Privacy

EXMGE GmbH & Co. KG, Potsdamer Allee 127, 14532 Stahnsdorf, Germany, is responsible for the processing described here. Contact: privacy@exmge.com or contact@exmge.com. These notices cover the website, applications, account access, the Referral Program and the official EXMGE apps. Updated: 13 October 2026.

We process the name, contact details, channel information and other information you submit to answer your request, assess an application and prepare or perform an agreement (Article 6(1)(b) GDPR). For representatives of organisations and necessary operational checks, our legitimate interest is handling the business relationship and protecting the service (Article 6(1)(f) GDPR). Required information is identified in the form; without it, we may be unable to process the request.

An application session lasts eight hours. A Google connection request expires after ten minutes. Submitted applications, review decisions and correspondence are retained as needed for processing, contractual evidence and applicable retention duties. There is no general automatic deletion of all applications after two years. You can request deletion or ask about the applicable retention period.

The application flow uses YouTube API Services. If you choose to connect Google, the authorised access can include ChannelID, channel name and image, subscriber, video and view counts, channel status and YouTube Analytics. Revenue information is requested only where the flow separately offers that permission. We use these data to assess the channel and application; we do not ask for your Google password. Google displays the requested permissions before authorisation.

The application connection uses a short-lived access token and requests its revocation after the retrieval. Failed revocations are retried with the token protected in storage. This application connection is separate from any later, separately authorised partner integration. You can revoke access at https://security.google.com/settings/security/permissions and request deletion of retrieved data via privacy@exmge.com, subject to applicable legal retention requirements.

When you select the YouTube connection, we record the displayed notice and its version, the time of your confirmation, your IP address and the browser’s user-agent information as evidence of the requested connection. If you submit the application, this record is linked to that application and the contact email address you provide. That address is not treated as a Google-verified email address. We do not inspect installed browser extensions.

Google processes data under https://policies.google.com/privacy. Use of the YouTube API features is also subject to https://www.youtube.com/t/terms. External links and media requests may disclose your IP address and browser request details to the relevant provider.

We use cookies to attribute visits and applications. This information may be retained for up to 60 days; information associated with a submitted application is retained with that application.

We process email address, account identity, permissions and protected authentication data to provide and secure access. Passwords are stored as password hashes. Necessary session cookies and selected account settings support login, security and your chosen preferences; these are separate from optional statistics.

For acceptance of contractual terms, we store the user and account identifiers, email address and name at the time of acceptance, UTC timestamp, the exact document version and content with its SHA-256 hash, the confirmation statement, language and available server-observed IP address and browser User-Agent. This creates a traceable record of the accepted agreement (Article 6(1)(b) and (f) GDPR). We do not enumerate installed browser extensions. IP and User-Agent data are technical observations, not infallible proof of a person.

Unverified referral registration requests expire after 48 hours and are removed by cleanup. Acceptance evidence, cancellation notices, contracts and accounting records remain protected for contract administration, applicable statutory retention and establishing or defending legal claims. Account closure does not automatically erase these records; retention depends on the record and its purpose, not an unlimited blanket retention period.

Payment, tax and billing details are processed to calculate commission, issue records and make authorised payments (Article 6(1)(b) and (c) GDPR). Authorised EXMGE staff and necessary service providers receive only the data needed for their task. Infrastructure includes netcup for server operation, Hetzner for protected storage and encrypted backups, and STRATO for email. Banks and PayPal receive the information needed for the selected payment method. Professional advisers and authorities may receive data where necessary or legally required.

Google, PayPal and other expressly selected external services may process data outside the EEA. Transfers require an applicable legal mechanism, such as an adequacy decision or appropriate contractual safeguards; the relevant mechanism depends on the service and recipient. Contact us for information on safeguards applicable to your data. We do not use Google Analytics or Borlabs Cookie for the website statistics described above.

When you send feedback, we store your message, any screenshot you choose to include, the page area, language, window size and EXMGE version. We also store the browser and its reported version, operating system, device category and recognisable model family where these are already included in the normal request sent by your browser. The information may be incomplete or reduced; it does not reliably identify an individual device.

This information helps us understand your report, reproduce errors and improve the affected functions (Article 6(1)(f) GDPR: our legitimate interest in handling feedback and maintaining a reliable service). The additional browser and device details come from the request headers; we do not request further hardware information or create a device fingerprint. The feedback record does not store the full User-Agent header, IP address, browsing history or URL parameters. The existing public feedback cookie supports abuse prevention and safe retries and expires after 30 days; this diagnostic addition sets no further cookies.

Feedback is available to authorised EXMGE staff and, where separately authorised, to assigned service partners within their access rights. Hosting and backup providers process it under the existing safeguards. We retain feedback and its context for handling the report and necessary follow-up on the reported issue; any longer retention requires a specific continuing purpose or legal obligation. It is not used to build advertising profiles. The rights and contact options below apply.

We use access controls, encrypted transport, protected credentials, security records and encrypted backups. Operational and security logs may contain IP addresses, request metadata and account events; they are used to detect faults and unauthorised use (Article 6(1)(f) GDPR). We restrict access and retain data according to operational need, incident investigation and legal duties. The separate 35-day website-statistics limit does not describe the retention of account or contract evidence.

Deletion requests are assessed for the specific data and any legal exceptions. Backup copies are protected and expire through the applicable backup rotation; they are not used to reinstate deleted data into ordinary use.

Subject to the GDPR, you can request access, rectification, erasure, restriction and data portability. You may object to processing based on legitimate interests for reasons relating to your situation and to direct marketing at any time. Consent can be withdrawn at any time without affecting prior lawful processing. Optional statistics, referral attribution and marketing are separate choices.

Contact privacy@exmge.com. We may request proportionate identity verification and respond within the statutory time limits, normally one month. You may complain to a supervisory authority, including the Brandenburg data protection authority: https://www.lda.brandenburg.de. Application checks and technical warnings do not remove your ability to contact EXMGE and request human review.