Privacy Policy

1. Overview

This Privacy Policy describes how Commandor (“Commandor”, “we”, “us”, “our”) processes personal data in connection with: the public Commandor website; the Commandor software platform and services (“Platform”); related communications, sales, marketing and support activities. Commandor is committed to protecting personal data and complying with applicable data protection laws, including the EU General Data Protection Regulation (GDPR) and other relevant international privacy regulations.

2. Data Controller

Legal entity: Commandor Website: https://commandor.app Contact email: info@commandor.app Unless explicitly stated otherwise, Commandor acts as the data controller for personal data processed under this Privacy Policy.

3. Applicability

This Privacy Policy applies to: website visitors; registered users of the Platform; trial users and customers; representatives of business customers; individuals contacting Commandor. This policy does not apply to third-party services or platforms that may be linked to or integrated with the Platform.

4. Roles & Responsibilities (Controller vs Processor)

4.1 Commandor as Data Controller Commandor acts as data controller for personal data related to: account registration; billing and contract administration; customer communication and support; marketing and sales activities; website analytics.

4.2 Commandor as Data Processor When customers connect third-party tools and data sources to the Platform, Commandor processes data solely on behalf of the customer. In such cases: the customer remains the data controller; Commandor acts as a data processor; processing is governed by a Data Processing Agreement (DPA).

5. Categories of Personal Data

5.1 Data Provided by You Name Company name Email address Phone number (optional) Login credentials Billing details Communication content (support requests, emails)

5.2 Data Collected Automatically IP address Device, browser and operating system data Log and usage data Date and time of access Referrer URLs Platform interaction data

5.3 Data via Integrations Data imported through integrations with third-party platforms, including marketing, analytics, advertising or CRM tools, as configured by the customer.

6. Purposes of Processing

Personal data is processed for the following purposes: providing and maintaining the Platform; user authentication and account management; customer support and service communication; billing, invoicing and payments; analytics and platform performance monitoring; product development and improvement; security, fraud prevention and abuse detection; legal and regulatory compliance; marketing communications (where permitted).

7. Legal Bases (GDPR)

Processing is based on one or more of the following legal grounds: Contractual necessity – to provide the Platform and services; Legitimate interests – such as service improvement, security and business operations; Consent – for marketing communications and certain cookies; Legal obligations – such as tax or accounting requirements. Where consent is required, it may be withdrawn at any time.

8. Cookies & Tracking

Commandor uses cookies and similar technologies to: enable website functionality; analyze traffic and usage; improve user experience; support marketing efforts (where applicable). Detailed information is provided in the Cookie Policy.

9. Data Sharing & Sub-Processors

Personal data may be shared with trusted third parties, including: cloud hosting and infrastructure providers; analytics and monitoring services; payment processors; customer support tools; professional advisors; public authorities where legally required. All sub-processors are subject to contractual data protection obligations.

10. International Data Transfers

Personal data may be transferred outside the EEA. Where applicable, appropriate safeguards are implemented, including: EU Standard Contractual Clauses (SCCs); adequacy decisions; equivalent lawful transfer mechanisms.

11. Data Retention

Personal data is retained only for as long as necessary to fulfil the purposes outlined in this policy, unless longer retention is required by law. Retention periods depend on: data type; contractual obligations; statutory requirements; legitimate business interests.

12. Security Measures

Commandor applies appropriate technical and organizational measures to protect personal data, including: encryption in transit and at rest where applicable; access controls and authentication; monitoring and logging; secure hosting environments. While no system is fully secure, Commandor continuously improves its security posture.

13. Your Rights

Depending on applicable law, you may have the right to: access personal data; rectify inaccurate data; request erasure; restrict or object to processing; data portability; withdraw consent; lodge a complaint with a supervisory authority. Requests can be submitted to: info@commandor.app

14. Children

The Platform is not intended for individuals under 18 years of age. Commandor does not knowingly collect personal data from children.

15. Changes to This Policy

This Privacy Policy may be updated periodically. The most recent version will always be published on the website. Continued use of the Platform constitutes acceptance of the updated policy.

16. Google User Data

Commandor allows you to connect your own Google Analytics and YouTube accounts. This section explains which Google user data we access, how we use it and how you stay in control. It applies in addition to the rest of this Privacy Policy. Note: this section is separate from the Google Analytics cookies used on our own website (see our Cookie Policy). Those cookies measure visits to commandor.app. This section covers data from accounts you choose to connect to the Platform.

17.1 Data we access • Google Analytics (analytics.readonly): the GA4 accounts and properties you have access to (names and IDs), and aggregated reporting data for the property you select. This includes sessions, users, pageviews, engagement rate, bounce rate, average session duration, conversions and traffic sources, broken down by date, page, device, channel and country/city. We do not access data about individual visitors to your website. • YouTube (youtube.readonly): basic information about your channel (name, ID, profile image, subscriber count, total views) and your list of videos (titles, thumbnails, publish dates and public counts). • YouTube Analytics (yt-analytics.readonly): aggregated analytics reports for your channel, such as views, watch time, average view duration, subscribers gained and lost, and traffic sources.

17.2 How we use this data We use Google user data only to provide the features you use in Commandor: showing your dashboards, generating automated reports, comparing periods and generating insights about your performance. Access is read-only. Commandor never creates, changes or deletes anything in your Google accounts.

17.3 AI-generated insights To generate insights, aggregated metrics may be processed by [Anthropic], acting as our sub-processor, solely to produce insights shown to you. Google user data is never used to develop, improve or train generalized AI or machine learning models, whether ours or a third party's.

17.4 Storage and security Data and access tokens are stored encrypted in [AWS, Frankfurt]. Access is limited to systems and staff who need it to operate the service.

17.5 Sharing We do not sell Google user data and do not use it for advertising. We only share it: • with sub-processors needed to provide the service (such as hosting and AI processing), under contractual data protection obligations; • when you choose to share it yourself, for example by sending a report; • when required by law, or to protect security. Our staff do not read your Google user data unless you give explicit permission (for example, for support), when needed for security or legal reasons, or when the data is aggregated for internal operations.

17.6 Retention and deletion We keep Google user data while your account is connected and use it only to provide Commandor's features. You can disconnect at any time on the Links page of your project. When you disconnect, we revoke Commandor's access and stop syncing. Previously synced reporting data remains available in your project until you delete the project or request deletion via info@commandor.app. YouTube video titles and thumbnails are refreshed or deleted at least every 30 days while connected, and are deleted immediately when you disconnect. You can also remove Commandor's access yourself via https://myaccount.google.com/permissions.

17.7 Limited Use Commandor's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

17. Contact

For questions or requests regarding privacy: info@commandor.app

Last updated: 1 Oktober 2026