Controller

The controller within the meaning of the GDPR is:

s1 media, Patrick Tangemann & Kolja Wagschal GbR
Uesener Feldstraße 20a
28832 Achim
Germany

Email: team@s1-media.de
Phone: +49 (0)42 02 – 765 09 86

Collection and Processing of Personal Data

2.1 Registration and User Account

When registering we collect: email address, password (stored as a bcrypt hash), optionally your name, and the IP address and time of registration and of your consent to the terms, privacy policy and data processing agreement (evidence under Art. 7(1) GDPR, protection against automated registrations). For credit purchases we additionally collect company name, billing address and, where applicable, VAT ID. This data is required for the performance of the contract or pre-contractual measures (Art. 6(1)(b) GDPR); the IP address is processed on the basis of our legitimate interest in evidence and abuse prevention (Art. 6(1)(f) GDPR).

2.2 Use of the Alt Text Generator

To use our service you submit image URLs (via the WordPress plugin or the API) from which we generate alt texts using AI. The image is passed to an AI provider (see section 3) together with the description prompt; the provider returns the text. For formats the providers cannot read (e.g. SVG, AVIF, TIFF, GIF) we briefly download the image, convert it and delete the copy once the job completes, at the latest after one hour. We store the image URL, the options you chose, technical job metadata and the generated text.

Where persons are recognisable in your images, this constitutes personal data of those persons. In that respect we act as your processor (Art. 28 GDPR) on the basis of the Data Processing Agreement; you remain the controller. Images are not used to train AI models — neither by us nor, under the terms of the paid services we use, by the AI providers.

2.3 Test Image on the Home Page

On our home page you can upload one image without signing up and have an alt text generated. The uploaded image is stored briefly on our server, passed to an AI provider (see section 3) and deleted immediately after the description is returned; it is not used to train AI models. What remains stored is the generated text and technical job data, not the image.

To stop the free test from being used as a permanent interface, it is limited to one image per visitor. For this we store a hash of your IP address (the address itself is not stored in clear text) and a marker in your session, each for 24 hours. The legal basis is our legitimate interest in preventing abuse and limiting cost (Art. 6(1)(f) GDPR). For this processing we are the controller; no processor relationship applies. If you upload an image showing identifiable people, you must be entitled to do so.

2.4 API Usage Data

We store log data on API usage (timestamps, number of requests, credits consumed) for billing and to ensure service availability. The legal basis is Art. 6(1)(b) GDPR (contract performance) and Art. 6(1)(f) GDPR (legitimate interest in system security).

2.5 Server Log Files

When accessing our website, the following data is automatically collected: IP address, date and time of access, URL accessed, HTTP status code, and data transferred. Processing is based on our legitimate interest (Art. 6(1)(f) GDPR) in security and uninterrupted operation.

Third Parties and Data Processors

3.1 AI providers for image description

We use several AI providers and select one automatically per job (availability, load, quality). Only the image and the description prompt are transmitted — no account data, no customer identifier. We use exclusively paid API tiers whose terms exclude the use of inputs for model training.

• Google Ireland Limited (Gemini API, Google Cloud), Gordon House, Barrow Street, Dublin 4, Irland — Verarbeitung durch Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA — Primary AI provider. Processing takes place partly in the USA; transfer basis: EU-US Data Privacy Framework adequacy decision (Google LLC is certified) and EU Standard Contractual Clauses. Privacy notice ↗
• OpenAI, L.L.C., 3180 18th Street, San Francisco, CA 94110, USA — AI provider (fallback). Processing takes place partly in the USA; transfer basis: EU-US Data Privacy Framework adequacy decision (OpenAI is certified) and EU Standard Contractual Clauses. Privacy notice ↗
• Anthropic, PBC, 548 Market St, PMB 90375, San Francisco, CA 94104, USA — AI provider (fallback). Processing takes place partly in the USA; transfer basis: EU-US Data Privacy Framework adequacy decision (Anthropic is certified) and EU Standard Contractual Clauses. Privacy notice ↗

Legal basis: Art. 6(1)(b) GDPR (performance of the contract with you); for persons depicted in images, the legal basis is yours as controller.

3.2 Hosting

Our service is hosted on servers of Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany. A data processing agreement has been concluded with Hetzner. More information: hetzner.com/legal/privacy-policy

3.3 Payment Processing

Payment processing is handled by Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Dublin, Ireland, with processing also by Stripe, Inc., USA. Stripe receives name, email address, billing address and payment details; we never see full card data. Transfer basis for the USA: EU-US Data Privacy Framework and EU Standard Contractual Clauses. More information: stripe.com/privacy

3.4 Email delivery

Transactional emails (verification, password reset, notifications) are sent from our own mail server in Germany. No newsletter or marketing emails are sent.

3.5 Complete list of sub-processors

All companies that process data on our behalf are listed with address, purpose and transfer basis at https://altowl-staging.s1-media.de/subprocessors. Beyond this, your personal data is not disclosed to third parties unless we are legally obliged to do so or you have expressly consented.

Cookies and Session Data

We use only technically necessary cookies required for the operation of the platform:

• Session Cookie: Stores your login session for the duration of your visit.
• CSRF Token: Protects against cross-site request forgery attacks.

No tracking or marketing cookies are used. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in secure operation).

Data Retention

We store personal data only for as long as necessary for the respective purposes:

• Account data: until you delete your account. Billing data that we must retain under tax law (invoices, purchase bookings) is kept for 10 years (§ 147 AO, § 257 HGB) and blocked from any other use.
• Image URLs in jobs: 90 days, then removed; the generated alt text and a checksum of the image remain so that a repeated request for the same image can be answered without renewed AI processing.
• Job data as a whole: 365 days.
• Downloaded image copies (format conversion): deleted once the job completes, at the latest after 1 hour(s).
• Server and application logs: 14 days.
• Consent records (terms, privacy policy, DPA): for the duration of the contract plus limitation periods, as evidence under Art. 7(1) GDPR.

Your Rights as a Data Subject

Under the GDPR, you have the following rights with respect to us:

• Right of access (Art. 15 GDPR): Information about your stored data.
• Right to rectification (Art. 16 GDPR): Correction of inaccurate data.
• Right to erasure (Art. 17 GDPR): Deletion of your data, unless statutory retention obligations apply.
• Right to restriction of processing (Art. 18 GDPR).
• Right to data portability (Art. 20 GDPR): Receipt of your data in machine-readable format.
• Right to object (Art. 21 GDPR): Objection to processing based on legitimate interests.

To exercise your rights, contact: team@s1-media.de

Right to Lodge a Complaint

You have the right to lodge a complaint with a data protection supervisory authority regarding the processing of your personal data. The supervisory authority responsible for our company is the State Commissioner for Data Protection of Lower Saxony: www.lfd.niedersachsen.de

Data Security

We implement technical and organizational security measures to protect your data against accidental or intentional manipulation, loss, destruction, or access by unauthorized persons. These include encrypted transmission via TLS/HTTPS, secure password storage using bcrypt hashing, encrypted storage of API keys, security headers (HSTS, Content Security Policy) and daily backups. A detailed description of the technical and organisational measures is provided in Annex 1 of the Data Processing Agreement. Our security measures are continuously improved in line with technological developments.