Privacy Policy

1. Controller

hearr Media UG (haftungsbeschränkt) Dürener Straße 266 50935 Köln Germany Email: support@hearr.me

2. Scope and principles

This policy applies to our website hearr.me and our web app app.hearr.me. We process personal data on the basis of the General Data Protection Regulation (GDPR) and the supplementary German rules, in particular the German Digital Services Act (Digitale-Dienste-Gesetz, DDG) and the German Telecommunications Digital Services Data Protection Act (TDDDG).

3. User account and performance of the contract

To use our service, you create a user account. In doing so, we process your email address, your login details and information about the plan you have booked and its use. If you sign in via a third-party service, we receive your email address and an identifier from that service.

Legal basis: Art. 6(1)(b) GDPR (performance of the user contract). Retention period: until your account is deleted, unless statutory retention obligations apply.

Further development of our service. From time to time we test variants of individual features. To do so, we randomly assign user accounts to a variant and evaluate how purchases, renewals and the creation of stories develop in the variants. Only aggregated values are evaluated; the content of your stories is not read in the process. Legal basis: Art. 6(1)(f) GDPR (our interest in improving our service). You can object to this at any time; a message to support@hearr.me is sufficient.

4. Creation of personalised audio stories

To create the audio stories you request, we process the information you provide in our form as well as the texts and audio files generated from it.

This information may allow conclusions to be drawn about your sex life or your sexual orientation. It therefore belongs to the special categories of personal data within the meaning of Art. 9 GDPR. We process it to create and provide your stories and, within the narrow framework described below, for statistical evaluations to improve our stories. It is not used for advertising purposes or passed on to advertising partners.

Legal basis: Art. 6(1)(b) GDPR in conjunction with Art. 9(2)(a) GDPR (your explicit consent, which you give before the creation). You can withdraw this consent at any time with effect for the future in your account settings; after that, it is no longer possible to create new stories. When withdrawing, you decide whether your previous stories and information remain in your account or are deleted. Stories that are being created at the time of the withdrawal are still completed if you keep your previous stories; otherwise, we cancel them. Stories that we do not complete because of the withdrawal are credited to your account. If the payment for a story is only confirmed after your withdrawal, we refund the purchase price to your means of payment. Retention period: until you delete the respective story or your account.

Statistical evaluation to improve our stories. To prevent your stories from repeating themselves, we evaluate from time to time how similar stories are to one another, for example whether openings, wording or scenes are repeated. For this purpose, stored stories and the associated form information are evaluated exclusively automatically on our servers and immediately converted into non-readable metrics. In this evaluation, no one reads your stories or your information, no data is transferred to further recipients and no additional data about you is stored. The result consists exclusively of aggregated values across many accounts, does not allow any conclusions to be drawn about individual persons and is not used for measures or decisions concerning you.

Legal basis: Art. 9(2)(j) GDPR in conjunction with Section 27(1) of the German Federal Data Protection Act (BDSG) (processing for statistical purposes) and Art. 6(1)(f) GDPR (our legitimate interest in improving the quality of the stories you have booked). Your consent is not required for this. You can object to this evaluation at any time (Art. 21 GDPR); a message to support@hearr.me is sufficient, and no reason is required. Your stories and information will then no longer be included. Retention period: no data is stored for the evaluation; the results are anonymous.

5. Payment processing

We process payments via Stripe Payments Europe Ltd., 25/28 North Wall Quay, Dublin 1, Ireland. Your payment data, in particular card or account details, is processed exclusively by Stripe; we do not receive it. We receive information on the payment status, the amount and the data required for invoicing.

Legal basis: Art. 6(1)(b) GDPR (performance of the contract); for retaining invoicing records, Art. 6(1)(c) GDPR. Retention period: accounting vouchers and invoices for eight years, books and financial statements for ten years (Section 147(3) of the German Fiscal Code (AO), Section 257(4) of the German Commercial Code (HGB), Section 14b of the German VAT Act (UStG)).

Proof of the service provided after an account deletion. If you delete your account, we remove your stories, your form information and your contact details. For each payment, the accounting record that must be retained by law remains; it contains the Stripe payment identifier, the amount and the date, but neither your name nor your email address. In addition, we store with this accounting record when the paid audio story was completed and when it was first played. We need these two points in time to be able to defend ourselves against subsequently disputed payments. Without them, we would no longer be able to prove after an account deletion that the paid service was provided. The content of your stories is not stored in the process.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in defending against payment claims); to this extent, the obligation to erase under Art. 17(3)(e) GDPR does not apply. Retention period: the time of completion forms part of the accounting voucher and is subject to its retention period. We delete the time of first playback no later than 400 days after the payment; if a payment dispute is pending at that time, we delete it 90 days after the dispute has been concluded.

For our revenue and renewal statistics, we also retain for each subscription its start, renewals, plan changes, cancellation and amounts, linked via an encrypted subscription identifier but without name or email address. Legal basis: Art. 6(1)(f) GDPR (our interest in reliable revenue planning). Retention period: five years from the respective event; after that, we delete this information.

6. Hosting and technical provision

Our web app is provided by Vercel Inc., 340 S Lemon Ave #4133, Walnut, CA 91789, USA; content is delivered via servers in the EU. We operate our backend, including the database, at Supabase Inc., USA, at the Frankfurt am Main data centre location. Our website is provided via Webflow Inc., 398 11th Street, 2nd Floor, San Francisco, CA 94103, USA.

Data processing agreements are in place with all of these providers. Insofar as processing may take place in the USA, it is based on the EU standard contractual clauses and, insofar as the respective provider is certified, the EU-U.S. Data Privacy Framework.

When you access our pages, technical access data is processed, in particular IP address, time, page accessed, browser type and operating system.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in secure and stable operation). Retention period: access data is stored for a short time and deleted regularly.

7. Cookies and consent management

We use the consent tool Cookie Script to obtain and document your consents. It stores your consent status, the time it was given and technical browser data.

We set technically necessary cookies to keep you signed in, to carry out the ordering process, to store your language selection (retention period: 12 months) and to detect drop-offs in our ordering process. For the latter, we store only a randomly generated identifier and information on which form steps were reached; the content of your answers is not stored. Retention period: 90 days.

In addition, we store in our own cookies how you came to us: campaign parameters from the address accessed, the domain of the referring website, the first page accessed and whether an in-app browser was used. These cookies are only read by us and are deleted after 90 days. We do not pass on their content to third parties, with three exceptions: we transmit the click identifier from an ad on X to X, the click identifier from an ad on Google to Google and the click identifier from an ad on TikTok to TikTok, in each case only if you have consented to advertising (see section 9). We use them to identify which of our advertising channels and partners led to a registration or a purchase. Legal basis: Section 25(2) no. 2 TDDDG and Art. 6(1)(f) GDPR.

We only set cookies that are not technically necessary, in particular for analysis and advertising, after you have given your consent. Our own usage analysis in our app (section 8) does not set cookies but likewise only takes place with your consent.

Legal basis: Section 25(2) no. 2 TDDDG and Art. 6(1)(f) GDPR for technically necessary cookies; Section 25(1) TDDDG and Art. 6(1)(a) GDPR for all others.

8. Reach measurement

Our own usage analysis in the app. If you have consented in our app, we record when you open the app, when you start a story, how far you listen to it (in steps of 25 percent), whether you listen to the end or play it again, and whether you have installed the app on your home screen. We store your user identifier, the type of event, the identifier of the story and the time, but no content of your stories or information. We use this data to understand how our service is used, to test new features and to improve it. We also use it to give you suitable notices in the app or by email, for example a reminder if you have not listened to anything for a longer time, or a suggestion on the length of your stories. For this purpose, we evaluate your usage behaviour automatically; no legal effects or similarly significant decisions are associated with this. The data is processed exclusively in our own systems (hosting see section 6), is not passed on to third parties and is not used for advertising by third parties. We use our email service provider (section 12) to send emails; it only receives the message itself, not your usage data.

Because your listening behaviour may allow conclusions to be drawn about your sex life, we only process this data with your explicit consent.

Legal basis: Art. 6(1)(a) and Art. 9(2)(a) GDPR and Section 25(1) TDDDG (your consent). The consent is voluntary; without it, you can use hearr without restriction. You can withdraw it at any time with effect for the future in your account settings. After a withdrawal, we do not record any further events and delete those already recorded. Retention period: we delete the individual events after 12 months at the latest, and immediately upon withdrawal or deletion of your account. After that, we only retain aggregated values across many users that do not allow any conclusions to be drawn about individual persons.

Google Analytics. Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. We use the service to analyse the use of our service. IP addresses are processed in shortened form. Legal basis: Art. 6(1)(a) GDPR (consent).

Google Tag Manager. Provider: Google Ireland Limited. The Tag Manager serves solely to manage the tags used and does not itself store any personal data.

Ahrefs Web Analytics. Provider: Ahrefs Pte. Ltd., 16 Raffles Quay, Singapore. We use the service to measure page views. The service does not set cookies; page view, referrer and technical browser data are processed. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in cookie-free reach measurement).

Hotjar. Provider: Hotjar Ltd., Dragonara Business Centre, 5th Floor, Dragonara Road, St Julian's STJ 3141, Malta. We use the service to evaluate the use of our pages, for example clicks, mouse movements and scroll depth. IP addresses are processed in anonymised form. Legal basis: Art. 6(1)(a) GDPR (consent).

Retention period: as long as necessary for the evaluation, at the latest until you withdraw your consent.

9. Advertising and conversion measurement

Google Ads. Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. We measure whether users complete a purchase or renew their subscription after clicking on one of our ads on Google. We do not use a Google advertising tag in your browser for this.

If you came to us via one of our ads on Google, the advertising link contains a click identifier, which we store for our own conversion measurement (see section 7). For each purchase, we also store whether you had consented to advertising at the start of the payment process. Only if this was the case do we make available to Google, for this purchase, the click identifier, the time, the order value, the currency and an order identifier, and likewise for a renewal of your subscription that takes place no more than 85 days after the purchase. Google usually retrieves this information from us once a day via a secure connection. We do not transmit your email address, your name or a user identifier. If you withdraw your consent while signed in to hearr, we no longer make later renewals available. We cannot assign a withdrawal in a browser in which you are not signed in to your account.

Google may transfer data to the USA; Google is certified under the EU-U.S. Data Privacy Framework. Further information: https://policies.google.com/privacy

The legal basis is your consent under Art. 6(1)(a) GDPR, which you give via our cookie notice. You can withdraw it at any time with effect for the future via the cookie settings.

Retention period: at Google, in accordance with its specifications. We store the information on your consent for as long as the associated purchase. We delete the click identifier no later than 365 days after the purchase (see "Our own conversion measurement"); after that, it is no longer made available to Google.

Meta. Provider: Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland. We measure the effectiveness of our ads and improve their delivery. This is done in two ways: via the Meta pixel in your browser and via an interface through which we transmit information on completed purchases from our server to Meta.

This involves processing your email address and an internal user identifier, each pseudonymised as a hash value, cookie identifiers set by Meta, your browser identifier as well as order value, currency and an order identifier.

We are jointly responsible with Meta for this processing within the meaning of Art. 26 GDPR. You can find the essence of the arrangement at https://www.facebook.com/legal/controller_addendum. Meta may transfer data to the USA; Meta is certified under the EU-U.S. Data Privacy Framework. Further information: https://www.facebook.com/privacy/policy

The legal basis is your consent under Art. 6(1)(a) GDPR, which you give via our cookie notice. Both the Meta pixel and the server-side transmission take place exclusively after your consent. You can withdraw your consent at any time with effect for the future via the cookie settings.

Retention period: as long as necessary to measure the success of our campaigns.

X. Provider: X Internet Unlimited Company, One Cumberland Place, Fenian Street, Dublin 2, D02 AX07, Ireland. We measure the effectiveness of our ads on X. For this purpose, we use the X pixel in your browser.

This involves processing cookie identifiers set by X, your IP address and technical browser data, the page accessed, where applicable the click identifier from an ad on X and, in the case of a purchase, order value, currency and an order identifier. We do not transmit your email address.

If you came to us via an ad on X, the advertising link contains a click identifier, which we store for our own conversion measurement (see section 7). If you have consented to advertising, we write this identifier into a cookie of the X pixel on our domain so that X can attribute a later registration or purchase to the ad. The X pixel then transmits the identifier to X with each of its events for as long as the cookie exists, i.e. also on page views. We do not overwrite an existing identifier from X, and we do not transmit any other identifiers in this way. X may transfer data to the USA; information on the safeguards used can be found in X's privacy policy at https://x.com/en/privacy

The legal basis is your consent under Art. 6(1)(a) GDPR and Section 25(1) TDDDG, which you give via our cookie notice. You can withdraw it at any time with effect for the future via the cookie settings.

Retention period: at X, in accordance with its specifications. The cookie with the click identifier that we set is deleted after 30 days. If the X pixel sets this cookie itself, for example if you come to us directly via an ad on X after giving your consent, X's lifetime of up to 390 days applies. Our own storage of the click identifier is governed by the paragraph "Our own conversion measurement".

TikTok. Provider: TikTok Technology Limited, 10 Earlsfort Terrace, Dublin, D02 T380, Ireland. We measure the effectiveness of our ads on TikTok and improve their delivery. This is done in two ways: via the TikTok pixel in your browser and via an interface (Events API) through which we transmit information on registrations and completed purchases from our server to TikTok.

This involves processing cookie identifiers set by TikTok, your IP address and technical browser data, the page accessed and the click identifier from an ad on TikTok. In the case of a purchase, order value, currency and an order identifier are added, and in the case of a registration an internal user identifier. Via the interface we also transmit your email address as a hash value (pseudonymised); we do not transmit the plain-text email address, names, IP address or browser identifier in this way.

Because hearr offers erotic content, TikTok learns that you use hearr and can link this to a TikTok account via the hashed email address, if you have one.

If you came to us via an ad on TikTok, the advertising link contains a click identifier, which we store for our own conversion measurement (see section 7). If you consented to advertising at the start of the payment process, we transmit it together with the information mentioned above via the interface to TikTok so that TikTok can attribute a registration or purchase to the ad. For each purchase we store whether you had consented to advertising. Without this consent, neither the TikTok pixel is called nor is anything transmitted via the interface.

TikTok also processes data outside the European Economic Area, including access from China, and states that it relies on EU Standard Contractual Clauses. More: https://www.tiktok.com/legal/page/eea/privacy-policy/en

We are jointly responsible with TikTok for collecting and transmitting this data (Art. 26 GDPR); TikTok alone is responsible for any further processing. You can exercise your rights with us or with TikTok.

The legal basis is your consent under Art. 6(1)(a) GDPR and Section 25(1) TDDDG, which you give via our cookie notice. You can withdraw it at any time with effect for the future via the cookie settings.

Retention period: at TikTok, in accordance with its specifications. Our own storage of the click identifier is governed by the paragraph "Our own conversion measurement" (365 days at most). To prove that an event was transmitted, we keep a log without the email address and without the user identifier in plain text.

TrafficJunky. Provider: Aylo Freesites Ltd, 195-197 Old Nicosia-Limassol Road, Block 1 Dali Industrial Zone, 2540 Dali, Cyprus. TrafficJunky is an advertising network through which we place ads on websites with offers for adults. We measure whether users create an account or complete a purchase with us after clicking on one of these ads. For this purpose, a measurement call is sent to TrafficJunky at that moment.

This involves processing your IP address, cookie identifiers set by TrafficJunky, technical characteristics of your device and browser (such as device model, operating system and browser version), in the case of a registration the sign-in method chosen and, in the case of a purchase, the type of purchase, the order value and an order identifier. We do not transmit your email address, your name or a user identifier, nor any content or information about your stories.

Because TrafficJunky delivers ads for offers for adults, the provider learns in this way that a registration or purchase has taken place with us after a click on such an ad.

Aylo may transfer data within its group of companies and to service providers, including to countries outside the European Economic Area. According to its own information, the provider bases this on adequacy decisions of the European Commission or on EU standard contractual clauses. Further information: https://www.trafficjunky.com/privacy-notice

The legal basis is your consent under Art. 6(1)(a) GDPR and Section 25(1) TDDDG, which you give via our cookie notice. Without your consent, no data is transmitted to TrafficJunky. You can withdraw your consent at any time with effect for the future via the cookie settings.

Retention period: at TrafficJunky, in accordance with its specifications; we ourselves do not store any additional data for this purpose.

Our own conversion measurement. Independently of the providers mentioned, we record in our own systems via which advertising channel a registration or purchase came about: campaign parameters, origin and the click identifier from the advertising link (see section 7). We do not pass on this information to third parties, with three exceptions: after your consent, we transmit the click identifiers from ads on X, on Google and on TikTok to the respective provider, as described in the paragraphs on X, on Google Ads and on TikTok. Legal basis: Art. 6(1)(f) GDPR (our interest in measuring the effectiveness of our advertising channels and settling accounts with partners). Retention period: we delete click identifiers no later than 365 days after the registration or the purchase; we retain campaign and channel information for conversion measurement. After an account deletion, we only retain an anonymous indication of the advertising channel for purchases, without any identifier.

10. Fonts

Our website loads fonts from servers of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. In doing so, your IP address is transmitted to Google. Legal basis: Art. 6(1)(a) GDPR (consent).

11. Use of AI services

To generate the texts and the voice output of your stories, we use specialised AI service providers. The information you provide and the texts generated from it are transmitted to these providers; processing in the USA may take place in the process.

You can find out which specific providers we use, with legal entity, registered office, purpose and basis for transfer, in our always up-to-date overview of processors at app.hearr.me/subprozessoren. Data processing agreements are in place with all providers; transfers to third countries are based on the EU standard contractual clauses (Art. 46 GDPR) and, insofar as the respective provider is certified, the EU-U.S. Data Privacy Framework.

Legal basis: Art. 6(1)(b) GDPR in conjunction with Art. 9(2)(a) GDPR (see section 4).

12. Email communication and newsletter

We use Brevo (Sendinblue GmbH, Köpenicker Str. 126, 10179 Berlin, Germany) to send emails. A data processing agreement is in place.

As a customer, you will also occasionally receive emails from us about our own similar offers, for example about new features or benefits for your subscription. You can object to these emails at any time without incurring any costs other than the transmission costs at the basic rates; an unsubscribe link is included in each of these emails.

As a subscriber, we occasionally remind you of your stories by email or point out a new suggestion. For this, we use when you last ordered a story and whether a suggestion is available for you, not the content of your stories. You receive no more than two such emails per week and can switch them off in the settings or via the unsubscribe link in each email. The legal basis is Art. 6(1)(b) GDPR.

Legal basis: Art. 6(1)(b) GDPR for contract-related messages; Art. 6(1)(f) GDPR in conjunction with Section 7(3) of the German Act against Unfair Competition (UWG) for emails about our own similar offers. Retention period: until you object or delete your account.

Newsletter "Die Nachtausgabe". If you subscribe, we send you news, ideas for audio stories and offers about hearr by email about once a month. Subscription takes place via the double opt-in procedure: you first receive an email with a link and are only subscribed once you confirm the subscription there. When subscribing on our website, you also confirm that you are at least 18 years old; when subscribing in the app, the age confirmation from your registration applies.

To prove your consent, we store your email address, the times of subscription and confirmation, whether you subscribed on the website or in the app, the version of the consent text, your age confirmation and, where applicable, the time of your withdrawal. We do not store your IP address for this purpose.

When sending the newsletter, Brevo measures whether an issue was opened and which links in it were clicked. For this purpose, the emails contain an invisible tracking pixel and links marked for you. We use this information to improve the newsletter. We do not assign you to groups with particular preferences on the basis of your clicks and do not link them to your information about stories.

After confirmation, you receive a voucher for your first subscription month as a welcome gift, provided you have not previously had a subscription with hearr. To redeem it, we check on the basis of your account whether you are eligible; the discount is applied when paying via Stripe (section 5). The voucher remains valid even if you unsubscribe from the newsletter beforehand.

Legal basis: Art. 6(1)(a) GDPR (your consent), additionally Section 25(1) TDDDG for measuring opens and clicks; for proof of your consent, Art. 6(1)(c) GDPR in conjunction with Art. 7(1) GDPR. You can withdraw your consent at any time with effect for the future: via the unsubscribe link in each issue, in your account settings or by email to support@hearr.me. Retention period: we delete unconfirmed subscriptions after 30 days. Brevo stores open and click data on the newsletter for as long as you receive the newsletter. When you unsubscribe or delete your account, we delete your contact at Brevo, including this data. We delete logs of the sending of our other emails after one month. We retain proof of your consent and of your withdrawal until the end of the third year after your withdrawal in order to be able to prove that the sending was lawful. If you delete your account, we retain this proof for the same period only with an irreversibly encrypted value of your email address (hash value).

13. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16 GDPR), erasure (Art. 17 GDPR), restriction of processing (Art. 18 GDPR) and data portability (Art. 20 GDPR). You can withdraw consents you have given at any time with effect for the future (Art. 7(3) GDPR).

Right to object: Insofar as we process data on the basis of a legitimate interest, you have the right to object to this processing at any time on grounds relating to your particular situation (Art. 21 GDPR). If the processing is for direct marketing purposes, you can object without giving reasons.

You also have the right to lodge a complaint with a data protection supervisory authority, in particular in the EU Member State of your habitual residence, your place of work or the place of the alleged infringement (Art. 77 GDPR).

To exercise your rights, a message to support@hearr.me is sufficient.

14. Changes to this policy

We adapt this policy if our service or the legal situation changes. The version published on this page applies in each case. This policy is available in German and English.