Privacy Policy

Introduction

We take the protection of your personal data very seriously. This privacy policy explains what data we collect when you use Elexess (the "Service"), how we use it, and what rights you have regarding your data.

1. Controller

The controller responsible for data processing is:

Newmatik GmbH, Am Markt 1, 55619 Hennweiler, Germany. Email: service@newmatik.com, Phone: +49 6752 16998-0.

2. Data Protection Officer

Our Data Protection Officer is Dominik Ottenbreit. You can reach the DPO at service@newmatik.com.

3. Data We Collect

When you use the Service, we collect and process the following personal data:

• Account data: email address, full name (optional), password (stored as a hash, never in plain text), avatar URL
• Organization data: team memberships, roles (admin/member), subscription plan
• Usage data: search queries, API request logs, supplier data viewed
• Billing data: subscription status and plan tier (payment details are processed and stored exclusively by Stripe; we do not store credit card numbers)
• Technical data: IP address, browser user agent, error logs, and performance traces (via Sentry)
• Consent records: timestamp, version, IP address, and user agent when you accept terms or privacy policy

4. Legal Basis for Processing

• Contract performance (Art. 6(1)(b) GDPR): Processing your account data, usage data, and organization data is necessary for providing the Service you signed up for.
• Consent (Art. 6(1)(a) GDPR): When you agree to the Terms & Conditions and acknowledge this Privacy Policy during registration.
• Legitimate interest (Art. 6(1)(f) GDPR): Error monitoring via Sentry to maintain service reliability and security, and maintaining a reliable record of policy acceptance. Our legitimate interest is ensuring the stability, security, and legal accountability of the Service.

5. Hosting and Data Processors

We use the following third-party services to operate the Service:

6. OAuth Authentication

If you sign in using GitHub or Microsoft Azure, we receive your email address, name, and avatar URL from the OAuth provider. This data is used solely for authentication and populating your profile. We do not share your data back with these providers. The OAuth flow is handled by Supabase Auth.

7. Cookies and Local Storage

The Service uses the following cookies and local storage:

• Supabase authentication tokens: Session tokens for maintaining your login state. Strictly necessary for authenticated access to the Service.
• cookie_consent_dismissed: Records whether you have dismissed the cookie information banner. Stored in localStorage.

We do not use any marketing, advertising, or analytics cookies.

8. Data Retention and Deletion

Your data is retained for as long as your account is active. You can request complete account deletion at any time through the Settings in your dashboard, which will permanently delete all your data including your profile, team memberships, search history, and consent records.

When you accept our Terms & Conditions or acknowledge this Privacy Policy, we record the policy type and version, acceptance time, request IP address, and browser user agent as evidence of that action. The IP address and user agent are removed after 90 days. The policy type, version, and acceptance time remain with your account until the consent record or account is deleted.

9. Your Rights

Under the GDPR, you have the following rights regarding your personal data:

• Right of access (Art. 15 GDPR): You can request information about what personal data we process.
• Right to rectification (Art. 16 GDPR): You can request correction of inaccurate data.
• Right to erasure (Art. 17 GDPR): You can request deletion of your data. Use the account deletion feature in your dashboard or contact us.
• Right to data portability (Art. 20 GDPR): You can request your data in a machine-readable format.
• Right to restriction of processing (Art. 18 GDPR): You can request that we restrict processing of your data.
• Right to object (Art. 21 GDPR): You can object to processing based on legitimate interest.
• Right to lodge a complaint: You can file a complaint with a supervisory authority. The competent authority for Newmatik GmbH is the Landesbeauftragte für den Datenschutz und die Informationsfreiheit Rheinland-Pfalz.

To exercise any of these rights, contact us at service@newmatik.com.

10. International Data Transfers

Your primary data is stored in the EU (Supabase, Frankfurt). Cloudflare may temporarily cache content at edge locations worldwide but does not permanently store personal data outside the EU. Sentry ingests data via its EU endpoint. Where data is transferred outside the EU/EEA, appropriate safeguards are in place, including EU Standard Contractual Clauses (SCCs).

11. Fonts

All fonts used on this website are self-hosted on our servers. No data is transmitted to Google or any external font provider when you visit our website.

12. Changes to This Policy

We may update this privacy policy from time to time. If we make material changes, we will notify you by requiring re-acceptance through the Service. The date of the last update is shown at the top of this policy.