Privacy Policy.
This is an English translation for convenience. The German version is the legally binding original.
Last updated: October 9, 2026
1. Data controller
Erison Zeka, NJUME Studio
Reisstraße 26, 13629 Berlin
Email: hello[at]njume.studio
2. Hosting via Vercel
This website is hosted via Vercel. When you access it, the hosting provider processes technically necessary connection data, in particular IP address, timestamp, requested file, referrer, and browser and device information. This processing serves the secure and reliable delivery of the website. The legal basis is Art. 6 Abs. 1 lit. f GDPR (General Data Protection Regulation).
The service provider is Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA. For transfers to the USA, Vercel states that it relies on appropriate safeguards for international data transfers.
3. Consent and privacy settings
On your first visit, you can accept or decline analytics and conversion measurement separately from Apollo company visitor identification. Your choice is stored in your browser's local storage under the key "njume-consent-v1" so that the prompt does not appear again on every page visit. This storage is necessary to manage your choice. Earlier consent to analytics is not treated as consent to Apollo.
You can change your choice at any time via "Privacy settings" in the site footer. Consent can be withdrawn at any time with effect for the future.
4. Optional web analytics
Only with your consent do we load Vercel Web Analytics. The service helps us evaluate aggregated page views, referrers, and device and browser categories. According to Vercel, Web Analytics does not use cookies and does not create visitor profiles across pages or days.
The legal basis is your consent pursuant to Art. 6 Abs. 1 lit. a GDPR. To the extent that information is stored on or read from your device for this optional measurement, this is additionally based on § 25 Abs. 1 TDDDG (German Telecommunications-Digital-Services-Data-Protection Act). Without your consent, the analytics script is not loaded.
5. Optional conversion measurement (OpenAI Ads Pixel)
Only with your consent do we load the OpenAI Ads Pixel ("oaiq"). It helps us measure whether our ads on OpenAI/ChatGPT lead to page views, content views, or contact inquiries with us, so we can evaluate and improve our ad campaigns. This may transmit your IP address, browser and device information, the page you viewed, and – if you book an intro call – that event (without the plain text of your form entries) to OpenAI.
The service provider is OpenAI, USA. For transfers to the USA, OpenAI states that it relies on appropriate safeguards for international data transfers; further information is available in OpenAI's own privacy policy.
The legal basis is your consent pursuant to Art. 6 Abs. 1 lit. a GDPR. To the extent that information is stored on or read from your device for this purpose, this is additionally based on § 25 Abs. 1 TDDDG. Without your consent, the pixel script is not loaded.
5a. Optional company visitor identification (Apollo)
We load Apollo's website tracker only after you give separate consent. Apollo may process visits to this website, pages viewed, and technical connection data to associate visits with companies. Apollo may set a cookie on your device for this purpose. We use these signals to understand which companies are interested in our services and prioritize appropriate sales activity. Identification of an individual visitor is not guaranteed.
The provider is Apollo.io, Inc., USA. Data may be transferred to the USA. The legal basis is your consent under Art. 6(1)(a) GDPR and, where information is stored on or read from your device, § 25(1) TDDDG. Without separate consent, the Apollo tracker is not loaded.
6. Appointment booking and contact inquiries
On the contact page you can book a free intro call. We process the data you provide in order to set up the appointment and hold the call: name and email address (required), optionally company or website, the service area you are interested in and a short message, plus the selected time slot and your confirmation of this privacy policy. Please do not submit particularly sensitive data.
To prevent abuse (spam, automated multiple bookings) we briefly process your IP address. The legal basis for this is Art. 6 Abs. 1 lit. f GDPR.
The legal basis for the remaining processing is Art. 6 Abs. 1 lit. b GDPR for pre-contractual communication and, where necessary, Art. 6 Abs. 1 lit. a GDPR. Details from appointments and inquiries that are not pursued further are deleted as soon as they are no longer required for processing and no statutory retention obligations apply. You can cancel a booked appointment at any time via the link in the confirmation email.
7. Google Calendar and Google Meet
We use Google Calendar and Google Meet for scheduling and the video call. When you book, an appointment is created in our calendar containing your name, email address and details, and a Google Meet video room is generated automatically. This data is transmitted to Google in the process. If you join the video call, Google processes further data (e.g. connection, usage and content data such as audio and video).
The service provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; a transfer to Google LLC in the USA is possible. According to Google, it relies on appropriate safeguards for this (including EU standard contractual clauses and certification under the EU-US Data Privacy Framework). The legal basis is Art. 6 Abs. 1 lit. b GDPR (holding the call you requested) and Art. 6 Abs. 1 lit. f GDPR (efficient, reliable scheduling).
8. Email delivery via Resend
We use Resend for the technical delivery of inquiries, appointment confirmations, portal access and booking messages. The relevant data is transmitted to Resend and delivered as an email to you or to NJUME. The service provider is Resend Inc., USA. The transmission serves to process your inquiry or purchase and provide the relevant confirmation or portal access (Art. 6(1)(b) GDPR).
9. Externally loaded fonts and media
The website loads fonts from Google Fonts. In doing so, your IP address may be transmitted to Google. The service provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Individual pages may also load videos via an external CDN provider. This technically requires your IP address to be transmitted to the respective provider.
The legal basis is Art. 6 Abs. 1 lit. f GDPR. Our legitimate interest lies in a consistent presentation and the provision of the intended media content. A local delivery of the fonts should be reviewed at the time of the final domain switch.
10. No newsletter sign-up
This website does not currently offer a newsletter. Email addresses from project inquiries are not used for promotional messages.
11. Your rights
Subject to the statutory requirements, you have rights of access, rectification, erasure and restriction of processing (Art. 15–18 GDPR). Data portability applies under the conditions of Art. 20 GDPR, in particular to data you have provided that we process automatically based on consent or a contract.
Where processing is based on Art. 6(1)(f) GDPR, you may object on grounds relating to your particular situation (Art. 21 GDPR). You may object to processing for direct marketing at any time. Consent can be withdrawn with effect for the future; this does not affect the lawfulness of processing before withdrawal. Contact hello@njume.studio to exercise your rights.
You can also lodge a complaint with a data protection supervisory authority. The competent authority is, in particular, the Berlin Commissioner for Data Protection and Freedom of Information (Berliner Beauftragte für Datenschutz und Informationsfreiheit).
12. Updates
This privacy policy will be updated whenever the services used or statutory requirements change.
8a. Socialme: accounts, content and purchases
Connections and functions you use
When you connect a social media account to Socialme, you initiate sign-in and authorisation with the relevant platform provider. We receive the account identifiers and display names made available for the connection, any available accounts or Pinterest boards, the granted permissions, and technical access tokens with their validity information. These data allow us to identify your account and provide the connection, publishing and analytics functions you use. Access tokens are stored encrypted on the server and are not included in the normal connection display.
For drafts and publishing, we store your text and uploaded media, selected destination accounts and publishing settings, scheduling times, approvals, processing statuses and technical result or error messages. For an approved publication, we transmit the necessary content and settings to your selected platform, such as TikTok or Pinterest. Time-limited, signed links may be used to retrieve media. Expiry of such a link does not delete the stored file.
If you use available analytics or inbox functions and the platform grants the required permissions, we also process the account and post metrics it provides, as well as comments or messages with their sender identifiers, content, timestamps and reply status. These data come from the connected platform. Approved replies are transmitted to the relevant platform. Connecting an account does not by itself mean that every function is available.
Purposes and legal bases
Account management, requested connections, purchased functions and payment processing serve the performance of our agreement with you or steps taken at your request before a contract (Art. 6(1)(b) GDPR). For business contacts who are not themselves parties to the contract, our legitimate interest is communicating and administering the business relationship (Art. 6(1)(f) GDPR). Necessary security and error data help protect against unauthorised access and ensure reliable processing; this is our legitimate interest under Art. 6(1)(f) GDPR. Legally required retention is based on Art. 6(1)(c) GDPR. Where optional processing relies on separate consent, Art. 6(1)(a) GDPR applies. Technical OAuth authorisation with the platform provider does not replace assessing the required data protection basis for each purpose.
The information required for access, a connection or a specific publication is needed for that function. We cannot provide the function without it. Your selected content and destination accounts determine the particular request. If your business uses Socialme to process other people's personal data, your own legal basis and any necessary separate data processing agreements must also be considered.
Storage and recipients
The website and its API are provided through Vercel; we also use a server at Hostinger to operate the portal. Portal records, access tokens and stored Socialme media are encrypted on the server. We transmit to the selected social media platforms only the data needed for the function you use. Further processing by the platform is also governed by its own privacy information and your account settings.
Paid Socialme purchases are processed through Stripe. Stripe processes the payment details entered during checkout. NJUME processes the information needed to identify and fulfil the purchase, particularly name, email address, company name if provided, plan, amount and currency, payment and subscription status, and Stripe customer, order and subscription identifiers. We use Resend for portal access and booking messages; the recipient details and content needed for the message are transmitted, including a personal access link where applicable.
Retention, disconnection and deletion requests
Retention depends on the purpose and necessity of the data concerned: an active connection and its permissions for connection data; processing your requests and the portal archive you use for drafts, media and results; investigating a specific error or security incident for technical records. Statutory retention duties and the necessary establishment, exercise or defence of legal claims may justify further retention limited to those purposes. There is no blanket automatic deletion period for all Socialme data.
When you disconnect a Socialme account in “Connections”, its active connection in Socialme is ended. This does not necessarily delete all stored connection data; data from earlier connections may remain. Disconnection does not remove posts already published on the platform or automatically delete your drafts, media or previous activity in the portal. Archiving or expiry of an access link is not complete data deletion either. You can also manage permissions in your account settings with the platform provider. Send access or deletion requests to hello@njume.studio; we review the data concerned and any statutory obligations preventing deletion. Your rights are explained in section 11.