Privacy Policy

4.1 SSL/TLS Encryption

Communication between your browser and our servers occurs via HTTPS (TLS encryption). This protects transmitted data from access by third parties.

4.2 Server Log Files

Each time our website is accessed, the web server automatically collects:

• IP address (anonymized after 7 days by truncating the last octet: IPv4 last 8 bits zeroed, IPv6 last 80 bits zeroed)
• Date and time of the request
• Requested page / URL
• Referrer URL
• Browser type and version
• Operating system

Legal basis: Art. 6(1)(f) GDPR. The data is used to ensure operation and to defend against attacks. Log files are deleted after 30 days.

4.3 Hosting

Our website is hosted by:

Hetzner Online GmbH
Industriestr. 25
91710 Gunzenhausen, Deutschland

Data center: Falkenstein/Vogtl. (Germany, EU).

Data Processing Agreement: hetzner.com/rechtliches/auftragsdatenverarbeitung

A data processing agreement (Art. 28 GDPR) is in place. All data is processed exclusively on servers in Germany. No CDN or WAF (e.g., Cloudflare) is currently in use; the reverse proxy (Nginx) runs on the same server.

5.1 Registration and Login

When registering for Faktor400, we process:

• Email address
• Password (stored using state-of-the-art hashing, never in plain text)
• Name (optional)
• Time of registration

Authentication is handled by Supabase Auth (Supabase, Inc., USA). Supabase is responsible for password hashing (bcrypt, server-side), email verification, and the password reset flow. Authentication tokens are stored in your browser's Local Storage (PKCE-based OAuth flow).

More information: supabase.com/privacy

Login via Google (OAuth 2.0): Alternatively, you can register and log in using your Google account. The following data is transmitted (OAuth scopes: email, profile):

• Email address
• Profile name (first and last name)
• Profile picture URL
• Google User ID

For Google's own data processing, their privacy policy applies: policies.google.com/privacy

Legal basis: Art. 6(1)(b) GDPR (performance of a contract).

5.2 Amazon Seller Data

When using Faktor400, users connect their Amazon Seller account via the Amazon SP-API and/or Amazon Ads API. In this context, we process business data such as product data, inventory data, fees, advertising campaign data, and aggregated revenue/order metrics. For this data, BeyondWega is the data controller within the meaning of the GDPR.

5.3 Amazon End-Customer Data (Data Processing)

Note: This privacy policy is primarily directed at website visitors and registered Faktor400 users. The following explanation of Amazon buyer data processing serves to provide transparency about our role as a data processor; the primary data protection information for buyers is the responsibility of the respective Seller as the data controller.

Order data retrieved via the Amazon SP-API may contain personal data of Amazon buyers (buyer name, delivery address, and where applicable phone number). For this data, the Seller is the data controller; BeyondWega acts as a data processor within the meaning of Art. 28 GDPR.

A Data Processing Agreement (DPA) is concluded between BeyondWega and the Seller upon connection of the SP-API. See DPA

Processed end-customer PII: buyer name, delivery address, and (where not masked by Amazon) email address. Payment information of buyers is not stored by Faktor400.

Amazon Data Protection Policy (DPP): Independent of the GDPR, SP-API data is subject to the Amazon Data Protection Policy. Personal buyer data (PII) may only be used for order fulfillment purposes and is automatically anonymized within 30 days of shipment (buyer names and addresses). Aggregated business data (revenue, ASIN metrics) is not affected.

Retention period: Amazon data is retained for as long as the user account is active. After account deletion, all data is deleted within 30 days, unless statutory retention obligations apply. For trial users without a subscription: 30 days after the end of the trial phase (see GTC § 3(5)).

5.4 Billing Data

We store billing address, company name, VAT ID, invoice history, payment status, and selected plan. This data is subject to retention obligations (§ 147 AO, § 257 HGB) and will be retained for up to 10 years after the end of the contract.

5.5 Payment Processing

Stripe Payments Europe, Limited (SPEL)
1 Grand Canal Street Lower, Grand Canal Dock, Dublin 2, Ireland

Stripe is an independent data controller for the processing of credit card and payment data. We do not store any credit card or bank account data ourselves.

5.6 Transactional Emails

For sending transactional emails, we use Resend, Inc. (San Francisco, CA, USA). Data transfer to the USA is based on the EU-US Data Privacy Framework (Art. 45 GDPR). Legal basis: Art. 6(1)(b) GDPR.

6.1 Strictly Necessary Cookies

We use cookies that are technically necessary for the operation of the website and the platform (e.g., session tokens, language settings). These cookies are set without consent.

Legal basis: § 25(2) TDDDG (technically required), Art. 6(1)(f) GDPR.

Supabase authentication tokens are stored in your browser's Local Storage (key: sb-auth-token). During the OAuth flow, a PKCE verifier is additionally stored in Session Storage. Server-side, @supabase/ssr sets additional SSR cookies. The language preference is stored as a cookie (faktor400-language). All of these storage operations are technically necessary and fall under § 25(2) TDDDG.

6.2 Analytics and Marketing

Within the Faktor400 app, we use PostHog as an analytics tool. PostHog is operated via the EU instance (eu.posthog.com), so analytics data is processed exclusively on servers in the EU.

Collected data: Explicitly defined events (e.g., page views, feature usage). Autocapture is disabled; only deliberately instrumented events are captured. Session recording is disabled. The Do-Not-Track browser setting is respected (respect_dnt: true). Users are identified by their app user ID (not the Supabase UID).

Legal basis: Art. 6(1)(a) GDPR (consent) in conjunction with § 25(1) TDDDG. Analytics cookies are only set after explicit consent (via cookie banner). You may withdraw your consent at any time with effect for the future.

Provider: PostHog, Inc., San Francisco, CA, USA — EU instance (data processing in the EU).

On the landing page (faktor400.com), no analytics or marketing cookies are currently used.

Right to Lodge a Complaint

You have the right to lodge a complaint with a data protection supervisory authority. The supervisory authority responsible for us is:

The State Commissioner for Data Protection of Lower Saxony
Prinzenstraße 5, 30159 Hannover
www.lfd.niedersachsen.de

You may also contact the supervisory authority of your place of residence or workplace.