Privacy Policy

4.1 SSL/TLS Encryption

Communication between your browser and our servers occurs via HTTPS (TLS encryption). This protects transmitted data from access by third parties.

4.2 Server Log Files

Each time our website is accessed, the web server automatically collects:

• IP address (anonymized after 7 days by truncating the last octet: IPv4 last 8 bits zeroed, IPv6 last 80 bits zeroed)
• Date and time of the request
• Requested page / URL
• Referrer URL
• Browser type and version
• Operating system

Legal basis: Art. 6(1)(f) GDPR. The data is used to ensure operation and to defend against attacks. Log files are deleted after 30 days.

4.3 Hosting

Our website is hosted by:

Hetzner Online GmbH
Industriestr. 25
91710 Gunzenhausen, Deutschland

Data center: Falkenstein/Vogtl. (Germany, EU).

Data Processing Agreement: hetzner.com/rechtliches/auftragsdatenverarbeitung

A data processing agreement (Art. 28 GDPR) is in place. All data is processed exclusively on servers in Germany. No CDN or WAF (e.g., Cloudflare) is currently in use; the reverse proxy (Nginx) runs on the same server.

5.1 Registration and Login

When registering for Faktor400, we process:

• Email address
• Password (stored using state-of-the-art hashing, never in plain text)
• Name (optional)
• Time of registration

Authentication is handled by Supabase Auth (Supabase Pte. Ltd., Singapore; database and sign-in service are hosted in the EU region Frankfurt). Supabase is responsible for password hashing (bcrypt, server-side), email verification, and the password reset flow. Sign-in runs through our server: Supabase's authentication tokens stay there, your browser only receives an HttpOnly session cookie (__Host-f400_session) and stores no access token in Local Storage. The public demo does not use Supabase sign-in (see 6.1).

More information: supabase.com/privacy

Login via Google (OAuth 2.0): Alternatively, you can register and log in using your Google account. The following data is transmitted (OAuth scopes: email, profile):

• Email address
• Profile name (first and last name)
• Profile picture URL
• Google User ID

For Google's own data processing, their privacy policy applies: policies.google.com/privacy

Legal basis: Art. 6(1)(b) GDPR (performance of a contract).

5.2 Amazon Seller Data

When using Faktor400, users connect their Amazon Seller account via the Amazon SP-API and/or Amazon Ads API. In this context, we process business data such as product data, inventory data, fees, advertising campaign data, and aggregated revenue/order metrics. For this data, BeyondWega is the data controller within the meaning of the GDPR.

5.3 Amazon End-Customer Data (Data Processing)

Note: This privacy policy is primarily directed at website visitors and registered Faktor400 users. The following explanation of Amazon buyer data processing serves to provide transparency about our role as a data processor; the primary data protection information for buyers is the responsibility of the respective Seller as the data controller.

Order data retrieved via the Amazon SP-API may contain personal data of Amazon buyers (buyer name, delivery address, and where applicable phone number). For this data, the Seller is the data controller; BeyondWega acts as a data processor within the meaning of Art. 28 GDPR.

A Data Processing Agreement (DPA) is concluded between BeyondWega and the Seller upon connection of the SP-API. See DPA

End-customer PII actually stored by Faktor400: Of the buyer data potentially available via the SP-API, Faktor400 extracts and stores only the email address as masked by Amazon. Buyer name, phone number and the street, postal code and city of the delivery address are neither extracted nor stored; of the delivery address only the country (country code) is taken over for VAT purposes (data minimization, Art. 5(1)(c) GDPR). Buyers’ payment data (card or account details) is not stored either; only the payment method Amazon reports for the order (e.g. “Other” or “COD”) is kept.

Amazon Data Protection Policy (DPP): Independent of the GDPR, SP-API data is subject to the Amazon Data Protection Policy. Among other things, it requires that personal buyer data (PII) may only be used for order fulfillment purposes and must be deleted within 30 days of shipment (unless statutory retention obligations apply). Faktor400 implements this by automatically pseudonymizing the only stored buyer PII — the masked email address — 30 days after the end of the shipping window Amazon states for the respective order (if absent: the end of the delivery window, otherwise the order date) (the email field is set to null). The order header relevant under GoBD (order number, date, amounts) is retained and could theoretically remain re-identifiable via the order number — the remaining stored data is therefore pseudonymous, not fully anonymous. Aggregated business data (revenue, ASIN metrics) is not affected.

Retention period: Amazon data is retained for as long as the user account is active. After account deletion, all data is deleted within 30 days, unless statutory retention obligations apply. For trial users without a subscription: 30 days after the end of the trial phase (see GTC § 3(5)).

5.4 Billing Data

We store billing address, company name, VAT ID, invoice history, payment status, and selected plan. This data is subject to retention obligations (§ 147 AO, § 257 HGB) and will be retained for up to 10 years after the end of the contract.

5.5 Payment Processing

Stripe Payments Europe, Limited (SPEL)
1 Grand Canal Street Lower, Grand Canal Dock, Dublin 2, Ireland

Stripe is an independent data controller for the processing of credit card and payment data. We do not store any credit card or bank account data ourselves.

5.6 Transactional Emails

For sending transactional emails, we use Plus Five Five, Inc. ("Resend", 2261 Market Street #5039, San Francisco, CA 94114, USA). Data transfer to the USA is based on the EU-US Data Privacy Framework (Art. 45 GDPR). Legal basis: Art. 6(1)(b) GDPR.

6.1 Strictly Necessary Cookies

We use cookies that are technically necessary for the operation of the website and the platform (e.g., session tokens, language settings). These cookies are set without consent.

Legal basis: § 25(2) TDDDG (technically required), Art. 6(1)(f) GDPR.

In the app, sign-in runs through our server: Supabase's authentication tokens stay there, your browser only receives an HttpOnly session cookie (__Host-f400_session); during a Google sign-in or a password reset, one more HttpOnly cookie is set for a short time. Local Storage only holds cached profile data (auth_user), no access token. The public demo has no sign-in: for the anonymous demo session an access token (auth_token) is kept in Local Storage and the renewal token in the HttpOnly cookie __Host-f400_refresh_token. The language preference is stored as a cookie (faktor400-language). All of these storage operations are technically necessary and fall under § 25(2) TDDDG.

6.2 Analytics and Marketing

Within the Faktor400 app, we use PostHog as an analytics tool. Analytics data is stored in PostHog's EU region (eu.posthog.com). Our contractual partner is PostHog, Inc. (USA); processing in the USA is also possible (see § 8).

Collected data: Explicitly defined events (e.g., page views, feature usage). Autocapture is disabled; only deliberately instrumented events are captured. Session recording is disabled. The Do-Not-Track browser setting is respected (respect_dnt: true). Users are identified by their app user ID (not the Supabase UID).

Legal basis: Art. 6(1)(a) GDPR (consent) in conjunction with § 25(1) TDDDG. Analytics cookies are only set after explicit consent (via cookie banner). You may withdraw your consent at any time with effect for the future.

Provider: PostHog, Inc., 2261 Market St., #4008, San Francisco, CA 94114, USA. Data processing agreement (DPA) dated October 9, 2026; storage in the EU region, transfers to the USA based on the EU Standard Contractual Clauses (see § 8).

On the landing page (faktor400.com), no analytics or marketing cookies are currently used.

Right to Lodge a Complaint

You have the right to lodge a complaint with a data protection supervisory authority. The supervisory authority responsible for us is:

The State Commissioner for Data Protection of Lower Saxony
Prinzenstraße 5, 30159 Hannover
www.lfd.niedersachsen.de

You may also contact the supervisory authority of your place of residence or workplace.