Security & data protection

This page summarises how VirtualCampaign handles your data – for procurement, IT and data-protection officers. The legally binding document is the privacy policy.

• Hosted in Germany: all servers at Hetzner Online GmbH, data centres in Germany (EU).
• No creative storage in the Creative Simulator: the live simulation runs entirely in the browser; the creative file is not uploaded.
• Encrypted transport: every connection uses HTTPS (TLS).
• Data processing agreement (DPA): under Art. 28 GDPR, available on request.
• Cookieless audience measurement: self-hosted on our own servers in Germany, without cookies, without any third party and without persistent recognition. No advertising trackers.

Website and platform run at Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, on servers in Germany. Hetzner operates ISO 27001-certified data centres. A data processing agreement is in place with Hetzner. All stored data is encrypted. Backups are taken as snapshots of the virtual machines under Hetzner's responsibility. Customer data and creatives are not transferred to third countries; the only exception is the platform's optional AI creative generator, which receives nothing but the text prompt (see section 6). The Creative Simulator is not affected.

The Creative Simulator places your creative onto the footage of the advertising surface client-side. In practice:

• The creative file (image or video) stays in the user's browser. For the live simulation it is not transferred to our servers and not stored there.
• Preview and export (video/image) are rendered locally in the browser.
• Only the advertising-surface videos (our content) and the application itself are loaded from the server.
• The creative file stays in the browser's memory only while the tab is open.
• The Creative Simulator stores no data and uses no AI image generation – nothing is sent to AI providers.

Only when you deliberately upload a creative to the platform's media library (for automated productions) is it stored on our servers in Germany – inside your tenant.

• Tenant isolation: data, creatives and productions are strictly separated per tenant. No tenant ever sees another tenant's data.
• Access: personal user accounts with passwords; access via HTTPS only.
• Roles and permissions: three roles inside a tenant – Creator, Lead and Admin. A cross-tenant Superadmin role exists only for VirtualCampaign's DevOps team.
• API: access only with a tenant-bound API key that can be revoked server-side at any time.
• Encryption: every connection (browser, API, iframe embedding) uses TLS; all stored data is encrypted.
• Logging: system logs are kept in anonymised form.
• Your creatives remain yours: uploaded assets stay the customer's property and responsibility. On request we retain them without time limit.
• Deletion: all customer data is deleted 30 days after the contract ends.

Via the contact form you send us your name, company (optional), e-mail address and message. We use this data solely to handle your enquiry. E-mails are sent through IONOS SE (Germany) as our processor. We additionally record which channel brought you to us (e.g. newsletter or LinkedIn) if the link carried that information – without a cookie, only for the duration of your visit in the browser. Details in the privacy policy.

For this website's statistics we use Umami – an open-source tool we run ourselves, on our own servers in Germany. No additional processor is involved and there is no third-country transfer.

• No cookies and no access to information on your device – so no consent under § 25 (1) TDDDG is required (§ 25 (2) no. 2 TDDDG).
• No IP storage: the IP address is only used transiently to derive a non-reversible hash that rotates daily.
• No recognition across days or across websites, no user profile, no sharing.
• Recorded are: page viewed, referring page, country, device type, browser and operating system.
• Legal basis: legitimate interest (Art. 6 (1) (f) GDPR); you may object at any time.

Details in the privacy policy, section 8.

• Hetzner Online GmbH, Gunzenhausen, Germany – hosting (website, platform, Creative Simulator, storage).
• IONOS SE, Montabaur, Germany – sending and receiving e-mail.
• fal.ai (Features and Labels, Inc., USA) – AI creative generator: generates poster creatives from a text prompt using various image models. Applies to the platform only (AI generator in the media library), not to the Creative Simulator. Only the entered prompt and the generation parameters are transmitted – no customer creatives, no user data. Active only when you use AI generation. The transfer to the USA is safeguarded by the EU Standard Contractual Clauses (Implementing Decision (EU) 2021/914), which form part of the data processing agreement with fal.ai.

For use of the platform we conclude a data processing agreement under Art. 28 GDPR with you, including a description of the processing, technical and organisational measures and the list of sub-processors. Simply request it: info@herzbergmedia.com. We are also happy to review your own template.

Found a vulnerability? Write to info@herzbergmedia.com. We confirm receipt within two working days and keep you informed about the fix. Please do not publish details until the issue is resolved.

HERZBERGMEDIA, owner Jens Harald Herzberg – contact details in the legal notice. Your rights as a data subject (access, erasure, objection) are described in the privacy policy.