Protecting your personal data matters to us. This privacy policy informs you, in accordance with Articles 13 and 14 of the General Data Protection Regulation (GDPR), which personal data tolinax UG (haftungsbeschränkt) processes in connection with this website, the aYOUne platform and the aYOUne desktop app, for which purposes and on which legal basis.

1. Controller

tolinax UG (haftungsbeschränkt)
Oberhof 4
83700 Oberhof
Germany

Commercial register: Local Court (Amtsgericht) München, HRB 271123
Represented by the Managing Director: Maximilian Hanrieder

Privacy: privacy@tolinax.com
General contact: info@tolinax.com

We have not appointed a Data Protection Officer because the statutory requirements for an appointment (Art. 37 GDPR, Section 38 BDSG) are not met. For any privacy question please contact privacy@tolinax.com.

2. Our role: controller and processor

As controller we process data for purposes and by means we decide ourselves — for example when operating this website, when preparing and managing contracts with business customers and for the technical operation of the platform.
As processor (Art. 28 GDPR) we process the content and customer data that our business customers (tenants) store in aYOUne, including data of their own customers. The respective tenant is the controller for this data; we act only on its documented instructions under a data processing agreement. If you are a customer of a company that uses aYOUne, please direct requests about your data to that company; we support it in answering them.

3. General information

Scope. We process personal data only as far as necessary to provide a functioning website, platform or application and our services.

Legal bases. Depending on the case: your consent (Art. 6(1)(a) GDPR), performance of a contract or pre-contractual measures (Art. 6(1)(b)), legal obligations (Art. 6(1)(c)) and our legitimate interests (Art. 6(1)(f)), for example in a secure, stable and economical operation of our services.

Storage period. We store personal data only as long as needed for the respective purpose or required by statutory retention periods (for example under commercial and tax law). The data is then deleted or restricted as required by law.

4. Website delivery and server logs

When you visit our website, our system automatically records data of the accessing device: IP address, date and time of access, requested page or file, amount of data transferred, referring page, browser and operating system. This serves to deliver the website, to ensure system security and to analyse errors (legitimate interest, Art. 6(1)(f) GDPR). Logs are deleted or anonymised after a short period unless they are needed to investigate security incidents.

5. Cookies and similar technologies

We use cookies and similar storage technologies that are technically necessary to operate the website and the platform (for example session management, sign-in, security) — legal basis Section 25(2) TDDDG in conjunction with Art. 6(1)(f) GDPR. Non-essential cookies (for example for audience measurement) are used only with your consent (Section 25(1) TDDDG, Art. 6(1)(a) GDPR), which you can withdraw at any time. You can also manage or delete cookies in your browser.

6. Contacting us

If you contact us by e-mail or through a contact form, we process the data you provide (for example name, e-mail address, message) to handle your request. Legal basis is Art. 6(1)(b) GDPR for contract-related requests, otherwise Art. 6(1)(f) GDPR. The data is deleted once the request has been fully handled and no retention obligations apply.

7. User account and use of the platform

Using aYOUne requires a user account. We process registration and master data (for example name, e-mail address, company, role and permissions) and usage and log data generated during operation, in order to provide, secure and bill the platform (Art. 6(1)(b) and (f) GDPR). Your account is protected by authentication and session mechanisms (including short-lived access tokens, session renewal, rights and tenant checks); additional sign-in factors are available.

8. aYOUne desktop app

The optional aYOUne desktop app connects to your aYOUne account. Depending on the features you use, it processes: sign-in and session tokens stored locally on your device; folders and files you choose to synchronise; device and system status for monitoring and error analysis; voice, video and chat (WebRTC/P2P), including optional recordings you start; peripheral input (NFC, barcode and QR scans, YubiKey) only while in use; clipboard synchronisation and remote support only when you enable or approve them; local AI features that run on your device without your input leaving it. Updates are delivered through our update service, which processes the connection data technically required.

9. Google API services (Google Ads API / Keyword Planner)

If you connect a Google Ads account in aYOUne, we access the Google Ads API with your explicit consent through the OAuth 2.0 scope https://www.googleapis.com/auth/adwords, limited to the Google Ads accounts you authorised. We use the data only to provide and improve the keyword research feature visible in aYOUne (keyword suggestions, search volumes, competition metrics). The OAuth tokens are stored encrypted in the platform's server-side credential vault; retrieved metrics are stored in your tenant until you disconnect, delete the data or your contract ends. You can disconnect at any time in aYOUne under "Account → Credentials" or at https://myaccount.google.com/permissions. Data received from Google APIs is not sold, not transferred to advertising platforms, data brokers or information resellers, not used for advertising or for assessing creditworthiness, and not read by humans except with your consent, for security purposes or where required by law. aYOUne's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

10. Hosting and sub-processors

We operate aYOUne in the Frankfurt am Main data-centre region (Germany) with carefully selected service providers whose data processing terms under Art. 28 GDPR apply — in particular providers for hosting and infrastructure, AI processing (only when AI features are used), communication (e-mail, telephony, notifications) and payment processing. The current list of sub-processors with their locations is published on our Security & Privacy page.

11. Transfers to third countries

Where service providers process personal data outside the EU/EEA (in particular in the USA, for example certain AI providers), we ensure an adequate level of protection through an adequacy decision (for example the EU-U.S. Data Privacy Framework) or the European Commission's Standard Contractual Clauses of 2021 together with an assessment of the recipient country. Details are available on request.

12. Your rights

Under the GDPR you have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on Art. 6(1)(f) GDPR (Art. 21). Where processing is based on your consent, you can withdraw it at any time with effect for the future. A message to privacy@tolinax.com is sufficient. If your request concerns data we process as a processor for a tenant, we forward it to that tenant or refer you to it.

13. Right to lodge a complaint

You have the right to lodge a complaint with a data protection supervisory authority. The authority responsible for us is the Bayerisches Landesamt für Datenschutzaufsicht (BayLDA), Promenade 18, 91522 Ansbach, Germany.

14. Data security

This website and our services transfer data only with TLS encryption. We also take technical and organisational measures to protect your data against unauthorised access and loss; they are described on our Security & Privacy page.

15. Changes

We update this privacy policy when the law or our services change. The version published on this page applies. In case of doubt the German version prevails.

Last updated: October 2026