Privacy policy

This page explains which personal data we process on radioplattform.eu and audioplattform.eu (our offering for podcasts) – on the websites, in the customer portal and in the admin area –, why, and for how long. The apps, Alexa skills and websites of the radio stations are covered by the privacy policy of the respective station (see Our role as a service provider for stations).

1. Controller and contact

The controller for data processing on radioplattform.eu and audioplattform.eu is:

WebInx
Owner: Benjamin Hartwich
Lanzenberg 10
4492 Hofkirchen im Traunkreis
Austria
Phone: +43 664 9700666
Email: support@webinx.eu

For all privacy questions and requests under section 18, please write to support@webinx.eu. More details are in our legal notice (in German).

2. In short

• The platform runs on our own servers at Hetzner in Germany. We serve fonts and maps ourselves.
• No tracking, no advertising, no analytics services. We only use technically necessary cookies.
• We process data to show you the website, answer requests and run the customer portal including subscriptions and support.
• Some service providers (e.g. for email, payment, transcription of voice messages and AI suggestions) only receive data as far as their task requires. All of them are listed in section 15.
• The respective station is responsible for listener data in apps and on station websites; we only act on its behalf there.

3. Visiting the website

Every time a page on radioplattform.eu (website, portal, admin, forms) is requested, the web server writes a log entry. The connection is encrypted with TLS. Fonts are hosted on our own server; the website loads nothing from Google Fonts, content delivery networks, analytics or advertising services. The same applies to audioplattform.eu: it runs on the same server, and all other addresses there redirect to radioplattform.eu.

Data

IP address, date and time, requested address, status code, amount of data transferred, previously visited page (referrer), browser and operating system

Purpose

Delivering pages, finding errors, detecting and fending off attacks (the server automatically blocks suspicious addresses for a limited time)

Legal basis

Art. 6(1)(f) GDPR – our legitimate interest in secure and stable operation

Recipients

Hetzner Online GmbH (hosting, Germany) as processor

Retention

14 days, after which the logs are deleted automatically

4. Cookies and browser storage

We only use cookies that are strictly necessary for the site to work. No consent is required for these (§ 165(3) Austrian Telecommunications Act 2021 and § 25(2) no. 2 German TDDDG); further processing is based on Art. 6(1)(b) and (f) GDPR.

• radioplattform-session – keeps your session together (e.g. form input, portal login). Expires after 120 minutes of inactivity.
• XSRF-TOKEN – protects forms against forged requests from other sites. Same lifetime as the session.
• remember_web_… – only if you log in to the portal with “Remember me”; valid until you log out, at most around 400 days.
• rp_angemeldet – only after logging in to the portal or admin; contains nothing but “portal” or “admin” (no personal details) so the website can show the way back to the portal instead of “Log in”. Deleted when you log out; otherwise valid until you close the browser or, with “Remember me”, as long as remember_web_….
• The home pages of radioplattform.eu and audioplattform.eu set no cookies. On audioplattform.eu only the request form uses the cookies radioplattform-session and XSRF-TOKEN (set for the domain audioplattform.eu, same lifetime as above).
• In the portal and admin area, your browser keeps display preferences such as light or dark mode and collapsed menus in local storage. This stays on your device.

5. Request form

With the “Request access” form you let us know that you are interested in the platform. We then get in touch and send you an invitation to the portal. The form on audioplattform.eu works the same way; there you enquire for your podcast and give its name, its feed or website and the building block you are interested in instead of station and package. We note which of the two sites the request came from.

Data

Name, email address, name of your station or podcast, preferred package or building block, message; optionally phone number and website or feed; plus IP address and time

Purpose

Answering your request, arranging an appointment, setting up access; the IP address helps us prevent abuse

Legal basis

Art. 6(1)(b) GDPR (steps prior to a contract); IP address: Art. 6(1)(f) GDPR

Recipients

Hetzner (hosting); we send the notification to our inbox via Mailjet

Retention

We delete the IP address after 30 days. If a contract results, the request becomes part of the customer records (term of the contract, then at most 7 years). Otherwise we delete it automatically 12 months after receipt.

6. Contact and support

When you contact us by email or phone, we process your details (name, contact details, content of your message) to handle your request – for customers to perform the contract (Art. 6(1)(b) GDPR), otherwise based on our legitimate interest in answering requests (Art. 6(1)(f) GDPR). We delete the details once they are no longer needed for this purpose and no statutory retention period applies.

7. Customer portal and admin

In the customer portal, radio stations manage their apps, websites and editorial modules. Access is by invitation only. The admin area is reserved for our team.

Data

Name, email address, password (only stored as an encrypted hash), language, role and membership of the customer account, time of email confirmation; invitations (email, role, expiry date); change log (who created, changed or deleted what and when, with IP address – passwords and other secrets are never logged); notifications

Purpose

Logging in, resetting passwords, confirming email addresses, assigning permissions, tracing changes and protecting the account; notifications in the portal and by email

Legal basis

Art. 6(1)(b) GDPR (contract with the customer); for the customer’s staff Art. 6(1)(f) GDPR (providing the agreed accounts); change log: Art. 6(1)(f) and Art. 32 GDPR (security, traceability)

Recipients

Hetzner (hosting), Mailjet (email delivery)

Retention

Invitations are valid for 7 days and are deleted 30 days after expiry or acceptance; password reset links are valid for 60 minutes. User accounts exist until they are removed in the portal or the contract ends. Portal notifications are deleted 90 days after being read, at the latest after 12 months. In the change log we remove the IP address after 90 days and delete entries after 24 months; entries relating to the contract and billing (customer account, package, prices, discounts, store submissions) are kept for 7 years (§ 132 Austrian Federal Fiscal Code).

Whatever customers store in the portal about their stations, listeners and content, we process on their behalf (see section 14).

8. Billing

You take out subscriptions in the portal via Stripe Checkout. You enter your card or account details directly at Stripe; we never see them. Invoices are issued and sent by our own accounting system.

Data

Company, address, contact person, billing email address, VAT ID, booked package and modules, prices and discounts; from Stripe we receive the customer and subscription ID and the payment status

Purpose

Taking out and changing subscriptions, collecting payments, issuing invoices and credit notes, accounting

Legal basis

Art. 6(1)(b) GDPR (contract); Art. 6(1)(c) GDPR (tax and commercial retention obligations)

Recipients

Stripe Payments Europe, Limited (Ireland). Stripe processes payment data partly as an independent controller, e.g. for fraud prevention and legal obligations; transfers to the USA are possible (EU-US Data Privacy Framework, standard contractual clauses). Details: stripe.com/privacy

Retention

Invoices and accounting records 7 years (§ 132 Austrian Federal Fiscal Code), other contract data until the end of the contract and the statutory periods

9. Bugs & wishes

In the portal you can send us bugs, wishes and questions – as text, with screenshots or as a voice message. This is a function of the platform itself; we cover the costs.

Data

Text, type of report, page you sent it from, screenshots (up to 8), voice message and its transcript, name and email address, replies in the thread, classification by the AI

Purpose

Handling and answering reports and sorting them by urgency

Legal basis

Art. 6(1)(b) GDPR (support as part of the contract) or Art. 6(1)(f) GDPR (improving the platform)

Transcript

Voice messages (up to 10 minutes) are transcribed automatically. For this, the recording is sent to OpenAI Ireland Ltd.; the provider processes it only to create the transcript on our behalf, does not use it for training and keeps it for at most 30 days for abuse monitoring. Processing may take place in the USA (EU standard contractual clauses).

AI classification

Text and transcript are sent to the Claude language model by Anthropic. It suggests a title, area, urgency and a short summary – as an aid for our team, not for training the model. Anthropic processes the data in the USA (EU standard contractual clauses) and deletes inputs and outputs after 30 days.

Retention

Screenshots and voice messages are deleted 90 days after the report is closed (resolved or rejected); the report including its thread and transcript 24 months after it is closed. Open reports are kept until they are closed. Files are only stored on our server.

10. AI functions in the portal

Some editorial modules offer AI suggestions, for example for studio and web texts, quiz questions, programme planning, traffic and weather texts or AI editing. For this, the necessary texts (e.g. templates, reports, transcripts – never passwords) are sent to the Claude language model by Anthropic Ireland, Limited. The results are suggestions; only what the editorial team confirms or approves is used. The data is not used for training. The station decides which content this is; we process it on its behalf (Art. 28 GDPR, data processing agreement). Anthropic processes the data in the USA on the basis of the EU standard contractual clauses and deletes inputs and outputs after 30 days.

11. App builds and stores

We build and publish the stations’ apps. Only little personal data is involved:

• Review account: for the review by Apple and Google we hand over the login of a test listener account created by the station. As contact address we give a general address of the platform.
• Store listings: contain the contact details the station releases for this (e.g. email address); they are public in the store.
• Reviews and crash reports: we fetch reviews (name or nickname, text, stars) and anonymous crash statistics from the stores so that the station can reply and fix problems – on behalf of the station.
• Builds: Codemagic (Nevercode Ltd., United Kingdom) builds the iPhone apps for us on build machines in the USA (standard contractual clauses); app content, signing keys and, where applicable, the review account are processed, but no listener data. The build machine is wiped after every build.

The legal basis is Art. 6(1)(b) GDPR (contract with the station). Recipients are Apple Distribution International Ltd. (Ireland), Google Ireland Limited and Nevercode Ltd. (Codemagic); details in section 15. If a station uses its own developer account at Apple or Google, its own contract with the store applies to that account.

12. Operations and backups

• Monitoring: a watchdog continuously checks services, streams and websites and reports outages by email (via Mailjet) to our administrators. These alerts contain information about the system status, no listener data (Art. 6(1)(f) GDPR).
• Backups: every day we back up the database and files on the server and, over an encrypted connection, to a storage box of Hetzner Online GmbH in Germany. Database backups and deleted or replaced files are kept for 30 days; after that, deleted data is also gone from the backups (Art. 6(1)(f) and Art. 32 GDPR).
• Background jobs: if a background job fails (e.g. sending an email), we keep it for troubleshooting; it may contain names or email addresses and is deleted after 30 days. Sessions expire on their own.

13. Maps and data from other sources

• Maps in the portal (e.g. traffic situation) come from our own server. Displaying them does not connect to any third-party map service.
• Data for programmes and apps – song titles and cover art (MusicBrainz, Cover Art Archive, Apple iTunes, Spotify), weather (German Weather Service via Bright Sky, MET Norway), place search (OpenStreetMap Nominatim), traffic (German federal motorway company) as well as news and podcast feeds – is fetched by our server itself. We only transmit search terms such as title, artist or place, never data of visitors, customers or listeners.
• Font preview while designing the app in the portal: our server fetches the fonts once and delivers them itself. Your browser does not connect to any font service.

14. Our role as a service provider for stations

The respective radio station is responsible for its apps, Alexa skills, station websites and editorial modules. We process listener data (e.g. listener account, messages to the studio, contests, notifications) only on the station’s behalf and according to its instructions (Art. 28 GDPR). To this end, every station concludes a data processing agreement with us in the portal.

What a station’s app and website process is described in its own privacy policy – in the app, on the station website and at radioplattform.eu/datenschutz/<station>. If you are a listener and have a question or want to exercise your rights, please contact the station; if your request reaches us, we will forward it.

Depending on the booked modules, we use the following service providers for this:

• Platform hosting: Hetzner Online GmbH – Germany
• Push notifications (Android): Google Ireland Limited (Firebase Cloud Messaging) – Ireland, USA possible – EU-US Data Privacy Framework, standard contractual clauses
• Push notifications (iPhone): Apple Distribution International Ltd. (Apple Push Notification service) – Ireland, USA possible – EU-US Data Privacy Framework, standard contractual clauses
• Email delivery: Mailjet SAS (Sinch) – France
• Map view: OpenFreeMap – EU – used directly by the app or the station
• Videos in articles: Google Ireland Limited (YouTube) / Vimeo.com, Inc. – Ireland, USA – EU-US Data Privacy Framework – used directly by the app or the station
• Google Analytics in the app: Google Ireland Limited (Google Analytics for Firebase) – Ireland, USA possible – EU-US Data Privacy Framework, standard contractual clauses – used directly by the app or the station
• Alexa skill: Amazon Europe Core S.à r.l. (Alexa) – Luxembourg, USA possible – EU-US Data Privacy Framework, standard contractual clauses – used directly by the app or the station
• Cloud transcription: Cantab Research Ltd. (Speechmatics) – United Kingdom (processing in an EU data centre) – EU adequacy decision (United Kingdom)
• Cloud transcription: AssemblyAI, Inc. – USA (processing in an EU data centre) – standard contractual clauses, storage in the EU
• Cloud transcription: OpenAI Ireland Ltd. – Ireland, USA – standard contractual clauses
• AI tools (AI editing): Anthropic Ireland, Limited (Claude) – Ireland, USA – standard contractual clauses
• AI text functions (editorial): Anthropic Ireland, Limited (Claude) – Ireland, USA – standard contractual clauses
• Anthropic Ireland, Limited (Claude) – Ireland, USA – standard contractual clauses
• Anthropic Ireland, Limited (Claude) – Ireland, USA – standard contractual clauses
• Anthropic Ireland, Limited (Claude) – Ireland, USA – standard contractual clauses
• Google Ireland Limited (YouTube) – Ireland, USA possible – EU-US Data Privacy Framework, standard contractual clauses – used directly by the app or the station
• Podigee GmbH – Germany – used directly by the app or the station
• Sound enhancement (AI editing): Auphonic GmbH – Austria (servers in Germany)
• Auphonic GmbH – Austria (servers in Germany)
• Speech synthesis (AI reports): Eleven Labs Inc. (ElevenLabs) – USA – EU-US Data Privacy Framework, standard contractual clauses
• Speech synthesis (AI reports): Google Ireland Limited (Google Cloud Text-to-Speech) – Ireland, USA possible – EU-US Data Privacy Framework, standard contractual clauses
• Anthropic Ireland, Limited (Claude) – Ireland, USA – standard contractual clauses
• Eleven Labs Inc. (ElevenLabs) – USA – EU-US Data Privacy Framework, standard contractual clauses
• Eleven Labs Inc. (ElevenLabs) – USA – EU-US Data Privacy Framework, standard contractual clauses
• Eleven Labs Inc. (ElevenLabs) – USA – EU-US Data Privacy Framework, standard contractual clauses
• Google Ireland Limited (Google Cloud Text-to-Speech) – Ireland, USA possible – EU-US Data Privacy Framework, standard contractual clauses
• Auphonic GmbH – Austria (servers in Germany)
• Mailjet SAS (Sinch) – France
• Anthropic Ireland, Limited (Claude) – Ireland, USA – standard contractual clauses
• Anthropic Ireland, Limited (Claude) – Ireland, USA – standard contractual clauses
• Meta Platforms Ireland Limited – Ireland, USA – EU-US Data Privacy Framework, standard contractual clauses – used directly by the app or the station
• Meta Platforms Ireland Limited – Ireland, USA – EU-US Data Privacy Framework, standard contractual clauses – used directly by the app or the station

15. Recipients and third countries

We only pass on data as far as necessary for the purposes described. Our service providers process it on our behalf (Art. 28 GDPR) unless stated otherwise above. For the platform itself, these are:

Some providers are based in the USA or the United Kingdom or may transfer data there. For the United Kingdom, an adequacy decision of the European Commission applies. For the USA, we rely on the EU-US Data Privacy Framework where the provider is certified, and additionally on the European Commission’s standard contractual clauses (Art. 45 and 46 GDPR). You can request a copy of the safeguards from us.

Authorities only receive data if we are legally obliged to provide it.

16. No automated decisions

We do not make decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you (Art. 22 GDPR). The AI classification of reports only helps our team sort them; AI suggestions in the editorial modules are only used once a person accepts them. We do not create profiles.

17. Do you have to provide data?

For a contract, a portal account and billing we need your name, email address and billing details; without them we cannot set up access. Everything else, such as phone number, screenshots or voice messages, is voluntary.

18. Your rights

You have the right to

• access the data we process about you (Art. 15 GDPR),
• rectification of inaccurate data (Art. 16 GDPR),
• erasure (Art. 17 GDPR) and restriction of processing (Art. 18 GDPR),
• data portability (Art. 20 GDPR),
• object to processing based on our legitimate interest (Art. 21 GDPR) on grounds relating to your particular situation,
• withdraw consent at any time with effect for the future (Art. 7(3) GDPR).

Simply write to support@webinx.eu. You can also change many details yourself in your portal profile.

19. Complaints to the supervisory authority

If you believe that we process your data unlawfully, you can lodge a complaint (Art. 77 GDPR). The authority responsible for us is the Austrian Data Protection Authority, Barichgasse 40–42, 1030 Vienna, Austria, dsb@dsb.gv.at, www.dsb.gv.at. You can also contact the supervisory authority in the country where you live or work. Usually, though, the quickest way is to write to us directly.

Last updated: 27.10.2026. If the platform or the legal situation changes, we will update this policy; the version published here applies. In case of doubt, the German version prevails.