This privacy policy provides information on the nature, scope, and purpose of the processing of personal data within our online offering. We place great value on data minimization and use a modern headless infrastructure to protect your privacy in the best possible way.
⸻
Due to the technical architecture of our website, we use specialized service providers. We have concluded Data Processing Agreements (DPA) according to Art. 28 GDPR with all providers.
⸻
⸻
Matomo audience measurement is activated only after voluntary consent to “Statistics”. Without consent, the tracker is not loaded and no statistics requests are sent. The website, sign-in and short AI Show ideas remain available when consent is rejected.
After consent, Matomo processes visited pages and technical usage data. Your IP address is also technically transmitted to the Matomo installation. From the page URL, the tracker receives only the page path, excluding query parameters, fragments, account identifiers, email addresses and AI Show form input. Visitor cookies are limited to 30 days and session cookies to 30 minutes. Matomo remains disabled on account, password and email-confirmation pages.
Optional statistics cookies require consent under section 25(1) TDDDG; associated processing is based on consent under Article 6(1)(a) GDPR. Each category can be allowed separately, and consent can be withdrawn at any time through “Privacy settings” in the footer or on this page. Withdrawal prevents further statistics requests and removes accessible Matomo cookies. Processing performed before withdrawal remains unaffected.
Your choice is stored in the browser with a version, timestamp and expiry date for up to 180 days. A changed consent version or expiry requires a new choice. Essential storage for this choice and requested account sign-in is separate from optional permissions.
Persistent storage of an AI Show draft on this device is a separate option that is off by default. The draft is stored in the browser only after consent. It expires after 30 days and is removed on the next read. Starting a new idea or withdrawing this option removes stored AI Show drafts. Consent is obtained under section 25(1) TDDDG.
An explicitly requested switch to sign-in can transfer the current draft using session storage for up to 30 minutes. This temporary transfer permits continuation of the requested function without persistent storage. It is consumed on return and removed when persistent draft storage is off. The essential HttpOnly session cookie “auth_token” supports sign-in, lasts for up to seven days and is removed on sign-out. Passwords and login tokens are never saved inside drafts or browser storage.
Guests may request three new short AI generations per calendar day (Europe/Berlin). To limit abuse and cost, a secret pseudonymous hash is derived from the IP address and day. Counter keys do not contain the plain IP address, change daily and expire at the end of the day. No additional browser cookie is set. Visitors sharing a network may share this allowance. The counter protects the requested function and is checked independently of voluntary statistics consent.
When you create or refine a show idea with AI, your event details, selected preferences and free-text input are sent through our server to the OpenAI API. Refinements also include the existing concept. The data is used to provide the concept service you requested, based on Article 6(1)(b) GDPR. Technical abuse and cost prevention serve our legitimate interest in secure operation under Article 6(1)(f) GDPR. Please do not enter passwords, confidential personal information or special categories of personal data in the idea field. Statistics and persistent draft consent are not required for short generation.
OpenAI processes the request as an external AI service provider; processing outside the EU, including in the US, is possible. AI Show disables API response storage using “store: false”. This does not mean all provider data is immediately deleted: according to the OpenAI data controls, abuse-monitoring logs may be kept for up to 30 days by default; API data is not used for training by default. Different retention and data regions depend on the contractual account configuration.
For a customer account, we process your name, email address and securely hashed password. After sign-in, we display your name to identify your account; if no name is available, we display your email address. You may optionally provide your company and a brief note about your work and how you found us. These voluntary details are used for personal review of the registration and handling your enquiry, not for statistics. Accounts become usable only after manual approval; email confirmation alone does not grant access. Account data is stored in the Strapi backend. Registration and requested account functions are based on Article 6(1)(b) GDPR. To request account deletion or information about your details, contact the address given in the legal notice.
If you subscribe to our Newsmail, we process your data based on your consent (Art. 6 Para. 1 lit. a GDPR). We use the double opt-in procedure. You can revoke your consent at any time via the link at the end of every email.
⸻
Vimeo players load only after your separate consent for embedded video. Connection data, including the IP address, is sent to Vimeo; processing outside the EU, including in the US, is possible. We use Do-Not-Track mode. It does not replace consent or guarantee that all cookies and data processing are excluded. Consent is obtained under section 25(1) TDDDG and Article 6(1)(a) GDPR and can be withdrawn through Privacy settings. Some directly supplied video files are served from our Linode infrastructure.
We link to profiles on LinkedIn, Xing, Facebook, and Instagram. Data transfer only occurs if you actively click on the respective link. For Facebook & Instagram, there is a joint responsibility with Meta Platforms Ireland Ltd. (Art. 26 GDPR).
⸻
You have the right to access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20), as well as the right to object (Art. 21) and the right to lodge a complaint with a supervisory authority (Art. 77 GDPR).
⸻
We use SSL/TLS encryption (HTTPS) to protect your data during transmission.
Cookie and AI Show information updated: 14 October 2026
Created for Dancing Bear Productions.