Privacy policy

The controller is Yussuf Bioud, YUSSE Digital Agency, Sportplatzstraße 22, 52152 Simmerath, Germany. Telephone: 0151 53979345. Email: contact@yusseagency.com.

For privacy questions and to exercise your rights, contact this email address.

We process personal data to provide and secure this website, handle inquiries and communicate. Personal data means information about an identified or identifiable natural person.

Contract-related inquiries and pre-contractual steps rely on Article 6(1)(b) GDPR. Other business inquiries may rely on Article 6(1)(f), our legitimate interest in handling them. Legally required processing relies on Article 6(1)(c). Where consent is required and given, Article 6(1)(a) applies.

Storing or accessing information on your device must additionally be assessed under section 25 of the German TDDDG. Naming a legal basis does not establish that its requirements are met.

The website is provided through Lovable; inquiries are stored in Lovable Cloud. Access may involve processing IP addresses, access times, requested pages, browser and device details, and error and security data. Article 6(1)(f) GDPR may apply to secure website provision.

Lovable’s privacy information identifies Lovable Labs Sweden AB, Regeringsgatan 25, 111 53 Stockholm, Sweden. Other contractual documents identify different entities. The entity governing our contract and the applicable data-processing terms have not been conclusively confirmed.

The infrastructure includes Cloudflare protection. The exact database location and processing locations and retention periods for backups and logs have not been reliably confirmed. We therefore make no claim that all data remains exclusively in Germany or the EU.

Name, email address, requested service and message are mandatory. Company or brand and budget are optional. An inquiry identifier and receipt timestamp are generated. Input formats and lengths are checked in the browser and on the server.

The information is first saved in the Lovable Cloud database. The system then attempts to email all form details to contact@yusseagency.com. The saved inquiry remains even if sending fails. The success message confirms acceptance of the inquiry, not email delivery.

The inquiry table does not expressly store IP addresses or browser identifiers. Technical infrastructure logs are separate. We use the information to handle your request, ask follow-up questions and, where applicable, prepare a contract under section 2. The form does not forward its contents to the SEO AI model.

Please do not submit health data, other special categories of personal data, or unnecessary information about third parties. The form has no attachment-upload function.

Contact notifications use Lovable’s managed email service. It receives the recipient address, subject, all form contents and the requester’s email as the reply-to address. The configured sender is YUSSE <noreply@yusseagency.com>; notify.yusseagency.com is the technical sending domain, not an additional recipient mailbox. A configured sending service does not prove successful delivery.

The mailbox contact@yusseagency.com is hosted by IONOS. Its German data-processing agreement identifies IONOS SE, Elgendorfer Straße 57, 56410 Montabaur, Germany. The specific email product and governing contract terms remain to be confirmed.

Direct email communication may involve your email address, message, any attachments and technical email metadata. Processing serves communication and request handling under Article 6(1)(b) or (f) GDPR, depending on the request. Statutory retention obligations remain unaffected.

Archivo and Manrope are loaded externally through fonts.googleapis.com and fonts.gstatic.com. Google may receive your IP address and technical connection data. These fonts are currently not provided exclusively locally.

For EEA users, Google generally identifies Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Other Google entities may participate, and transfers outside the EEA are possible.

The fonts are used to display the website. The legal basis and any requirement for prior consent for this particular external integration have not been conclusively established. This policy does not claim that such consent is already obtained.

yusse-lang (local storage): Written when switching between DE and EN. The current code derives the displayed language from the URL. The entry has no automatic expiry; its actual necessity remains to be established.

tsr-scroll-restoration-v1_3 (session storage): Stores scroll positions for restoration during navigation within a browser session. Browser session restoration may extend its practical lifetime.

__cf_bm (cookie): Cloudflare bot management protecting against automated access. According to Cloudflare, it expires after 30 minutes of continuous inactivity.

__dpl (cookie): Observed on the published website. Its provider-confirmed purpose and binding lifetime have not been established. We do not assume that it is strictly necessary.

yusse-seo (cookie): Protected session for the private SEO Studio, with a configured maximum lifetime of eight hours and HttpOnly, Secure and SameSite=Strict attributes.

You can delete or restrict cookies and site data through your browser; this may affect functionality. The requirements for an exemption from consent under section 25(2) TDDDG have not been conclusively established for all listed storage operations. Cookie-free analytics does not mean the entire website uses no cookies.

Integrated Lovable visitor statistics are enabled to understand reach, use and traffic sources and improve the website.

The product documentation describes visits, page views, visit duration, engagement, referring pages or channels, countries and device types. Referrers and link tags such as UTM parameters may identify traffic sources. IP addresses may be processed when receiving requests; this does not confirm permanent storage of full IP addresses.

Lovable describes aggregate statistics without cross-session visitor profiles. A random visit identifier is discarded at the end of the visit. According to the provider, analytics sets no cookies and stores no browser data. Its script and collection address use the application’s domain; Lovable remains the processing provider.

Authorized project editors and workspace owners can access statistics. Lovable also describes creating de-identified data for its own improvements and comparisons. The reporting view of up to 90 days does not establish a complete deletion period for raw data, logs or backups.

Necessary and proportionate audience measurement may rely on Article 6(1)(f) GDPR. The specific balancing of interests and retention and deletion conditions have not been conclusively confirmed; the absence of cookies does not replace this assessment.

The password-protected SEO Studio is intended for the operator. It creates SEO titles and meta descriptions and is not part of the contact form. The password is sent to and checked by our server; access is recorded in a protected session.

Generation sends the entered page text and target language to Lovable AI Gateway. An OpenAI model is configured in the reviewed project. There is no automatic redaction of personal information; unnecessary personal details should be removed before entry.

The reviewed workflow does not additionally save inputs or drafts as such in the project database. Technical access-blocking or error information may be stored. The store: false request option does not prove that the gateway and participating providers perform no logging or security retention.

Lovable documents logs containing status, model, cost and time. When AI app context is enabled, full requests and responses may be retained for 90 days. This project’s actual setting is unconfirmed. store: false does not demonstrably disable this Lovable logging.

The function serves editorial website metadata. Necessary internal editorial processing may rely on Article 6(1)(f) GDPR. The lawful use of other people’s personal data, recipients, processing locations and transfer conditions must be assessed before entering such data.

The site links to Instagram profile @yusse.official without embedding a feed. During the technical review, merely loading the page did not establish an Instagram connection through this link.

Opening the link leaves this website. Instagram may then process connection and usage data under its own terms. For EEA users, the provider is generally Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland.

The same applies to external portfolio-site links. No embedded Google Maps, YouTube videos or standalone marketing pixels were identified in the reviewed project.

Hosting, cloud, security, email and AI providers may process data as necessary, particularly Lovable and its actual subprocessors and IONOS for the mailbox. Google receives technical data through external fonts; linked providers process data when their services are opened.

A German or Swedish provider does not mean that all processing occurs within the EEA. Security and AI infrastructure may involve other countries, including the USA.

Third-country transfers must satisfy Articles 44 et seq. GDPR, for example through an adequacy decision or appropriate safeguards. This project’s applicable contractual and transfer arrangements have not been fully confirmed. You can request information on recipients and transfer grounds affecting your data at contact@yusseagency.com.

Retention depends on the purpose and statutory duties, including whether an inquiry is still being handled, a contract follows, retention obligations apply, or data is needed to establish, exercise or defend legal claims.

There is currently no fixed deletion rule for contact inquiries. The reviewed project does not automatically delete them. They initially remain in the database; email copies, backups and logs must be considered separately. This does not mean indefinite retention is legally permissible.

Send deletion requests to contact@yusseagency.com. Statutory conditions and any conflicting obligations must be assessed. Specific operational deletion periods, responsibilities and backup and log periods have not been conclusively established; we do not promise an already implemented deletion routine.

Subject to statutory requirements, you have rights of access (Article 15 GDPR), rectification (Article 16), erasure (Article 17), restriction (Article 18), portability (Article 20) and objection (Article 21).

For processing under Article 6(1)(f), you may object on grounds relating to your particular situation. Processing then stops unless compelling legitimate grounds or the establishment, exercise or defence of legal claims justify continuation. You may object to direct marketing at any time.

You may withdraw consent for the future without affecting the lawfulness of previous processing. Contact contact@yusseagency.com to exercise your rights. Reasonable identity-verification information may be requested where necessary.

You may complain to a supervisory authority, particularly where you live or work or where an alleged infringement occurred. For the controller’s location in North Rhine-Westphalia, this includes the Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen: Postfach 20 04 44, 40102 Düsseldorf, Germany; telephone +49 (0)211 38424-0; email poststelle@ldi.nrw.de.

The website uses HTTPS. Private SEO access is checked server-side and its session cookie has protective attributes. The inquiry table has row-level access protection; the form server saves through privileged server access. These measures do not replace a full review of permissions and organizational safeguards.

The reviewed contact form implements no solely automated decision with legal or similarly significant effects under Article 22 GDPR. AI creates editorial metadata drafts, not decisions about people making inquiries.

This policy must be updated when the website, services or legal requirements change. Its date identifies the technical review date, not approval by a lawyer or authority.