← Timir

This English version is provided for convenience. The German version prevails.

Privacy Policy

Information on the processing of personal data under the GDPR, the German BDSG and the TDDDG.

1. Controller

The controller for data processing on this website and in the Timir app is:
Castor Pollux GmbH (brand "Timir")
Sterleyer Straße 6, 23879 Mölln, Germany
Email: moin@timir.de
Full details are in the legal notice.

2. Data protection officer

Julian Gebhard
Castor Pollux GmbH, Sterleyer Straße 6, 23879 Mölln
Email: moin@timir.de

3. Hosting and server log files (Cloudflare)

This website is hosted by Cloudflare (Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA). When you visit it, Cloudflare processes technically necessary access data in server log files, in particular:

Purpose: secure, stable and fast delivery of the website and defense against attacks. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in secure operation). A data processing agreement under Art. 28 GDPR is in place with Cloudflare. Transfers to the USA are safeguarded by the EU Standard Contractual Clauses or the EU-US Data Privacy Framework.

Log files are kept for 7 days.

4. Encryption (SSL/TLS)

This website uses TLS encryption for security, recognizable by "https" in the address bar.

5. Demo requests and product information

You can use the form to request a personal product demo and then choose an appointment. We process the data you provide:

Purpose: handling your demo request and preparing the appointment. We only send product news if you separately consent. Legal basis: Art. 6(1)(b) GDPR for the demo request and appointment preparation; Art. 6(1)(a) GDPR for optional product information. Recipients and storage: the data is stored on our own server in Mölln, Germany, and is not passed to third parties for advertising. Confirmation: after a successful booking you receive a confirmation by email. Optional product information may require an additional confirmation of your email address. Retention: until you withdraw consent or for as long as the stated purpose requires. Withdrawal: you can withdraw consent at any time with effect for the future, for example by email to moin@timir.de or through the unsubscribe link in the newsletter.

6. Appointment booking

After submitting the demo form, you can choose a free appointment directly on the same page. The appointment view is part of our website and is not embedded as a third-party iframe. It is handled technically through our automation platform at n8n.castor-pollux.co.

When free appointments load, technically necessary connection data is transferred (in particular IP address, browser information and time zone). When you book, we process:

Purpose: arranging, holding and confirming a demo appointment. Legal basis: Art. 6(1)(b) GDPR (pre-contractual measures at your request) and Art. 6(1)(f) GDPR (legitimate interest in efficient scheduling). Confirmation: you receive the booking confirmation at the email address you provide. Retention: until the appointment is completed and no retention obligations remain; we then delete the booking data. No additional analytics cookies: the native appointment view sets no additional analytics or marketing cookies itself.

7. Local storage in the browser (technically necessary)

To make the page work, we store small items locally in your browser: your language choice (localStorage) and your progress in the form (sessionStorage). This storage is technically required, is not used for analysis and is not transferred to us or third parties. Legal basis: § 25(2) TDDDG and Art. 6(1)(f) GDPR.

For Google Analytics we use Google Consent Mode v2: without your consent, no analytics cookies are set and no personal analytics data is processed. The Meta Pixel and PostHog load only after your consent. You can withdraw consent at any time with effect for the future through the "Cookie settings" in the page footer.

8. Web analytics: Google Analytics (with consent only)

If you consent, we use Google Analytics, a service of Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland). Google Analytics uses cookies or similar technologies and processes usage data (including truncated IP address and device and usage information) to evaluate use of the website. Data may be transferred to Google, including in the USA.

We integrate Google Analytics through Google Consent Mode v2: the Google tag loads, but without your consent it sets no cookies and only transmits anonymous, cookieless signals. Cookies are set and usage is fully evaluated only after your consent. Legal basis: consent under Art. 6(1)(a) GDPR with § 25(1) TDDDG. Third-country transfer: EU Standard Contractual Clauses / EU-US Data Privacy Framework. Measurement ID: G-9WEC1JR4NP. You can withdraw consent at any time through the cookie settings.

9. Meta Pixel (with consent only)

If you consent, we use the Meta Pixel of Meta Platforms Ireland Limited (Merrion Road, Dublin 4, Ireland) to measure and optimize advertising campaigns, for example on Facebook and Instagram. Cookies are set and usage data (possibly including IP address, device and event data) is transferred to Meta, including in the USA. For part of the processing there is joint controllership with Meta under Art. 26 GDPR.

Legal basis: consent under Art. 6(1)(a) GDPR with § 25(1) TDDDG. Third-country transfer: EU Standard Contractual Clauses / EU-US Data Privacy Framework. You can withdraw consent at any time through the cookie settings.

10. Product analytics: PostHog (with consent only)

If you consent, we use PostHog for product and usage analytics: automatic capture of clicks, scroll and heatmap evaluation and session recordings, to understand how the page is used and where people abandon the form. The provider is PostHog, Inc.; we use the EU cloud, so the data is processed in the European Union. Form inputs such as email and name are automatically masked in recordings and not captured.

Legal basis: consent under Art. 6(1)(a) GDPR with § 25(1) TDDDG. You can withdraw consent at any time through the cookie settings.

11. Sign in with Google in the Timir app

If you register or sign in to Timir with Google, Google sends us, after your approval, your Google identifier, email address, name and possibly your profile picture. We use this only to create your Timir account, link it to your Google account and sign you in. For this we store the account data, the account link and the OAuth tokens needed for sign-in in our account database.

Through Google sign-in we do not request access to Gmail, Google Drive, YouTube or other Google content. The YouTube connection is separate and voluntary (see section 14). We do not use data received through Google sign-in for advertising and do not share it for advertising purposes. Account data remains stored until your Timir account is deleted, unless statutory retention obligations apply.

Sign-in is handled by Google, which processes data itself under its privacy policy.

12. Bot protection with Cloudflare Turnstile in the Timir app

We use Cloudflare Turnstile (Cloudflare, Inc.) to protect registration, sign-in and password reset against automated attacks. The check usually runs invisibly in the background. The app loads Turnstile from Cloudflare; Cloudflare processes technical signals such as IP address, TLS fingerprint, browser identifier, the site key and the originating page. Our server sends the generated token to Cloudflare for verification and uses the result to allow or reject the protected request.

The purpose and legal basis are protecting our accounts and services against abuse (Art. 6(1)(f) GDPR). More information on Cloudflare's processing and technically necessary cookies is in Cloudflare's Turnstile privacy notice.

13. TikTok connection in the Timir app

You can voluntarily connect your TikTok account to Timir to plan content, transfer it to TikTok through the available publishing functions, and display profile information, published videos and statistics provided by TikTok in Timir. Which functions are usable depends on the interfaces TikTok has approved and the permissions you grant. Without a connection, this data exchange does not take place.

Connection and permissions: approval takes place on TikTok's authorization page (OAuth), where you see the requested permissions and decide on the connection. Your TikTok password is not sent to Timir. We only process data necessary for the functions you use and accessible through the granted permissions.

Depending on the approved function, we process the following data:

Purposes: linking and managing the connection, displaying your content and available metrics, carrying out your publishing instructions and showing publishing status. We transfer content and related settings to TikTok only after you expressly approve the transfer. Scheduled posts are transferred as part of the instruction you approved. We use data received through TikTok's interfaces only for the integration functions you use.

Legal bases: where processing is necessary to provide the connection and functions you request, Art. 6(1)(b) GDPR applies. Where we obtain separate consent for additional voluntary processing, Art. 6(1)(a) GDPR applies, and you can withdraw that consent at any time with effect for the future. TikTok's technical permission does not replace any separately required consent under data protection law.

Recipients and processing by TikTok: Timir exchanges data with TikTok for the connection. According to TikTok's privacy notice, for users in the European Economic Area, TikTok Technology Limited, 10 Earlsfort Terrace, Dublin, D02 T380, Ireland, and TikTok Information Technologies UK Limited, Kaleidoscope, 4 Lindsey Street, London, EC1A 9HP, United Kingdom, are jointly responsible for the processing described there. When its authorization page is opened, TikTok also processes technical connection data such as your IP address and browser information. TikTok's own privacy notice applies to its processing.

Third-country transfers: TikTok may process or make data accessible outside the European Economic Area. Its privacy notice explains the recipients, destination countries and transfer mechanisms used, in particular adequacy decisions and EU Standard Contractual Clauses, and gives contact options for requesting information and copies of the safeguards.

Retention, disconnection and deletion: we store the account link, permissions and tokens for as long as the connection is active, as far as needed to operate it. You can remove access at any time in TikTok under the permissions for connected apps. You can also request disconnection or deletion of TikTok data stored by us at moin@timir.de. After the connection ends, we stop using the permissions and promptly delete tokens and profile, video and statistics data retrieved through TikTok that are no longer needed, unless statutory retention obligations apply. If data must be kept for legal reasons, its processing is limited to that purpose. Content and plans you created in Timir remain until you delete them or their purpose ends. Content already transferred to TikTok is not automatically deleted by disconnecting; you manage it on TikTok.

14. YouTube connection in the Timir app

Timir uses YouTube API Services. You can voluntarily connect a YouTube channel so that Timir uploads videos you select at the time you choose. This connection is independent of signing in with Google. By connecting, you agree to the YouTube Terms of Service. The Google Privacy Policy also applies.

Through YouTube API Services we process:

We send YouTube the video you chose, its title, description and hashtags, and your choices for visibility, "made for kids" and altered or synthetic content. The description also contains a visible technical identifier in the format [timir:…], which we use to prevent duplicate publications.

Purpose and sharing: We use this data only to carry out your publishing instructions and to show you the connected account and status. We do not sell it or use it for advertising. The recipient is Google/YouTube; internally, only people who need it for operations and support have access. The legal basis is Art. 6(1)(b) GDPR.

Timir's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Retention: We refresh or delete channel name, channel image and channel URL after 30 days at the latest. [OPEN BEFORE PUBLISHING: set the retention of video ID and link.]

Revocation and deletion: You can disconnect at any time in Timir's settings under publishing accounts. In addition to this, you can revoke access through the Google security settings page. After revocation in Timir we delete the related YouTube data within 7 days, and after revocation at Google within 30 days. Deleting data at Timir does not change any data on YouTube; you manage videos published there on YouTube. Send questions and complaints about how we handle this data to moin@timir.de.

15. Instagram connection in the Timir app

You can voluntarily connect a professional Instagram account (Business or Creator) so that Timir publishes Reels you schedule. We use the permissions instagram_business_basic and instagram_business_content_publish. [OPEN BEFORE PUBLISHING: reconcile the final permissions from #152 and #93.]

We send Instagram the description, hashtags and your publishing settings. Instagram fetches the video through a short-lived signed address. The description contains a technical identifier that we use to prevent duplicate publications. Meta Platforms Ireland Limited (Merrion Road, Dublin 4, Ireland) is responsible for processing by Instagram. The legal basis is Art. 6(1)(b) GDPR.

Revocation and deletion: Disconnect in Timir's settings under publishing accounts, remove Timir in Instagram's settings for apps and websites, or write to moin@timir.de. If you remove the app at Meta, we delete the related tokens and data. [OPEN BEFORE PUBLISHING: add the Meta deletion callback URL from #53 and #159.]

16. Calendar subscription

You can subscribe to your Timir calendar in calendar apps such as Google, Apple or Outlook through a private link. The link works like a password: anyone who has it can read the calendar without signing in, so do not share it. It contains titles, dates and a link to Timir; descriptions, notes and locations are included only if you explicitly turn them on. The calendar app fetches the link regularly and processes the content under its own terms.

You can regenerate the link in Timir at any time, which invalidates the old one, or turn the subscription off. We store only a hash of the link. Timir never reads your Google, Apple or Outlook calendars.

17. Service providers of the Timir app

18. Your rights

Under the GDPR you have the following rights:

A message to moin@timir.de is enough to exercise them.

19. Right to lodge a complaint

You have the right to complain to a data protection supervisory authority. The authority responsible for us is:
Unabhängiges Landeszentrum für Datenschutz Schleswig-Holstein (ULD),
Holstenstraße 98, 24103 Kiel, Germany.

20. Updates

Last updated: November 2026. We adjust this Privacy Policy when processing changes.

Terms · Legal notice