Privacy Policy

1. Controller

The controller responsible for data processing on this website within the meaning of the General Data Protection Regulation (GDPR) is:

Emanuele Fanizza
Hofsteder Straße 39
44791 Bochum
Germany
Email: Connect@llmstxt.info

2. Principles of data processing

We process personal data only to the extent permitted by law or where you have consented. We collect only the data necessary for the respective purpose (data minimization pursuant to Art. 5 (1)(c) GDPR).

Legal bases we rely on:

• Art. 6 (1)(b) GDPR: performance of a contract (e.g. processing your entry, handling paid services)
• Art. 6 (1)(c) GDPR: compliance with legal obligations (e.g. retention duties under the German Commercial Code/Fiscal Code)
• Art. 6 (1)(f) GDPR: legitimate interest (e.g. website operation, abuse prevention, communication)

3. Server log files

The hosting provider of this website automatically collects and stores information in so-called server log files, which your browser transmits. These are:

• IP address of the requesting device
• date and time of the request
• name and URL of the retrieved file
• amount of data transferred
• browser type and version, operating system, referrer URL

The hosting provider uses this data to ensure the operation and security of the website. We do not merge it with other data sources. According to the hosting provider, the log files are deleted after seven days at the latest, unless they are needed longer to investigate an attack. Legal basis: Art. 6 (1)(f) GDPR (legitimate interest in the secure operation of the website).

4. Contact by email

If you contact us by email, your details (sender address, subject, message content) are stored to process your request. No transfer to third parties takes place. Legal basis: Art. 6 (1)(f) GDPR (legitimate interest in processing your request).

The data is deleted once your request has been fully processed and no statutory retention obligation prevents deletion.

Online withdrawal function: If you use our withdrawal function at llmstxt.info/widerruf, we process the data entered there (name, order/contract number, email address and optional details) solely to process your withdrawal and to send the legally required confirmation of receipt. Legal basis: Art. 6 (1)(c) GDPR (compliance with a legal obligation under § 356a German Civil Code) and (b) (contract performance). The data is deleted after completion of the process, unless a statutory retention obligation applies.

5. Listing form (registration)

When you register your organization via the listing form (/submit/), we collect the following data:

• name of the organization / product
• URL of the llms.txt file
• business category (from a predefined list or custom)
• email address (optional, for queries and notifications)
• chosen listing tier (Standard, Bronze, Silver, Gold, Platinum, Diamond)
• free text / context on the implementation (optional)
• social media and web-presence links (all optional, unlockable depending on the chosen tier): X/Twitter handle, LinkedIn, GitHub, YouTube, Instagram, Facebook, Mastodon, Discord, TikTok, Slack invitation link, newsletter URL, additional website URL

This data is stored in a JSON file on our server and serves the operation of the directory. Publicly visible after activation are: organization name, llms.txt URL, category, tier badge and, depending on the chosen tier, free text, custom category and the social media profiles voluntarily provided by the customer. Email addresses are not published.

Because social media links and profile data are provided voluntarily and for the specific purpose of public presentation in the directory, their processing and publication is based on Art. 6 (1)(b) GDPR (contract performance) in conjunction with the express consent given by using the listing form.

Legal basis: Art. 6 (1)(b) GDPR (contract performance / pre-contractual measures). Data remains stored as long as the entry is active. For deletion requests, contact Connect@llmstxt.info.

5.1 Community entries from public sources

Some directory entries are not created by the owner themselves but by us on the basis of publicly available information (so-called community entries). Factual basic data is processed: name/designation of the website, its publicly reachable address or llms.txt URL, and a category.

In addition, we automatically retrieve the website’s public llms.txt and evaluate it technically (availability, file size, structure, number of sections and links, language). On the detail page we show a short check report and a shortened excerpt from the first section of the file with a source reference. We remove email addresses, phone numbers and postal addresses from this excerpt. The retrieval respects the website’s robots.txt and declared usage reservations (such as Content-Signal or a TDM reservation); if such a reservation exists, we show no excerpt. We store the retrieved file content only internally as a cache. We renew the check report and the cache after 30 days at the latest; if the entry is deleted, both are deleted with it. We also remove the names of people in leading roles (such as “founded by …”) from the excerpt.

Community entries are marked as a “community entry”, are not assigned to a paid tier and are displayed without embedding third-party logos/favicons. Detail pages may be indexed by search engines if they contain enough original content. Entries whose name, domain or file content suggests a natural person (for example a personal website) are excluded from this indexing (noindex). For such entries we also show no excerpt and no links to social media profiles.

The legal basis is our legitimate interest in operating a discoverable industry/topic directory (Art. 6 (1)(f) GDPR). You have the right at any time to object to the processing (Art. 21 GDPR) or to request deletion (Art. 17 GDPR): via the “Remove entry” function on the respective detail page or by email to Connect@llmstxt.info. To prevent abuse, we send a confirmation link to the address provided; only after it is opened is the entry hidden and the domain blocked from future automatic imports. At that point we also delete the cached file content and the check report. Internally we keep a record for each entry of when and how we checked the source. After an objection we keep this record for no more than three years so that we can defend ourselves against claims (Art. 17 (3)(e) GDPR), and then delete it automatically.

5.2 Early Access request

Via the Early Access page (/early-access/) you can request free access. We process: email address (mandatory), website/URL, name, organization/company/brand, the type of presence and an optional free-text description.

The data is stored in a separate file on our server, is not publicly accessible and is used solely to review and process your request. To protect against automated abuse we additionally store a shortened, one-way hashed IP address (last block removed) for one day; no full IP address is retained.

If we approve your request, we create, on the basis of your entry, a publicly visible directory entry, a customer portal account and a free Pro subscription. Access credentials are sent to you in two separate emails; each of them contains a link with which you can revoke everything immediately if the request was not made by you.

Legal basis: Art. 6 (1)(b) GDPR (pre-contractual measures at your request). The additional checkbox documents your consent to being contacted about the request. Retention: requests that are not approved are deleted no later than six months after the decision; for approved requests the data remains stored for as long as the resulting account and directory entry exist. You can request deletion at any time from Connect@llmstxt.info.

6. Payment processing for paid plans

For paid listings (Bronze to Diamond) and one-time add-ons (AI optimization, llms.txt hosting, AI Signal Kit), we process payments via the payment provider Stripe. The provider is Stripe Payments Europe Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland (“Stripe Europe”). When you book a paid plan, you are forwarded to Stripe’s secure checkout page and enter your payment details there directly.

In particular, the following data is processed:

• email address of the payer
• chosen plan and amount
• payment/card data (you enter these exclusively at Stripe; we do not receive them)
• payment confirmation, payment date and a transaction identifier

The legal basis is Art. 6 (1)(b) GDPR (contract performance). Stripe may also transfer data to Stripe, Inc. in the USA. For this transfer to a third country, Stripe relies on the European Commission’s standard contractual clauses and is certified under the EU-US Data Privacy Framework. Details on data processing by Stripe are in Stripe’s privacy policy at stripe.com/privacy.

Payment by bank transfer or PayPal remains possible by individual arrangement; with PayPal, data is then shared with PayPal (Europe) S.à r.l. et Cie, S.C.A.

Retention of invoice and payment data: 10 years pursuant to § 147 AO / § 257 HGB (German Fiscal Code / Commercial Code). Legal basis: Art. 6 (1)(b) GDPR (contract performance) and Art. 6 (1)(c) GDPR (statutory retention obligations).

7. Customer portal

For paid plans (Bronze to Diamond) we provide a password-protected customer portal at /portal/. The following is stored:

• username (email address)
• password (bcrypt-hashed value, no plain text)
• view statistics of your own listing page (page-view counter)
• session data (temporary, only for the duration of the session)

Passwords are stored exclusively as a non-reversible bcrypt hash. Plain-text passwords are not stored permanently anywhere. Legal basis: Art. 6 (1)(b) GDPR.

7.1 Monitoring account (Free/Pro/Premium/API) & API access

For the visibility monitoring (Free, Pro, Premium, API tiers) we maintain an account tied to your email address. Access is passwordless via a one-time link sent by email (magic link). We store: email address, chosen plan tier and billing period, the domains and competitor domains you add for monitoring, the last determined status per domain and, with Stripe payment, the Stripe customer/subscription identifier (no card data, see section 6).

If you book the Premium or API tier, you can generate a personal API key. The key itself is not stored in plain text, only as a non-reversible hash; it is shown to you in plain text once at creation. To enforce the monthly call quota we store anonymous usage counters per key (number of calls per month) and the time of last use. This data is processed solely for contract and abuse control (Art. 6 (1)(b) and (f) GDPR) and is deleted upon revocation of the key or termination of the account.

8. Hosting & infrastructure

This website is hosted by ALL-INKL.COM, Neue Medien Münnich:

ALL-INKL.COM, Neue Medien Münnich
Owner: René Münnich
Hauptstraße 68 · 02742 Friedersdorf, Germany
https://all-inkl.com

Processing takes place exclusively on servers in Germany; according to the provider’s own statements it operates its own data centres in Dresden. No transfer to a country outside the EU/EEA under Chapter V GDPR takes place for the hosting. A data processing agreement pursuant to Art. 28 GDPR exists with ALL-INKL.COM. Legal basis: Art. 6(1)(f) GDPR (secure and reliable operation of this service); towards customers additionally Art. 6(1)(b) GDPR. Further information: all-inkl.com/datenschutzinformationen/

Hosted customer content (llms.txt hosting)

If you book the paid llms.txt hosting, the content you determine (llms.txt and llms-full.txt) is likewise stored and made publicly available on the same infrastructure at ALL-INKL.COM in Germany.

The roles differ from the rest of the service: for the content of those files you are the controller within the meaning of Art. 4(7) GDPR: you determine what they say. We process them on your behalf (Art. 4(8) GDPR), and ALL-INKL.COM is a sub-processor in that chain. Details, the list of sub-processors and your right to object to changes are set out in the data processing agreement.

9. Cookies, analytics & tracking

Cookies

This website sets no tracking cookies and uses no third-party analytics tools (Google Analytics, Matomo or similar). A technically necessary session cookie is set only when you open the customer portal (/portal/) or the monitoring account (/abo/); it keeps you logged in and protects the forms there against misuse. It is limited to the session duration (no expiry date). Other pages only read an existing session and do not set a cookie. Consent is not required pursuant to § 25 (2) no. 2 TDDDG.

Own analytics system (server-side)

To improve our offering, we operate a self-hosted, privacy-friendly analytics system. The data is stored exclusively on our server and is not passed on to advertisers or third parties.

The following data is recorded per page view:

• IP address anonymized (last IPv4 octet set to 0, e.g. 192.168.1.0)
• date, time and weekday of the visit
• page visited
• source type (direct / search engine / social media / referral), source domain (e.g. google.com) and the referring page without parameters (no full referrer URL)
• search term (where derivable from a publicly visible search query, e.g. Google search)
• UTM parameters (if contained in the URL visited, e.g. utm_source)
• device type (desktop / tablet / smartphone), browser, operating system
• browser language (from the Accept-Language header)

In addition, a script on our pages reports the following actions on our own pages, without the content of form fields:

• clicks on external links (target domain only, no full URL)
• clicks on directory entries and their llms.txt files, internal search terms, filters used
• use of the generator, the sign-up form and the portal login (only that it happened)

The script does not read any information from your device (such as screen size, scroll position or time spent on the page) and stores nothing on your device.

All analytics data is automatically deleted after 365 days. Attribution to individual persons is not possible due to IP anonymization. No cross-site tracking and no behavioral profiling takes place.

Legal basis: Art. 6 (1)(f) GDPR (legitimate interest in the anonymized analysis and improvement of our web offering). You can object to this at any time (see section 15).

We do not determine your location via external services.

Local storage in your browser (§ 25 TDDDG)

Beyond the customer portal's session cookie, we store something on your device only where a feature you use requires it:

• your chosen appearance (light/dark) in the customer portal, so it persists on your next visit;
• your own API key or access keys you enter yourself, kept locally in your browser only, so you need not re-enter them. These values are not transmitted to us;
• your consent to the embedded Google search (see section 14), so the prompt does not reappear on every visit.

These are necessary for the feature you expressly requested (§ 25 (2) no. 2 TDDDG) or based on your consent (§ 25 (1) TDDDG). You can delete them at any time in your browser settings. Reach measurement via browser storage (e.g. “new vs. returning visitor”) has been discontinued as of 16 August 2026.

10. AI citation check & AI visibility analysis

On our tool pages (e.g. the “AI citation check”) and in Pro monitoring you can check whether and how a website is named or cited by AI systems. When you start such an analysis, we transmit the domain or query you entered directly to the official application programming interfaces (APIs) of the respective AI providers, which research the web and return the result to us:

• OpenAI (ChatGPT): OpenAI, L.L.C., USA · privacy
• Perplexity: Perplexity AI, Inc., USA · privacy
• Google (Gemini): Google Ireland Ltd. / Google LLC, USA · privacy
• Anthropic (Claude): Anthropic, PBC, USA · privacy

Depending on the configuration, one or more of these interfaces is queried. We no longer use an intermediary service (proxy) for this. Processed are the domain/query you entered and, to limit abuse and cost, your IP address shortened to the last segment (anonymized). You generally do not enter third-party personal data here. The legal basis is Art. 6 (1)(f) GDPR (legitimate interest in providing the analysis function you expressly requested). Where processing takes place in the USA (third country), it is based on the European Commission’s standard contractual clauses pursuant to Art. 46 GDPR or, where certified, the EU-US Data Privacy Framework. Results are cached for a short time to avoid repeated queries. Where we use the free Gemini interface, Google may, according to its own terms, use the transmitted domain or query to improve its products.

10.1 AI optimization and AI-assisted generation of llms.txt files

When you use one of our AI-assisted functions (AI optimization, llms.txt / llms-full.txt generation, AI Signal Kit), the publicly available content of the website you specify is fetched by our server, reduced to text and transmitted together with the domain to Cloudflare, Inc. (USA). There, an open language model (currently gpt-oss-120b) generates the structured file on Cloudflare’s infrastructure (Cloudflare Workers AI) and returns it to us. The model provider receives no data; Cloudflare processes the request on its own network.

Only the content of the specified website and the domain are processed. Your IP address, name and email address are not transmitted. If the specified website contains personal data (e.g. names of contact persons in the imprint or on team pages), this is processed as part of the page content. Cloudflare acts as our processor on the basis of its Data Processing Addendum. According to Cloudflare, inputs and outputs are processed only to answer the request and are not stored permanently (we do not use a Cloudflare storage service for them) and not used to train AI models or to improve Cloudflare or third-party services. At Cloudflare we only store a daily usage counter without content. The legal basis is Art. 6 (1)(b) GDPR (performance of the contract you commissioned) or Art. 6 (1)(f) GDPR (legitimate interest in providing the function you expressly requested). Processing may take place in Cloudflare data centres outside the EU. Transfers to the USA are based on Cloudflare’s certification under the EU-US Data Privacy Framework and, as a fallback, on the European Commission’s standard contractual clauses pursuant to Art. 46 GDPR contained in the Data Processing Addendum.

Storage on our server: We store your order with the source material and the generated files so that you can download them via the link we send you. For orders that have not been paid, we delete source material, contact and billing details after 30 days. For completed orders, we delete source material and generated files 12 months after delivery; invoice and order data are kept for 10 years under statutory retention obligations (§ 147 AO, § 257 HGB).

Protection against misuse: We accept at most 8 orders per hour and, together with the AI Signal Kit, at most 10 orders or kit checks per day from one IP address. For the daily limit we do not store the IP address but a counter under a value computed from the IP address and the date with a secret key (HMAC-SHA-256). The value changes daily and the counters are overwritten the next day. The legal basis is Art. 6 (1)(f) GDPR (legitimate interest in protection against misuse and overload). If the AI service has reached its daily quota, a paid order remains in place and is created automatically as soon as quota is available again.

Note on AI use (EU AI Act): The results of these functions are generated with AI support. The system restructures the content you provide and is instructed not to invent content. Results can nevertheless be incomplete or inaccurate. Please review them before publishing. We visibly label AI-assisted output at the respective function.

11. GEO tips, newsletter & product updates by email

At various points, in particular on our tool pages, you can voluntarily sign up to receive tips on llms.txt/GEO and product updates by email. We use the double opt-in procedure: after you sign up, you first receive an email asking you to confirm the sign-up. Only after your confirmation do we send you further emails.

We process your email address and, to document consent, the time of sign-up/confirmation, your anonymized IP address and the source of the sign-up. The legal basis is your consent under Art. 6 (1)(a) GDPR. You can withdraw at any time via the unsubscribe link in every email or by message to Connect@llmstxt.info; we then remove your data from the distribution list. No transfer to third parties for advertising purposes takes place. Technical sending is carried out via our hosting/email provider (see section “Hosting & infrastructure”).

12. Automatic feature on X (Twitter) from the Gold tier

For customers from the Gold tier, we automatically feature their entry on our X profile (@llmstxtinfo) after successful activation. Information from the entry is published: in particular name/designation, category and short description and, if provided, the X handle you stored (as a mention). This information is already part of your public directory entry.

Publication takes place via the application programming interface (API) of the provider Twitter International Unlimited Company, One Cumberland Place, Fenian Street, Dublin 2, Ireland (for users from the EEA), part of X Corp. based in the USA. A transfer to the USA (third country) may take place. The legal basis is Art. 6 (1)(b) GDPR (performance of the contract concluded with the booked tier). You may object to this automatic feature already at the time of listing (opt-out box in the listing form) or ask us at any time by email to Connect@llmstxt.info to remove a post. Information on data processing by X: x.com/en/privacy.

13. Customer reviews (testimonials)

As a customer, you can voluntarily submit a review (testimonial). We process the star rating you provide, your review text and the name/company name you provide and, if given, your role/function.

After a brief editorial review (moderation), we publish approved reviews with the stated name/company name on our website (e.g. on the home page). The legal basis is your consent under Art. 6 (1)(a) GDPR, which you grant by submitting the review form. You can withdraw your consent at any time with effect for the future; we then remove the review from the website. A message to Connect@llmstxt.info is sufficient.

14. Embedded Google search (website search)

In the directory we offer, alongside our own server-side entry search, an optional full-text search across the entire website (the “Whole site” tab). This is provided technically via the Google Programmable Search Engine (Google Custom Search).

This Google search is not loaded automatically. It is activated only when you select the “Whole site” tab and there expressly click “Enable Google search”. Only then is program code from Google loaded, and a data transfer to Google and the setting of cookies or access to information on your device may occur. As long as you do not actively consent, no connection to Google takes place.

Upon activation, in particular your search term, your IP address and technical information about your browser and device are transmitted to Google. Processing may also take place in the USA.

The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (possibly Google LLC, USA). Details on data processing by Google are in their privacy policy.

The legal basis is your consent (Art. 6 (1)(a) GDPR and § 25 (1) TDDDG for the storage of or access to information on your device), which you grant by clicking “Enable Google search”. Where processing takes place in the USA (third country), it is additionally based on the European Commission’s standard contractual clauses pursuant to Art. 46 GDPR or, where certified, the EU-US Data Privacy Framework.

Your consent is voluntary and not required to use our offering. The own directory search is available to you without Google at any time. You can withdraw a granted consent with effect for the future by deleting the consent stored in your browser (remove website data for llmstxt.info) and not using the Google search further.

14a. Notices about illegal content (Art. 16 DSA)

If you report content to us via the notice form, we process the details that Art. 16(2) of Regulation (EU) 2022/2065 (DSA) requires for a valid notice: your name, your email address, the reason, the address (URL) concerned, your explanation and your confirmation that the information is accurate to the best of your knowledge. In addition we store a non-reversible hash of your IP address (to prevent abuse), the time and a case number.

We use your email address to send you the acknowledgement of receipt (Art. 16(4) DSA) and subsequently our reasoned decision (Art. 16(5) DSA). Where content is removed, we state the reasons to the affected person (Art. 17 DSA). We do not pass on your contact details, only the substantive grounds. No automated decision-making takes place.

Legal basis: Art. 6(1)(c) GDPR (legal obligation under Art. 16 and 17 DSA), in addition Art. 6(1)(f) GDPR (evidence of proper handling). We retain notice files for as long as they are needed to handle the matter and to defend against possible claims, and delete them afterwards.

14b. Self-test "Visitor information"

At /besucherinformationen/ we show what information a website can technically learn about its visitors.

Before any click we only show what your browser sends to every server with every page request anyway: IP address and request headers (such as browser identifier, language, referring page). We only use this information to display it to you and do not store it for this purpose.

After you click "Start analysis" the page reads further attributes in your browser (for example screen, graphics card, fonts, time zone, permissions) and computes a fingerprint from them. This happens entirely in your browser; the values are neither stored nor transmitted to us or third parties. Once, the page asks our own server for the server time (clock sync) and for the host name of your IP address (reverse DNS); as with every request, the server receives your IP address and request headers and only returns them to you. This is not stored either. The page only requests your location if you explicitly click for it and allow it in your browser; the coordinates stay in your browser. Keystrokes in the typing test are not read; only the time intervals are displayed. No third-party services are embedded on this page, and event-based analytics (section 9) is switched off here; the anonymous page view is counted as everywhere.

The legal basis for reading attributes in the browser is § 25(2) no. 2 TDDDG (a service you explicitly requested); for the brief processing of the IP address for display it is Art. 6(1)(f) GDPR (our legitimate interest in explaining tracking techniques). Server log files are created as with every request (section 3).

15. Your rights

Under the GDPR you have the following rights:

• Access (Art. 15 GDPR): which data we have stored about you
• Rectification (Art. 16 GDPR): correction of inaccurate data
• Erasure (Art. 17 GDPR): removal of your data
• Restriction (Art. 18 GDPR): restriction of processing
• Data portability (Art. 20 GDPR): your data in a machine-readable format
• Objection (Art. 21 GDPR): see the following note
• Withdrawal of consent (Art. 7 (3) GDPR): you can withdraw consent at any time with effect for the future; the lawfulness of processing up to that point remains unaffected

To exercise your rights, contact: Connect@llmstxt.info

You are not legally or contractually obliged to provide personal data. Without the details required for a contract (for example your email address when ordering), we cannot provide the service. We do not use automated decision-making, including profiling, within the meaning of Art. 22 GDPR.

Right to lodge a complaint

You have the right to lodge a complaint with a data protection supervisory authority. The competent authority in North Rhine-Westphalia is the State Commissioner for Data Protection and Freedom of Information NRW (LDI NRW). A list of all German data protection authorities is available from the Federal Commissioner for Data Protection and Freedom of Information (BfDI).

16. Changes to this policy

We reserve the right to adapt this privacy policy in the event of changes in the legal situation or the service. The current version is always available at https://llmstxt.info/datenschutz/.

As of: 7 October 2026