With this privacy policy, we inform you about which personal data we process when you visit beyondo.one, what we use it for and which rights you have.
The key points at a glance
- You can use beyondo without an account, sign-up or newsletter. Only if you rate a provider do we store the details from the form; we never publish your email address.
- Without your consent, we only set technically necessary cookies. Videos from YouTube or Vimeo and, if active, Google Analytics only load after you consent.
- We serve fonts, icons and video thumbnails from our own server. We do not use advertising or social media pixels.
- We count clicks on provider links only as a total per provider and day, without IP address and without cookies.
Controller
OM Network GmbH
Alexanderstraße 9b
70184 Stuttgart
Germany
Managing Director: Morten Ohle
Email: info [at] created21.com
Phone: 015678 / 561390
You will find further details in the Legal Notice. We are not required to appoint a data protection officer. For privacy questions, write to the email address above.
Hosting and server log files
The website runs on a server from Hetzner Online GmbH, Industriestraße 25, 91710 Gunzenhausen, in a data center in Germany. The server is set up and maintained via the service Ploi (Ploi B.V., Netherlands); Ploi has technical access to the server. We have concluded data processing agreements (Art. 28 GDPR) with both providers.
With every request, the web server automatically stores access data in log files:
- IP address of the requesting device
- Date and time of access
- requested address (URL), HTTP status code and amount of data transferred
- Referrer URL (the previously visited page), if your browser transmits it
- Browser type, version and operating system (user agent)
We need this data to deliver the website, find errors and defend against attacks. The legal basis is our legitimate interest in secure and stable operation (Art. 6(1)(f) GDPR). Log files are deleted after 14 days at the latest, unless a security incident still needs to be investigated. The data is not merged with other data.
Cloudflare
Cloudflare's network sits between your browser and our server (Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA). Cloudflare provides the encrypted connection, delivers content faster and protects the website against overload and bot attacks. To do so, Cloudflare processes the connection data of every request, in particular your IP address, the requested URL, the user agent and the time. To detect bots, Cloudflare may set a technically necessary cookie (__cf_bm, lifetime 30 minutes).
The legal basis is our legitimate interest in secure and fast delivery of the website (Art. 6(1)(f) GDPR; for the cookie, § 25(2) No. 2 TDDDG). We have a data processing agreement with Cloudflare. Cloudflare is certified under the EU-US Data Privacy Framework, so transfers to the US are covered by the European Commission's adequacy decision (Art. 45 GDPR); standard contractual clauses also apply. More: cloudflare.com/privacypolicy.
Images and media
Logos, graphics and photos that we upload ourselves are stored in the object storage of UpCloud Ltd (Helsinki, Finland) in a data center in the EU and are delivered from there via media.beyondo.one. When an image loads, UpCloud processes your IP address and request data to transmit the image. We have a data processing agreement with UpCloud. The legal basis is Art. 6(1)(f) GDPR.
Stock images from Unsplash
For some posts and sections, we show stock images from the platform Unsplash (Unsplash Inc., Montréal, Canada). These images are loaded directly from Unsplash's servers (images.unsplash.com) according to Unsplash's requirements. In doing so, your IP address, user agent and the referring page are transmitted to Unsplash and its delivery network. The legal basis is our legitimate interest in an appealing design with license-free images (Art. 6(1)(f) GDPR). For Canada, there is an adequacy decision by the European Commission. More: unsplash.com/privacy.
Fonts and icons
The fonts (Geist and Geist Mono) and all icons are stored on our own server. Your browser does not connect to Google Fonts, Iconify or other third-party providers for them.
Cookies and local storage
Cookies are small text files that your browser stores. Without your consent, we only set or read what is technically necessary for the website or what you have explicitly selected (§ 25(2) No. 2 TDDDG, Art. 6(1)(f) GDPR). Everything else only with your consent (§ 25(1) TDDDG, Art. 6(1)(a) GDPR).
| Name | Purpose | Storage period | Basis |
|---|---|---|---|
| beyondo_consent (cookie) | stores your choice in the cookie banner | 6 months | necessary |
| currency (cookie) | the currency you chose for prices; only set if you choose one | 1 year | necessary |
| nuxt-color-mode (local storage) | your choice between light and dark design | until you delete it | necessary |
| __cf_bm (cookie) | bot detection by Cloudflare | 30 minutes | necessary |
| nuxt-session (cookie) | login to the editorial area, only for our team | session | necessary |
| im_youtube, im_vimeo (cookie) | remembers that you have allowed videos from this provider | 6 months | consent |
| _ga, _ga_* (cookie) | Google Analytics 4, only if active and allowed (see Statistics) | up to 2 years | consent |
Cookie settings and withdrawal
On your first visit, a banner asks which optional content we may load. The banner is part of our website (open-source software, without an external service provider); your choice is only stored in the beyondo_consent cookie in your browser, together with a random identifier, the date and the version of the settings. You can change or withdraw your choice at any time under Cookie settings (also in the footer). Withdrawal takes effect for the future.
Embedded videos (YouTube, Vimeo)
In some posts we embed videos. Instead of the video, you first see a placeholder with a thumbnail. We load the thumbnail via our own server, so no data flows to YouTube or Vimeo yet. Only when you click "Load video" or allow external media in the cookie settings is the video loaded by the respective provider:
- YouTube in extended privacy mode (youtube-nocookie.com), provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Privacy policy: policies.google.com/privacy
- Vimeo with the "Do Not Track" option enabled, provider: Vimeo.com, Inc., 330 West 34th Street, 5th Floor, New York, NY 10001, USA. Privacy policy: vimeo.com/privacy
In doing so, the provider receives your IP address, the referring page and device information, and may use cookies or similar technologies. Data may be transferred to the US; Google and Vimeo are certified under the EU-US Data Privacy Framework. The legal basis is your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG), which you can withdraw at any time in the cookie settings.
Partner links and click counting
beyondo is funded through partner links (affiliate links). Links to providers first lead via an address on our website (/go/…) and from there redirect you to the provider or a partner network. We only increase a counter per provider and day. For this click, we store neither your IP address nor a cookie or identifier, so it is not possible to trace it back to you. The access data in the server log file (see above) is not affected by this.
After the redirect, you are on the provider's website. The provider and, where applicable, the partner network may set cookies there to attribute a later purchase to our link; their privacy policies govern what data they process in doing so. We do not receive any data about you from them, only reports on referred purchases and commissions. The provider is also told which page on beyondo you came from (referrer). The legal basis for the redirect and counting is our legitimate interest in funding our free service (Art. 6(1)(f) GDPR).
Statistics
To understand which pages are used and where we can improve, we may use one or both of the following methods. You can see which methods are active in the Cookie settings: if no "Statistics" category appears there, Google Analytics is not active.
Self-hosted reach measurement without cookies
We may use self-hosted statistics software (for example Plausible Community Edition) that runs on our own servers in the EU. It sets no cookies, stores nothing on your device and creates no user profiles. From the IP address and user agent, only a daily changing, non-reversible checksum is generated to count visits; the IP address itself is not stored. Recorded are the pages viewed, referrers, country, device type and browser, evaluated only in aggregated form. The data does not leave our servers. The legal basis is our legitimate interest in privacy-friendly reach measurement (Art. 6(1)(f) GDPR).
Google Analytics 4 (only with consent)
If we use Google Analytics 4, it only loads after you have agreed to the "Statistics" category in the cookie settings. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google Analytics sets cookies (_ga, _ga_*) and processes usage data such as pages viewed, time on page, referrers, approximate location (derived from the IP address, which itself is not stored), device and browser. Google signals, advertising features and personalized ads are switched off. The data is deleted after 14 months.
Data may be transferred to Google LLC in the US. Google is certified under the EU-US Data Privacy Framework. We have a data processing agreement with Google. The legal basis is your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG). You can withdraw it at any time in the cookie settings; we then delete the Google Analytics cookies in your browser. More: policies.google.com/privacy.
Search, language and currency
Search on beyondo runs on our own server. Search terms are only processed to answer the query and are not stored. We detect the language from the address (e.g. /en/), and the currency from your selection (currency cookie).
Translation of our content
We translate our editorial texts with the support of AI models from Anthropic (Anthropic, PBC, USA). We only transmit our own texts, no data from visitors.
Share links and external links
The share buttons (e.g. WhatsApp, Facebook, X, LinkedIn) are simple links. Only when you click on them does the page of the respective service open, which then processes your data under its own terms. The same applies to all other links to external websites.
Provider reviews
On each provider page, you can share your experience with the provider without an account. For this, we process:
- your star rating (1 to 5), an optional title and your text
- your name, as you enter it; a first name or nickname is enough
- your e-mail address
- the language of the page and the time
- a hash value of your IP address (HMAC with a secret key); we do not store the IP address itself
Purpose: We review every review before it is published. Approved reviews appear on the provider's page with name, stars, title, text and date. Your e-mail address is never published or shared; we only use it to ensure that each address can review a provider only once, and to contact you if we have questions about your review.
Spam protection: Using the hash value of the IP address, we limit the number of reviews per hour; we delete it automatically after 7 days. In addition, the system automatically checks the text for typical spam signs (e.g., links or duplicate texts) and stores such notes about the review. A human on our editorial team always decides whether a review is published. We do not use CAPTCHAs or external services for this, and the form does not set any cookies.
Legal basis: your consent, which you give with the checkbox in the form (Art. 6(1)(a) GDPR). For the hash value of the IP address and the spam check, our legitimate interest is preventing misuse of the form (Art. 6(1)(f) GDPR).
Retention and withdrawal: The data is stored in our database on our server at Hetzner and is not transferred to third parties. We automatically delete the hash value of the IP address 7 days after submission. Rejected reviews and reviews classified as spam are automatically deleted 90 days after the decision or after the automatic classification. We store published and not yet reviewed reviews until you withdraw your consent or request deletion, or until we delete the review. An e-mail to the address above is sufficient; we will then delete your review completely.
Contact
If you contact us by e-mail or phone, we process your details (e.g., name, e-mail address, content of the inquiry) to handle your request. The legal basis is Art. 6(1)(b) GDPR if your inquiry relates to a contract; otherwise, it is our legitimate interest in responding (Art. 6(1)(f) GDPR). We delete the data as soon as the inquiry is resolved and no statutory retention obligations (e.g., for business letters up to six years under § 257 HGB) apply.
Editorial area
The editorial area is accessible only to our team. For login, we store your e-mail address, password hash, role and the time of your last login, as well as a session cookie. If our team connects AI assistants to the editorial system, this is done via a separate login (OAuth). The legal basis is Art. 6(1)(b) and (f) GDPR.
Storage period
We store personal data only as long as necessary for the respective purpose or as long as statutory retention periods require. The specific periods are listed in the individual sections.
Data security
The connection to beyondo is encrypted end to end via TLS (HTTPS). We protect our systems with technical and organizational measures under Art. 32 GDPR, including access restrictions, encrypted connections between our services, and regular updates.
Your rights
You have the right at any time to:
- Access to the data stored about you (Art. 15 GDPR)
- Rectification of inaccurate data (Art. 16 GDPR)
- Erasure (Art. 17 GDPR) and restriction of processing (Art. 18 GDPR)
- Data portability (Art. 20 GDPR)
- Withdrawal of consent given, with effect for the future (Art. 7(3) GDPR), e.g., in the cookie settings
Right to object (Art. 21 GDPR): If we process data on the basis of our legitimate interest (Art. 6(1)(f) GDPR), you may object at any time for reasons arising from your particular situation. We will then no longer process the data, unless we can demonstrate compelling legitimate grounds or the processing serves to assert, exercise or defend legal claims.
For all concerns, an e-mail to us is sufficient. You may also lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The responsible authority for us is the State Commissioner for Data Protection and Freedom of Information of Baden-Württemberg, Lautenschlagerstraße 20, 70173 Stuttgart, baden-wuerttemberg.datenschutz.de.
No automated decisions
We do not make automated decisions within the meaning of Art. 22 GDPR and do not create profiles of visitors. Our provider ratings are based on fixed criteria and concern companies, not you.
Changes
We update this privacy policy when our website or the legal situation changes. The version published here at any given time applies.
Last updated: November 12, 2026