Privacy policy

Last updated: 10 November 2026 · Deutsche Fassung

This policy covers the website fnrelay.com, our topic channels on social media and the Distribution Engine, the internal software we use to create, publish and measure posts for those channels. It explains which personal data is involved, why and on what legal basis we process it, who receives it, how long we keep it and what rights you have. The German version is legally binding; this translation is provided for convenience.

1. Controller

FN Digital UG (haftungsbeschränkt) i. G.
Görresstr. 11
80798 München
Germany
Represented by the managing director: Felix Nutsch
Email: kontakt@fnrelay.com

We have not appointed a data protection officer, as we are not required to under Art. 37 GDPR and § 38 BDSG. Please send privacy questions and complaints to kontakt@fnrelay.com.

2. Summary

• This website sets no cookies, uses no browser storage, loads no third-party scripts, fonts or content and contains no tracking.
• The Distribution Engine only connects social media accounts that we own. From the platforms it reads details of those accounts and aggregated metrics for our posts – no data about individual users, no comment text and no follower lists.
• We count clicks on our ref links without cookies and without storing IP addresses.
• Our products report sign-ups and purchases to us without names or email addresses.
• We do not sell data, do not use it for advertising and do not train AI models with it.

3. Visiting this website

The website is served by Cloudflare (Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA). When you visit it, Cloudflare processes technically necessary data: IP address, time, requested URL, browser identifier (user agent) and referrer. This is required to deliver the site and protect it from attacks. We do not keep access logs for this website ourselves and do not analyse visits.

The legal basis is our legitimate interest in a secure, available website (Art. 6(1)(f) GDPR). Cloudflare acts as our processor (data processing agreement). Cloudflare, Inc. is certified under the EU-US Data Privacy Framework (Art. 45 GDPR); the European Commission's standard contractual clauses also apply (Art. 46(2)(c) GDPR). See Cloudflare's privacy policy.

4. Emailing us

Emails to addresses at fnrelay.com are received by Cloudflare Email Routing and forwarded to our managing director's mailbox. Cloudflare does not host mailboxes; the mailbox is provided by Google Ireland Limited (Gmail), Gordon House, Barrow Street, Dublin 4, Irland (privacy policy). We process your address, the content and the metadata of your message in order to reply (Art. 6(1)(b) GDPR for enquiries about a contract, otherwise Art. 6(1)(f)).

Each of our social media accounts has its own address at fnrelay.com, which the platforms use, for example, to send confirmations. These messages reach the same mailbox the same way.

5. Our topic channels

We run channels on Instagram, Facebook and Threads (Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland), on YouTube (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland) and on TikTok (TikTok Technology Limited, 10 Earlsfort Terrace, Dublin, D02 T380, Ireland). When you visit, follow, comment on or message these channels, the platform processes your data under its own terms: Meta, Threads, Google/YouTube, TikTok.

We read and answer public comments and messages to our channels in the platforms' own apps; the Distribution Engine does not read them. The legal basis is our legitimate interest in communicating with our audience (Art. 6(1)(f) GDPR).

For the statistics of our Facebook Page and Instagram account ("Insights") we are joint controllers with Meta (Art. 26 GDPR). Meta only provides us with aggregated figures, never data about individuals. Responsibilities are set out in the Page Insights Controller Addendum; Meta takes primary responsibility and you can exercise your rights directly with Meta.

6. Distribution Engine: Meta and YouTube connections

Only we can access the Distribution Engine (protected by Cloudflare Access). We connect our own accounts to it via OAuth. It processes:

Tokens are stored encrypted (AES-GCM) in our database at Cloudflare (D1) and used only for these tasks. Metrics are totals per post and cannot be traced back to individuals. The platforms fetch the images and videos we publish from our storage (Cloudflare R2) through signed links that expire.

TikTok is not connected: we publish TikTok posts by hand in the app and enter their metrics by hand.

The legal basis is our legitimate interest in running our channels efficiently and understanding which posts are useful (Art. 6(1)(f) GDPR). We process data obtained from Meta only as described here and as the Meta Platform Terms permit.

7. YouTube API Services and Google user data

The Distribution Engine uses YouTube API Services. By connecting a YouTube channel you agree to the YouTube Terms of Service; the Google Privacy Policy applies.

• Access: We access only the permissions listed above and only channels that we own.
• Use: We use the data only to publish videos on those channels and to display and analyse their metrics in the engine's cockpit. We do not use it for advertising, do not sell it, do not transfer it to data brokers, do not use it to determine creditworthiness and do not train AI models with it. Google user data is not sent to Anthropic.
• Sharing: The data is stored only with Cloudflare as our processor. Otherwise we share it only where the law requires.
• Human access: Only our managing director can read the data, in the cockpit.
• Protection: Encrypted transport (TLS), encrypted tokens, access to the engine only after sign-in via Cloudflare Access.
• Retention and deletion: We keep tokens while the channel is connected. Metrics are statistics data; we keep them for analysis while the channel is connected and re-verify the authorisation at least every 30 days. If you disconnect or ask for deletion, section 8 applies.
• Cookies and devices: The engine does not store or access information on third parties' devices or browsers through the YouTube API Services.
• Revoking access: In addition to deletion by us, you can revoke access at any time in Google's security settings: https://security.google.com/settings/security/permissions.

Limited Use: FN Relay's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

8. Data deletion and revoking access

To have data deleted that the Distribution Engine received from Meta (Instagram, Facebook, Threads) or Google (YouTube):

1. Email kontakt@fnrelay.com with the subject "Deletion" and name the account or channel. We delete tokens and stored platform data within 7 days and confirm this to you.
2. Or remove access directly at the platform: at Meta under "Apps and websites" or Business integrations, at Google under https://security.google.com/settings/security/permissions. We then delete the data from that connection as soon as we learn of it, and within 30 days at the latest.

Aggregated figures that can no longer be linked to an account or a person are kept.

9. Ref links and clicks

Links in our posts and profiles go through our short domain (go.fnrelay.com/r/…) to the product's website. Each link carries a code that stands for a post, an account or a creator. On a click, the engine writes one data point to Cloudflare Workers Analytics Engine: code, product, link type, language, market, the related post, account or creator, and whether the request came from a person or a bot (such as a link preview), judged by the browser identifier. The browser identifier is only checked for this, not stored. We do not store IP addresses and set no cookies. We then redirect to the product's website with ?ref=<code>; what happens there is governed by the product's privacy policy.

To deliver the link, Cloudflare briefly processes your IP address (as in section 3). The legal basis is our legitimate interest in measuring the reach of our posts (Art. 6(1)(f) GDPR). Cloudflare deletes the data points automatically after three months.

10. Conversions from our products

Our products (Patronia, GraphAdemic) tell the engine when someone signs up, activates an account, buys or cancels. Each report contains only:

• an event ID from the product (no email address, usually a hash),
• the event type and time,
• the ref code of the first visit, if any,
• for purchases, amount and currency.

The engine does not accept names, email addresses or any other fields; it rejects such reports. We cannot link a report to a person. Using the code we attribute it to a post, account or creator, to see which posts work and to calculate commissions (Art. 6(1)(f) GDPR; for commissions also Art. 6(1)(b) towards the creator). The privacy policy of each product also informs about these reports.

11. AI processing (Anthropic)

We use Claude, an AI model by Anthropic (Anthropic Ireland, Limited; processing also by Anthropic, PBC in the USA), to draft posts, check texts, classify trend topics and write briefings for creators. Anthropic receives product descriptions, topics from public sources and our drafts; for creator briefings also the creator's name, platform and handle. It receives no Google user data, no platform tokens and no data about users of our products.

Anthropic processes the data as our processor under its data processing addendum with standard contractual clauses (Art. 46(2)(c) GDPR), states that it does not use it for training, and generally deletes API inputs and outputs after 30 days (Anthropic privacy). The legal basis is our legitimate interest in creating content efficiently (Art. 6(1)(f) GDPR). A person reviews and approves every draft before it is published.

12. Public trend signals

To find topics, the engine collects publicly available data every day: Hacker News, Product Hunt, Apple app store charts, videos and figures via the YouTube Data API, the Meta Ad Library and notices from public authorities (e.g. police, consumer protection, Europol). It stores titles, figures (e.g. points, rank), the date and the source's raw response. This data may occasionally contain names, for example of advertisers or in headlines. We only analyse it by topic, never by person. For grouping, Cloudflare Workers AI (model bge-m3) computes numeric vectors from the titles.

The legal basis is our legitimate interest in identifying current topics (Art. 6(1)(f) GDPR). Notifying individuals would involve disproportionate effort (Art. 14(5)(b) GDPR); this policy makes the processing public.

13. Working with creators

For possible collaborations we store creators' name, platform, handle, language and market, and the business contact address they publish themselves (profile or imprint). We contact creators only through that address. If we work together, we also store commission rate, term, briefing, the ref code, attributed conversions and recorded payouts.

Legal bases: legitimate interest in initiating collaborations (Art. 6(1)(f) GDPR), then the contract (Art. 6(1)(b)) and statutory retention obligations (Art. 6(1)(c)). You can object at any time; we will then delete your data and not contact you again.

14. Recipients and international transfers

15. Retention

16. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object (Art. 21). Write to kontakt@fnrelay.com.

Right to object: Where we process data based on our legitimate interest (Art. 6(1)(f) GDPR), you may object at any time on grounds relating to your particular situation. We will then stop processing unless we can demonstrate compelling legitimate grounds or the processing serves the establishment, exercise or defence of legal claims.

You may also lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), for example where you live or where we are based. Our competent authority is: Bayerisches Landesamt für Datenschutzaufsicht (BayLDA), Promenade 18, 91522 Ansbach.

17. Other

You are not obliged to provide us with data, but without an email address we cannot reply to you. We do not make automated decisions within the meaning of Art. 22 GDPR and do not profile individuals.

If our data flows change, we will update this policy. We will not process Google or Meta data in ways other than described here before updating this policy.