Regensbot

Privacy notice

This privacy notice covers the Regensbot app (app.regensbot.de and the test environment staging.regensbot.de), Regensbot's MCP endpoint and the website regensbot.de with its "Deep Audit" request form. Regensbot is a product of Ibram & Dawwa GmbH. As of 28 October 2026 (version 2026-10-28).

This is a translation; the German Datenschutzerklärung is binding.

In short: we use no tracking and no analytics tools. The app uses exactly one strictly necessary cookie, the website none. Our server is in Frankfurt am Main.

Controller and contact

The controller is:

Ibram & Dawwa GmbH
Johanna-Kinkel-Straße 1+2
93049 Regensburg
Germany
Represented by
Ibrahim Anjro (managing director)
E-mail
info@ibramdawwa-gmbh.de
Phone
+49 1575 1702770
Register court
Amtsgericht Regensburg, HRB 21570

We have not appointed a data protection officer. We are not required to, because fewer than 20 people at our company regularly process personal data (§ 38(1) BDSG). For all privacy questions, for requests under Art. 15 to 22 GDPR and to report security vulnerabilities, please write to info@ibramdawwa-gmbh.de. The managing director handles them directly.

When we are controller and when processor

We act in two roles.

Stripe processes payment data as an independent controller (see Payment through Stripe).

Website regensbot.de

No cookies, no analytics

The website regensbot.de sets no cookies and stores nothing in your browser. We use no analytics or tracking tools. Fonts are served from our own server. Your browser does not connect to third-party servers.

Server logs

Data
On every request our web server processes technical details, in particular your IP address, date and time, the page requested, the HTTP status code, the amount of data sent and your browser's identifier (user agent).
Purpose
Delivering the website, analysing errors and defending against attacks.
Legal basis
Art. 6(1)(f) GDPR. Our legitimate interest is a secure and stable website.
Retention
14 days. Longer only if a specific security incident must be investigated, and only for as long as that takes.

Deep Audit request

Data
Name, e-mail address, company, website, approximate number of pages, accesses offered (for example Search Console or server logs), preferred language and your message. To protect against spam we also store technical details: time, language and path of the page, a shortened IP address (for IPv4 the first three of four blocks, for IPv6 the first three of eight blocks), your browser's identifier and how long filling in the form took.
Purpose
We answer your request and prepare a possible offer. The technical details serve to detect spam and abuse.
Legal basis
Art. 6(1)(b) GDPR (request before a contract) where you yourself become our contracting party. If you act for a business, Art. 6(1)(f) GDPR; our legitimate interest is answering requests from businesses. For spam detection Art. 6(1)(f) GDPR; our legitimate interest is a form that is not abused. The checkbox in the form only confirms that you have read this information. It is not consent.
Disclosure
We store the request on our server in Frankfurt am Main and send it by e-mail over a TLS-encrypted connection to our mailbox info@ibramdawwa-gmbh.de. The e-mail goes through Google Workspace (see Recipients). Requests detected as spam or duplicates are stored with a flag and not forwarded.
Retention
We delete your request 12 months after we receive it. Requests flagged as spam or duplicates are deleted after 30 days. If a contract results, we keep the records that commercial or tax law requires for the statutory periods. To limit the number of requests we derive only hashed check values from your full IP address and your details. They are held in memory only and expire after 10 minutes or 24 hours.

For the Deep Audit itself we conclude a separate data processing agreement and a confidentiality agreement before any access to your systems.

Contact by e-mail or phone

When you write to us or call us, we process your contact details and your request in order to reply. The legal basis is Art. 6(1)(b) GDPR where it concerns a contract to which you yourself are or will become a party. Otherwise Art. 6(1)(f) GDPR applies (our interest in answering requests). We delete the data once the request is dealt with and no statutory retention obligation applies.

Regensbot app and MCP endpoint

Regensbot is exclusively for businesses (Unternehmer) within the meaning of § 14 BGB, also on the Free plan. We are the controller for all processing in this section.

Account and registration

Data
E-mail address, password (only as an Argon2id hash, never in plain text), optionally your name, language, time of e-mail confirmation, time of the last sign-in and of the last password change, account status and the number of failed sign-ins. Also your organisations (name, type, plan) and your role in them.
Purpose
We provide Regensbot to you.
Legal basis
Art. 6(1)(b) GDPR where you yourself are our contracting party. Where you act for a business that uses Regensbot, Art. 6(1)(f) GDPR; our legitimate interest is providing that business with the accounts of its staff.
Retention
We delete an unconfirmed account 7 days after registration. If you delete your account, we lock it at once and delete it for good after 30 days. The same applies to organisations of which you are the only member.

Proof that the terms and privacy notice were accepted

Data
When you register, create an account as an invited person or set your password for an account we created for you, we store which version of the terms of service and of this privacy notice you accepted or took note of (for example "2026-10-28"), and the time. With the same confirmation you declare that you act as a business and accept the AVV.
Purpose
Proof that the contract was concluded on these terms.
Legal basis
Art. 6(1)(b) and (f) GDPR; our legitimate interest is being able to prove the conclusion of the contract.
Retention
With the account; we delete these details with the account.

Sign-in, sessions and security

Data
For each session we store a hash of the session key, times, the shortened IP address (see above) and your browser's identifier (at most 256 characters). We log security-relevant events with time, internal identifier, type of event (for example a failed sign-in or a new API key) and shortened IP address. This log never contains passwords, keys or full e-mail addresses. To limit requests we count attempts per shortened IP address or per hash of your e-mail address.
Purpose
Secure sign-in, protection against abuse, account takeover and attacks. After 100 failed sign-ins in a row we lock the account and inform you by e-mail.
Legal basis
Art. 6(1)(b) GDPR for the session itself. For the other details Art. 6(1)(f) GDPR; our legitimate interest is the security of your account and of our service (see also Art. 32 GDPR).
Retention
A session ends after 30 minutes without activity, at the latest after 12 hours. We delete it 7 days after it ends. We delete counters for limiting requests at the latest two days after their time window starts. We delete security events after 12 months. Until then they remain after your account is deleted, but they contain neither your name nor your e-mail address.

Check against known passwords

When you choose a new password, we check whether it appears in known data breaches. Our server computes a SHA-1 hash of the password and sends only its first 5 characters to the "Have I Been Pwned" service (Pwned Passwords). Your password, your e-mail address and your IP address do not leave our server. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is protecting your account.

Teams and invitations

Data
Owners and admins of an organisation can invite other people by e-mail address. We store the e-mail address, the intended role, who invited and when the invitation expires. The invited person's data therefore come from the person who invites.
Purpose
Teamwork in an organisation.
Legal basis
Art. 6(1)(f) GDPR; our customer's legitimate interest is adding its staff. If the person accepts the invitation, Art. 6(1)(b) GDPR applies.
Retention
An invitation is valid for 7 days. We delete it one day after it is accepted or expires.

API keys and connections of AI assistants (MCP)

Data
For API keys: name, organisation, who created it, the last 4 characters, permissions, expiry date, last use and any revocation. We store the key itself only as a hash. If you connect an AI assistant (for example Claude or ChatGPT) through our MCP endpoint, we store the details of the connected program, for automatic registration also the shortened IP address, and your grant (who, for which organisation, with which permissions, last use). We store codes and access tokens only as hashes.
Purpose
Access to Regensbot from your own programs and AI assistants.
Legal basis
Art. 6(1)(b) GDPR.
Retention
A revoked API key loses its hash at once. The other details of the key remain until the organisation is deleted. Sign-in codes are valid for 120 seconds, access tokens normally for one hour; we delete them one day after they expire. Refresh tokens expire after 30 days without use, at the latest after 180 days; we delete them one day after this maximum. Your grants remain stored until your account is deleted. We delete a registered program without a grant after 24 hours and an unused one after 90 days.

What your AI assistant retrieves from Regensbot is processed by its provider under your own contract with that provider. You choose this provider yourself. It is not our processor. Under "Apps" in your account you see all connected programs and can disconnect each of them at once. When you delete your account, we disconnect all connected programs.

E-mails

Data
Your e-mail address, type and language of the message, content and time of sending.
Purpose
We send only messages that belong to the service: for example confirmation and password links, invitations, security notices, payment notices, notices of changes to the terms and messages about audits, crawls and deadlines. We send no newsletters or advertising. The sender is noreply@regensbot.de; mail goes through Google Workspace (see Recipients) over TLS-encrypted connections.
Legal basis
Art. 6(1)(b) GDPR; security notices also Art. 6(1)(f) GDPR (protecting your account).
Retention
Content such as one-time links is kept encrypted until it is sent and deleted when it is sent. Confirmation links are valid for 24 hours, password reset links for 30 minutes. We delete the sending record (recipient address, type and language of the message, time) 90 days after sending, even if your account was deleted earlier. If a message could not be sent, we delete its record with the encrypted content 90 days after it was created.

App server logs

Data
Our web server logs your full IP address, time, request method, path requested without parameters, status code, amount of data, response time and your browser's identifier; on errors its error log can also contain the full address. The application logs IP address, request method and path. It replaces secret values in the address, such as keys, codes, passwords or e-mail addresses, with "redacted".
Purpose
Operation, error analysis and defence against attacks.
Legal basis
Art. 6(1)(f) GDPR; our legitimate interest is secure and stable operation.
Retention
14 days. Longer only if a specific security incident must be investigated, and only for as long as that takes.

Record of your privacy requests

When you download your data or delete your account, we store the type, status and times of this request with an internal identifier, but without name or e-mail address. This lets us prove that we fulfilled the request (Art. 6(1)(c) GDPR in conjunction with Art. 5(2) and Art. 12 GDPR). We delete this record three years after the end of the year in which the request was completed; a request that was never completed, three years after the end of the year it was received.

Cookies

The app sets exactly one cookie: __Host-rb_session. It contains a random key and is valid for at most 12 hours. It keeps you signed in and protects forms against forged requests (CSRF). Before sign-in it only carries this protection for the registration and sign-in forms. The cookie is only sent over encrypted connections and cannot be read by scripts.

This cookie is strictly necessary. No consent is required for it (§ 25(2) no. 2 TDDDG). We base the subsequent processing on Art. 6(1)(b) and (f) GDPR. We use no other cookies, no local storage in the browser, no analytics tools, no third-party scripts and no third-party fonts. That is why we show no cookie banner.

Payment through Stripe

Data
When you book a paid plan, we send Stripe the owner's e-mail address, the organisation's name (for a personal organisation your name or the part of your e-mail address before the @), the preferred language and our internal identifier of the organisation. Stripe collects the billing address, the VAT identification number and the payment details (for example card or SEPA direct debit) directly from you. We do not store card details. We store the Stripe customer number, the plan booked, the subscription status, periods, the status of the last invoice and the messages Stripe sends us about the subscription.
Purpose
Concluding and handling your subscription, payment, calculating VAT (Stripe Tax) and management through Stripe's customer portal.
Legal basis
Art. 6(1)(b) GDPR. For keeping invoices and accounting records Art. 6(1)(c) GDPR in conjunction with § 147 AO and § 257 HGB.
Retention
Messages from Stripe: content 30 days, record 90 days. Subscription data until the organisation is deleted. We keep invoices and accounting records for as long as commercial and tax law require (up to ten years).

Stripe Payments Europe, Limited (1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland) processes payment data as an independent controller, also for its own legal obligations such as preventing fraud and money laundering. Stripe is not our processor and receives no data that we process on behalf of our customers. Stripe's privacy policy applies.

Data we process on behalf of our customers

Our customer is the controller for the following processing. We act only on its instructions and on the basis of the data processing agreement. The customer needs its own legal basis for these data. If you are a data subject with questions or want to exercise your rights, please contact the customer. If your request reaches us, we forward it to the customer and support it.

Server logs of the customer's website

Customers can send us their website's server logs so that we can analyse crawler visits. By default our command-line program filters the logs on the customer's own computer. Only lines from known crawlers whose address is on the crawler's published address list reach us in full. Visitors' requests are first summarised into response times per day, host and page type; their lines do not reach us.

Only if we have switched on receiving full logs and the customer sets it up do full lines with visitors' IP addresses, browser identifiers, requested addresses, referrers and times reach us. This function is switched off at present. We analyse such lines in one pass and delete them afterwards, at the latest 24 hours after receipt. They are not included in our backups.

We keep permanently only daily totals (count, amount of data, response times per host, page type, crawler and status code), addresses seen for the first time and alerts. We never store visitors' IP addresses or browser identifiers. We check by DNS lookup whether a request really comes from a crawler. We remember confirmed crawler addresses for 7 days, unconfirmed ones only as a hash for 24 hours.

Google connection

The Google connection is optional. Owners or admins of an organisation set it up themselves and grant Regensbot access at Google. Regensbot only reads; it changes nothing in your Google accounts.

Permissions
Your identity (openid, email), read access to Search Console and, only if you choose it, read access to BigQuery and access to Merchant Center. For Merchant Center Google grants only a permission that would also allow changes. Regensbot uses it only to read data and changes nothing.
What we read
Your Search Console properties, URL inspection results, search analytics data with queries, page and country, samples of products and issues from Merchant Center and aggregated values from BigQuery. BigQuery queries run in your own project with your permission.
What we store
The Google account number and e-mail address of the person who connects (to show which account is connected), the permissions granted and the access tokens. We store the tokens encrypted with AES-256-GCM.
Retention
Search analytics data 24 hours, at most 7 days. Merchant Center samples 30 days. URL inspection results until the connection is removed, at the longest until 30 days after the website or the organisation is deleted. The list of properties until the connection is removed, at the longest until 30 days after the organisation is deleted.
Revocation
You can remove the connection in Regensbot at any time. We then delete everything we read through this connection and revoke access at Google, unless the same Google account is still connected to another Regensbot organisation. You can also revoke access in your Google account.

Regensbot's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We do not use data from Google APIs to develop, improve or train AI models, and we do not pass it on for that purpose.

We manage the access tokens as controller (Art. 6(1)(b) GDPR). We process the data read as the customer's processor.

Optional AI review

Regensbot can have individual content reviewed by an AI model from Anthropic. This function is switched off for Regensbot at present. It runs only if we switch it on and the customer expressly switches it on for a website it has verified. It is off for every website until the customer switches it on. The Free plan includes no AI reviews.

What is sent
Excerpts from the text of the audited page, structured details such as headings and alternative texts and, for some checks, images, such as images of the page or uploaded Search Console screenshots.
What we store
Type of check, model used, amount of data processed and the result with reasoning and verbatim quotes. If a member confirms or rejects a result, we store this decision with the member. We store no more page text than these quotes.
Retention
The result with reasoning and quotes and the members' decisions on it until the website or organisation is deleted; deleted for good 30 days later. We keep a counter record without quotes, reasoning or decisions (type of check, model, amount) for the monthly quota until the organisation is deleted.
Role
We act on behalf of the customer. Anthropic is then our sub-processor (see Recipients). The AI review is based on the customer's instruction, not on consent.

Information for operators of audited websites

This section is for people whose public web pages a Regensbot customer has audited and for people named on such pages (Art. 14 GDPR).

Who fetches
Our crawler identifies itself as RegensbotBot/1.0 (+https://app.regensbot.de/bot). Some checks of single pages repeat a request with the user agent of Googlebot, of Storebot-Google or of a browser to compare what search engines and visitors see. These requests come from Regensbot, not from Google.
Source of the data
Publicly accessible web pages whose address a customer enters.
What we store
For an audit of a single page only the results and short evidence, in which we make e-mail addresses and phone numbers unrecognisable. For crawls of a website, among other things, titles, descriptions, link texts and author details as shown on the pages. For rendering (not in operation at present) a rendered copy of the page and screenshots.
Scope
In crawls we fetch at most one page per second. If the customer has not proved that it runs the website (verification), only one manual crawl of at most 25 pages a month is possible, at most one page every two seconds. Across all customers Regensbot audits at most 30 single pages of a domain per hour.
robots.txt
If you exclude RegensbotBot in your robots.txt with "Disallow: /", it fetches nothing from your host except robots.txt, neither in crawls nor in audits of single pages. Exception: if another address redirects RegensbotBot to your host, the target page is fetched once before your robots.txt can be read; Regensbot then does not evaluate it. In crawls of websites the customer has not verified, RegensbotBot also follows your rules for all crawlers (User-agent: *) when there is no group of its own for RegensbotBot. We treat these rules as a machine-readable reservation of use under § 44b UrhG. If your robots.txt cannot be fetched (server error, status code 429 or no answer), RegensbotBot fetches nothing further from your host in such crawls; if it is the host of the start address, the crawl stops. Only on the hosts of a website whose owner has verified itself to us as its operator do the rules for all crawlers not apply to RegensbotBot. An audit of a single page is one fetch the customer requests for that address.
Purpose
Technical checks of public pages, for example for findability in search engines.
Legal basis
For the fetch and the results: the customer's legal basis, usually Art. 6(1)(f) GDPR. For operating the crawler: Art. 6(1)(f) GDPR; our legitimate interest is a safe, considerate crawler. We store as little as possible.
Retention
As stated for audits, crawls and rendering in the section Retention.

The customer that started the audit is the controller for fetching a page and for the results stored; we act as its processor. We are the controller for operating the crawler itself, such as the block list and the fetch limits.

If you do not want Regensbot to fetch your website, you can also write to info@ibramdawwa-gmbh.de. We then block your domain for all audits. You also have the rights listed in the section Your rights, in particular the right to object.

Recipients and transfers to third countries

We pass data only to the following recipients. We have concluded a contract under Art. 28 GDPR with Hostinger and Google; with Anthropic we will conclude it before the AI review is switched on.

Hostinger International Ltd., 61 Lordou Vironos Street, 6023 Larnaca, Cyprus
Hosting of the app (production and test environment), the database, uploaded files, logs, backups and the website regensbot.de on a virtual server in Frankfurt am Main. Processor. No transfer to third countries is intended. Hostinger's privacy policy.
Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (Google Workspace)
Sending our e-mails from noreply@regensbot.de, delivering Deep Audit requests and our mailbox info@ibramdawwa-gmbh.de: recipient address and content of the message. Processor. Google may also have data processed by Google LLC in the USA. Safeguards: contract under Art. 28 GDPR (Cloud Data Processing Addendum); for transfers to Google LLC the adequacy decision on the EU-U.S. Data Privacy Framework (Art. 45 GDPR), supplemented by EU standard contractual clauses (Art. 46(2)(c) GDPR). Google's privacy policy.
Stripe Payments Europe, Limited, Ireland
Payment processing, tax calculation, checkout and customer portal. Independent controller (see Payment through Stripe). Stripe may also process data through Stripe, Inc. in the USA. For transfers to Stripe, Inc. the adequacy decision on the EU-U.S. Data Privacy Framework (Art. 45 GDPR) applies, supplemented by EU standard contractual clauses (Art. 46(2)(c) GDPR). Stripe's privacy policy.
Anthropic PBC, 548 Market Street, PMB 90375, San Francisco, CA 94104, USA
Only when the AI review is switched on; at present it is switched off. Then: text excerpts and images of the audited pages. Sub-processor. Safeguards: contract under Art. 28 GDPR (Anthropic's Data Processing Addendum); EU standard contractual clauses, module 3 (processor to sub-processor), Implementing Decision (EU) 2021/914 (Art. 46(2)(c) GDPR); in addition the adequacy decision on the EU-U.S. Data Privacy Framework where Anthropic is certified under it. Under its commercial terms Anthropic does not use the data to train its models. Anthropic's privacy policy.
Server for rendering pages
We will use a separate server for rendering pages in a browser once this function goes live. We will name its provider here then.
Google (PageSpeed Insights, Chrome UX Report)
For performance measurements we send the address of the audited page to Google. We send no details about you personally.
Google APIs with your permission
We call Search Console, Merchant Center and BigQuery with your own permission (see Google connection). Your own contract with Google applies.
Have I Been Pwned (Pwned Passwords)
Only the first 5 characters of a password hash. No person can be identified from them.
Requests without personal data
Our server downloads public lists: vulnerabilities (Wordfence), version details from WordPress.org, the published IP addresses of Google's and OpenAI's crawlers and descriptions of AI assistants (claude.ai, chatgpt.com). We send no data about you.
Your own providers
Services you connect to Regensbot yourself, such as your AI assistant, Cloudflare, Amazon S3, Cloudflare R2 or GitHub, are your providers, not our processors.

You can obtain a copy of the EU standard contractual clauses on request at info@ibramdawwa-gmbh.de. The list of companies certified under the EU-U.S. Data Privacy Framework is at https://www.dataprivacyframework.gov.

Beyond this we pass data on only where the law requires it, for example to authorities.

Retention

We keep data only as long as the purpose requires or the law demands. The main periods:

Further periods are given with each processing activity above. Stripe keeps customer, invoice and payment data under its own periods.

Your rights

You have the following rights against us:

In your account you can download your data as a JSON file and delete your account yourself. For security reasons we ask for your password again. Please send all other requests to info@ibramdawwa-gmbh.de. We answer within one month. If we have doubts about your identity, we may ask for proof.

If we process data on behalf of a customer, please contact that customer. We support it with your request.

None of our processing is based on consent. There is therefore no consent for you to withdraw.

Right to object under Art. 21 GDPR

You can object at any time. Where we process your data on the basis of Art. 6(1)(f) GDPR, you can object at any time on grounds relating to your particular situation.

We then no longer process the data, unless we demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims.

An informal objection to info@ibramdawwa-gmbh.de is enough. We do no direct marketing.

Complaint to a supervisory authority

You can complain to a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is:

Bayerisches Landesamt für Datenschutzaufsicht (BayLDA)
Promenade 18
91522 Ansbach

Further information

Obligation to provide data

You are not legally obliged to give us data. Without an e-mail address and password, however, we cannot create an account. For a paid plan we need the billing address, VAT identification number and payment details. For a Deep Audit request we need name, e-mail address, company, website, number of pages and language; all other details are optional.

No automated decisions

We make no automated decisions within the meaning of Art. 22 GDPR and do no profiling.

Data security

All connections are encrypted with TLS. We store passwords only as Argon2id hashes and session keys, API keys and access tokens only as hashes. We encrypt Google access tokens and other secrets with AES-256-GCM. The server's disks are not encrypted. We store IP addresses of users and visitors in the database only in shortened form; we store in full only addresses of crawlers confirmed by DNS, for 7 days. Each organisation's data are kept separate from those of other organisations. Only the managing director has access to the server and the database. Details are in Annex 1 of the AVV.

Please report security vulnerabilities or personal data breaches to info@ibramdawwa-gmbh.de.

Changes

We update this privacy notice when Regensbot or the law changes. The version published here applies. As of 28 October 2026 (version 2026-10-28).