Privacy Policy

Last updated: 29 September 2026

This privacy policy explains which personal data MONNINGHOFF Labs UG (haftungsbeschränkt) (“we”, “us”) processes when you

• visit our website puzh.com,
• use the PUZH platform and the client portal at app.puzh.com,
• order an AI Superfilm, or
• connect social media accounts to PUZH.

PUZH is a product of MONNINGHOFF Labs UG (haftungsbeschränkt), not a separate legal entity. The German version of this policy (Datenschutzerklärung) is the binding one; this English version is provided for convenience.

Contents

1. Controller
2. Overview
3. Visiting puzh.com
4. Customer account, platform and client portal
5. AI Superfilm and AI processing
6. Connected social media accounts
7. WhatsApp, email and calendar
8. Payments
9. Recipients and processors
10. Transfers outside the EU
11. Retention
12. Security
13. Your rights
14. Cookies and local storage
15. Changes

1. Controller

MONNINGHOFF Labs UG (haftungsbeschränkt)
Wehrstr. 3
48151 Münster
Germany

Represented by its managing director Chris Mönninghoff
Local court (Amtsgericht) Münster, HRB 22312 · VAT ID DE451176103

Privacy contact: datenschutz@puzh.com
General contact: hi@puzh.com

Controller or processor? For the website, your customer account, orders, payments and connected accounts, we are the controller. If a business (for example an agency) uses PUZH to process data of its own clients, contacts or newsletter recipients, that business is the controller and we process the data on its behalf (Art. 28 GDPR). We forward requests concerning such data to the business concerned.

2. Overview

We do not sell personal data, we do not use it for advertising, and puzh.com uses no analytics or tracking tools.

3. Visiting puzh.com

3.1 Hosting and server logs

The website is delivered via Cloudflare Pages by Cloudflare, Inc. (101 Townsend St., San Francisco, CA 94107, USA). When you visit, Cloudflare necessarily processes your IP address, date and time, the requested address, the referring page and browser and operating system details in order to deliver the page and fend off attacks. The legal basis is our legitimate interest in a secure, fast website (Art. 6(1)(f) GDPR).

3.2 Fonts and icons

Our pages load the fonts “Inter” and “JetBrains Mono” from Google Fonts (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland) and icons (“Bootstrap Icons”) via the jsDelivr content delivery network. Your IP address is transmitted to these providers. The legal basis is our legitimate interest in a consistent presentation (Art. 6(1)(f) GDPR). Google’s privacy policy: policies.google.com/privacy.

3.3 Language suggestion on the English site

If you open the English version of the website and have not yet chosen a language, your browser asks the service ipapi.co (Kloudend, Inc., USA) which country you are visiting from. Your IP address is transmitted for this. We only use the country code to suggest the German version to visitors from Germany, and we do not store the IP address. Legal basis: Art. 6(1)(f) GDPR.

3.4 Newsletter and contact form

If you sign up for the newsletter or write to us via the form, your email address and, if provided, your name and message are passed to our platform via a Cloudflare, Inc. service (Cloudflare Workers) and stored there.

• Newsletter: we use double opt-in. You receive an email with a confirmation link; we only send the newsletter after you confirm. We log sign-up and confirmation as proof. The legal basis is your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time via the unsubscribe link in every email or by writing to us.
• Contact requests: we use your details to answer your request (Art. 6(1)(b) or (f) GDPR).

3.5 Sign-up and orders on the website

If you create an account or start an order on puzh.com (for example on the “AI Superfilm” page), your details are sent directly to our platform at app.puzh.com. Section 4 applies.

3.6 Origin of a sign-up

If you arrive at the “AI Superfilm” page via a link with campaign parameters (e.g. utm_source, utm_campaign or an ad click ID such as gclid, fbclid, ttclid, msclkid), the page stores these parameters together with the domain of the referring page (without path) and the landing page in your browser’s local storage (puzh.herkunft). They are only sent to us if you then sign up, together with the sign-up. We use them exclusively to learn how new customers find us. We do not pass them on to advertising platforms. Legal basis: Art. 6(1)(f) GDPR. You can delete the entry at any time by clearing the site data in your browser.

4. Customer account, platform and client portal

4.1 Data

• Account and master data: name, email address, company or brand, role and permissions, language setting.
• Login and security data: login times, IP address, browser identifier, session data.
• Content: everything you or your company create or upload in PUZH, e.g. posts, images, videos, texts, approvals, comments.
• Records: when you accepted which terms, and which permissions you granted and withdrew (time, IP address, browser identifier and the wording you were shown).

4.2 Purposes and legal bases

We process this data to provide the platform and the client portal, carry out your orders and communicate with you (Art. 6(1)(b) GDPR). We process security and log data to prevent abuse and fix errors (Art. 6(1)(f) GDPR). We keep records of consents and permissions to comply with our legal obligations and to be able to prove claims (Art. 6(1)(c) and (f) GDPR).

4.3 Where the platform runs

The platform, its database, our email server and the WhatsApp connection run on servers we operate at netcup GmbH, Emmy-Noether-Straße 10, 76131 Karlsruhe, Germany. Uploaded and generated media files (images, videos, audio) are stored in the Cloudflare R2 object storage of Cloudflare, Inc.

5. AI Superfilm and AI processing

5.1 Data

For an AI Superfilm and other AI features we process what you give us for it: photos (including photos of people), logos, product images, texts and messages, voice recordings, as well as your choices (style, character, voice) and your approvals. In addition, we process order data (name, email address, billing details, time of order, the declarations you made before purchase).

5.2 How it is processed

To generate images, scenes, voice, subtitles and the final film, we send the content needed for each step to specialised AI providers (section 9). They process the content on our behalf to produce the result and return it to us. The legal basis is the performance of your order (Art. 6(1)(b) GDPR).

5.3 Photos and voices of other people

If you upload photos or voice recordings of other people, you must be entitled to do so and have their consent. If you use your own voice, we use it exclusively for your films.

5.4 No training

We do not use your photos, voices, texts or films to train our own AI models, and we do not pass them on for that purpose.

5.5 No automated decisions

We do not make automated individual decisions with legal effect on you (Art. 22 GDPR). Every film is presented to you for approval before production.

6. Connected social media accounts

In PUZH you can connect your own accounts on LinkedIn, Meta (Facebook Pages, Instagram, Threads), Bluesky, TikTok, YouTube, X and Pinterest so that we can publish posts on your behalf. You always connect an account yourself, through the platform’s own login dialog, and decide there which permissions you grant to PUZH.

6.1 Data we receive from the platforms

• the account or profile ID and the name or username of the account,
• the profile picture,
• for Facebook Pages, Instagram business accounts, LinkedIn company pages and YouTube channels, the list of Pages, accounts or channels you give us access to,
• for LinkedIn, the profile’s email address, if you agree to sign in with it,
• access tokens that allow us to act within the permissions you granted,
• the status of posts published via PUZH (published, failed, link to the post) and, where the platform provides them, metrics for these posts, such as views and reactions.

On Facebook and Instagram we do not access private messages, ad accounts or friend lists.

6.2 What we use it for

Exclusively to

• show your connected accounts in PUZH (“Your accounts”),
• publish posts that you, or your agency on your behalf, have approved,
• show the status and metrics of these posts in PUZH.

The legal basis is the performance of our contract with you (Art. 6(1)(b) GDPR). We do not sell this data, do not use it for advertising, do not build profiles from it and do not share it with anyone, except the service providers listed in section 9, which process it only on our behalf, and the platform itself when we publish there on your behalf.

6.3 Connection service provider

For the technical connection to several platforms we use a service provider for connecting social media accounts based in the USA. It stores the access tokens and forwards our posts to the platforms. It processes the data only on our behalf; the transfer to the USA is based on the European Commission’s standard contractual clauses (Art. 46(2)(c) GDPR). Access tokens that we store ourselves are kept encrypted (AES-256-GCM) in our database.

6.4 Retention

We keep the data of a connected account for as long as it is connected. If you disconnect the account or the account subscription ends, we end the connection immediately, stop using the access tokens and have the account, including its access tokens, deleted at our service provider as well (unless you have connected the same account for another brand in PUZH). Posts already published remain on the platform and in your history in PUZH until you delete them there. We keep the record of when you granted and withdrew the connection for as long as claims can be based on it.

6.5 Withdraw at any time

• In PUZH: in the client portal under “Your accounts” → choose the account → “Disconnect”. It is as easy as connecting, and no reason is required.
• On the platform itself: you can also revoke PUZH’s access directly, e.g. on Facebook under Settings & privacy → Settings → Apps and websites, on Google/YouTube at myaccount.google.com/permissions, and on LinkedIn, X, TikTok, Pinterest and Bluesky in the connected-apps section of your account settings.
• Deletion: how to have your data deleted is described on our Data Deletion page.

6.6 The platforms’ privacy policies

The platform operators are responsible for processing on the platforms themselves. Their privacy policies apply:

• Meta (Facebook, Instagram, Threads): facebook.com/privacy/policy
• LinkedIn: linkedin.com/legal/privacy-policy
• TikTok: tiktok.com/legal/privacy-policy-eea
• YouTube: Terms of Service youtube.com/t/terms and Google Privacy Policy policies.google.com/privacy
• X: x.com/privacy
• Bluesky: bsky.social/about/support/privacy-policy
• Pinterest: policy.pinterest.com/privacy-policy

7. WhatsApp, email and calendar

• WhatsApp: if a business connects its WhatsApp number to PUZH, the connection runs through a server operated by us (section 4.3). Messages, senders and attachments are processed there for the business that connected the number; that business is the controller.
• Email: platform emails (e.g. sign-in links, order confirmations, notices) are sent through our own mail server. If you write to us, we process your message to answer it (Art. 6(1)(b) or (f) GDPR).
• Microsoft 365 calendar: if a business connects its Microsoft 365 calendar, PUZH retrieves appointments through the interface of Microsoft Ireland Operations Limited to display them in PUZH.

8. Payments

Payments (e.g. for an AI Superfilm or an account subscription) are handled by Stripe (Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Dublin 2, Ireland). You enter your card or bank details directly with Stripe; we do not receive them in full, only the payment status and the details required for invoicing and accounting. Stripe also processes data for fraud prevention as a controller in its own right: stripe.com/privacy. Legal basis: Art. 6(1)(b) and (c) GDPR.

9. Recipients and processors

We only share personal data where necessary for the purposes described. We have data processing agreements under Art. 28 GDPR with our processors.

Beyond this, we only share data where we are legally required to (e.g. with tax authorities).

10. Transfers outside the EU

Some of the recipients listed are based outside the EU/EEA, mainly in the USA, or process data there. We only transfer data there if there is an adequacy decision by the European Commission (for the USA: the EU-U.S. Data Privacy Framework, where the recipient is certified under it, Art. 45 GDPR) or if the European Commission’s standard contractual clauses have been agreed with the recipient (Art. 46(2)(c) GDPR). You can request a copy of the safeguards at datenschutz@puzh.com.

11. Retention

12. Security

All connections to puzh.com and app.puzh.com are encrypted with TLS. Access tokens and keys are stored encrypted (AES-256-GCM). Data of different customers is kept separate in the database, and only authorised persons have access. Nobody can guarantee absolute security; we keep our measures in line with the state of the art.

13. Your rights

Under the GDPR you have the right to

• access (Art. 15),
• rectification (Art. 16),
• erasure (Art. 17),
• restriction of processing (Art. 18),
• data portability (Art. 20),
• withdraw consent with effect for the future (Art. 7(3)).

Right to object (Art. 21 GDPR): where we process data on the basis of our legitimate interest (Art. 6(1)(f) GDPR), you may object at any time on grounds relating to your particular situation.

Write to datenschutz@puzh.com. We respond within one month (Art. 12(3) GDPR).

Right to lodge a complaint: you can complain to a data protection supervisory authority. The authority responsible for us is:

Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW)
Kavalleriestr. 2–4
40213 Düsseldorf, Germany
www.ldi.nrw.de

Obligation to provide data: for a customer account, an order or a connected account we need the data named for it; without it we cannot perform the contract. Beyond that, you are not obliged to provide data.

14. Cookies and local storage

The website sets no analytics or advertising cookies. It stores your language choice (cookie puzh_lang_preference, 365 days), light/dark mode and display settings in your browser’s local storage and, on the “AI Superfilm” page, the origin of a sign-up (section 3.6). The platform at app.puzh.com sets strictly necessary cookies for sign-in and security. Legal basis: § 25(2) no. 2 TDDDG and Art. 6(1)(b) or (f) GDPR. Details: Cookies.

15. Changes

We update this privacy policy when our services or the law change. The version published here applies.

Last updated: 29 September 2026