtain a copy. We do not share website analytics with advertising providers.

12. Opt-Out

Authenticated users can disable product analytics in account settings. Website visitors can immediately withdraw optional processing using “Privacy settings / withdraw consent” at the bottom of every page. You may also contact us to exercise your data protection rights.

13. Changes

We may update this policy.

14. Contact

Email: [email protected]