Data protection

Controller

The controller for the processing of personal data on this website is NeckarByte UG (haftungsbeschränkt), Im Roggen 9, 71636 Ludwigsburg, represented by the managing director Philipp Häusser. Email: kontakt@neckarbyte.com, phone: +49 160 98722321. Contact for data protection: Philipp Häusser, haeusser@neckarbyte.com.

Basics

This privacy policy informs you about the nature, scope and purpose of the processing of personal data on the MadeForPrivacy website. We treat your personal data confidentially and in accordance with the statutory provisions, in particular the General Data Protection Regulation (GDPR) and the Federal Data Protection Act (BDSG). As this website evolves, this policy may also change; the version published here at the time applies. We use terms such as “personal data” or “processing” within the meaning of Art. 4 GDPR.

Hosting

This website is hosted by Hostinger International Ltd., 61 Lordou Vironos str., 6023 Larnaca, Cyprus. The servers are located in the European Union, currently in France. Hostinger processes on our behalf the data generated when the website is accessed, in particular server log files with IP addresses (see “Access data”), which we store to operate and secure the website; a data processing agreement under Art. 28 GDPR exists with Hostinger. The legal basis is our legitimate interest in a secure and reliable provision of the website (Art. 6(1)(f) GDPR).

Access data (server log files)

When the website is accessed, access data is stored in server log files for technical reasons and on the basis of our legitimate interest (Art. 6(1)(f) GDPR):

• page accessed and time of access
• amount of data transferred
• source or referring page from which you reached the site
• browser and operating system used
• IP address used

The server log files are stored for a maximum of 7 days and then deleted. Storage serves the security and stability of the website, for example to be able to investigate cases of abuse. If data has to be kept for evidentiary reasons, it is excluded from deletion until the incident has been finally clarified.

Security measures

To protect the website against attacks we use security functions that limit sign-in attempts and block suspicious access. In doing so, IP addresses and times of failed sign-in attempts are stored temporarily. The security functions (plugins Limit Login Attempts Reloaded and Sucuri Security) work exclusively on our own server; their cloud functions are not activated, and no data is transmitted to the plugin providers. The legal basis is our legitimate interest in defending against abuse (Art. 6(1)(f) GDPR). The connection to the website is encrypted via TLS.

No cookies, no tracking by third parties

This website sets no cookies and uses no third-party marketing or analytics services. We measure reach ourselves, without cookies, with Matomo (see next section). Fonts are loaded from our own server; no connection to servers of Google or other font providers is made when a page is requested. No third-party content (videos, maps, social media plugins) is embedded.

The website contains links to external websites (for example to reference customers or open-source projects). The respective provider is responsible for their content and data processing; their privacy notices apply.

Audience measurement with Matomo (no cookies)

We use the Matomo software to measure how this website is used. Matomo runs on a server of our own (analytics.neckarbyte.com) in the European Union, currently in France. We do not pass this data on to third parties, and no data is transferred to third countries.

Matomo is set up so that it sets no cookies and stores nothing on your device. When a page is requested, we record the page viewed, the time, the referring page, browser, operating system and screen size, and your IP address. The IP address is shortened by two bytes before it is stored or used for rough location detection; after that it can no longer be linked to you. Visitors are not recognised across several visits.

We delete the individual page views (raw data) after 180 days. Only aggregated statistics without personal reference remain. If your browser sends the “Do Not Track” signal, we do not measure your visit.

The legal basis is our legitimate interest in improving the website and understanding its reach (Art. 6(1)(f) GDPR). Because your device is not accessed, no consent under Section 25 TDDDG is required. You can object to the measurement at any time (Art. 21 GDPR), for example by email to the address given below or with your browser’s Do Not Track signal.

Contact form and getting in touch

If you contact us via the contact form, by email or by phone, we process the data you provide in order to handle and answer your inquiry. In the contact form, this means your request (question about the platform, live demo, integration check), first and last name, email address, company name, optionally a phone number and your message. The details are sent to us by email and stored in our email system. For this purpose, we use Microsoft 365 (Exchange Online) of Microsoft Ireland Operations Ltd., One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland, as a processor under Art. 28 GDPR; our mailboxes are located in European data centers. Providing your data is voluntary; however, without the details marked as mandatory, we cannot process your inquiry via the form.

The legal basis is Art. 6(1)(b) GDPR insofar as your inquiry is aimed at concluding a contract or arranging a live demo, and otherwise our legitimate interest in answering inquiries (Art. 6(1)(f) GDPR). We do not pass this data on to third parties without your consent. We delete the data as soon as your inquiry has been fully dealt with and no statutory retention obligations prevent this; if a business relationship results, the retention periods applicable to it apply.

App for iOS and Android

This privacy policy also applies to the MadeForPrivacy app for iOS and Android. The app gives access to a MadeForPrivacy instance, that is, a server running the platform. After installation, the public demo instance (demo.madeforprivacy.de), which we operate, is preset. In the app you can add your company’s instance and switch between instances.

Where your data goes

The app sends your input, files and conversations only to the instance you are currently connected to. They are processed and stored there. The operator of the instance is the controller for this processing: for a company instance, the company that operates it and informs you about the processing there; for the demo instance, us. The rules of the demo (fictitious data, retention, deletion of your demo account) are described on the demo page. Sign-in uses the method the operator of the instance has set up.

After sign-in, the app creates its own access key for shortcuts at the instance. It carries the device name the operating system reports to the app. The app revokes this key when you sign out and when you remove the instance.

What is stored on your device

The list of your instances, your sign-in sessions and the app’s keys are kept in the operating system’s protected storage (the iOS Keychain, or encrypted with a key from the Android Keystore), only on this device and without synchronisation. Content the app caches for an instance is stored encrypted on the device.

If you wish, you can protect this data with your device’s biometric unlock (such as Face ID or fingerprint) or the device passcode. The operating system performs the check; the app only receives the result. Neither the app nor we nor the operator of an instance receive biometric data.

Calendar, contacts, camera and photos

The app accesses your calendar and contacts only after you switch the source on in the app under Settings, Neva, Connect and allow access in the operating system’s dialog. You can withdraw both at any time in the device settings.

When the calendar is switched on, the app reads your appointments up to the end of the following day on the device, with title, time, place, notes, organiser and attendees. These appointments are sent to the connected instance when you write to Neva, the personal assistant, and when a rule you agreed with Neva applies (for example a reminder).

The app reads contacts only to compare a contact card from an answer with the contacts on your device, so that you see what is already saved. The comparison runs on the device; your contacts are not transmitted. The app does not change contacts or appointments; you create new entries yourself in the operating system’s dialog.

The app uses the camera and photos only when you take or select a picture to attach it.

Sharing, widgets and notifications

If you share text or files from another app with MadeForPrivacy, the app places them as a draft with Neva. Nothing is sent until you send the message. Widgets only show whether you are signed in, the name of the instance and the number of open approvals. The app shows running agents with their name and running time on the lock screen. The app creates notifications locally on the device; it does not use a push service.

No tracking

The app contains no third-party analytics, advertising or crash reporting software, does not read an advertising ID and does not track you across apps or websites. You download the app from Apple’s App Store or Google Play; the download is subject to the privacy notices of the respective provider.

Accounts and deletion

Accounts on an instance are created and deleted by its administrator. Please contact the operator of your instance for this. You can delete your demo account yourself on the demo page. If you remove an instance in the app, the app deletes the associated sessions, keys and cached data from your device.

Recipients and transfers to third countries

Recipients of personal data are the processors named above (Hostinger for hosting, Microsoft for email). There is no disclosure for advertising purposes. The data is stored and processed in the European Union; Microsoft processes it within the EU Data Boundary. Microsoft Ireland belongs to Microsoft Corporation, based in the USA. Insofar as access from the USA occurs in an individual case, for example in the context of support or to fend off security incidents, it relies on the European Commission’s adequacy decision on the EU-U.S. Data Privacy Framework, under which Microsoft is certified (Art. 45 GDPR), and additionally on the EU standard contractual clauses (Art. 46(2)(c) GDPR).

There is no automated decision-making including profiling (Art. 22 GDPR).

Your rights

You have the right towards us to obtain information about the data stored about you (Art. 15 GDPR), to rectification of incorrect data (Art. 16), to erasure (Art. 17), to restriction of processing (Art. 18) and to data portability (Art. 20). If processing is based on your consent, you can withdraw it at any time with effect for the future.

You also have the right to lodge a complaint with a data protection supervisory authority if you believe that the processing of your data violates data protection law. The authority responsible for us is the State Commissioner for Data Protection and Freedom of Information Baden-Württemberg, Lautenschlagerstraße 20, 70173 Stuttgart.

Right to object

Insofar as we process your data on the basis of a legitimate interest (Art. 6(1)(f) GDPR), you may object to this processing at any time on grounds relating to your particular situation (Art. 21 GDPR). We will then no longer process the data unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing serves the establishment, exercise or defense of legal claims. No particular form is required for an objection; an email to the address given below is sufficient.

Deletion and storage period

We store personal data only as long as is necessary for the respective purpose or statutory retention periods require. If deletion cannot take place because the data is needed for permitted legal purposes, processing is restricted: the data is blocked and not processed for other purposes.

Contact for data protection questions

If you want access, rectification, erasure or restriction, have questions about the processing of your data or wish to withdraw consent, contact haeusser@neckarbyte.com or write to the address given above.

As of: October 2026