Legal
Privacy Policy
Information per Art. 13 and 14 GDPR on the processing of personal data on this marketing website (entradigm.com). The app at app.entradigm.com has its own privacy policy, maintained in the app. Last updated: June 2026.
1. Controller
Kerim Agdaci (ByKA Insights), Wolnzach, Germany. Email: contact@bykainsights.com. Full provider details in the Imprint.
2. Processing when you visit this website
This marketing website is designed as a static page and sets no tracking cookies and no web-analytics tracking. When pages are retrieved, the hosting provider processes technically necessary connection data (e.g. IP address, time of access, resource accessed, user agent) to deliver and secure the site. The legal basis is the legitimate interest in a secure and functional service (Art. 6(1)(f) GDPR). This connection data is used only for short-term technical delivery and attack defense and is generally deleted or anonymized within a few days; longer retention occurs only where required for security. See Cookies for details.
3. Hosting and third-country reference
The website is delivered via Cloudflare (processing per Art. 28 GDPR, EU region). Cloudflare processes the connection data named under item 2 on our behalf. The provider belongs to a corporate group headquartered in the USA; to the extent processing occurs outside the EU, it is safeguarded by EU Standard Contractual Clauses (Art. 46 GDPR).
4. Lead capture (Early Access request)
If you fill out the Early Access form or the contact form on this website, we process the following data categories: name, email address, company, use-case description. The purpose is Early Access onboarding (reviewing and responding to the request, sending an invitation) and answering general contact inquiries. The legal basis is your explicit consent per Art. 6(1)(a) GDPR, which you give by checking the consent box. Processors for form submission: Supabase Inc. (database, EU region) and Resend, Inc. (transactional email, EU). Data is retained until you withdraw your consent or the beta phase ends, whichever occurs first. Deletion is possible at any time on request to contact@bykainsights.com (Art. 17 GDPR). You may withdraw your consent at any time; the lawfulness of processing carried out until then remains unaffected.
In addition (Phase 22, lead journey): once you submit the Early Access form, we also send a one-time, purely transactional confirmation email ("request received") outlining the next steps. The legal basis for sending this confirmation is primarily Art. 6(1)(b) GDPR (steps taken at your request prior to entering into a contract); your consent under Art. 6(1)(a) GDPR additionally continues to cover storage and further contact. We also store the language (locale) you selected on the form, so the confirmation email and any later invitation can be sent in that language. Concrete retention periods: requests that do not lead to an invitation are deleted no later than 12 months after receipt; in any case no later than 90 days after your withdrawal or the end of the beta phase, whichever occurs first. Where a request leads to an invitation, the request record is deleted or anonymized no later than 90 days after the account is created.
5. Sub-processors and third-country transfers
For this website (entradigm.com) itself we use Cloudflare (hosting/CDN), Supabase (database service for the Early Access form, see the Lead Capture section) and Resend (email notification) as processors. The following additional categories apply for the app platform (app.entradigm.com):
As part of using the platform (app.entradigm.com) we use further processors to which personal data is disclosed. Where processing takes place in a third country (outside the EU/EEA), it occurs on the basis of EU Standard Contractual Clauses (Art. 46 GDPR, Decision 2021/914) or other suitable safeguards. Overview by category:
| Category | Region / third country | Transfer basis |
|---|---|---|
| AI inference | USA | SCC 2021/914 |
| Hosting / edge compute | EU + USA | EU region (primary); SCC 2021/914 (USA PoPs) |
| Database / auth | EU region | EU hosting (no third-country transfer) |
| Transactional email | EU | EU hosting (no third-country transfer) |
| Notifications (messaging bot) | Third country | SCC 2021/914 |
| Web research | USA | SCC 2021/914 |
| Social publishing (optional provider) | Third country | SCC 2021/914 |
| Email marketing | EU (Lithuania) | EU hosting (no third-country transfer) |
| Knowledge-base storage (materials) | EU region | EU hosting (no third-country transfer) |
| Embedding generation (AI) | EU region (Cloudflare) | EU hosting (Cloudflare); Art. 46 GDPR (SCC) to the extent processing outside the EU occurs as part of model provisioning |
| Media rendering and GPU media generation (voice synthesis, music generation) | EU region (Frankfurt) | EU hosting (no third-country transfer) |
The complete, named and always-current sub-processor list can be viewed in the app's Privacy Policy as well as in the Data Processing Agreement (DPA). You can find the DPA at app.entradigm.com/legal/avv. Data processing agreements with all sub-processors are concluded before processing begins.
6. Sign-in / product use
Actual product use (sign-in, cycles, content) takes place on app.entradigm.com. Processing there is described in the app's own privacy policy. The app uses passwordless sign-in via magic link with mandatory two-factor authentication. An overview of our infrastructure is on the Security & Compliance page.
7. Your rights
You have the right to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection (Art. 21). In the product you can delete your own account and data (Settings → Account, Art. 17 GDPR). We grant access and data portability on request to contact@bykainsights.com. You also have a right to lodge a complaint with a data-protection supervisory authority. For the controller this is the Bavarian State Office for Data Protection Supervision (BayLDA), Ansbach. No Data Protection Officer has been appointed, as the statutory requirements for one are not met.
8. Uploaded materials, knowledge-base processing, and AI assistant features
When you upload documents (PDF, PPTX, DOCX) or images (JPG, PNG, WEBP) in the app (app.entradigm.com, Settings → Materials), we process: the uploaded file itself, its filename, its content type, and — after automated processing — derived text excerpts ("chunks") and their vector representation ("embeddings"). Purpose: to build a searchable knowledge base for your organization, used by the AI-assisted generation and assistant feature (below) to create content grounded in your own materials, or to answer questions about them. Legal basis: contract performance (Art. 6(1)(b) GDPR) for the core function; where uploaded materials might touch special-category personal data (Art. 9 GDPR), the separate rights-warranty you explicitly confirm at upload time applies.
Storage location: files are stored in a private Cloudflare R2 storage area scoped
exclusively to your organization (no public access; access only via short-lived signed
read URLs). The derived text excerpts and embeddings are stored in our database
(Supabase, EU region), also scoped per-organization (row-level security). Vector
embeddings are generated via Cloudflare Workers AI (model @cf/baai/bge-m3);
Cloudflare processes this on our behalf within the EU, and to the extent processing
outside the EU occurs as part of model provisioning, it is safeguarded by EU Standard
Contractual Clauses (Art. 46 GDPR).
Retention: materials and their derived text excerpts/embeddings are stored for as long as your organization remains a customer, or until you delete the individual material yourself (Settings → Materials → Delete). Deleting your account (Settings → Account → Delete account, Art. 17 GDPR) automatically erases all of your organization's materials records — the files in storage, the database rows, and every derived text excerpt/embedding — provided your organization has no remaining members after your departure.
Decision ledger: to continuously improve the automated topic and format selection, we log, for every content cycle, which topics/formats the engine chose or suppressed, your human review decision, and the actual publishing outcome. There is no solely automated decision producing legal effects or similarly significant impact under Art. 22 GDPR: every publication still passes the existing human-review gate (human-in-the-loop). Legal basis: legitimate interest in product improvement (Art. 6(1)(f) GDPR), alternatively contract performance (Art. 6(1)(b) GDPR). Retention and erasure follow the same process as your materials above.
AI-assisted assistant feature (RAG): when you use the assistant feature (asking the platform questions about your own materials/knowledge base, or research queries against our general documentation knowledge base), your query and the matching text excerpts from your knowledge base are transmitted to Anthropic (Claude, USA) to generate an answer — the same AI processing already disclosed for content generation (see the AI transparency page). Transmission occurs under EU Standard Contractual Clauses (SCCs); Anthropic does not use your queries or documents to train its models. Processing is transient (not durably stored by Anthropic beyond the processing window of the individual query); on our side we do not durably log the query text. Legal basis: contract performance (Art. 6(1)(b) GDPR). The assistant feature is subject to technical spend caps (per-query, per-organization, and platform-wide) that technically prevent excessive or abusive use (see also Security & Compliance).
Social publishing — expansion to multiple accounts per organization: for publishing your content to social media platforms we use Upload-Post (TONVI TECH SL, Spain) as a processor. Each organization receives its own, organization-specific Upload-Post profile with its own connected social media accounts (instead of one shared profile). The Data Processing Agreement with TONVI TECH SL (version 1.4, countersigned 2026-06-14) covers this multi-organization model at the current usage volume. If you delete your account and your organization is left with no remaining members as a result, your Upload-Post profile is also best-effort deprovisioned with the vendor.