PRIVACY POLICY

1. Controller

Markus Stöger
Lehmhäusl 23, 3261 Steinakirchen am Forst, Austria
Email: office@markusstoeger.com
Phone: +43 660 326 64 97

2. Data I process

Website visit

When you open this website, the web server automatically logs: IP address, date and time of access, requested address, referrer (the page you came from), browser and operating system. Legal basis: Art. 6 (1) (f) GDPR (legitimate interest in operating and securing the website). Retention period: 14 days.

Contact form and email

If you contact me via the contact form or by email, I store your name, your email address and your message to handle your inquiry. Legal basis: Art. 6 (1) (b) GDPR (contract initiation) or Art. 6 (1) (f) GDPR. Retention period: 3 years after the end of communication.

Inquiry form on the offer pages

The pages /webdesign-niederoesterreich and /wordpress-hilfe have their own inquiry form. It transmits your name, your email address and your message, plus, if provided, your business name and phone number, and on /wordpress-hilfe the address of your website. The data is sent to me by email (office@markusstoeger.com) and is processed and stored as described for the contact form. Section 4 explains which details about the origin of the inquiry are added.

Newsletter

The MasterAI and WooCommerce pages have a field for my newsletter. When you submit it, Substack’s sign-up page (Substack Inc., USA) opens in a new tab. Your email address is passed to Substack in the address of that page and is already filled in there. This website does not store it. Substack’s privacy policy applies to the sign-up and the mailings.

3. Audience measurement with Plausible

For audience measurement I use Plausible Analytics, self-hosted on the same server as this website (plausible.markusstoeger.com, server located in Germany). Plausible loads for all visitors, sets no cookies and stores no IP addresses. It counts page views including campaign parameters and, on the pages with an inquiry form, the events “inquiry sent”, “click on the phone number” and “click on the email address”, each with the page and campaign name, without any content of the inquiry. The data stays on my server. Legal basis: Art. 6 (1) (f) GDPR.

4. Google advertising and conversion measurement

I run Google Ads. Campaign parameters (utm_source, utm_medium, utm_campaign, utm_term, utm_content) and automatic Google click identifiers (such as gclid, wbraid or gbraid) may be appended to the destination address. Our inquiry forms do not include these Google click identifiers in inquiry emails.

Only after you consent to advertising measurement do I load the Google Ads tag (Basic Consent Mode v2). Before consent and when choosing “Necessary only”, the tag is not loaded and no cookieless Google measurement signals are sent. Google Analytics is not installed. The website and its forms work without consent. Legal basis: Article 6(1)(a) GDPR and Section 165(3) Austrian Telecommunications Act 2021.

After consent, Google may store and process advertising click identifiers in cookies. We measure ad attribution and successfully received inquiries, not mere submit-button clicks. Technical event and browser data, IP address, timestamps and the page address are transmitted; our integration removes unnecessary query parameters and URL fragments. Our Google integration does not send names, email addresses, phone numbers, message text or personal offer and payment tokens. Enhanced conversions using contact details, Google Analytics and advertising personalization are disabled in our integration. Personal offer, payment and withdrawal pages of the booking service do not load advertising tags.

The recipient is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Processing by Google LLC and other service providers in the US is possible. Google’s privacy information explains processing and international transfers. You can withdraw consent at any time through Privacy settings. Our integration disables measurement, deletes accessible attribution cookies and reloads the page without advertising tags. This does not retroactively delete previously transmitted data.

Google privacy policy · Google data processing terms

On offer pages, general campaign parameters and the referrer may also accompany a submitted inquiry. Until submission they are kept in session storage (ms-kampagne), which is cleared when the tab closes, without cookies. The inquiry is processed for contract initiation under Article 6(1)(b) GDPR; general campaign parameters are processed to evaluate our advertising under Article 6(1)(f) GDPR.

4a. Advertising measurement with OpenAI

Only if you agree in Privacy settings do I load the OpenAI Measurement Pixel. It measures whether ads in ChatGPT lead to website visits and successfully sent inquiries. The website and its forms remain available without consent. Processing is based on your consent under Article 6(1)(a) GDPR and Section 165(3) of the Austrian Telecommunications Act 2021.

After consent, OpenAI receives page-view and inquiry events, timestamps, the website source address, and advertising and browser identifiers. The connection also transmits your IP address and browser information. Enabled automatic matching can detect entered contact details such as email address, phone number and names, normalize them in the browser and send SHA-256 hashes. These hashes support matching and are not anonymous data. The pixel does not send these contact details in plain text; our integration does not pass your message text as event data.

The recipient is OpenAI Ireland Ltd., 1st Floor, The Liffey Trust Centre, 117–126 Sheriff Street Upper, Dublin 1, D01 YC43, Ireland, including affiliates and service providers used for the service. Processing may take place in the US. The linked terms and privacy information describe processing, retention and OpenAI’s international transfer mechanisms.

OpenAI privacy policy · OpenAI advertising tools data protection terms

Use “Privacy settings” at the bottom left to withdraw consent at any time for future processing. Our integration then stops sending measurement events and deletes attribution cookies. This does not retroactively delete data already sent. Our events opt out of future user-level personalization. Cookie lifetimes are listed in section 5.

5. Cookies and browser storage

Plausible continues to work without cookies (see section 3). Google Ads and OpenAI use advertising-measurement cookies only after your consent (see sections 4 and 4a).

The following entries are stored in your browser:

• ms-advertising-consent-v2 (localStorage): stores your advertising-measurement choice for 180 days, after which you are asked again. If browser storage is unavailable, the choice lasts only until reload.
• _gcl_*: Google Ads attribution cookies after consent, such as _gcl_aw and _gcl_au, with an intended lifetime of up to 90 days. Accessible attribution cookies are deleted when consent is withdrawn.
• __oppref / __obref: OpenAI cookies after consent: an ad-click identifier (30 days) and a browser identifier (365 days). Another ad click can renew the __oppref lifetime. Both are deleted when consent is withdrawn.
• oaiq_consent / __oaiq_consent: once the OpenAI script has loaded, it also stores consent status in local browser storage and a cookie (30 days). Our consent choice independently controls whether the script loads at all.
• ms-kampagne (sessionStorage): only on the pages with an inquiry form, the campaign parameters until you close the tab (see section 4).

The ms-kampagne entry is not sent to the server by itself; campaign parameters are only sent along with a submitted inquiry.

Until 29 September 2026 this website included Google Analytics, which only loaded after consent. It has been removed; the website deletes any remaining cookies on your next visit.

6. Data sharing

I do not share your data with third parties, except:

• Hosting: Hostinger International Ltd., Cyprus, servers located in Germany; data processing is governed by the provider’s data processing agreement
• Email: the website sends messages from the forms through Hostinger’s email service to my mailbox, which is also hosted by Hostinger
• OpenAI: only after your advertising-measurement consent, see section 4a
• Substack: only if you use the newsletter field, see section 2
• Legal obligation: upon official request

7. Your rights

You have the right to access, rectification, erasure, restriction of processing, data portability and objection. You can withdraw consent at any time. Contact: office@markusstoeger.com

You have the right to lodge a complaint with the Austrian Data Protection Authority (dsb@dsb.gv.at, +43 1 52 152-0).

8. SSL/TLS encryption

For security reasons and to protect confidential content, this website uses SSL/TLS encryption. You can recognise an encrypted connection by the browser address bar starting with “https://”.

9. Hosting

This website is hosted on a virtual server operated by Hostinger International Ltd., 61 Lordou Vironos Street, 6023 Larnaca, Cyprus, with the server located in Germany. Data processing under Art. 28 GDPR is governed by the provider’s data processing agreement.

10. Use of the Meta Graph API (Facebook & Instagram Auto-DM)

I operate an internal tool named HeyHank Auto-DM that connects to Meta platforms (Facebook Pages, Instagram Business) via the official Meta Graph API. This connection is used exclusively for comment-triggered Private Reply messages: when a user comments a keyword (pre-configured by the Page administrator) on a Page post or Instagram media, the tool sends a one-time private reply to that person containing the pre-configured content (typically a previously announced link or resource).

Data I process from Meta users

For each Auto-DM operation I technically process:

• Comment ID (Meta-issued public comment identifier)
• Commenter ID / Page-Scoped ID (Meta-issued public identifier for the commenting person)
• Comment Text (compared against the configured keyword)
• Post ID (public identifier of the commented post)
• Display Name (if publicly visible on the comment)

I do NOT process: private profile information, email addresses, phone numbers, follower lists, reactions/likes, insights, ads data, or any other engagement statistics.

Purpose

The processing serves the sole purpose of executing the Page administrator’s Auto-Reply logic. Sent Private Reply messages are stored in the technical send-audit log with timestamp and IDs for deduplication purposes (preventing duplicate messages to the same person).

Retention

• Comment ID + Commenter ID + Post ID + timestamp: as long as the associated Auto-DM rule is active (deduplication list). Deleted on rule deletion.
• Comment Text: NOT persistently stored. Processed in-memory only during keyword matching.
• Sent DM content: not retained beyond the send operation.

Revocation / Deauthorize

Page administrators can revoke the app authorization at any time via Facebook or Instagram settings (Settings → Apps and Websites → HeyHank Auto-DM → Remove). My backend is automatically notified through the registered Deauthorize Callback URL: https://agent.markusstoeger.com/api/auth/meta/deauthorize. All stored tokens and configurations are subsequently deleted.

Data Deletion Requests

Users may request deletion of stored Auto-DM data (Comment ID + Commenter ID) at any time via the registered Data Deletion URL: https://agent.markusstoeger.com/api/auth/meta/data-deletion or by email to office@markusstoeger.com. I confirm deletion within 30 days.

Legal Basis

Processing is based on Article 6(1)(f) GDPR (legitimate interest in efficient customer funnel management for my own page content) and in compliance with the Meta Platform Terms.