Privacy Policy

1 About Sodalytics and this policy

Who we are

Sodalytics is the trading name of Medienbüro Björn Rohwer, a German sole proprietorship operated by Björn Rohwer, at Seminarstr. 12a, 25436 Uetersen, Germany. In this policy, “Sodalytics”, “we”, “us” and “our” refer to that business.

What this policy covers

This policy explains how we collect, use, share and retain personal data when you visit sodalytics.com, contact us, use our forms or booking features, request a Free Sample, subscribe to our communications, visit our social media pages or deal with us as a client or business contact. It also explains our processing of publicly available social media information for analyses, reports, examples and our own publications, and the personal data we process for our own administration of client accounts and services.

Our role

We are the controller for our website, communications, business administration and the public social media processing described in this policy. Where we process a client’s personal data solely on that client’s documented instructions, we act as processor. Section 4 explains this distinction and the role of the client’s data processing agreement.

What personal data means

Personal data is information relating to an identified or identifiable individual. It can include a work email address, a social media handle, an identifiable person’s public posts or comments, or information about a sole trader. Information relating only to a company is not personal data unless it also relates to an identifiable individual.

How to contact us

For privacy questions and requests, contact [email protected].

You can contact our Data Protection Officer at [email protected].

General business enquiries can be sent to [email protected].

2 Website operation and analytics

Website operation and form protection

Our website and server-side forms are hosted using Cloudflare. Visiting the website involves processing the technical information needed to deliver its pages, including your IP address and browser and device information. Sodalytics does not maintain a separate set of website server access logs. Cloudflare may process technical and security information in operating and protecting its infrastructure.

We use Cloudflare Turnstile to help protect forms against spam and automated misuse. It loads when a form is used and processes technical information, including IP address and browser signals, to assess whether an interaction is likely to be legitimate. Storing or accessing information on your device for this purpose does not require consent, as it is strictly necessary to provide the form you have chosen to use. Information submitted through a form is handled for the purpose of that form, as described below.

We process this technical information to deliver the website, operate requested features, detect misuse and protect forms and accounts. We rely on our legitimate interest in operating a reliable and secure website. The separate rules for storing or accessing information on your device are explained below.

Our website forms send submitted information through our own server functions to Attio and Brevo. Attio is our customer relationship management provider and stores Free Sample applications, including those made through the quiz, and newsletter and marketing consent records. Brevo sends transactional emails, such as Free Sample confirmations and quiz results, runs the newsletter confirmation process and is used as a fallback route where a form submission cannot reach Attio.

Website analytics

We use Plausible for website analytics. Its analytics operates without analytics cookies or browser storage. We measure page visits and interactions such as teaser clicks, PDF downloads, outbound link clicks and quiz applications. We do not send names, email addresses, social media handles or free-text answers to Plausible, including through page URLs, custom events or event properties.

Plausible temporarily uses limited technical information, including IP address and browser information, to produce website statistics. Plausible states that raw IP addresses and user-agent information are not stored and that the temporary identifier used to count daily visitors is not maintained across days.

We use these statistics to understand which content and features are useful and improve the website. To the extent personal data is processed, we rely on our legitimate interest in understanding website use through limited analytics.

Cookies and similar technologies

Cookies are small files stored on your device. Similar technologies can store information in your browser or access information from your device. Rules on storing and accessing information on devices apply even where the information is not personal data.

Interactive features, including form protection, appointment booking and account login, may involve separate storage of or access to information on your device. Where this is strictly necessary to provide a service you expressly request, it may take place without consent. Other storage or access requires your prior consent unless another statutory exemption applies. Applicable data protection law separately governs any resulting processing of personal data.

Where we request consent, we explain the relevant purpose, duration and provider before you choose, and provide a way to withdraw consent as easily as it was given. Withdrawal does not affect the lawfulness of processing before withdrawal. You can also manage or delete cookies through your browser settings, although blocking necessary storage may prevent a requested feature from working. Browser settings do not replace any consent choices we are required to provide.

3 Requests and communications

You can browse the public website without submitting an enquiry or signing up for communications. Information identified as required in a form is needed to handle that request or provide the relevant feature. If it is not supplied, we may be unable to respond, deliver a sample, arrange a booking or create access. Other fields and marketing choices are optional. We identify information required by law or contract where relevant.

We use information submitted with enquiries, bookings and Free Sample applications to handle the request and communicate with you about it. Likewise, we process this information where necessary to take steps at your request towards a contract with you or to perform that contract. Where you act for a company or another person, we rely on our legitimate interest in handling business enquiries and providing the requested response.

Enquiries and bookings

When you email us or submit an enquiry, we process the contact details you provide, such as your name, work email address, organisation and role, together with your message and related correspondence. We use this information to respond and maintain an appropriate record, using business email, document storage and customer relationship management providers.

We use Cal.com for appointment bookings. The booking calendar loads after you choose to open it. If you make a booking, the information needed to arrange and manage the appointment is processed, including the details you enter and relevant technical information. Opening the calendar can connect your browser to the booking provider. Cal.com may process booking information in the United States; section 6 explains how we safeguard international transfers.

Free Samples and the quiz

A Free Sample application may include your name, work email address, organisation, relevant channel handles, the question you want explored and any other information you choose to submit. We use this information to assess and administer the request, prepare a sample where offered, and send related acknowledgements, delivery messages or a walkthrough invitation. We use public social media data for the sample itself, as described in section 5.

Your quiz answers stay in your browser. They only leave it if you request a Free Sample through the quiz: your answers and the matched service are then stored with your application in our customer relationship management system and included in the internal notification we receive about new applications. If you ask for your result by email, we pass your email address and the matched service to our email provider to send that email; your answers are not transmitted. If you also tick the marketing box, we additionally store your email address, the name you entered and your consent in our customer relationship management system and start the confirmation process described under “Newsletters and marketing”. If a submission cannot be delivered to one of these systems, we forward it to our business email account so that we can handle it manually; if that also fails, it is recorded in the error logs of our form functions at Cloudflare.

If an agency requests a sample for a client it represents, we process the details provided to administer that request and deliver the sample to the requesting agency. The agency may share the sample with its represented client.

The Free Sample request and marketing choices are separate. Marketing choices are initially unticked. A request for a sample does not subscribe you to marketing. If you do not separately opt into marketing, we do not use your application details for subsequent sales prospecting or marketing follow-up. This does not prevent communications needed to handle the request you made, or a sample from including information about our paid services.

Newsletters and marketing

You can choose to subscribe to our Feed Forensics newsletter or other marketing communications. We record the relevant choice and use a confirmation process to verify the subscription. Consent records may include the contact details, signup and confirmation times, relevant IP information and the version of the consent wording presented.

Our legal basis for newsletter subscriptions, marketing emails and any separately agreed measurement of email opens or clicks is your consent. Consent for one activity does not automatically cover another.

We send marketing only within the scope of the consent given. A newsletter subscription and consent to other marketing are distinct choices. Declining or withdrawing marketing consent does not affect a Free Sample request or the availability of a contracted service.

Where you separately agree, email measurement may record whether a message was opened or a link was clicked, to help us understand engagement and improve communications. We distinguish this from the records needed to send a requested message or document a subscription.

You can withdraw marketing consent at any time through the unsubscribe link in the relevant message or by contacting [email protected]. You can also contact that address about a separate tracking choice. Withdrawal does not affect earlier lawful processing. We may retain a limited consent record and a suppression entry where necessary to document compliance and prevent further unwanted messages.

Business contacts and prospecting

We also process the business contact details of people we meet at events, are introduced to, or identify as relevant contacts at brands, agencies and creator businesses, for example through a professional networking profile or a company website. This can include your name, role, organisation, business contact details, links to professional profiles, the source of the contact and notes on our exchanges. We keep these details in our customer relationship management system and use them to contact you about a possible business relationship, for example through a professional networking platform, and to keep track of our conversations. Where we obtain these details from a source other than you, this section provides the information we are required to give.

We rely on our legitimate interest in building and maintaining business relationships. We send promotional emails only where the law permits, which generally requires your prior consent. You can object to this processing at any time without giving a reason. We then stop contacting you and keep only the minimum information needed to respect your objection.

4 Client accounts and AI assisted services

Client administration and our role

We process client contacts, authorised user details, work email logins, service and subscription information, billing and transaction records, and correspondence to administer engagements, manage access, provide support, issue invoices and maintain required records. Where a company or agency provides your details as its contact or user, we obtain those details from that organisation.

We use PandaDoc (PandaDoc, Inc., United States) to prepare, send and sign contracts and onboarding documents electronically. PandaDoc processes the names, email addresses and signatures of the people who sign, together with related audit information such as timestamps and IP addresses, and may process this information in the United States; section 6 explains how we safeguard international transfers.

For these client relationship and administration purposes, we process personal data where necessary to perform a contract with the individual concerned. We rely on our legitimate interests in administering contracts with organisations and maintaining secure, properly managed client accounts. Information retained to comply with legal obligations is addressed in section 7.

When we process a client’s non-public channel analytics, exports or other personal data solely on that client’s documented instructions, we act as a processor. The client remains responsible for deciding why and how that information is used. Our client agreement and data processing agreement govern that processing, including instructions, confidentiality, security, subprocessors, assistance with rights requests and return or deletion of the data.

Craig and other AI processing

Craig is an AI question-answering feature for authorised Watch users, drawing on the relevant client’s reports. We process work email details, account access and usage information to manage access, security and agreed usage limits. We process the questions, the report content retrieved to answer them and the resulting answers as controller, based on our legitimate interest in providing our services. Where a report contains personal data that a client supplied for processing solely on its instructions, we process that data as processor under the client’s data processing agreement.

We use commercial API services from Anthropic, OpenAI and Google Gemini to assist with classification, analysis, drafting and answers to questions through Craig. Information supplied can include relevant public content, creator or brand handles, report extracts and questions. Commenter handles are excluded from our analysis payloads, but a verbatim comment or other content may still make an individual identifiable.

We use API arrangements covered by data processing terms for personal data. Under the applicable paid API arrangements, submitted content is not used to train the providers’ general models.

AI processing may take place outside the European Economic Area, in particular in the United States. Standard API services may retain information for abuse prevention or security, and some features retain submitted content or files until deletion. The applicable retention depends on the provider, feature and configuration.

Our services combine AI assistance with human curation. AI-generated classifications or answers can be incomplete or inaccurate. We use automated analysis to identify patterns and organise information; an assessment may amount to profiling where it evaluates personal aspects of an identifiable individual. We do not use solely automated processing to make decisions about you that produce legal or similarly significant effects.

Client channel connections

Non-public channel exports supplied for client work are processed on the applicable client’s instructions. For a Channel Deep Dive or Channel Watch, a client can share non-public analytics of its own channels as exports or, optionally, by connecting its Instagram, TikTok or YouTube account to Sodalytics. The client sets up the connection on the platform’s own authorisation screen; we never see, ask for or store the account password. The connection is optional, and every service also works without it.

The connection is read-only and covers the permissions shown on the authorisation screen. These can include basic profile information, the list of posts, metrics for posts and the account such as views, reach and engagement and, where the platform provides them, aggregated audience insights such as age ranges or countries. We do not access direct messages, and we do not collect comment text or commenter handles through the connection. The connection does not let us post, comment, delete or change anything on the account.

We use the data only to prepare the Channel Deep Dive or Channel Watch the client ordered. Our service is human-curated: our analysts read the data retrieved through the connection when preparing the report. We process the access token and the retrieved data, like exported analytics, as processor on the client’s instructions under the client’s data processing agreement. We store the access token and the retrieved data encrypted in our database in the European Union.

The connection can be revoked at any time in the account’s settings for connected apps or by emailing [email protected]. We delete the access token when the connection is revoked or the engagement ends, whichever comes first.

Deleting data received from Meta: To have us delete data we received through Meta, revoke the connection in your Instagram or Facebook settings, or email [email protected] with the subject “Meta data deletion”. We delete the data within 30 days and confirm by email.

YouTube: For YouTube, the connection uses YouTube API Services. Google’s own processing is governed by the Google Privacy Policy at https://www.google.com/policies/privacy. In addition to our own deletion process described above, you can revoke Sodalytics’ access to your data at any time on the Google security settings page at https://security.google.com/settings/security/permissions. Sodalytics’ use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Information and sources

You may appear in a Sodalytics analysis even if you have not contacted us. We analyse publicly available information from platforms including TikTok, Instagram and YouTube, and other relevant public sources. Collection may be carried out using specialist data collection providers. Analyses may concern creators, competitors, brands and discussion on relevant public channels, including account-level comparisons, content themes, engagement patterns and comment trends.

The information may include account names and handles, public profile and professional information, posts, captions, images and video covers, transcripts, engagement and performance metrics, comments, and information derived from analysis of that content.

We rely on our legitimate interests for collecting and analysing relevant public content, preparing reports and Free Samples, identifying social media patterns and producing our own examples and publications. The legitimate interests are providing social media research and commercial insight, and communicating research and analysis. We assess the necessity and impact of the processing, including individuals’ reasonable expectations, the nature of the content, identifiability, disclosure and available safeguards.

For comments, we replace commenter identifiers with keyed pseudonyms, keep the key separately, mask mentions and remove avatar links from the relevant working files. This reduces direct identification but does not make the information anonymous. A comment may still identify its author or another person through its wording or context.

Our exclusion process checks for people who have objected to inclusion. Creator and brand handles may be retained where needed to identify the subject of an analysis. The objection route and its practical limits are explained in section 9.

Reports and publications

Analysis results may be provided to the client commissioning a report or sample. We also prepare our own newsletter, blog, social media publications and website examples from datasets collected for those purposes. Our publications may also use samples or extracts of them, without identifying the person who requested the sample or their represented client. Depending on the content, recipients may see account names, public content, comparisons and selected quotations. Publishing material online makes it accessible to a wider audience, which may include people outside the European Economic Area.

We may identify creators in our publications under our editorial criteria, including a follower threshold. Quotations without handles and examples using fictional client names may still relate to identifiable people or real accounts.

Information provided by a client for processing solely on its instructions remains subject to those instructions and the data processing agreement. A client engagement does not by itself authorise us to reuse that information for our own publications or a separate identifiable benchmark dataset.

Children and sensitive information

Our website and commercial services are intended for business and professional use. Public social media content may nevertheless concern children or contain sensitive information, including health information, political opinions or information about racial or ethnic origin. We do not quote commenters who state that they are children.

We do not intentionally seek out special categories of personal data, use them to categorise individuals or publish them in identifiable form. Where public content we analyse incidentally reveals such information, we process it only where the individual concerned has manifestly made it public. Otherwise, we exclude the information from analysis and publication.

Information obtained from other sources

This policy provides the information we are required to give where we obtain personal data from public sources or from clients. Where informing individuals directly would be impossible or involve disproportionate effort, given the number of creators and commenters whose public content we analyse, we make this information publicly available and apply the safeguards described in this section, including pseudonymisation and our exclusion process. Where we contact you, we provide this information no later than our first communication.

We maintain pages on social media platforms to share our publications. When you visit or interact with these pages, the platform processes your data under its own privacy policy. For the page statistics the platform provides to page operators, we and the platform may be joint controllers under the platform’s applicable joint-controller terms. We rely on our legitimate interest in presenting our business on social media. You can exercise your rights with us or directly with the platform.

Information on the essence of the joint-controller arrangements is available from each platform:

Who receives personal data

We use service providers for website hosting, network and form security, databases, authentication and storage; business email, document management and customer relationship management; appointment booking, electronic contract signing, newsletters and message delivery; website analytics; public data collection and AI processing; and accounting. Providers receive the information needed for the relevant function, rather than every category of information described in this policy.

Our service providers operate in the European Economic Area and, depending on the service and support arrangements, in the United Kingdom, United States and Singapore. Providers involved in website analytics, form protection, customer relationship management, email delivery, booking, contract signing and AI processing are identified in the relevant activity sections. The safeguards for transfers outside the European Economic Area are explained below.

Where a provider processes personal data on our behalf, it is subject to the applicable data processing arrangements. A provider may also act as controller for particular processing it undertakes for its own purposes; its relevant privacy information explains that processing. Where we act as processor for a client, the providers assisting with that processing are addressed as subprocessors in the client’s data processing agreement.

Other recipients may include the client commissioning an analysis or a represented client receiving a sample, the public where material is published, professional advisers where necessary, and authorities or courts where disclosure is legally required or justified for a specific legal matter. If we sell or transfer all or part of our business, including by transferring it into a company, or a prospective buyer or investor reviews our business, we may disclose personal data to the new operator, the buyer or investor and their advisers to the extent permitted by data protection law.

International transfers

Our principal databases and report storage are located in the European Union. Some providers, support teams and AI services may nevertheless process or access personal data outside the European Economic Area, including in the United States and Singapore.

For transfers outside the EEA, we rely on an adequacy decision or other recognised safeguards, such as standard contractual clauses.

You can request information about the safeguards applicable to your data, including a copy of relevant contractual safeguards, by contacting [email protected]. Where necessary, confidential commercial details or information affecting another person’s rights may be redacted.

7 How long we keep information

We retain personal data for the relevant purpose and applicable legal requirements. Different records have different deletion triggers. The following periods and criteria apply to processing for which we are controller.

Information	Retention period or criterion
Public creator and competitor source data	Raw public posts, account information, metrics, covers and transcripts are retained for 12 months from collection.
Raw comments	Deleted within 30 days of collection or on delivery of the relevant analysis, whichever occurs first.
Pseudonymised comment files	Retained for 12 months from collection. These files remain personal data where individuals are identifiable.
Enquiries, bookings and Free Sample applications	Retained while needed to assess and complete the request and related correspondence. Records forming part of a client relationship, legal obligation or specific legal claim may be kept for the corresponding purpose.
Client contacts and account administration	Retained during the relevant relationship and afterwards to complete outstanding administration, satisfy applicable statutory duties or address specific legal claims. Account access and underlying data retention are assessed separately.
Marketing and consent records	Subscription information is used until consent is withdrawn or the subscription otherwise ends. Limited proof of consent and suppression information may be retained as needed to demonstrate compliance and respect the withdrawal.
Invoices and statutory business records	Retained for the applicable statutory retention periods.
Objection and rights request records	Minimum exclusion information is retained while needed to honour the objection. Request and response records are retained as needed to demonstrate how the request was handled and meet applicable legal obligations or specific claims.

Access to a Watch workspace ends 30 days after the Watch ends. Craig questions and answers are deleted 30 days after the Watch ends. Related records, reports, and logs may be kept beyond that date, depending on the type of information and our obligations as controller or processor.

The source-data periods do not automatically determine how long an identifiable report, published example, security record or provider-held copy is retained. For these records, retention depends on whether the relevant purpose remains necessary, the relationship or publication concerned, any legal duty, and the handling of an objection or deletion request. Information processed solely for a client follows the return and deletion arrangements in the data processing agreement.

We process information where necessary to keep accounting records, respond to data protection requests or meet other applicable legal duties. We rely on our legitimate interests where information is necessary to establish, exercise or defend legal claims or protect the business against misuse.

If a specific legal duty or claim requires information to be retained longer, we limit that retention to the information and purpose concerned. Irreversibly anonymised information may be retained because it no longer identifies an individual.

8 Security and confidentiality

We use technical and organisational measures appropriate to the nature and risks of the processing. These include access permissions, separation of relevant client workspaces and datasets, and the pseudonymisation measures described above. Measures are reviewed as systems and risks change. No internet service or transmission method can guarantee absolute security.

Where a personal data breach occurs, we assess it and make notifications to the relevant authority and affected individuals where required by law.

9 Your rights and choices

Subject to the conditions and exceptions in applicable data protection law, you have the following rights in relation to personal data for which we are controller:

Right	What it means
Access	Ask whether we process your personal data and obtain a copy and related information about the processing.
Rectification	Ask us to correct inaccurate personal data and complete information where appropriate.
Erasure	Ask us to delete personal data where a ground for deletion applies. This right may be subject to exceptions, including legal obligations, certain freedom of expression interests or legal claims.
Restriction	Ask us to limit processing in the circumstances set out by law, including while certain accuracy or objection issues are considered.
Portability	Obtain data you provided in a structured, commonly used, machine-readable format, and request transfer to another controller where technically feasible, where processing is automated and based on consent or a contract with you.
Objection	See “Your right to object” below.
Withdrawal of consent	Withdraw consent at any time, without affecting the lawfulness of processing carried out before withdrawal.
Automated decisions	Receive the protection provided by applicable data protection law where a decision is based solely on automated processing and has legal or similarly significant effects, including applicable rights to human intervention and to contest a decision.

How to exercise your rights

To exercise a right, contact [email protected] or use the objection route described below. Our Data Subject Rights and Privacy Complaints Policy explains in more detail how we handle requests and complaints. Please provide enough information to locate the relevant data, such as the platform, account handle, relevant content or interaction. We ask for additional identity information only where reasonably necessary to establish that a request concerns the correct person; we do not routinely require an identity document.

If a client is the controller for data you wish to access, correct or delete, please contact that client. If you contact us, we will direct or pass your request to the relevant client where appropriate and assist in accordance with our obligations. Removing information from our systems does not delete the original content from a social media platform; use the platform’s controls or contact the platform to remove the original.

We respond without undue delay and in any event within one month of receiving a request. Where necessary because of the complexity or number of requests, we may extend this period by up to two further months. If we do, we inform you within the first month and explain why. Requests are normally free. Where a request is manifestly unfounded or excessive, we may charge a reasonable fee or refuse to act, with an explanation and information about the available complaint and judicial remedies.

Where required, we notify recipients of rectification, erasure or restriction and inform you about those recipients if you ask. These obligations are subject to the applicable conditions and exceptions. If we cannot act on a request, we explain the applicable reason and available remedies.

Your right to object

You can object at any time, on grounds relating to your particular situation, to processing based on our legitimate interests, including our analysis of public social media content and any related profiling. We will then stop that processing unless we demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing is necessary to establish, exercise or defend legal claims.

You can object to processing for direct marketing at any time, without giving a reason. This includes profiling to the extent it relates to that marketing. Once you object, your personal data will no longer be processed for those purposes.

For public social media analysis, individual creators and commenters can also use our voluntary exclusion process at sodalytics.com/data-objection or email [email protected]. We do not require a reason for an individual’s exclusion request. We use the information provided to stop future inclusion of the relevant account and take reasonable steps to remove matching information from past collected datasets.

To maintain the exclusion, we keep the platform and account handle in an exclusion list in readable form. We keep this list, including entries made through the form at sodalytics.com/data-objection, in our database at Supabase (Supabase Pte. Ltd., Singapore), stored in Frankfurt, Germany. We use pseudonymised identifiers where needed to locate information in past comment datasets. A change of handle may prevent an existing exclusion entry from matching the renamed account; if your handle changes, please tell us so that the exclusion can be updated.

Requests relating to previously delivered reports, quotations or published material are assessed under the applicable rights and legal requirements. The exclusion process does not remove your statutory rights.

Complaints

You have the right to lodge a complaint with a data protection supervisory authority, in particular in the country of your habitual residence, place of work or the alleged infringement. You do not have to contact us before complaining. You may also pursue an available judicial remedy.

The supervisory authority responsible for us is the Unabhängiges Landeszentrum für Datenschutz Schleswig-Holstein (ULD), Holstenstraße 98, 24103 Kiel, Germany; email: [email protected]; website: www.datenschutzzentrum.de.

10 Changes to this policy and language versions

We update this policy when our activities, systems or legal obligations change. The date above shows the latest revision. If we intend to use personal data for a further purpose, we assess the applicable legal requirements and provide additional information before that processing where required. Where a change requires fresh consent, we seek that consent. Use of the website, acceptance of terms, receipt of this policy or continued browsing does not amount to consent to a new processing purpose.

This policy is available in English and German. The German version is provided for convenience of reading. In the event of any inconsistency, the English version prevails.

Other legal pages

Imprint Data rights and complaints Terms Object to data use