Regensbot

Privacy notice

This privacy notice covers the Regensbot app (app.regensbot.de and the test environment staging.regensbot.de), Regensbot's MCP endpoint and the website regensbot.de with its "Deep Audit" request form. Regensbot is a product of Ibram & Dawwa GmbH. As of October 2026.

This is a translation; the German Datenschutzerklärung is binding.

In short: we use no tracking and no analytics tools. The app uses exactly one strictly necessary cookie, the website none. Our servers are in Frankfurt am Main.

Controller and contact

The controller is:

Ibram & Dawwa GmbH
Johanna-Kinkel-Straße 1+2
93049 Regensburg
Germany
Represented by
Ibrahim Anjro (managing director)
E-mail
info@ibramdawwa-gmbh.de
Phone
+49 1575 1702770
Register court
Amtsgericht Regensburg, HRB 21570

We have not appointed a data protection officer because the law does not require us to. For all privacy questions and for requests under Art. 15 to 22 GDPR, please write to info@ibramdawwa-gmbh.de. The management handles them directly.

When we are controller and when processor

We act in two roles.

Website regensbot.de

No cookies, no analytics

The website regensbot.de sets no cookies and stores nothing in your browser. We use no analytics or tracking tools. Fonts are served from our own server. Your browser does not connect to third-party servers.

Server logs

Data
On every request our web server processes technical details, in particular your IP address, date and time, the page requested, the HTTP status code, the amount of data sent and your browser's identifier (user agent).
Purpose
Delivering the website, analysing errors and defending against attacks.
Legal basis
Art. 6(1)(f) GDPR. Our legitimate interest is a secure and stable website.
Retention
We delete the logs after 14 days at the latest. Longer only if a specific security incident must be investigated, and only for as long as that takes.

Deep Audit request

Data
Name, e-mail address, company, website, approximate number of pages, accesses offered (for example Search Console or server logs), preferred language and your message. To protect against spam we also store technical details: time, language and path of the page, a shortened IP address (for IPv4 the first three of four blocks, for IPv6 the first three of eight blocks), your browser's identifier and how long filling in the form took.
Purpose
We answer your request and prepare a possible offer. The technical details serve to detect spam and abuse.
Legal basis
Art. 6(1)(b) GDPR (request before a contract) where you yourself become our contracting party. If you act for a business, Art. 6(1)(f) GDPR; our legitimate interest is answering requests from businesses and preparing offers. For spam detection Art. 6(1)(f) GDPR; our legitimate interest is a form that is not abused. The checkbox in the form only confirms that you have read this information. It is not consent.
Disclosure
We store the request on our server in Frankfurt am Main and send it by e-mail over a TLS-encrypted connection to our mailbox info@ibramdawwa-gmbh.de. The e-mail goes through Google Workspace (see Recipients). Requests detected as spam or duplicates are stored with a flag and not forwarded.
Retention
If no contract results, we delete your request at the latest 12 months after our last message to you. Requests flagged as spam or duplicates are deleted after 30 days. If a contract results, the statutory retention periods apply. To limit the number of requests we derive only hashed check values from your full IP address and your details. They are kept in memory only and expire after 10 minutes or 24 hours respectively.

For the Deep Audit itself we conclude a separate data processing agreement and a non-disclosure agreement before any access to your systems.

Contact by e-mail or phone

When you write to us or call us, we process your contact details and your concern in order to reply. The legal basis is Art. 6(1)(b) GDPR where a contract is concerned to which you yourself are or will be a party. If you act for a business or no contract is concerned, Art. 6(1)(f) GDPR applies (our interest in answering enquiries). We delete the data once the enquiry has been dealt with and no statutory retention duties apply.

Regensbot app and MCP endpoint

Regensbot is offered only to businesses within the meaning of § 14 BGB, including on the Free plan. We are the controller for all processing in this section.

Account and sign-up

Data
E-mail address, password (only as an Argon2id hash, never in plain text), optionally your name, language, time of e-mail confirmation, time of last sign-in and of last password change, account status and the number of failed sign-ins. Also your organisations (name, kind, plan) and your role in them.
Purpose
Providing Regensbot to you.
Legal basis
Art. 6(1)(b) GDPR where you yourself are our contracting party. Where you act for a business that uses Regensbot, Art. 6(1)(f) GDPR; our legitimate interest is providing that business with its staff's accounts.
Retention
We delete an unconfirmed account 7 days after sign-up. If you delete your account, we block it at once and delete it permanently after 30 days. The same applies to organisations of which you are the only member.

Sign-in, sessions and security

Data
For every session we store a hash of the session key, times, the shortened IP address (see above) and your browser's identifier (at most 256 characters). We log security-relevant events with time, internal ID, kind of event (for example a failed sign-in or a new API key) and shortened IP address. This log never contains passwords, keys or full e-mail addresses. To limit requests we count attempts per shortened IP address or per hash of your e-mail address.
Purpose
Secure sign-in and protection against abuse, account takeover and attacks. After 100 failed sign-ins in a row we lock the account and inform you by e-mail.
Legal basis
Art. 6(1)(b) GDPR for the session itself. For the other details Art. 6(1)(f) GDPR; our legitimate interest is the security of your account and of our service (see also Art. 32 GDPR).
Retention
A session ends after 30 minutes without activity and after 12 hours at the latest. We delete it 7 days after it ends. We delete counters for request limits at the latest two days after their time window begins. We do not delete security events automatically at present. They contain only an internal ID, the kind of event, the time and the shortened IP address. They remain after your account is deleted, but contain neither your name nor your e-mail address.

Check for known passwords

When you choose a new password, we check whether it appears in known data breaches. Our server computes a SHA-1 hash of the password and sends only its first 5 characters to the "Have I Been Pwned" service (Pwned Passwords). Your password, your e-mail address and your IP address do not leave our server. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is protecting your account.

Teams and invitations

Data
Owners and admins of an organisation can invite other people by e-mail address. We store the e-mail address, the intended role, who invited and when the invitation expires. The invited person's data therefore come from the person who invites.
Purpose
Teamwork within an organisation.
Legal basis
Art. 6(1)(f) GDPR; our customer's legitimate interest is adding its staff. Once the person accepts the invitation, Art. 6(1)(b) GDPR applies.
Retention
An invitation is valid for 7 days. We delete it one day after it is accepted or expires.

API keys and connections of AI assistants (MCP)

Data
For API keys: name, organisation, who created it, the last 4 characters, permissions, expiry date, last use and, where applicable, revocation. We store the key itself only as a hash. If you connect an AI assistant (for example Claude or ChatGPT) through our MCP endpoint, we store the details of the connected program, for automatic registration also the shortened IP address, and your grant (who, for which organisation, with which permissions, last use). We store codes and access tokens only as hashes.
Purpose
Access to Regensbot from your own programs and AI assistants.
Legal basis
Art. 6(1)(b) GDPR.
Retention
A revoked API key loses its hash at once. The other key details remain until the organisation is deleted. Sign-in codes are valid for 120 seconds, access tokens normally for one hour; we delete them one day after they expire. Refresh tokens expire after 30 days without use and after 180 days at the latest; we delete them one day after that maximum period. Your grants remain stored as a record until your account is deleted. We delete a registered program without a grant after 24 hours and an unused one after 90 days.

What your AI assistant retrieves from Regensbot is processed by its provider under your own contract with that provider. You choose this provider yourself. It is not our processor. Under "Apps" in your account you can see every connected program and disconnect any of them yourself at once. If you delete your account, we disconnect all connected programs.

E-mails

Data
Your e-mail address, kind and language of the message, content and time of sending.
Purpose
We send only messages that belong to the service: for example confirmation and password links, invitations, security notices, payment notices and messages about audits, crawls and deadlines. We send no newsletters or advertising. The sender is noreply@regensbot.de; sending runs through Google Workspace (see Recipients) over TLS-encrypted connections.
Legal basis
Art. 6(1)(b) GDPR; security notices also Art. 6(1)(f) GDPR (protecting your account).
Retention
Content such as one-time links is kept encrypted until sending and deleted after successful sending. The content of messages that could not be sent even after several attempts currently remains stored in encrypted form. Confirmation links are valid for 24 hours, password reset links for 30 minutes. We do not delete the sending record (recipient address, kind and language of message, time) automatically at present. It remains after your account is deleted; this also applies to the addresses of invited people.

Server logs of the app

Data
Our web server logs your full IP address, time, request method, path requested without parameters, status code, amount of data, response time and your browser's identifier; on errors, its error log may also contain the full address. The application logs IP address, request method and path. Secret values in the address such as keys, codes, passwords or e-mail addresses are replaced by "redacted".
Purpose
Operation, error analysis and defence against attacks.
Legal basis
Art. 6(1)(f) GDPR; our legitimate interest is secure and stable operation.
Retention
We delete the logs after 14 days at the latest. Longer only if a specific security incident must be investigated, and only for as long as that takes.

Record of your privacy requests

When you download your data or delete your account, we store the kind, status and times of this request with an internal ID, but without name or e-mail address. This lets us prove that we fulfilled the request (Art. 6(1)(c) GDPR in conjunction with Art. 12 and Art. 5(2) GDPR). We do not delete this record automatically at present. It contains only the internal ID and the kind, status and times of the request.

Cookies

The app sets exactly one cookie: __Host-rb_session. It contains a random key and is valid for at most 12 hours. It keeps you signed in and protects forms against forged requests (CSRF). Before sign-in it only carries this protection for the sign-up and sign-in forms. The cookie is sent only over encrypted connections and cannot be read by scripts.

This cookie is strictly necessary. No consent is required for it (§ 25(2) no. 2 TDDDG). We base the subsequent processing on Art. 6(1)(b) and (f) GDPR. We use no other cookies, no local browser storage, no analytics tools, no third-party scripts and no third-party fonts. That is why we show no cookie banner.

Payment through Stripe

Data
When you book a paid plan, we send Stripe the owner's e-mail address, the organisation's name (for a personal organisation your name or the part of your e-mail address before the @), the preferred language and our internal ID of the organisation. Stripe collects the billing address, the VAT identification number and the payment details (for example card or SEPA direct debit) directly from you. We do not store card data or invoices. We store the Stripe customer ID, the plan booked, the subscription status, periods, the status of the latest invoice and the messages Stripe sends us about the subscription.
Purpose
Concluding and running your subscription, payment, calculating VAT (Stripe Tax) and managing it through Stripe's customer portal.
Legal basis
Art. 6(1)(b) GDPR. For keeping invoices Art. 6(1)(c) GDPR in conjunction with § 147 AO and § 257 HGB.
Retention
Messages from Stripe: content 30 days, record 90 days. Subscription data until the organisation is deleted. We keep invoices and accounting records for the statutory periods of up to ten years.

Stripe Payments Europe Ltd. (Ireland) processes the payment on our behalf. For its own statutory duties, such as preventing fraud and money laundering, Stripe is itself the controller. Stripe's privacy information applies to that.

Data we process on behalf of our customers

Our customer is the controller for the following processing. We act only on its instructions and on the basis of the data processing agreement. The customer needs its own legal basis for these data. If you are a data subject with questions or want to exercise your rights, please contact the customer. If your request reaches us, we pass it on to the customer and support it.

Server logs of the customer's website

Customers can send us their website's server logs so that we analyse crawler visits. By default our command-line program filters the logs on the customer's own machine. Only lines from known crawlers whose address is on the crawler's published address list reach us in full. Visitor requests are first reduced to response times per day, host and page type; their lines do not reach us.

Only if unfiltered logs are expressly switched on do complete lines reach us, with visitors' IP addresses, browser identifiers, requested addresses, referring pages and times. We analyse them in one pass and delete them afterwards, at the latest 24 hours after arrival. They are not included in our backups.

We permanently store only daily totals (count, data volume, response times per host, page type, crawler and status code), first-seen addresses and alerts. We never store visitors' IP addresses or browser identifiers. We check by DNS lookup whether a request really comes from a crawler. We remember confirmed crawler addresses for 7 days and unconfirmed ones only as a hash for 24 hours.

Google connection

Connecting Google is optional. Owners or admins of an organisation set it up themselves and grant Regensbot access at Google. Regensbot only reads; it changes nothing in your Google accounts.

Permissions
Your identity (openid, email), read access to Search Console and, only if you choose so, read access to BigQuery and access to Merchant Center. For Merchant Center, Google only grants a permission that would also allow changes; Regensbot uses it for reading only.
What we read
Your Search Console properties, URL inspection results, search analytics data with search queries, page and country, samples of products and issues from Merchant Center and aggregated values from BigQuery. BigQuery queries run in your own project with your grant.
What we store
The Google account ID and e-mail address of the person who connects (to show which account is connected), the permissions granted and the access tokens. We store the tokens encrypted with AES-256-GCM.
Retention
Search analytics data 24 hours, at most 7 days. Merchant Center samples 30 days. Properties and URL inspection results until the connection is removed or the website or organisation is deleted.
Revocation
You can disconnect at any time in Regensbot. We then delete everything we read through this connection and withdraw the access at Google, unless the same Google account is still connected to another Regensbot organisation. You can also revoke the access in your Google account.

Regensbot's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We do not use data from Google APIs to develop, improve or train AI models, and do not pass them on for that purpose.

We manage the access tokens as controller (Art. 6(1)(b) GDPR). We process the data read as the customer's processor.

Optional AI review

Regensbot can have individual content reviewed by an AI model from Anthropic. This feature is switched off by default. It runs only if we have enabled it for Regensbot and the customer expressly switches it on for a website. The free plan includes no AI reviews.

What is sent
Excerpts of the text of the page under review, structured details such as headings and alternative texts and, for some checks, images, for example images of the page or uploaded Search Console screenshots.
What we store
Kind of check, model used, amount of data processed and the result with reasoning and verbatim quotes. We store no more page text than these quotes.
Retention
Until the organisation is deleted, even if the website is deleted earlier.
Role
We act on behalf of the customer. Anthropic is then our sub-processor (see Recipients). The AI review is based on the customer's instruction, not on consent.
Anthropic
Under its commercial terms, Anthropic does not use the data to train its models and keeps inputs and outputs only for the period stated in its Data Processing Addendum.

Information for operators of audited websites

This section is for people whose public web pages a Regensbot customer has audited and for people named on such pages (Art. 14 GDPR).

Who fetches
Our crawler identifies itself as RegensbotBot/1.0 (+https://app.regensbot.de/bot). Some checks repeat a request with Googlebot's identifier to compare what Google sees.
Source of the data
Publicly accessible web pages whose address a customer enters.
What we store
For an audit of a single page only the results and short evidence, in which we make e-mail addresses and phone numbers unreadable. For crawls of a website, among other things, titles, descriptions, link texts and author details as they appear on the pages. For rendering, a rendered copy of the page and screenshots, only if the check found a problem or a confirmation is pending (otherwise deleted after 2 days at the latest). Rendering is not in operation at present.
Scope
In crawls we fetch at most one page per second. If the customer has not proved that it operates the website, only one manual crawl of at most 25 pages per month is possible, at most one page every two seconds.
Purpose
Technical checks of public pages, for example of how well search engines can find them.
Legal basis
For the fetching and the results: the customer's legal basis, as a rule Art. 6(1)(f) GDPR. For operating the crawler: Art. 6(1)(f) GDPR; our legitimate interest is a safe, considerate crawler. We store as little as possible.
Retention
As stated in the Retention section for audits, crawls and rendering.

The customer who started the check is responsible for fetching a page and for the stored results; we act as its processor. We are responsible for operating the crawler itself, for example the block list and the fetch limits.

If your robots.txt excludes RegensbotBot with "Disallow: /", it fetches nothing from your host except robots.txt. If you do not want Regensbot to fetch your website, you can also write to info@ibramdawwa-gmbh.de. We can then block your domain for all checks. You also have the rights listed under Your rights, in particular the right to object.

Recipients and transfers to third countries

We pass data only to the following recipients. We have concluded an agreement under Art. 28 GDPR with every processor.

Hostinger International Ltd., Cyprus
Hosting of the app, the database, uploaded files, logs, backups and the website regensbot.de. Processor. The server is in Frankfurt am Main. No transfer to third countries is intended.
Google Ireland Ltd., Ireland (Google Workspace)
Sending our e-mails from noreply@regensbot.de and delivering Deep Audit requests to our mailbox: recipient address and message content. Processor. Google may also have data processed by Google LLC in the USA. Safeguards: agreement under Art. 28 GDPR (Cloud Data Processing Addendum); for transfers to Google LLC: adequacy decision on the EU-U.S. Data Privacy Framework (Art. 45 GDPR), supplemented by EU standard contractual clauses (Art. 46(2)(c) GDPR).
Stripe Payments Europe Ltd., Ireland
Payment processing, tax calculation, checkout and customer portal. Processor, and controller itself for its own statutory duties. Stripe may also have data processed by Stripe, Inc. in the USA. Safeguards for transfers to Stripe, Inc.: adequacy decision on the EU-U.S. Data Privacy Framework (Art. 45 GDPR), supplemented by EU standard contractual clauses (Art. 46(2)(c) GDPR).
Anthropic PBC, USA
Only when the AI review is switched on: text excerpts and images of the pages under review. Sub-processor. Safeguards: agreement under Art. 28 GDPR (Anthropic's Data Processing Addendum); EU standard contractual clauses, Module 3 (processor to sub-processor), Commission Implementing Decision (EU) 2021/914 (Art. 46(2)(c) GDPR). Under its commercial terms, Anthropic does not use the data to train its models and keeps inputs and outputs only for the period stated in its Data Processing Addendum.
Server for rendering pages
Once rendering pages in a browser goes into operation, we will use a separate server for it. We will name its provider here then.
Google (PageSpeed Insights, Chrome UX Report)
For performance measurements we send Google the address of the page under review. We send no details about you.
Google APIs with your grant
We call Search Console, Merchant Center and BigQuery with your own grant (see Google connection). Your own contract with Google applies.
Have I Been Pwned (Pwned Passwords)
Only the first 5 characters of a password hash. No person can be identified from them.
Downloads without personal data
Our server downloads public lists: vulnerabilities (Wordfence), version information from WordPress.org, the published IP addresses of Google's and OpenAI's crawlers and descriptions of AI assistants (claude.ai, chatgpt.com). We send no data about you.
Your own providers
Services you connect to Regensbot yourself, such as your AI assistant, Cloudflare, Amazon S3, Cloudflare R2 or GitHub, are your providers, not our processors.

You can obtain a copy of the EU standard contractual clauses by writing to info@ibramdawwa-gmbh.de. The list of companies certified under the EU-U.S. Data Privacy Framework is at https://www.dataprivacyframework.gov.

Beyond that we pass on data only where the law requires us to, for example to authorities.

Retention

We keep data only for as long as the purpose requires or the law demands. The main periods:

Further periods are given with each processing activity above. Stripe keeps customer, invoice and payment data according to its own periods.

Your rights

You have the following rights against us:

In your account you can download your data yourself as a JSON file and delete your account yourself. For security we ask for your password again. Please send all other requests to info@ibramdawwa-gmbh.de. We reply within one month. If we have doubts about your identity, we may ask for proof.

Where we process data on behalf of a customer, please contact that customer. We support it with your request.

None of our processing is based on consent. There is therefore no consent for you to withdraw.

Right to object under Art. 21 GDPR

You can object at any time. Where we process your data on the basis of Art. 6(1)(f) GDPR, you can object at any time on grounds relating to your particular situation.

We then stop processing the data, unless we demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims.

An informal objection to info@ibramdawwa-gmbh.de is enough. We do no direct marketing.

Complaint to a supervisory authority

You can lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority competent for us is:

Bayerisches Landesamt für Datenschutzaufsicht (BayLDA)
Promenade 18
91522 Ansbach

Further information

Obligation to provide data

You are not legally obliged to give us data. Without an e-mail address and password, however, we cannot create an account. For a paid plan we need the billing address, VAT identification number and payment details. For a Deep Audit request we need name, e-mail address, company, website, number of pages and language; all other details are optional.

No automated decision-making

We make no automated decisions within the meaning of Art. 22 GDPR and do no profiling.

Data security

All connections are encrypted with TLS. We store passwords only as Argon2id hashes and session keys, API keys and access tokens only as hashes. We encrypt Google access tokens and other secrets with AES-256-GCM. We store IP addresses of users and visitors in the database only in shortened form; we store in full only addresses of crawlers confirmed by DNS, for 7 days. Each organisation's data are kept separate from those of other organisations.

Changes

We update this privacy notice when Regensbot or the law changes. The version published here applies. As of October 2026.