AI Compare Ninja AI Compare Ninja

Check prices, features and limits.
EN

Privacy policy

This privacy policy explains how personal data are processed when you visit vergleich-ki.de and aicompare.ninja, use the embedded API cost calculator, or book advertising placements.

The German version is authoritative. Mandatory rights under applicable law remain unaffected.

Updated: 15 October 2026

How we use cookies and how to change your consent is explained in our Cookie Policy.

1. Controller

Martin Müller
Sole proprietorship (Einzelunternehmen)
Buttmannstraße 7A
13357 Berlin
Germany

Phone: +49 156 79 83 11 51
Email: info@aicompare.ninja

2. Hosting, delivery and server logs

We operate the website with Cloudflare Pages and Cloudflare Workers. Cloudflare KV stores customer and advertising data; Cloudflare D1 stores the advertising event data described below. The provider is Cloudflare, Inc. and its affiliates. On each request Cloudflare processes technically necessary connection and log data. These may include the IP address, date and time, requested URL, HTTP method and status, data volume, referrer, browser, operating system, device information, and a country signal derived from the connection.

The processing is necessary to deliver pages and API functions, defend against attacks, investigate errors, and keep the service stable. The legal basis is Art. 6(1)(f) GDPR. Art. 6(1)(b) GDPR also applies to customer accounts, advertising bookings, and billing. See the Cloudflare Privacy Policy for more information.

Cloudflare processes connection data as a processor under Art. 28 GDPR. HTTP request logs are accessible in our account for up to 32 days. Cloudflare processes other technical data to the extent and for as long as necessary for delivery, security and diagnostics. Data may reach the US; section 13 explains transfer safeguards.

3. Country detection and pricing market

For automatic pricing-market selection, the browser reads Cloudflare's coarse country signal through /cdn-cgi/trace. No precise location is determined. Processing serves regional price display and is based on Article 6(1)(f) GDPR. A manually selected pricing market and recent searches are held only in the open page's working memory. No cookies, localStorage or sessionStorage are created for these purposes; reloading discards these values. Automatic detection may then run again.

4. Device storage and consent

Global Privacy Control concerns data sales and sharing for cross-context advertising. Analytics consent does not enable either. Optional website analytics starts only with your explicit consent, including when GPC is active, and can be withdrawn at any time.

The decision is stored under vergleich-ki-consent-v1 only in this browser's localStorage. Consent is valid for no more than 180 days. An express rejection or withdrawal remains until the user changes it. If the consent schema or providers change, an earlier grant becomes invalid while a rejection remains effective. Choices can be changed at any time through “Cookie settings”. The legal bases for optional analytics are Art. 6(1)(a) GDPR and § 25(1) TDDDG. Storage of the choice itself is necessary to implement the expressly stated request under § 25(2) no. 2 TDDDG.

5. Cloudflare Web Analytics

We use Cloudflare Web Analytics for cookieless audience and performance measurement. According to Cloudflare, its beacon collects page-view and performance data through the Performance API. Data sent may include page and path, referrer host and path, country, browser, operating system, device type, navigation type, and performance metrics. It sets no cookies, does not use localStorage for recognition, and creates no cross-device visitor profile. Cloudflare states that this service does not collect or use visitors' personal data. Cloudflare nevertheless processes the connection data required to retrieve the beacon.

The contractual provider of this service is Cloudflare, Inc., USA. Where Cloudflare processes personal data on our behalf, the data processing terms pursuant to Article 28 GDPR apply. The beacon starts only after consent, including on direct visits to our statistics widgets. Cloudflare describes retention of unsampled beacon data for seven days followed by reduced sampling; reports are available for the previous six months. This reporting window is not a guarantee of a specific deletion period for all technical connection data beyond it. Data may be transferred to the USA. Legal bases for optional analytics are Article 6(1)(a) GDPR and, where device information is stored or accessed, section 25(1) TDDDG. You can withdraw through Cookie settings at any time. Transfer safeguards are explained in section 13.

6. Optional analytics, including Google Analytics 4

We use Google Analytics 4 after your consent. The contracting entity in the European Economic Area is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google LLC and affiliates may act as further recipients or subprocessors and process the page path, referrer, time, approximate location, browser, device, operating-system, interaction and session data. Our direct configuration sends no URL query string or fragment, does not enable advertising, and sends no ad-personalization signals. The cookies _ga and _ga_<identifier> may be set for recognition. Google Analytics 4 loads only on www.aicompare.ninja. vergleich-ki.de and www.vergleich-ki.de redirect there permanently and create no separate measurement partition or consent. The calculator in the iframe does not load Google Analytics. Another provider may be activated only after the configuration and this policy have been updated.

The legal bases are Art. 6(1)(a) GDPR and § 25(1) TDDDG. Consent can be withdrawn at any time through Cookie settings. Google explains its processing in the Google Privacy Policy and its GA4 data collection information.

The _ga and _ga_<identifier> cookies last up to 180 days and are not renewed on every visit by our configuration. We configure GA4 user and event data retention to 14 months. New activity does not restart the user retention period. Google deletes expired data in its monthly deletion cycle. This setting does not apply to aggregated standard reports; their continued use requires that they remain necessary for the stated analyses. The longer period supports comparison of annual usage cycles and evaluation of subsequent improvements. Google Ireland Limited processes data for us under data processing terms pursuant to Article 28 GDPR; Google LLC and affiliates in the USA may be additional recipients. Data may be transferred to the USA, subject to section 13 safeguards. Automatic collection of site searches, form interactions and browser-history changes is disabled. Our own GA4 search events contain only derived catalog categories, never free text. Use requires consent under Article 6(1)(a) GDPR and section 25(1) TDDDG, which can be withdrawn at any time through Cookie settings.

With your consent, we evaluate page views, search results, result selections, categories, filters, comparisons, tool visits, provider and affiliate clicks, active time and scroll depth to improve search and the catalog. For ad placements, we measure delivery, visibility and clicks. Data include random event, search and session identifiers, time, page path without query parameters, language, referring website, approximate country, device, operating-system and browser categories. Depending on usage, they also include result counts and positions, selected tools, categories and filters, and placement and campaign attribution.

For search statistics, we transmit only recognized catalog categories or a neutral classification, not free search text. After consent, a session identifier and search context remain in sessionStorage for up to 30 minutes. Stored search data and pseudonymous search journeys are deleted within 366 days; other events, sessions and daily aggregates within 400 days. An EU-based service provider processes our statistics solely on our instructions under Art. 28 GDPR. Legal bases are Art. 6(1)(a) GDPR and section 25(1) TDDDG.

For multi-year comparisons, we create aggregate monthly usage, search and placement values without free search text or individual identifiers. These remain while we operate multi-year reporting. Withdrawal stops new measurement and contributions to these reports.

Withdrawal through Cookie settings stops further measurement and removes local analytics identifiers. Own statistics data linked to your consent are deleted. Necessary withdrawal identifiers remain separately from your choice in localStorage until deletion is confirmed; failed requests are retried and analytics remains blocked. A server-side blocking identifier remains until the 180-day consent expires to prevent delayed measurement. Existing aggregate monthly values without individual attribution are retained. Withdrawal does not affect the lawfulness of earlier processing.

On withdrawal, we also automatically request Google to delete the GA4 client IDs linked to your consent. We store the identifiers actually used in our own database during the consent period of up to 180 days and capture them before removing Google cookies. Necessary identifiers and withdrawal references remain in this browser’s localStorage until our own deletion and Google’s acceptance of the deletion requests are confirmed; analytics stays blocked until then. While the website is open, the browser retries failed requests every 30 seconds and when the connection returns. Google requests already stored on our server are independently retried hourly in limited batches. Failed requests remain stored until successfully submitted. We then remove the raw Google identifier; a pseudonymous association and submission record remains until 30 days after consent expires or after submission, whichever is later. With prompt submission, this is at most 210 days from consent. Acceptance of a request does not mean immediate final deletion. For User explorer, Google states that data stops appearing within 24 hours and is permanently removed within the following 63 days. Other browsers or devices and already anonymised aggregates are not automatically covered. Consent expiry or renewal alone does not trigger Google deletion.

For historical placement comparisons, we also retain fixed aggregate delivery, visibility and click values without individual events or search journeys for as long as these comparisons are needed.

7. Partner recommendations and paused ad placements

The catalogue shows partner or affiliate recommendations labelled as advertising, either as banners or provider links, but we do not operate a display ad network. They remain clearly separate from editorial tool comparisons. Only when clicked does the browser contact the provider or an intermediary partner network. Those parties may process connection data and use cookies or similar technologies under their own rules. We may receive remuneration if a contract results. Providing the links relies on Art. 6(1)(f) GDPR, our interest in information and financing the service.

Labelled own and affiliate placements use the same analytics consent as our own statistics. Delivery, at least 50 percent viewability and clicks are measured with the event and attribution data listed in section 6. Local placement events in Cloudflare D1 are deleted within 90 days; deletion runs regularly and independently of dashboard visits. Pseudonymously linkable copies in the private analytics system remain for up to 400 days; daily aggregates without session identifiers for up to 400 days. A click reference may associate placement, campaign, creative and variant with a reported partner transaction where the affiliate program supports this. Ads are not personalized. Transmission takes place server-side through our own domain without visitor IP addresses, cookies or other visitor headers. Section 6 processor and withdrawal information also applies here.

To prevent abuse, we process pseudonymous keys derived from IP addresses and event identifiers in memory for up to ten minutes. Raw IP addresses are not stored or forwarded for this purpose. The legal basis is Art. 6(1)(f) GDPR, our interest in preventing abuse.

8. Advertising account, ads, and essential session cookie

When an advertising account is registered, we process the name or company, email address, a salted password hash, creation date, and ad identifiers assigned to the account in Cloudflare KV. We also store the confirmation and its time that the booking is made as an entrepreneur or business customer under § 14 BGB. The plain-text password is not stored. For an ad we process its title, optional short text, destination URL, placement, duration, status, and creation, activation, expiry, and, where applicable, cancellation times.

After registration or login we set the vki_ad_session cookie for no more than 14 days. It contains a signed session record with the account identifier and expiry, is HttpOnly, Secure, and SameSite=Lax, and is deleted on logout. The cookie is essential for login and the dashboard and is not used for audience measurement. The legal basis is Art. 6(1)(b) GDPR; device storage is necessary under § 25(2) no. 2 TDDDG.

9. Stripe Checkout and billing

We use Stripe Checkout and the Stripe customer portal for paid advertising placements. When a checkout begins, we send Stripe in particular the advertiser's email address, price and duration, and ad, customer, and placement identifiers. On Stripe's pages, Stripe processes the contact, billing, payment, device, and transaction data entered there. Depending on the transaction, we receive and store checkout, customer, and subscription identifiers, payment status, and webhook events. We do not receive complete card or bank details.

The processing supports contract formation, payment, subscription management, fraud prevention, and statutory accounting or evidence duties. The legal bases are Art. 6(1)(b), (c), and (f) GDPR. Stripe may act as a controller for its own regulatory, security, and fraud-prevention purposes. See the Stripe Privacy Center for details.

10. Embedded cost calculator

The home page embeds the API cost calculator in an iframe from calculator.aicompare.ninja. This creates a direct connection to a separately delivered website. The technically necessary connection data described in section 2 and the language and embed-mode parameters are processed. The quantity values entered are currently calculated only in the embedded browser state and are not assigned by us to a user account. The calculator sends only its display height to the parent page. The embedded calculator does not load optional analytics. A direct visit to calculator.aicompare.ninja outside the iframe may load Google Analytics 4 after consent. The legal basis is Art. 6(1)(f) GDPR, our interest in providing the comparison calculator.

The browser fetches model prices and token limits directly from OpenRouter (OpenRouter, Inc., USA) at https://openrouter.ai/api/v1/models. For the approximate EUR conversion in the German version, it also fetches USD/EUR reference rates from Frankfurter at https://api.frankfurter.dev/v1/latest?from=USD&to=EUR. These services and their delivery infrastructure receive technically necessary connection data, in particular the IP address and browser and request information. The quantities entered, prompts and API keys are not sent with these requests. We base these requests on Art. 6(1)(f) GDPR, our legitimate interest in current pricing, limit and exchange-rate data. The OpenRouter request may transfer data to the USA. Frankfurter states that it does not itself log personal data, IP addresses or request URLs; its public API uses Cloudflare for delivery and protection. See the OpenRouter privacy policy and Frankfurter privacy information for processing by these services.

11. Provision of badges and widget graphics for external websites

We provide providers of listed tools and third parties with official badges and widget graphics (such as "Featured on AI Compare Ninja"), which they may embed on their own websites using HTML code (typically via an <img> element). When an external web page featuring such a badge is accessed, the visitor's web browser automatically retrieves the graphic file (such as an SVG) directly from our servers or our Content Delivery Network (CDN).

In this process, connection data are transmitted to us for technical reasons. These include the IP address of the requesting device, date and time of the request, address of the embedding web page (referrer URL), browser and operating system identifiers (user agent), transferred data volume, and HTTP status code.

Processing these data is technically necessary to deliver the badge graphics reliably, efficiently, and securely, to balance server loads, and to detect and prevent disruptions, service failures, and abusive requests (such as denial-of-service attacks). The legal basis is Art. 6(1)(f) GDPR, our legitimate interest in the technical provision, operational security, and integrity of our web services.

Badge requests set no analytics cookies and do not recognize individual visitors. We do not build individual user profiles or perform cross-site tracking from them. Necessary connection and log data follow the purposes and retention criteria in section 2.

Badges are delivered through our hosting and CDN provider Cloudflare (Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA) acting as a data processor pursuant to Art. 28 GDPR. Any transfer to third countries relies on the European Commission's Standard Contractual Clauses and Cloudflare's certification under the EU-U.S. Data Privacy Framework (DPF) under the principles set out in section 2 and section 13.

External directory images on Listed on

The Listed on page loads official badge images directly from the directory services and image servers listed below. These connections occur when the page is opened or scrolled, before a click and independently of analytics consent. The image servers receive the IP address and browser/request information. The no-referrer policy prevents our page address being sent as a referrer. We do not use these requests for recognition or our usage statistics. Their purpose is to display official directory graphics; the legal basis is Art. 6(1)(f) GDPR, our interest in presenting directory entries transparently. Services may process connection data under their own rules, including outside the EEA; provider information is available through the linked websites. No particular deletion period or exclusively European processing is promised for these external recipients. You can block external images in your browser; directory links remain usable.

12. Email, contact forms, local search, and external and affiliate links

If you email us or use the “Contact” and “Submit an AI” forms, we process sender name, sender address, recipient address, time, subject or form fields, content, and technically necessary transmission data to handle the request and keep necessary evidence. Listings are not published automatically; we review them manually. The legal basis is Art. 6(1)(b) GDPR for pre-contractual or contractual messages and otherwise Art. 6(1)(f) GDPR.

For spam protection, the IP address is converted to a pseudonymous HMAC key used in memory for up to ten minutes. Form messages, their fields and processing status remain in Cloudflare KV for up to 90 days. Notifications are sent through Resend (Plus Five Five, Inc., US); tool suggestions are forwarded to editorial recipients. Email copies follow the retention criteria in section 14.

The AI catalog search filters the provided catalog data locally in the browser; the search text is not sent to our search API for this purpose. Links to providers may be external links or affiliate links labelled as advertising. They are native recommendations in the catalogue, not banners from a display ad network. Only when clicked does the browser contact the provider or an intermediary affiliate network. Those parties may process connection data and use cookies or similar technologies under their own rules. We may receive remuneration if a contract results. Providing the links relies on Art. 6(1)(f) GDPR, our interest in information and financing the service.

Emails to our contact addresses are forwarded through Cloudflare Email Routing by Cloudflare, Inc. (USA) to two Gmail mailboxes we use and stored there by Google. Google Ireland Limited (Ireland) and Google LLC (USA) may process personal data in this context. We send outgoing emails through SMTP2GO (Sand Dune Mail Ltd, New Zealand). These providers process the message and delivery data needed for forwarding, storage or sending. Processing may take place outside the European Economic Area, particularly in the USA. Processing exclusively in Europe is not guaranteed. Section 13 explains the transfer bases and safeguards.

13. Recipients and transfers to third countries

Recipients of personal data are, only where required for the relevant purpose: Cloudflare as infrastructure and database provider; Stripe and participating payment providers; an optional analytics provider named in Cookie settings, if any; Cloudflare Email Routing for email forwarding, Google for the Gmail mailboxes, SMTP2GO for outgoing emails and Resend for form notifications; destination providers or affiliate networks after a click; and authorities or courts where disclosure is legally required. Advertisers see only the aggregated statistics described in section 7. The advertiser's legal name is displayed publicly with the ad content as intended. We do not sell or rent personal data to list brokers.

Cloudflare, Stripe, Google, SMTP2GO and other recipients selected by the user may process data outside the European Economic Area. Where we are responsible for such a transfer, we rely on an adequacy decision, including a valid EU-US Data Privacy Framework certification, or appropriate safeguards such as the European Commission's Standard Contractual Clauses. Residual risks of access by public authorities in the recipient country cannot be completely excluded. Destination sites and affiliate networks also apply their own notices.

An EU-based service provider processes our own statistics on our instructions as a processor under Art. 28 GDPR.

You can request information and copies of the relevant transfer safeguards using the contact address in section 1.

14. Retention

We keep personal data only for as long as needed for the relevant purpose or a statutory duty. It is then deleted or aggregated so that a person can no longer be identified. The following criteria apply:

Sections 2, 4 to 7 and 12 explain retention for connection data, browser storage and statistics. Stored search data and journeys: up to 366 days; other own events, sessions and daily aggregates: up to 400 days; local placement events: up to 90 days. Aggregate monthly and placement values without individual attribution remain for the duration of the relevant historical reporting.

15. Your rights, objection, and automated decisions

Subject to the statutory conditions, you have the rights of access under Art. 15 GDPR, rectification under Art. 16, erasure under Art. 17, restriction under Art. 18, portability under Art. 20, and objection under Art. 21. You may withdraw consent under Art. 7(3) at any time for the future. In particular, you may object to processing based on Art. 6(1)(f) GDPR on grounds relating to your particular situation. Contact info@aicompare.ninja. If we have reasonable doubts about your identity, we may request additional information necessary to confirm it.

Under Art. 77 GDPR you may complain to a supervisory authority, including the Berlin Commissioner for Data Protection and Freedom of Information, Alt-Moabit 59-61, 10555 Berlin, Germany.

We do not make a solely automated decision under Art. 22 GDPR that produces legal effects concerning you or similarly significantly affects you. Catalog search and pricing market only determine which information is displayed. Stripe may use automated systems for payment and fraud checks under its own responsibility; Stripe's notices apply.

16. Requirement to provide data and changes

You do not have to actively provide data merely to visit the site, although technical connection data are required for delivery. Selecting a pricing region and optional analytics are voluntary. An advertising account requires a name or company, email address, and password. A booking requires the stated ad, contract, and payment data; without them the account, ad, or payment cannot be provided. For email, at least a reachable sender address and the information needed to handle the request are necessary.

We update this policy when features, providers, or the law change. A material change to optional analytics invalidates an earlier consent and may require a new choice. The date above identifies the current version.