Privacy Policy

Last updated: July 2026 Applies to: CT Ranking web application (ct-ranking.ct-flow.com / app.ct-ranking.ct-flow.com) and the related backend API

§ 1 Controller

The controller responsible for data processing is: Centraltec GmbH Blütenstraße 15 80799 Munich Represented by Managing Director André Scheffer Email: andre.scheffer@centraltec.de

Please send privacy inquiries to the email address above. We are currently not legally required to appoint a data protection officer.

§ 2 Purposes of processing and legal bases

We process personal data exclusively for defined purposes:

- Providing CT Ranking, managing user accounts, projects (workspaces), and quotas (Art. 6 (1) lit. b GDPR) - Monthly AI visibility monitoring: storing benchmark prompts, retrieving AI responses, evaluating visibility, competitor comparisons, and recommendations (Art. 6 (1) lit. b GDPR) - Authentication and operationally necessary system processes (Art. 6 (1) lit. b GDPR) - Protection against abuse and bots, IT security, technical operations, and error analysis (Art. 6 (1) lit. f GDPR) - Compliance with tax and commercial law obligations where billing data arises (Art. 6 (1) lit. c GDPR)

§ 3 Which data we process

Depending on usage, we process in particular:

- Master data: email address, display name, company or account name - Authentication data: password (stored exclusively as a hash via our identity provider), login and session tokens - Project data: project name, industry, target term (brand/product), stored competitors, benchmark prompts, website details for prompt generation - Evaluation data: response texts or excerpts returned by AI models, mention and position metrics, visibility scores, share of voice, recommendations/playbooks, run logs, and error notices - Quota and usage data: consumption of API/model calls - Technical log data: IP address, date and time of access, browser/device information, audit events (e.g. login, project changes)

You decide which brand, prompt, and competitor data you enter. Please do not enter personal data of third parties that is not required for visibility measurement.

§ 4 Cookies and local storage

CT Ranking uses technically necessary storage (localStorage or comparable tokens) to keep you logged in after authentication and to store your theme preference. These are required for operation (§ 25 (2) TDDDG; Art. 6 (1) lit. f GDPR).

To prevent automated access, we use Cloudflare Turnstile for registration and login (bot protection). Technical data (e.g. IP address, browser information) may be transmitted to Cloudflare in this process (Art. 6 (1) lit. f GDPR).

§ 5 Processors and recipients

We use carefully selected service providers that process personal data on our instructions (Art. 28 GDPR):

- Hetzner Online GmbH – hosting and server operations (data centers in Germany/EU) - Cloudflare, Inc. (Turnstile) – bot protection for registration and login - AI providers for monitoring, in particular Anthropic (Claude), OpenAI (ChatGPT), Google (Gemini), and Perplexity – processing of the prompts you define and the returned responses to deliver the visibility analysis

Your data is not shared for the service providers’ own purposes, nor sold to third parties.

§ 6 Transfers to third countries

Individual services (in particular Cloudflare and the AI providers named above) may process personal data in the USA or other third countries. Where a provider is certified under the EU-US Data Privacy Framework, we rely on that adequacy decision. Otherwise, transfers are based on EU Standard Contractual Clauses together with supplementary safeguards (Art. 46 GDPR). A copy of the appropriate safeguards will be provided on request.

§ 7 Processing by artificial intelligence (AI)

CT Ranking sends your benchmark prompts to the AI models configured by you or in the project in order to measure the visibility of your brand and competitors in the responses. The following applies:

- Transmission takes place solely to deliver the monitoring service. - Responses and evaluations are decision support and do not replace your own substantive or legal review. - Avoid including personal data in prompts that is not required for this purpose.

§ 8 Retention period

We store personal data for as long as your account exists and the respective purpose requires it. After deletion of your account or project, related content and evaluation data are deleted unless statutory retention obligations apply.

§ 9 Data security

We implement appropriate technical and organizational measures pursuant to Art. 32 GDPR. These include encrypted transmission (TLS/HTTPS), tenant/project separation, and role- and access-restricted data processing.

§ 10 Your rights

You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20), and to object to processing based on legitimate interests (Art. 21 GDPR).

To exercise your rights, a message to andre.scheffer@centraltec.de is sufficient.

§ 11 Right to lodge a complaint

You have the right to lodge a complaint with a data protection supervisory authority. The authority responsible for us is: Bayerisches Landesamt für Datenschutzaufsicht (BayLDA) Promenade 18, 91522 Ansbach, Germany

§ 12 Changes to this policy

We update this privacy policy when processing or the legal situation changes. The version published on ct-ranking.ct-flow.com applies.