Privacy Policy

Zeptix is a multi-tenant platform. There are three user groups with different processing activities:

• Visitors — any person visiting zeptix.io without registering. Zeptix is the controller.
• Tenant owners (“bot operators”) — person/company creating a paid account, configuring a chatbot and providing it on a subdomain. Zeptix is the controller for the account data.
• End-users (“bot visitors”) — any person interacting with a chatbot operated by a tenant. Zeptix and the respective tenant owner are joint controllers (Art. 26 GDPR, see section 12).

Where the same operator runs a first-party product on a linked domain (e.g. VelonLabs: velonlabs.dev for coding chat, velonlabs.app for its tools cloud and velonlabs.io with its connected workspace), login, membership and credits are managed for the same tenant through api.zeptix.io. No second user account is created. Legal bases are Article 6(1)(b) GDPR for accounts and credits and Article 6(1)(f) for necessary security logs (legitimate interest: preventing abuse). The strictly necessary vl_token cookie stays on api.zeptix.io and uses SameSite=None; Secure; HttpOnly for cross-site requests from custom and satellite domains. It is not a marketing cookie. Linking a domain enables no additional marketing tracking: GA4/Ads remain restricted to Zeptix marketing hosts. VelonLabs is a first-party product of the same operator; there is no joint controllership with third-party tenant owners for this product. Article 26 arrangements for third-party customer bots remain unchanged.

3.1 Server log files. On every visit, technical data is transmitted to our servers (location: Germany, Hetzner): IP address, date/time, requested URL, HTTP status code, transferred data volume, referrer URL, user agent.

Purpose: ensuring operation, protection against attacks, error analysis. Legal basis: Art. 6 (1)(f) GDPR. Our legitimate interest is the secure and stable operation of the service; as only technically necessary data is processed briefly, your protected interests do not override it. Storage period: 14 days, then automatic deletion or anonymization (system-level log rotation).

3.2 Cookies and similar technologies. We use technically necessary cookies and storage mechanisms without consent (§ 25 (2) No. 2 TDDDG):

• vl_token — JWT auth token (HttpOnly, Secure, SameSite=None; also for satellite login), 30 days
• zeptix_locale — language preference (DE/EN), 30 days
• zeptix_tenant — bot subdomain mapping for the chat page, 1 day
• vl_consent — stores your cookie consent (statistics/marketing), 180 days
• localStorage zx-theme — theme preference (light/dark), persistent until browser cache is cleared

Statistics and marketing cookies (Google Analytics 4, Google Ads — see 3.5) are only set after your explicit consent. On your first visit we show an equivalent cookie banner with the options “Only necessary”, “Settings” and “Accept all” (no pre-ticked boxes). Until you consent, no statistics/marketing scripts are loaded (Google Consent Mode v2, default “denied”). You can change or withdraw your choice at any time via the “Cookie settings” link in the footer. A complete overview is available at zeptix.io/cookies.

3.3 Cloudflare. For service delivery we use services of Cloudflare, Inc. (San Francisco, USA). When the site is accessed, technically necessary connection data (IP, user agent, referrer) is transmitted to Cloudflare servers. Cloudflare is certified under the EU-US Data Privacy Framework. We use Cloudflare Turnstile as bot protection. Legal basis: Art. 6 (1)(f) GDPR. A DPA including standard contractual clauses is in place with Cloudflare.

3.4 Anonymous traffic measurement (first-party, cookieless). We run our own privacy-friendly traffic measurement to understand how many people visit our marketing pages (zeptix.io, zeptix.de, zeptix.dev), which pages are viewed and via which source/campaign visitors arrive. No cookie and no identifier is stored on your device. Per page view we process, in anonymized form: the requested path, referrer domain, any UTM parameters, coarse device type (mobile/desktop) and the country derived from Cloudflare. As part of this anonymous, cookieless measurement we also count aggregated conversion events (sign-up, trial start, purchase) — solely as totals per campaign/source, without any personal reference and without storing anything on your device. For daily statistics, shortened connection data is processed with a pseudonymous identifier that changes each day; results are evaluated only in aggregate. Because the measurement is anonymous and stores nothing on your device, no consent is required (German DPA guidance on consent-free reach measurement). Legal basis: Art. 6 (1)(f) GDPR (legitimate interest in operational and reach statistics). Storage location: our servers in Germany; the data is not shared with third parties. The measurement also runs on tenant bot subdomains, there too anonymously only.

3.5 Google Analytics 4 and Google Ads (only with consent). On our marketing pages we use — only after your consent (section 3.2) — Google Analytics 4 (statistics) and Google Ads (marketing/conversion measurement and remarketing). The provider is Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland); a transfer to Google LLC (USA) is possible. Processed data includes a shortened IP address (IP anonymization active), device/browser information, online identifiers in cookies (_ga, _ga_*, _gcl_*), pages viewed and interactions and — when you click one of our ads — conversion events (e.g. sign-up, trial, purchase). Purpose: reach and advertising-effectiveness measurement, campaign optimization. Legal basis: Art. 6 (1)(a) GDPR and § 25 (1) TDDDG (consent). Via Google Consent Mode v2, all storage/advertising signals default to “denied” and are only activated after your consent. Transfer to the USA relies on the EU-US Data Privacy Framework adequacy decision (Google LLC is certified) plus the EU standard contractual clauses. You can withdraw consent at any time with future effect via the Cookie settings in the footer; Google also offers a browser add-on to opt out (tools.google.com/dlpage/gaoptout). GA4 retention: by default up to 14 months at event level. More info: policies.google.com/privacy. Google Analytics and Google Ads are not loaded on tenant bot subdomains.

For the newsletter sign-up form, we collect: e-mail address, IP address, user agent, timestamps of sign-up and confirmation (double opt-in), confirmation token.

Purpose: sending the announced information, proof of consent. Legal basis: Art. 6 (1)(a) GDPR. Storage period: until withdrawal, then deletion of sign-up data within 30 days; consent proof data 3 years (§ 195 BGB).

Providing your email address is voluntary; without it we cannot send the newsletter. You can withdraw your consent at any time via the unsubscribe link.

E-mail dispatch is performed via IONOS SE (Montabaur, Germany) — servers in Germany, DPA in place.

When you create a paid account, we process: e-mail address, display name, password (secure password hash, no plaintext), Stripe customer ID, account creation/login timestamps, selected plan and status.

Purpose: contract performance (Art. 6 (1)(b) GDPR), authentication, billing. Storage period: contract duration + statutory retention periods (10 years under § 147 AO for invoice-relevant data, otherwise 30 days after account deletion). If a subscription ends, the related chatbot is deactivated and retained for up to 60 days for export, reactivation or support cases.

Providing this data is required to conclude the contract; without it no account can be created and no bot operated.

When you register with email and password, we send a confirmation email containing a one-time, time-limited verification link. For this we process: your email address, a cryptographic token (stored only as a hash), timestamps of the request and confirmation, and the IP address and user agent of the request.

Purpose: to prove that the email address belongs to you, to prevent fake and disposable registrations, and to unlock the free starting credits. Legal basis: Art. 6 (1)(b) GDPR (performance of the usage relationship) and Art. 6 (1)(f) GDPR (legitimate interest in preventing abuse). When registering via an external provider (Google, Discord), the email address already confirmed by that provider counts as verified. Storage period: verification tokens expire after 24 hours or upon confirmation; the verification status is stored for the lifetime of the account.

To prevent abuse of free starting credits through multiple accounts, we process email and sign-in details, IP address and network range, a pseudonymous device/browser identifier (fingerprint), coarse device and system properties and registration frequency. The identifier is computed locally from browser characteristics and device properties; we mainly receive hash values and selected coarse device properties. Raw browser signals are not transmitted to us. A local identifier supports recognition. Other indicators include unusual email or network associations and previously used social sign-in identities. These data may be updated at later sign-ins.

This check primarily determines whether and to what extent the free starting credits are granted (0 instead of starting credits where abuse is reasonably suspected; the starting balance may also be released in time-based portions / throttled). In clear cases where the same device has already obtained free starting credits for another account of the same chatbot, the newly added secondary account may be blocked for that chatbot; the first ("genuine") account, any paid purchases already made and earned balance remain unaffected. There is no evaluation with legal or similarly significant effect within the meaning of Art. 22 GDPR. On request we review a negative assessment or block manually.

Legal basis: Art. 6 (1)(f) GDPR. Our legitimate interest is protection against the abusive multiplication of owner-financed free credits. These signals are not used for advertising or profiling purposes and are not combined across tenants for marketing. Storage period: grant logs and abuse signals (including the hashed device identifier, the structured coarse hardware subset and the IP at registration time) for up to 12 months, then deletion or anonymization.

Optional contact details as a trust anchor. You may voluntarily add contact details (name, address, phone number) in your account. This is not mandatory. These details help verify your account and reduce any time-based throttling of your starting credits. We additionally store the phone number as a hash value to detect reuse of the same number across multiple accounts as a weak abuse signal (legal basis Art. 6 (1)(b) and (f) GDPR). This data is not shared with third parties for advertising.

If enabled by the bot operator, you can use GitHub to sign in, register where permitted, or link your account under “My account”. Sign-in and registration are enabled separately. For authentication and identification, we store your GitHub user ID, login, display name, avatar URL, verified email address and linking/sign-in timestamps. The legal basis is Art. 6(1)(b) GDPR for the sign-in function you choose. The link remains stored until you disconnect it or delete your account; other account data is subject to the remaining retention periods in this statement.

The login app requests only profile and email access. OAuth tokens are used for server-side identity retrieval and are not stored persistently as part of the login link. Repository access requires separate GitHub App authorization in Agent Mode. When you open GitHub sign-in, GitHub receives technical connection data and processes it under the GitHub Privacy Statement; processing in the USA is possible. You can disconnect the link in your account if another sign-in method remains, and separately revoke the app authorization on GitHub.

If you connect your own Vercel account, we store the installation and, where applicable, team identifier, authorised project/deployment associations and encrypted OAuth credentials, bound to your Zeptix account and selected tenant. This fulfils your requested connection and deployment (Art. 6(1)(b) GDPR). Credentials are excluded from website files and AI prompts. “Disconnect” clears the local connection and stored launch data; you can also revoke the integration at Vercel. Published websites remain in your Vercel account.

Only when you explicitly deploy do we send the reviewed website files or selected GitHub repository/commit association and required project data to Vercel Inc. Vercel receives technical connection data when you connect. Vercel processes this data for your hosting account under its terms and Privacy Policy; processing in the USA is possible. The optional Zeptix chatbot stays at Zeptix; its knowledge base and conversation history are not transferred to Vercel as website files.

Chatbot operators may upload content themselves or enter it via the training AI in the dashboard:

• Knowledge-base documents and training content (PDF or dialog-based input, currently max. 50 MB per file) — text is extracted or adopted, chunked and stored in a database
• System prompt — defines bot behavior
• Branding (logo, colors, bot name)

Uploaded documents are not shared with third parties except for the specific LLM request (see section 7). Storage location: our servers in Germany. Legal basis: Art. 6 (1)(b) GDPR. Storage period: contract duration; after contract end the bot is deactivated and the knowledge base is retained for up to 60 days for export or reactivation, then deleted unless statutory retention obligations require otherwise.

Chatbot operator responsibility: As the chatbot operator, you are responsible for holding the necessary rights to uploaded content or content entered via the training AI and for not adding personal data of third parties without legal basis.

When an authenticated chatbot operator or end-user interacts with a chatbot hosted on Zeptix, the following data is processed.

Implementation status (as of 14.10.2026): Registered end-users may interact with a tenant chatbot depending on the bot configuration. The respective tenant owner decides on access, end-user plan limits, free credits, upgrades and credit top-ups.

7.1 What is stored. Chat content and conversation ID in our database in Germany. Tenant attribution, timestamps, account identifiers, tenant membership status, plan/credit quotas, usage counters and billing events are processed where required for operation, abuse prevention, support and billing. IP address 14 days in server logs; accounting and proof-relevant counters for up to 24 months.

Chat storage period (role-based): If you are logged in (tenant owner or registered end-user), your conversation history is retained as long as your account exists — ordinary AI chats can be deleted by you at any time; separate procedures apply to Agent archives (section 7a), and it is removed when your account is deleted. Chats of anonymous guest users (without an account) are automatically deleted after no more than 90 days, as there is no lasting purpose and no self-management option here.

Source of data (Art. 14 GDPR): We generally receive end-user data directly from chat input. Where a tenant owner submits or assigns data about their end-users within the joint controllership (Section 12, e.g. during end-user management), such data originates from the respective tenant owner.

There is no tracking across multiple tenants for advertising purposes. Optional re-identification or marketing features may only be activated by the tenant owner if a separate legal basis exists.

7.2 Disclosure to AI service providers. To provide the requested AI service, we transmit necessary messages, knowledge excerpts and project content to the AI services used. A task may involve several providers; their use depends on the feature, plan and selected settings. The provider overview identifies the actual recipients, data categories, regions, transfer safeguards and differing retention and training conditions. Optional providers process content only after the corresponding active selection. The following sections additionally apply to Agent Mode and editors.

Legal bases are Art. 6(1)(b) GDPR for the agreed service and point (f) for secure operations. Processing outside the EEA, particularly in the USA, may occur. The safeguards described for each provider apply, particularly EU standard contractual clauses and relevant valid adequacy decisions. You can request information and copies of applicable safeguards through our privacy contact. Agreed information and objection rights for chatbot operators remain: changes to automatically used processors are announced at least 14 days in advance; additional optional AI providers are identified in the overview no later than their availability.

7.3 Notice on data input. End-users should not enter sensitive personal data (health, financial, account, password data) unless the tenant owner explicitly indicates this and has implemented appropriate safeguards.

7.4 Tenant-internal caching and optimization. To control costs and speed up responses, Zeptix may cache previously answered, similar requests within the same tenant and reuse or rephrase them for later answers. The cache is tenant-isolated, is not used across tenants and does not train third-party AI models. Processing of personal content for training purposes is generally not performed without explicit consent.

7.5 Safety moderation. To protect end-users and tenant owners, chat content is automatically checked by safety services from OpenAI for harmful content (self-harm, sexual abuse, violence, hate, illicit activities). Text excerpts are transmitted; OpenAI does not use API data for training under their data policy. Flagged events are stored in our German-located database for 6 months (proof to authorities, Art. 6(1)(c)/(f) GDPR). Tenant owners can configure in their dashboard via which channels (Discord webhook, e-mail, in-app) they want to be alerted.

7.6 End-user management by tenant owners. Tenant owners can view registered end-users of their bot in their dashboard and take status actions (active / suspended / banned / deleted). They can also configure end-user plan limits, free credits and credit modes. This management is part of the joint controllership (see Section 12). Status changes and relevant quota changes are logged with timestamp, reason and acting person (audit log, retained for 12 months).

7.7 API access and webhooks (developer features). Tenant owners can optionally set up read-only API access (personal access token) to their own bot's data and create webhooks that deliver bot events (e.g. completed messages) to an HTTPS endpoint they operate. If owners enable webhooks, conversation content of their bot is forwarded to that endpoint; the owner is responsible for processing it there. For security we log the last use of an API token (timestamp, IP) and webhook delivery logs (status, response excerpt). Legal basis: Art. 6 (1)(b) and (f) GDPR.

7.8 Sharing features and launch announcement (voluntary). On publicly enabled chatbots and in the dashboard we offer share buttons for social networks (X, LinkedIn, Facebook, WhatsApp, e-mail). These are implemented as plain links ("Shariff" principle): no third-party scripts, no tracking pixels and no cookies are loaded. Data only flows to the respective network once you actively click a button and open its page; from that point the privacy policy of the respective provider applies. If your browser supports the Web Share API, your device's native system share dialog is used instead — we do not process any additional data in that case either. When a tenant owner makes their bot public for the first time, they can voluntarily (opt-in) choose to announce their launch in our official Discord server (#launches). Only in that case do we transmit the public bot name, a short description and the bot link to Discord (Discord Inc., USA); no transfer occurs without explicit consent. Legal basis: Art. 6 (1)(a) and (f) GDPR (consent or legitimate interest in reach). For the transfer to Discord (USA) we rely on the EU Standard Contractual Clauses.

Agent Mode processes account and workspace associations, display names, chats, supplied project files, changes and technical outputs to carry out your tasks. Project files and backups may contain personal data, Git history and author information. Chats and file checkpoints are stored so work can be resumed.

Purposes are the requested editing, execution, restoration, collaboration and usage billing (Art. 6(1)(b) GDPR). Operational, security and error analysis rely on Art. 6(1)(f) GDPR; legally required billing records on point (c). Anyone providing other people’s data must have the necessary authority and legal basis. For processing on behalf of an organisation, responsibilities and any agreement required by Art. 28 GDPR depend on the actual task; workspace sharing does not replace that agreement.

Workspace data is stored on our infrastructure in Germany. Several AI service providers may process the conversation, file and tool context and selected images needed for an AI task. Their use depends on the requested feature and applicable settings; Chat and Agent Mode may use different settings. The provider overview identifies recipients, data categories, processing regions and relevant retention and training conditions. Optional services are used only when selected. There is no general guarantee of exclusively European processing. We do not use content to train our own AI models.

GitHub is optional. Connecting involves processing profile and account associations, authorised repositories, permissions and invitations. GitHub receives data needed for sign-in, search and expressly requested file, write or membership actions, including entered search terms and authorised content. The relevant GitHub account’s contractual and privacy terms apply; processing outside the EU is possible.

Authorised workspace members see, within their role, the files, all past and future chats in that source and the chat creator’s display name. This does not share other workspaces or personal account areas. Revoking a share ends that access; separate GitHub permissions and copies already received may remain.

For operations, error analysis and billing, we store technical usage and error records, runtimes, AI and credit consumption and their association with the user and task. Authorised platform administrators may inspect chats, files and these records on a read-only basis for support and security review. This does not make them public. Technically necessary browser storage remembers interface and layout preferences.

Agent chats and file checkpoints are retained to provide and resume the workspace. Stopping a task, removing a workspace entry or disconnecting an integration does not automatically erase these archives. They are deleted when the service purpose ends or a valid erasure request is received, unless legal obligations or overriding legitimate grounds require retention. Billing records, continuing shared workspaces and copies at GitHub require separate consideration.

The general account export and deletion functions do not yet fully cover Agent archives. You can request access, export, correction, erasure or restriction at [email protected]. Identify the account and workspace without sending passwords or keys. After identity and authorisation checks, we handle the request within statutory deadlines. Complaint and objection rights remain; a separate request to GitHub may be needed for data in your own GitHub account.

For an expressly connected server, we process connection and access details, the selected project area and transfer records. Credentials are encrypted at rest and used for the requested connection; they are not sent to model providers as AI context. Selected files are edited as workspace copies and may be sent to AI services to the extent necessary. Import safeguards do not replace your review for personal data and embedded secrets.

Optional FiveM server controls process resource states, player counts without player identifiers, limited technical performance measurements and action records. Disconnecting the server deletes our active credentials and control authorisations. Existing workspace copies follow the deletion rules above. Backups and installed control files on your server remain under your management; an installed controller must be stopped or removed separately. Operational backup copies are replaced through the regular backup cycle.

Privacy: Agent Mode · Subprocessors · GitHub Privacy Statement

Payments are processed via Stripe Payments Europe, Limited (Dublin, Ireland). From Stripe we only receive the data necessary for contract execution (payment status, Stripe customer ID, last 4 digits of the card). We do not store full credit card numbers or CVCs.

As an alternative payment method we offer PayPal, operated by PayPal (Europe) S.à r.l. et Cie, S.C.A. (Luxembourg). If you choose PayPal, the data required for payment processing (name, e-mail address, PayPal transaction/order ID, amount) is transmitted to PayPal and stored by us only as a transaction reference. We do not see or store full payment details (e.g. bank account information).

Legal basis: Art. 6 (1)(b) GDPR. Stripe’s privacy policy: stripe.com/privacy · PayPal: paypal.com/us/legalhub/privacy-full.

Personal data is generally not shared except with:

• Service providers (hosting, delivery, email, payments and AI processing; processors or independent controllers depending on their role)
• Joint controllers (tenant owners, see section 12)
• Authorities, where legally obliged to provide information

Service providers, processing locations and privacy conditions: zeptix.io/subprocessors.

Some processors (in particular LLM providers, Cloudflare) are based in the USA. Transfers occur exclusively on the basis of:

• EU-US Data Privacy Framework (where the provider is certified)
• Standard contractual clauses of the EU Commission (Decision 2021/914) incl. supplementary technical measures
• where applicable, explicit consent in individual cases

You have the following rights at any time:

• Access (Art. 15 GDPR) — e-mail with subject “Access”
• Rectification (Art. 16 GDPR) — in the account or by e-mail
• Erasure / right to be forgotten (Art. 17 GDPR)
• Restriction of processing (Art. 18 GDPR)
• Data portability (Art. 20 GDPR) — delivery as JSON
• Objection (Art. 21 GDPR)
• Withdrawal of consent (Art. 7 (3) GDPR)

Contact for exercising rights: [email protected]

You also have the right to lodge a complaint with a supervisory authority (Art. 77 GDPR). Competent:

Commission for Personal Data Protection (CPDP)
2 Prof. Tsvetan Lazarov Blvd.
Sofia 1592, Bulgaria
Phone +359 2 915 3519
www.cpdp.bg

To protect against misuse, we may request proof of your identity to process your request where there are reasonable doubts (Art. 12 (6) GDPR). We typically process requests within 7 days, at the latest within the statutory period of one month (Art. 12 (3) GDPR).

There is no solely automated decision producing legal effects or similarly significant effects within the meaning of Art. 22 GDPR. In particular, we do not create profiles to evaluate individuals.

The chatbot generates AI-assisted answers — this is the contractually agreed service itself, not a decision about you. The automated safety moderation (Section 7.5) filters harmful content only and makes no decision about your person. Decisions to ban or suspend end-users are made by the respective tenant owner (with human involvement), not solely automatically by the platform.

For the processing of end-user data in chatbots operated by tenant owners on Zeptix, Zeptix and the respective tenant owner are joint controllers within the meaning of Art. 26 GDPR.

Allocation of responsibilities:

• Provision of the technical platform — Zeptix
• Security of the platform (TOMs, backups, patches) — Zeptix
• Selection of knowledge base and system prompt — Tenant
• Information of end-users about the processing — primarily Tenant
• Handling data subject requests for chats — primarily Tenant (Zeptix forwards)
• Legal basis for chat content — Tenant

The full agreement is concluded bindingly between Zeptix and each tenant during account onboarding. End-users may exercise their rights both against Zeptix and against the respective tenant.

Zeptix provides a GPAI-based platform on which tenant owners run their own chatbots. Where the EU AI Act applies, the following notes are relevant:

• Art. 50 — transparency: end-users are clearly informed before the first chat that they are interacting with an AI (see AI-disclosure modal and end-user terms).
• Art. 5 — prohibited practices: tenant owners are contractually bound not to use their bots for prohibited AI applications (manipulative techniques, social scoring, real-time biometric identification etc. — see Acceptable Use Policy).
• Art. 6 / Annex III — high-risk: Zeptix is not approved for high-risk applications. Anyone wanting to use a bot for e.g. medical diagnosis, credit scoring, recruitment, justice or migration must clarify this with us in writing in advance.
• Art. 85 — right to complain: if you believe a Zeptix-hosted bot violates the EU AI Act, you may file a complaint with the competent market surveillance authority and notify us via zeptix.io/legal/incident-reporting.
• Logging & retention: where required (esp. for high-risk configurations), we keep records pursuant to Art. 12/19 AI Act and provide them to authorities on request.

Single point of contact for AI Act queries and formal authority requests is the e-mail address listed in our imprint: [email protected].

For reporting problematic content or bot behaviour, a central notice-and-action channel exists at zeptix.io/legal/incident-reporting. You will also find the required information for a valid notice and the responsible mailboxes for privacy, abuse and law enforcement.

• Server logs (IP, user agent) — 14 days
• Newsletter sign-up data — until withdrawal, then 3 years proof
• Tenant account data — contract duration + 30 days
• Accounting-relevant data — 10 years (§ 147 AO)
• Ordinary AI chats of logged-in users — until account deletion (deletable by you at any time); Agent archives: section 7a
• Chats of anonymous guest users — no more than 90 days, then deletion
• Safety-moderation events (flagged content excerpts, max. 500 chars) — 6 months
• Audit log / end-user status change logs (incl. IP, suspension, ban) — 12 months
• Knowledge-base documents — contract duration + 30 days
• Backups (encrypted DB dumps) — rolling 14 days; after deletion, data may therefore persist in backup copies for up to 14 days
• Cookies zeptix_locale — 30 days; zeptix_tenant — 1 day; vl_consent (cookie consent) — 180 days
• Anonymous first-party traffic measurement (cookieless, pseudonymous daily hash) — up to 24 months aggregated
• Google Analytics 4 (only with consent) — event data by default up to 14 months; Google Ads conversion cookies up to 90 days

We take technical and organizational measures pursuant to Art. 32 GDPR:

• TLS encryption (HTTPS) for all connections
• Protection of stored credentials through encryption or secure password hashes
• Restricted access to production systems via SSH keys with passphrase
• Regular system updates (at least monthly)
• Automated backups, tested recovery
• Logging and monitoring of security-relevant events
• Separation of test and production environment

Full TOM documentation can be provided on request.

Data breaches. In the event of a personal data breach, we report it where required to the competent supervisory authority within 72 hours (Art. 33 GDPR) and inform affected individuals without undue delay where there is a high risk (Art. 34 GDPR).

In our assessment, the current processing (AI-assisted chat without profiling, without automated individual decisions, without systematic processing of special categories of data) does not reach the threshold of a likely high risk that would mandate a data protection impact assessment. We review this continuously and will carry out a DPIA as soon as risk-increasing features are added (e.g. profiling, large-scale processing of sensitive data, or automated decisions with significant effects).

This privacy policy is updated in case of material changes. Logged-in tenant owners are informed before such changes take effect via e-mail. The current version is always available at zeptix.io/privacy.

Current version: 14.10.2026