Privacy Notice for "WriteUp"

Meta-Level Software AG — As of: July 2026

Meta-Level Software AG takes the protection of your personal data and compliance with the General Data Protection Regulation (GDPR) and the German Federal Data Protection Act (BDSG) very seriously. This notice provides you with a detailed overview of how we ensure the confidentiality and integrity of your data in connection with the "WriteUp" service.

1. General Information and Data Controller

The controller responsible for data processing within the meaning of the GDPR is:

The data protection officer for the data controller is:

For all data protection inquiries related to WriteUp, please use the contact information provided above.

2. General Principles and Applicable Law

The operation of the WriteUp website and the provision of related services are governed exclusively by German law and the provisions of the GDPR.

WriteUp's offerings are primarily geared toward the German and European markets.

3. Principle of Data Minimization: Collected Data

WriteUp is designed in accordance with the principle of data minimization (Art. 5(1)(c) GDPR). We process only the data that is strictly necessary for technical provision, security, and contract fulfillment:

• Email address: Collected for account management and login purposes.
• Login data (hash): To ensure account integrity and authentication, passwords are stored exclusively as cryptographic hash values.
• Communication data: Data generated in the course of interacting with the service or support.
• Technically Necessary Data: Collection of the IP address and the URL of the website where the plugin is used to ensure functional provision in accordance with Appendix 1 of the technical specification.
• Request content: Text entered by the user into input fields for AI-assisted processing.
• Temporary cookies (session cookies): Store session IDs ("tokens") that allow various requests from a browser to be assigned to the same session. They are deleted when the browser is closed. These are necessary cookies that are absolutely essential for the operation of the "WriteUp" application.
• HTML5 Web Storage (Local Storage): Stores preferred settings for using the service (e.g., "theme" for Dark or Light Mode). These preference objects are stored locally in the browser's cache and remain even after the browser window is closed or the program is terminated; they can be read as long as the cache is not cleared.

4. AI-Powered Text Processing by IONOS

The core functionality of WriteUp is based on artificial intelligence for text optimization.

• Provider: The AI infrastructure is provided exclusively by IONOS.
• Processing location: To ensure data sovereignty, all AI-powered processing takes place exclusively on servers located in Germany.
• Security: No data is transferred to third countries. The content of your requests remains within German jurisdiction and is subject to local security standards.

5. Payment Processing via the Reseller Digistore24

WriteUp uses a reseller model for the purchase of subscriptions.

• Contractual Partner: The legal contractual partner for the user (Merchant of Record) is Digistore24 GmbH (Hildesheim, Germany). A direct B2C sales contract is established between the user and Digistore24.
• Data Flow: Payment-related data (e.g., credit card or bank details) is processed directly by Digistore24. Meta-Level Software AG receives only a confirmation of the payment status in order to activate the corresponding features.

6. Recipients of Personal Data

Recipients of personal data include, in particular, IONOS SE as the hosting and AI infrastructure service provider, and Digistore24 GmbH as the reseller and payment processor. Technical service providers involved in maintenance and support, as well as tax advisors, auditors, and government authorities, may also be recipients of personal data, provided this is required by law. In this regard, Meta-Level Software AG has entered into data processing agreements in accordance with Article 28 of the GDPR, to the extent necessary.

7. Access from Third Countries and International Data Transfers

The WriteUp service is primarily geared toward the German and European markets. The technical infrastructure is located in Germany.

As a general rule, personal data is not transferred to countries outside the EU or the EEA. Therefore, neither adequacy decisions nor other safeguards pursuant to Art. 44 et seq. of the GDPR are currently required.

If users access the service from locations outside the EU/EEA, they do so on their own initiative. In this case, the user is responsible for the associated transfer of device data to Germany.

8. Legal Basis for Processing

The processing of personal data is based on the following articles of the GDPR:

• Article 6(1)(b) GDPR: Necessity for the performance of a contract (e.g., provision of the login and the AI service).
• Art. 6(1)(c) GDPR: Compliance with legal obligations (in particular, commercial and tax law retention requirements regarding transaction data).
• Art. 6(1)(f) GDPR: Protection of legitimate interests (e.g., technical operation).

These legitimate interests include, in particular, ensuring the secure and stable operation of the platform, detecting and preventing attempts at misuse and fraud, IT security and system monitoring, error analysis and troubleshooting, as well as the enforcement and defense of legal claims.

9. Data Security (Technical and Organizational Measures)

Meta-Level Software AG implements state-of-the-art technical and organizational security measures to comply with data protection laws and to protect your data against accidental or intentional manipulation, partial or complete loss, destruction, or unauthorized access by third parties.

To protect your data in the "WriteUp" product, we implement comprehensive measures in accordance with Appendix 3 of our technical documentation:

• Encryption: End-to-end SSL/TLS encryption of communication between the client, server, and backend.
• Physical security: Use of smart card and transponder-based locking systems for building and floor access at the Saarbrücken location.
• Client Isolation: Ensuring isolated client access through central control via the Entity Framework to prevent the mixing of user data.
• Authorization Policy: Implementation of a strict role-based access policy by system administrators.

10. Data Subject Rights Under the GDPR

You have the following rights, which you can exercise without bureaucratic hurdles by contacting Meta-Level Software AG:

• Right of access (Art. 15 GDPR): To obtain information about the personal data stored about you.
• Rectification (Art. 16 GDPR): Correction of inaccurate data.
• Erasure (Art. 17 GDPR): Removal of your data when the purpose of processing no longer applies.
• Restriction (Art. 18 GDPR): Limiting processing under certain conditions.
• Data portability (Art. 20 GDPR): Receiving your data in a commonly used format.
• Objection (Art. 21 GDPR): Objecting to processing based on legitimate interests.

If processing is based on your consent, you may withdraw it at any time with future effect. The lawfulness of the processing carried out prior to withdrawal remains unaffected.

Right to File a Complaint

You have the right to lodge a complaint with a supervisory authority. The competent supervisory authority is the one in your usual place of residence, your place of work, or our company headquarters.

11. Retention Period and Deletion

Data is deleted as soon as the purpose for which it was stored no longer applies (e.g., upon account deletion). If complete deletion is not possible due to legal retention requirements (e.g., accounting data for Digistore24 transactions), the data will be blocked for further processing or anonymized in accordance with the provisions of our data processing agreement.

Request Content: The text entered by the user into the input fields for AI-supported processing is not stored. These entries are also not logged. Furthermore, the entries are not used to train AI models.

12. Necessity of Providing Personal Data

The provision of data required for registration, authentication, and contract fulfillment is, in part, contractually required. Without this data, a user account cannot be created and the service cannot be provided. There is generally no legal obligation to provide such data, unless commercial or tax law requirements are involved.

13. Automated Decision-Making and Profiling

There is no exclusively automated decision-making, including profiling, within the meaning of Article 22 of the GDPR. The AI-generated text suggestions are intended solely to assist the user and have no legal effect.

14. Final Provisions and Amendments

This privacy policy will be updated in response to technical innovations or legal changes. German law applies exclusively. To the extent permitted by law, Saarbrücken is agreed upon as the exclusive place of jurisdiction for all disputes arising in connection with this policy.

Data Protection Impact Assessment (DPIA) for the AI Solution "WriteUp"

1. Introduction

This Data Protection Impact Assessment (DPIA) is conducted in accordance with Article 35 of the GDPR for the "WriteUp" WordPress plugin for AI-powered text optimization and error correction developed by Meta-Level Software AG, hereinafter referred to as the "Provider." The objective is to systematically analyze the risks to data subjects and to define appropriate safeguards.

2. Description of the Processing

The user enters free-form text within a WordPress plugin. The plugin transmits this input for the automated generation of an AI prompt or for processing by a connected AI service. The generated result is then returned to the user's WordPress system, where it is processed exclusively by the user. The Provider cannot rule out the possibility that the user may include personal data in the free-form text.

The plugin provider does not permanently store the entered text or the generated results. There is no logging of the entries. Processing occurs only temporarily, to the extent technically necessary for transmission and generation.

The provider processes only the data necessary for user and license management, in particular the user's email address and the associated license information. This data is not combined with the text entries processed via the plugin.

3. Necessity and Proportionality

Processing is carried out to enable efficient text generation and to minimize the effort required for manual writing. Proportionality is ensured, as only data provided by the user is processed. It is the user's responsibility to ensure that they possess all rights to use and process the data they provide.

4. Assessment of Risks to the Rights and Freedoms of Data Subjects

Potential risks:

• Risks arising from the use of external AI service providers.
• Misuse or misinterpretation of the data.

Risk Mitigation Measures:

• Encrypted transmission of all user data.
• For users from the European Union (EU), all data traffic remains entirely within the EU's data border. No personal data is transferred or processed outside the European Union.
• No storage of raw data.
• Raw data is not used to train the AI. This is guaranteed by the AI provider/data processor.
• No logging of user inputs when submitted to the AI ("prompt").

5. Conclusion

An assessment concludes that the processing is GDPR-compliant and involves a reasonable risk to personal data, as the data transferred to the AI is neither used for its training nor are the prompts stored; therefore, no loss of control and no restriction of the rights of data subjects or their ability to exercise those rights is to be expected. Likewise, no profiling or bulk processing takes place.

The data protection impact assessment is regularly reviewed and updated.