Privacy

This page says what clearshortlist processes about you, why, for how long, who else sees it, and what you can ask of us. It is written to be read, not skimmed past. Last updated 19 October 2026.

In short

• This site loads no analytics or advertising scripts and sets no advertising cookie. When you start a conversation with the AI assistant, and only then, it sets one cookie of its own: it keeps that conversation together for the rest of the day and is described below.
• Our hosting provider, Cloudflare, sees the connection data every website needs to answer a request.
• What you type into the AI assistant chat is processed to answer you. Chat transcripts are deleted 90 days after the conversation. See the AI assistant section below.
• If you sign up with a partner through our link, that partner shows us your e-mail address and whether you bought, so we can be paid our commission.
• We do not sell data, and we do not share it with advertising networks.

Who is responsible

The controller under the GDPR is Oddlynew GmbH, Vorgartenstraße 210/2/54, 1020 Wien, Austria. Reach us at hello@clearshortlist.com. Full details are in the imprint.

Delivering the site: server logs

The site runs on Cloudflare. To answer your request, Cloudflare and our code see the connection data every web server sees: your IP address, the page you asked for, the time, the browser you use and the page you came from, if your browser sends it. We use this to deliver the site, keep it working and defend it against abuse. The legal basis is our legitimate interest in running a working, secure site (Art. 6(1)(f) GDPR). Request logging is switched on for this site: for every request Cloudflare records the address it was made to, including anything carried in that address, together with the method, the status and how long it took, plus whatever our own code writes to the log. Our own lines are the error and warning lines a failed page render or an unreadable partner document produces; they never carry chat text. Cloudflare deletes these logs after at most seven days. Cloudflare also processes connection data on its own edge to protect the site; its own retention is described in Cloudflare's privacy policy.

Campaign identifier

The link you arrived on may carry a campaign identifier, so a sign-up at the partner can be credited to the right campaign. The raw value travels in the page address and can therefore appear in the server logs described above before this site checks it; it is deleted with those logs. The site forwards the value in the partner link only when it contains letters, digits, hyphens or underscores and is at most 64 characters long. Otherwise, the partner link uses `direct`. This syntax check prevents obvious URL payloads from being sent to the partner, but it cannot prove that an accepted token is anonymous. Our campaign links therefore use only non-personal campaign labels and must never put a name, e-mail address, phone number or cross-site identifier in this field. Nothing is stored on your device for it while you are only reading: the campaign identifier lives in the page address, so it is gone the moment you leave. If you start a conversation with the assistant, the same label is written into the assistant's own cookie, for the same purpose and for that day only - it is what the link the assistant offers you is credited to, exactly as the button on the page is. That cookie is not an advertising cookie and builds no profile of you; it is described under the AI assistant below.

Measurement: counting, not tracking

This site loads no analytics script, sets no analytics cookie and gives you no identifier. What it does do is count: our own server adds one to a number when a partner page is delivered, and your browser tells that same server when a link on the page was clicked, so we can tell whether our advertising is worth its money. The numbers we keep are totals per day, per page and per advertising campaign label - for example “12 views and 3 clicks on this page on 5 September”. Each total also says which of the two versions of the page was shown, which wording the ad asked us to show, whether the address you arrived on asked for a wording at all, and whether the page was opened in the mode we use to review a version ourselves. Which version you see is worked out fresh for the day from your network’s address, which is never written down: only the answer - version one or version two - reaches the total, and it changes again at midnight. There is no row about you: no IP address, no cookie and no device or visitor identifier. The only label in these totals is the campaign label described above, taken from the address the ad sent you to, and it is never stored the way it was sent: a value with the shape our own campaigns emit is shortened to the campaign group it names, a visit that arrived without any campaign is counted under “direct”, and every other value is added to a single “other” total and is not stored at all. We put no personal data in our campaign labels - that is a rule we keep, not something this page can prove to you - which is why the totals carrying a label are deleted after 90 days, while the totals without one are kept for 13 months. Both are deleted automatically. The legal basis is our legitimate interest in knowing whether the advertising we pay for works (Art. 6(1)(f) GDPR). Should we ever add analytics that stores something on your device or recognises you, it will run only after you agree in a consent dialog, and this page will say what it is and what it stores.

Server-side measurement: Cloudflare Zaraz

On clearshortlist.com, our server also sends the accepted link and option clicks to Cloudflare Zaraz, our server-side measurement hub. Each event carries the partner page, campaign label, page version, wording group and review flags described above, plus the browser language if sent. Page and referrer addresses are reduced to their origin: no path and no fragment is sent. We do not send the visitor token, cookies, IP address or browser user agent to the hub. Zaraz loads no script on your device, writes no cookie and creates no visitor identifier for this measurement. We keep only the aggregate counters described above.

When you click a partner link, that one event goes on from the hub to Google Analytics 4, server-side, and it carries the Google click id (gclid) from the page address - in the address of the page and as a separate value. Google Ads then imports the click as a conversion from Google Analytics, so we can tell which advertisement led to a recommendation being followed. Google Analytics receives the event with a random identifier that is new for every event, and without your IP address or browser user agent. No cookie and no browser storage is used for this, on your device or ours, and nothing recognises you on a later visit.

The legal basis is your consent (Art. 6(1)(a) GDPR). You give it by continuing to the partner after the note under the link, which says what continuing sends. Not clicking is how you withhold it: nothing is sent for a page you only read. You can withdraw your consent for the future at any time by contacting us at the address above; a click id already sent cannot be taken back, and withdrawal does not make the earlier sending unlawful. Cloudflare and Google process these events for us; Google Ireland Limited is the recipient, and data may be processed by Google LLC in the United States. Our own retained measurement records remain the aggregate counters, without the click id, with the retention periods described above.

AI assistant on partner pages

Some partner pages offer an AI assistant that answers questions about the tool the page is about, from that tool's public documentation. It is software, not a person. It can be wrong, and nothing it says is a promise or a binding offer, by us or by the partner. Check prices and terms on the partner's own site before you sign up.

Please do not type personal data into the chat. The assistant does not need your name, e-mail address, phone number, customer numbers or anything about other people to help you, and it tells you so. If you type personal data anyway, it is processed and stored like any other message, as described below, and you can ask us to delete it.

Why we run it. To answer your questions about the tool on the page, to keep one conversation per partner page and day, to keep out bots and abuse, to keep our own cost for the assistant bounded, and to improve the assistant and the documentation it draws on.

What is processed.

• What you type, and the assistant's answers. Your messages are sent to a language model to generate the answer and are stored together with the answers as a transcript.
• A short description of your visit. With your messages, the language model receives a short description of how you arrived: whether you came from one of our Google ads and with which campaign label, which version of the page you saw and which question you picked, the country and time zone Cloudflare derives from your connection, the part of the day it is where you are (for example “evening”), the first language your browser asks for, and whether you use a mobile or a desktop device. When the ad's address carries them, it also names the numbers Google gives the campaign, the ad group and the ad. It never contains your IP address, your full browser details or the words you searched for. The assistant uses it to answer in your language and for your situation; it is not used for analytics or advertising and builds no profile of you.
• A visitor token, in a cookie. When you send your first message, and only then, the site sets one cookie named onsite_visitor (written as __Host-onsite_visitor over https). It holds a random, signed token, which partner page you started on, which campaign label the page address carried, which version of the page wording you saw and which of the offered questions you picked. It also holds that description of your visit, so the assistant receives it for the whole conversation. It is HttpOnly, so no script on the page can read it, SameSite=Lax, so it does not travel to other sites, and it expires at the end of the same UTC day. It contains no name and no e-mail address, is not used for analytics or advertising, and does not recognise you anywhere else or on any other day. Reading a page, arriving from an ad, or leaving without asking anything sets nothing.
• An anonymised part of your IP address. The site derives a network prefix from your IP address, never the full address, and counts the assistant's cost per prefix and per day against a limit. This stops one network from consuming the whole daily budget and helps us spot abuse. The counters are deleted after two days. There is also a site-wide daily spending cap; when it is reached the assistant pauses for everyone until the next day, and no personal data is involved in that.
• A bot check. Before your first message, Cloudflare Turnstile checks that a person, not a script, is asking. The check issues a short-lived token that our server verifies once. Turnstile may keep a technical value on your device for the duration of the check; it builds no profile and is not used for advertising, and its optional pre-clearance cookie is switched off. Turnstile is run by Cloudflare under Cloudflare's privacy policy.
• Our own test conversations. When we test the assistant ourselves, those conversations are marked as internal and are excluded from the transcripts described here.

Who processes it for us. All of the following act as our processors under a data processing agreement. None of them may use your data for their own purposes.

• Hosting, bot check and AI request routing: Cloudflare, Inc., San Francisco, United States. Our Cloudflare account is set to store its data in the European Union. Cloudflare's global network still handles the connection itself, as it does for every page on this site, and the request to the language model passes through Cloudflare's AI Gateway. Cloudflare is certified under the EU-US Data Privacy Framework and its terms include the EU standard contractual clauses.
• Language model: the assistant uses an Anthropic Claude model, run by Amazon Web Services on Amazon Bedrock in the eu-central-1 region (Frankfurt, Germany). Amazon Web Services EMEA SARL, Luxembourg, is the contracting entity. Under Bedrock's published terms your messages are not stored by AWS after the answer is generated, are not shared with Anthropic and are not used to train any model.
• Database: PlanetScale, Inc., San Francisco, United States, hosts the PostgreSQL database in which conversations and transcripts are stored, in its eu-central region (Frankfurt, Germany). The company is based in the United States, so its support staff could in principle reach EU-stored data; its data processing agreement covers this with the EU standard contractual clauses.

Nobody else receives chat data. We do not sell it and we do not share it with advertising networks. If you follow a link from the chat to the partner, the partner's own privacy policy applies from that moment; the link carries our affiliate id and the campaign label, and no personal data about you.

Legal basis. Our legitimate interest in offering a useful assistant, keeping it free of bots and abuse and keeping its cost bounded (Art. 6(1)(f) GDPR). Our reasoning: the processing is what you would expect when you type a question into a chat box, it is limited to answering you, it involves no profiling, no advertising and no cross-site identification, it is confined to the European Union and Switzerland wherever we control the location, and you can object at any time. We therefore do not ask for consent for the chat itself. The cookie is exempt from the consent requirement of § 165(3) TKG 2021 because it is set only when you start a conversation and is strictly necessary to keep that conversation together. Anything optional, such as leaving an e-mail address so we can get back to you, happens only with your consent (Art. 6(1)(a) GDPR), and you can withdraw it at any time.

How long. The visitor token expires at the end of the UTC day the conversation started on; your browser drops the cookie itself at that point, and you can delete it sooner. The per-network cost counters are deleted after two days. Chat transcripts are deleted 90 days after the conversation. What we keep for longer is aggregated and anonymous: which questions come up, which objections, how long conversations run.

Your rights. You can ask for access to the personal data we hold about you, for its correction or deletion, for a restriction of its processing, and for a copy in a portable format. You can object to processing based on our legitimate interest, and withdraw any consent you gave, with effect for the future. Write to hello@clearshortlist.com. For a chat transcript, tell us the partner page, the day and roughly the time, and if possible the first thing you typed, because the transcript carries no identity of its own and we cannot otherwise tell which one is yours. If you think we handle your data unlawfully, you can complain to the Austrian Data Protection Authority (Datenschutzbehörde, Barichgasse 40-42, 1030 Wien, dsb@dsb.gv.at) or to the supervisory authority where you live.

Who else sees data

• The partner, only when you follow a link to it: from that moment the partner's own privacy policy applies. The link carries our affiliate id and the campaign identifier, and no personal data about you.

We do not sell personal data and do not share it with advertising networks. Nobody else receives it unless the law requires us to hand it over.

What we receive from the partner

Data does not only travel outwards. When you sign up with the partner through our link, the partner shows us in its affiliate dashboard the e-mail address you signed up with and whether you became a paying customer. We use this only to account for the commissions we are owed and to see which campaigns work. The legal basis is our legitimate interest in being paid for the referrals we make (Art. 6(1)(f) GDPR). We look at it in the partner's dashboard and keep only aggregated counts and amounts in our own records - never a copy of the e-mail list. What the partner itself does with your data is governed by the partner's own privacy policy.

Your rights

You can ask us for access to the personal data we hold about you, for its correction or deletion, for a restriction of its processing, and for a copy in a portable format. You can object to processing based on our legitimate interest, and withdraw any consent you gave, with effect for the future. Write to hello@clearshortlist.com. For chat transcript requests, see the AI assistant section above. If you think we handle your data unlawfully, you can complain to the Austrian Data Protection Authority (Datenschutzbehörde) or to the supervisory authority where you live.