Privacy Policy.

1. Controller

The controller for the processing operations described in this policy is:

2. Scope and roles

This policy applies to the processing operations for which Nextaim GmbH is the controller: the website noirdoc.de, the status page (status.noirdoc.de), the customer portal (portal.noirdoc.de) with account and billing, and the metadata of gateway usage that we process for billing and security.

Where we also process account and usage data on behalf of the customer, for example for the audit logs of its organisation, the Data Processing Agreement (DPA) (Annex 1) applies to that processing.

Content that customers send through the gateway's API (prompts, files, outputs) is processed by us as a processor on behalf of the respective customer. This is governed by the DPA; the subprocessors engaged are listed in Annex 4 of the DPA. Data subjects with concerns about this content should contact the customer that uses the gateway.

3. Operation, customer account and billing

We operate the website, portal and gateway on servers of T-Systems International GmbH (T Cloud Public) as processor. The independently operated status page (status.noirdoc.de) runs on servers of Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany (German data centres), as processor; no customer data or API content is processed there. With every request, our servers process technically necessary data such as your IP address in order to deliver the services and to defend against attacks and misuse. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is secure and functional operation. The logs rotate by file size, and older entries are overwritten in the process.

For the customer account we process the following data:

• Account and contact data of users in the portal (name, business email address, organisation, role, acceptance of the Terms and Conditions with timestamp). Registration and sign-in run through an identity service that we operate ourselves.
• Usage metadata for billing, security and misuse prevention: timestamp, organisation and key identifier, requested model, token consumption; where masking is enabled, additionally the number and type of fields detected.
• Emails (invitations, account notifications, notices about credit) are sent via the transactional email service of Scaleway SAS, 8 rue de la Ville-l'Évêque, 75008 Paris, France, as processor.

The legal basis is Art. 6(1)(b) GDPR (contract) and, for security and misuse prevention, Art. 6(1)(f) GDPR with the interest in secure operation. We store this data for the term of the contractual relationship and beyond that where statutory retention obligations apply (Art. 6(1)(c) GDPR). Without name, email address and organisation we cannot set up an account.

For self-registration, we check, to prevent misuse, whether your request originates from the EU or an EFTA state (Switzerland, Norway, Iceland, Liechtenstein); we reject other registrations with a notice. For this purpose we match your IP address against a database stored on our own server (IP geolocation by DB-IP, database DB-IP City Lite, licence CC BY 4.0); no data is transferred to third parties in the process. We store the country and city determined in this way with the registration and sign-in event in the log of the identity service. We also limit the number of registrations per IP address and, instead of an external captcha service, use a self-operated computational challenge (proof of work). The legal basis is Art. 6(1)(f) GDPR (prevention of misuse).

Payment processing (Mollie)

If you top up credit in the portal, Mollie B.V., Keizersgracht 126, 1015 CW Amsterdam, Netherlands, processes the payment. For this purpose we transmit to Mollie your billing details (company name, address, billing email, VAT ID where applicable), the amount and an internal identifier of your organisation. You enter your card or account details directly with Mollie. The legal basis is Art. 6(1)(b) GDPR.

Mollie processes the payment data as an independent controller, among other things to fulfil its obligations as a payment institution. Details are set out in Mollie's privacy policy. Mollie issues the invoice for the top-up on our behalf as processor (Art. 28 GDPR). We retain the invoices in accordance with the retention periods under commercial and tax law (Art. 6(1)(c) GDPR).

Emails to customers (Brevo)

We send bulk emails to our customers, for example about contract changes, new developments and offers, via the email platform of Sendinblue SAS (Brevo), 9-17 rue Salneuve, 75017 Paris, France, as processor. For this purpose we process name, business email address and organisation as well as the delivery status of the email for the term of the contractual relationship.

We send notices about the contract, for example about changes to the Terms and Conditions, the DPA or our services, on the basis of Art. 6(1)(b) GDPR. We inform our customers about new developments and offers relating to Noirdoc on the basis of Art. 6(1)(f) GDPR; our legitimate interest is advertising our own services (§ 7(3) Act against Unfair Competition (UWG)). You may object to this at any time, for example via the unsubscribe link in each of these emails.

4. Data processing on the website

Consent management (Usercentrics)

We store your consent decision with the consent management platform of Usercentrics GmbH, Sendlinger Str. 7, 80331 München, so that we can demonstrate it (Art. 7(1) GDPR). In the process, your decision, its timestamp, device and browser information and an identifier are processed. The legal basis is Art. 6(1)(c) GDPR and, for storing the decision on your device, § 25(2) no. 2 Telecommunications Digital Services Data Protection Act (TDDDG). The decision remains stored on your device until you change it or delete your browser data; we retain the record for as long as we must be able to demonstrate the consent. Your decision applies jointly to noirdoc.de and the customer portal (portal.noirdoc.de).

Google Ads

Only if you consent in the consent banner do we use Google Ads with the Google tag (gtag.js) for conversion measurement and remarketing, provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. In doing so we record booked demo appointments as well as clicks on email links and on registration in the portal. In the portal we record only completed registrations. In the process, data such as IP address, device and browser information and pages visited may be transferred to Google LLC in the USA; the basis for this is the EU-US Data Privacy Framework. The storage period of the individual cookies is shown in the cookie settings. The legal basis is your consent under Art. 6(1)(a) GDPR and § 25(1) TDDDG. You can withdraw it at any time with effect for the future via the cookie settings. If you register after clicking an ad, we store the campaign data with your organisation's account until it is deleted, on the basis of our legitimate interest in measuring the success of our advertising (Art. 6(1)(f) GDPR).

Demo booking (Google Calendar / Google Meet)

If you book an appointment via noirdoc.de/en/demo, we process your name, email address and the selected time slot, and optionally also your company and message, in order to arrange the meeting. The legal basis is Art. 6(1)(b) GDPR; without name, email address and time slot we cannot arrange an appointment. To protect against misuse, we limit bookings per email address (Art. 6(1)(f) GDPR; our interest is protecting the booking system). We create the appointment in our Google Workspace calendar and send the invitation with a Google Meet link from there. Google Ireland Limited is our processor for this; a transfer to the USA is possible on the basis of the EU-US Data Privacy Framework. We delete the details as soon as we no longer need them for the meeting and its follow-up.

5. Your rights

Under the GDPR you have the right to:

• access to your data stored by us (Art. 15)
• rectification of inaccurate data (Art. 16)
• erasure (Art. 17)
• restriction of processing (Art. 18)
• data portability (Art. 20)
• withdrawal of consent given, with effect for the future (Art. 7(3))

To exercise your rights, write to hello@noirdoc.de. You also have the right to lodge a complaint with a data protection supervisory authority, for example the Bavarian State Office for Data Protection Supervision (Bayerisches Landesamt für Datenschutzaufsicht, BayLDA), www.lda.bayern.de.