Datenschutzerklärung | Privacy Policy

Last updated: October 10, 2026

1. Introduction

BOSETEIN UG ("we," "us," or "our") is committed to protecting your privacy and ensuring the security of your data. This Privacy Policy explains how we collect, use, and protect your data in accordance with the General Data Protection Regulation (GDPR), the German Federal Data Protection Act (BDSG), and other applicable data protection laws.

This policy applies to all our services, including our business automation tools and AI-powered solutions ("Services").

2. Scope of Services and Data Processing

Our Services include business automation tools and AI-powered solutions. We act as a data controller when you use our Services directly, and as a data processor when providing services through our business partners.

2.1 Data We Process:

• Authentication credentials necessary for service provision
• Technical service identifiers
• Service performance metrics
• Temporary session data required for functionality
• Business account information

2.2 Platform Integrations:

When you use our Services with third-party platforms:

• We only request necessary platform permissions
• We process platform data solely for providing our Services
• We adhere to all platform-specific terms and developer policies
• We maintain separate data storage for different platforms
• When you connect your LinkedIn profile or organization page, we request only the permissions necessary (e.g., posting, analytics, comments) and process this data solely to provide the requested features.
• Only LinkedIn Page administrators may connect an organization page to Smartypant.
• If you disconnect LinkedIn or delete your account, related LinkedIn data and stored access tokens are deleted or anonymized within 30 days.

2.3 LinkedIn Data Use

Depending on the permissions you grant, we may on your behalf:

• Create, publish, and manage posts for your personal profile or organization page.
• Access post and page analytics (e.g., impressions, reactions, comments) to display performance metrics.
• Read and reply to comments on authorized posts.

We do not sell LinkedIn-derived data or share it with third parties for their independent purposes. LinkedIn access can be revoked at any time via your LinkedIn settings or within our Services. Upon revocation, stored tokens are invalidated immediately and associated data is deleted or anonymized within 30 days, subject to legal retention obligations.

2.4 Google & YouTube Data Accessed

When you connect your Google or YouTube account to Smartypant AI, we access only the data that you explicitly authorize through the Google OAuth consent screen. This data is required to provide automated content creation, publishing, and analytics features.

Data Accessed

• Google Account Information (userinfo.email, userinfo.profile, openid):
  • Email address
  • Name and profile picture
  • Google account unique ID
• YouTube Channel Information (youtube.readonly):
  • Channel ID
  • Channel title
  • Channel thumbnail image
  • Subscriber count
• Video Upload Permissions (youtube.upload):
  • Permission to upload videos to your YouTube channel on your behalf
  • Metadata needed for publishing (title, description, tags, privacy settings)
• YouTube Analytics Data (yt-analytics.readonly):
  • Views and watch time
  • Likes and comments count
  • Subscribers gained
  • Daily or time-range performance metrics for your videos

How We Use This Data

• To authenticate your Google account and securely link it to your Smartypant AI account
• To automatically upload videos or Shorts that you create or schedule inside Smartypant AI
• To show your YouTube channel details in the dashboard so you can see which account is connected
• To display analytics and performance insights for the content Smartypant AI posts on your behalf

Data Storage & Security

• OAuth access tokens are stored securely and encrypted. They are used only to perform actions you have authorized.
• We store the media files (videos/Shorts) that Smartypant AI generates for you so we can edit, schedule, and publish them to your connected platforms.
• We do not download or permanently store copies of your existing YouTube videos or comments; we only keep the IDs and analytics metrics needed to display performance.
• When you disconnect YouTube or delete your Smartypant AI account, we delete stored Google OAuth tokens and related channel credentials without undue delay and in any case within 30 days, unless a longer period is required by law.

No Data Sharing

We do not sell, rent, or share Google user data with any third party. Data obtained from Google APIs is used exclusively to provide the features you choose to enable within Smartypant AI.

2.5 Using Smartypant in ChatGPT, Claude and other chatbots

You can connect your Smartypant account to ChatGPT or Claude with the "Smartypant Social Autopilot" plugin or connector. To connect, you log in to Smartypant and confirm that the AI assistant may access your account. The assistant then receives an access token from us. Your password is never shared with OpenAI or Anthropic.

Data the plugin reads

• Your planned and recently published posts: date, platform, caption, links to images and videos, approval status
• Whether your account runs in Co-pilot or Autopilot mode

Actions the plugin can perform

• Approve a post or undo an approval. An approved post is published by Smartypant on its planned day.
• Change the caption of a post

These actions happen only when you ask for them in the conversation or click a button in the plugin. The plugin cannot create or delete content and has no access to your connected social media accounts.

Recipients

The data shown to you in ChatGPT is transmitted to OpenAI, the provider of ChatGPT (for users in the EU: OpenAI Ireland Ltd.), and processed under OpenAI's privacy policy. The data shown to you in Claude is transmitted to Anthropic, the provider of Claude, and processed under Anthropic's privacy policy. In both cases this happens because you requested it there, and it may include a transfer outside the EU. The plugin only shows content created by Smartypant. It does not pass on data received from Google services or other connected platforms.

Purpose and legal basis

We process this data to provide the plugin you chose to use (Art. 6(1)(b) GDPR).

Storage

We do not receive or store your conversations in ChatGPT or Claude. When you change a caption through the plugin, the new text is saved as part of your post. Our plugin server keeps technical logs (for example your user ID, time of request and error messages) for at most 30 days for security and troubleshooting.

Your control

You can disconnect Smartypant at any time in your ChatGPT or Claude settings. The assistant then stops accessing your account. Your rights under section 6 apply as well.

3. Data Protection Principles

We follow strict data protection principles:

• Data Minimization: We collect and process only data necessary for service provision
• Purpose Limitation: Data is used solely for specified business purposes
• Storage Limitation: Data is retained only as long as necessary
• Integrity and Confidentiality: Implementation of strong security measures

4. Security Measures

We implement state-of-the-art technical and organizational measures:

• End-to-end encryption for sensitive data
• Regular security audits and assessments
• Multi-factor authentication
• Access control and monitoring systems
• Regular security training for employees
• Automated backup and recovery systems
• We rely on Supabase-managed infrastructure that provides encryption in transit (TLS) and encryption at rest for stored data.
• Access tokens are stored securely within our infrastructure; they are never exposed in client-side code and are invalidated immediately when you revoke access.

5. Data Storage and Transfer

All data is stored exclusively on servers located within the European Union. Any data transfers outside the EU are conducted only with adequate safeguards in accordance with GDPR requirements. When you use our ChatGPT plugin, data you request in ChatGPT is passed to OpenAI as described in section 2.5.

6. Your Rights Under GDPR

You have the following rights:

• Right to access (Art. 15 GDPR)
• Right to rectification (Art. 16 GDPR)
• Right to erasure (Art. 17 GDPR)
• Right to restrict processing (Art. 18 GDPR)
• Right to data portability (Art. 20 GDPR)
• Right to object (Art. 21 GDPR)
• Right to withdraw consent

To exercise these rights, contact us at [email protected]

7. Data Protection Officer

Our Data Protection Officer ensures compliance with data protection regulations and can be contacted at:

Dr.-Ing. Alok Singh
Email:[email protected]

8. Changes to Privacy Policy

We may update this privacy policy to reflect changes in our practices or for operational, legal, or regulatory reasons. Updates will be posted on this page with a revised date.

9. Contact Information

BOSETEIN UG
Reinsburgstr. 77
70197 Stuttgart
Germany
Email: [email protected]
[email protected]
Phone: +49 157 3722 9481
Commercial Register: HRB 774002