Privacy Policy

1. Controller

The controller responsible for processing within the meaning of the GDPR is:

hy.am studios GmbH
Torstr. 164, 10115 Berlin Germany
Phone: +49 30 26565656
Email: hello@phainos.ai
Website: phainos.ai

2. Registering your interest and lead management

When you submit a contact form, request a walkthrough, leave your email on a report page, or otherwise ask us to contact you, we process the data you provide. Depending on the form or interaction, this may include:

• Name
• Email address
• Company / organisation
• Role or job title
• Message or enquiry details
• The page, report, event, or source that led to the enquiry

We may also process business contact data from professional sources, such as LinkedIn, referrals, events, or publicly available company websites, when we identify a relevant business contact for PHAINOS. In those cases, we record the source and use the data only for business-to-business outreach, relationship management, and relevant follow-up.

Purpose: to respond to your enquiry, manage prospective customer relationships, provide requested information, and send relevant follow-up about PHAINOS, including future reports or brand-specific insights where this is connected to your business interest.

Legal basis: Art. 6 (1)(b) GDPR where processing is necessary to respond to your request or take steps before entering into a contract; and Art. 6 (1)(f) GDPR where we have a legitimate interest in managing B2B relationships, following up with relevant business contacts, and understanding which reports or enquiries generate qualified interest. Where we ask for consent for a specific communication, the legal basis is Art. 6 (1)(a) GDPR.

Storage period: we store this data until your request has been dealt with and you no longer wish to be contacted — at the latest 24 months after our last contact — unless statutory retention obligations require otherwise. You can ask us to delete your data at any time (see Section 8).

You can object to B2B outreach or withdraw consent at any time with effect for the future, e.g. by emailing us at the address in Section 1. This does not affect the lawfulness of processing carried out before the objection or withdrawal. We may keep a suppression record to ensure we do not contact you again.

3. Public reports and creator intelligence data

PHAINOS processes publicly available social-media and web data about athletes, creators, brands, teams, organisations, and public social-media accounts to produce public reports and to provide creator intelligence, campaign measurement, social listening, benchmarking, and reporting tools.

Depending on the report or product feature, this may include:

• Names, aliases, handles, profile URLs, and profile images
• Public account metadata, such as platform, bio information, follower counts, and posting activity
• Public posts, captions, hashtags, mentions, thumbnails, images, videos, and engagement metrics
• Public brand, team, campaign, or partnership references
• Derived metrics and classifications, such as growth rates, engagement rates, content categories, rankings, benchmarks, and other performance indicators

Sources: publicly available social-media profiles, posts, and other public web sources; data provided by our customers for their workspaces or campaigns; and data generated by PHAINOS analysis of those sources.

Purpose: to identify and analyse public social, creator, and cultural signals; produce editorial and market-intelligence reports; help customers discover and evaluate relevant creators or accounts; measure campaign performance; and benchmark public content and audience engagement.

Legal basis: Art. 6 (1)(f) GDPR. We have a legitimate interest in producing social, creator, and cultural intelligence from public professional-context data, and our customers may have a legitimate interest in identifying suitable creators, analysing public content, and measuring campaign performance.

Safeguards: we do not access private messages, private account data, paid reach, or platform-internal metrics. We do not use public report data for biometric identification, and we do not intentionally infer special-category data such as health, religion, political opinions, or sexual orientation. Rankings and scores may be calculated automatically from public metrics or content classifications, but they do not produce legal or similarly significant effects for the individuals concerned.

Storage period: public report outputs may remain available as part of our editorial archive. Underlying snapshots and analysis data are retained only as long as needed for reporting, product functionality, quality control, legal defence, or customer obligations. We review retained public social-media datasets periodically and remove or restrict data when it is no longer needed for those purposes.

If you are a creator, athlete, or other person included in a PHAINOS report or creator intelligence dataset, you may request access, correction, removal, or object to processing by contacting us using the details in Section 1. We will assess the request in accordance with the GDPR and any overriding legitimate grounds that may apply.

4. Customer workspace and campaign data

When customers use PHAINOS workspaces or campaign tools, they may upload, import, or create data about their own users, campaigns, creators, partners, content, reports, and business workflows. Depending on the feature and customer instructions, PHAINOS may act as a processor for the customer or as an independent controller for product operation, security, and improvement.

Customers are responsible for ensuring that they have a valid legal basis for any personal data they upload, import, or instruct us to process. We process customer workspace data to provide the requested product functionality, maintain security, support users, troubleshoot issues, and improve the service.

5. Recipients

To manage your enquiry we use Attio, a customer relationship management (CRM) service provided by Attio, Inc. (United States). Lead and business contact information is stored in our Attio workspace and handled for the purposes described in Section 2. Attio acts as our processor on the basis of a data processing agreement pursuant to Art. 28 GDPR.

As Attio processes data in the United States, this transfer to a third country is safeguarded by the EU Standard Contractual Clauses pursuant to Art. 46 GDPR.

With your consent (see Section 7), we also use PostHog, a product-analytics service provided by PostHog, Inc. (United States), to understand how our pages are used. Our PostHog data is hosted in the EU; where PostHog, Inc. acts as our processor it does so on the basis of a data processing agreement (Art. 28 GDPR), with any transfer to the United States safeguarded by the EU Standard Contractual Clauses (Art. 46 GDPR). Analytics is loaded only after you accept it in the cookie banner, and you can withdraw that consent at any time.

We do not pass your data to any other third parties unless we are legally obliged to do so. We do not sell personal data.

6. Server log files

When you access our website, our hosting infrastructure may process technical data that your browser transmits, such as IP address, browser and device information, referrer URL, requested URL, and date and time of access. This is processed on the basis of Art. 6 (1)(f) GDPR for secure and stable delivery of the website. Application runtime logs are not used for long-term access tracking and are retained only as long as needed for operation, troubleshooting, and security, unless a longer retention period is required by law or configured for security diagnostics.

7. Cookies and analytics

By default we set only technically necessary cookies, which are required to deliver the page and to remember your cookie choice (Art. 6 (1)(f) GDPR, § 25 (2) TDDDG). These do not require your consent.

We use cookie-based analytics (PostHog, see Section 5) only if you accept it in the cookie banner. Until you consent, no analytics cookies are set and no analytics data is collected. Your choice is stored so the banner isn't shown again; you can change it at any time through the Privacy settings link in the footer. Legal basis: your consent under Art. 6 (1)(a) GDPR and § 25 (1) TDDDG.

Separately, on our public website and reports we use a self-hosted, privacy-friendly analytics tool (Umami) to measure aggregate usage such as page views, referrers, and approximate country. Umami runs on our own infrastructure within the EU and does not set cookies or store or access any information on your device, does not create cross-site identifiers, and does not track you across other websites. IP addresses are only processed transiently to derive coarse, non-identifying statistics and are not stored. Because it neither stores nor accesses information on your device, it does not require your consent and § 25 TDDDG does not apply; we use it on the basis of our legitimate interest under Art. 6 (1)(f) GDPR. It is not used within the authenticated product.

Separately from cookie-based website analytics, we may record minimal server-side events when a person submits a lead form, requests a report, or unlocks a gated report. These events are used to understand lead quality, report interest, and the effectiveness of our B2B outreach. They are not based on browser cookies and are processed on the basis of our legitimate interest under Art. 6 (1)(f) GDPR.

8. Your rights

Under the GDPR you have the right to: access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20), object (Art. 21), and to withdraw consent at any time (Art. 7 (3)). To exercise any of these, contact us using the details in Section 1.

9. Additional regional rights

Depending on where you live, you may have additional privacy rights under local laws, such as UK GDPR, the Swiss Federal Act on Data Protection, Brazil's LGPD, Canada's privacy laws, Australian privacy law, Singapore's PDPA, or other applicable regional privacy rules. These rights may include access, correction, deletion, objection, withdrawal of consent, restriction of processing, portability, or the right to complain to a local supervisory authority.

We apply the rights described in this Privacy Policy as a global baseline where practical. If a local law gives you additional rights, you can exercise them by contacting us using the details in Section 1.

10. Right to lodge a complaint

You have the right to complain to a data protection supervisory authority. The authority competent for our registered office is the Berliner Beauftragte für Datenschutz und Informationsfreiheit (BlnBDI), Alt-Moabit 59–61, 10555 Berlin.

11. Changes

We may update this Privacy Policy as the product develops or as legally required. The current version is always available here, with the "last updated" date shown above.