Privacy Policy

statycs GmbH, Liechtensteinstrasse 59, 1090 Vienna, Austria is the data controller for the processing described in this policy: visitors to this website, account administration, product analytics, platform security, billing, and communication with our customers. For the content our customers upload to the platform, the customer is the controller and statycs acts as its processor; that processing is governed by our Data Processing Agreement and not by this policy. For any data protection inquiries, please contact us at [email protected].

We have not appointed a data protection officer, as the criteria of Art. 37 GDPR are not met. For privacy matters, the most direct channel is [email protected].

We collect personal data that you provide to us directly, together with data generated through your use of the platform.

Account information. When you register, we collect your name, your email address, your company name, and any further contact details you provide.

Requests through the website. Through the contact and demo forms we collect your name, email address, company and message, together with the language, page and time of the request and the campaign that brought you to us (utm parameters). If you have consented to marketing, the identifier of your latest ad click is added (for example gclid or fbclid). Your request goes to our CRM, Zero (§ 05).

Usage data. We collect information about how you interact with the platform, including pages visited, features used, browser type, device information, and session duration. Your IP address reaches our servers and security systems as part of any web request; our product analytics has IP collection switched off and does not record it.

Financial data. Data that you upload to the platform - such as accounting records, reports, and financial plans - is processed to deliver the service. statycs may access this data to operate the platform, respond to support requests, fulfill legal obligations, and - in aggregated and anonymized form only - to improve the product and generate anonymous industry benchmarks, as further described in the Terms. Access to identifiable customer content is restricted by role, logged, and permitted only for the purposes listed above.

Providing account data is required to use the platform; without it, we cannot deliver the service. Website analytics, marketing and optional integrations are voluntary and run on your consent. Product analytics in the application runs on our legitimate interest rather than on consent, and you can object to it at any time as described in §04.

Your personal data is used for the following purposes:

• Providing, operating, and maintaining the statycs platform
• Authenticating you and managing your account (via Hanko)
• Responding to your inquiries and delivering customer support
• Sending relevant product updates and marketing communications, where you have opted in
• Analyzing and improving our platform and services (via Google Analytics and PostHog)
• Measuring our advertising on Google, Meta, LinkedIn and in ChatGPT, and showing ads to previous visitors of this website, where you have consented

Legal bases. We process your personal data on the following legal bases:

• Art. 6(1)(b) GDPR (performance of a contract and pre-contractual steps) - providing the platform, authentication, customer support, and answering your requests through the contact and demo forms.
• Art. 6(1)(c) GDPR (legal obligation) - meeting statutory retention obligations, in particular § 132 of the Austrian Federal Fiscal Code (BAO), which requires invoices and accounting records to be kept for seven years.
• Art. 6(1)(f) GDPR (legitimate interests) - securing the website and the platform and preventing fraud, analysing and improving our product, communicating directly with our existing customers, and attributing a request to the campaign that brought you to us.
• Art. 6(1)(a) GDPR (consent) - marketing emails, and anything this website stores on or reads from your device beyond what is strictly necessary: live chat and videos, website analytics and advertising tags. Storing and reading are additionally governed by § 165(3) of the Austrian Telecommunications Act 2021 (TKG 2021) and, for visitors from Germany, § 25(1) TDDDG.

statycs operates two separate surfaces: this website, and the statycs application at app.statycs.com. They store different things on your device and rest on different legal grounds, so this section describes each in turn.

This website. Anything not strictly necessary is stored or read only after you consent. On your first visit a banner asks for your decision: Accept all and Essential only are designed as equals, and under Settings you decide per category. Until you decide, none of it loads. The categories:

• Necessary (always on) - your choice itself, and spam protection for the forms (Cloudflare Turnstile).
• Functional - live chat (Chatwoot) and embedded videos (YouTube). You can play a single video without this consent: only your click on play loads it from YouTube, and the note under the video tells you beforehand what that involves.
• Statistics - website analytics with PostHog (hosted in Frankfurt) and Google Analytics: which pages are read and where visitors leave. Without marketing consent we remove ad click identifiers from every address we record.
• Marketing - the advertising tags of Google Ads, Meta, LinkedIn and OpenAI (ads in ChatGPT): we measure which ads lead to a request or a signup, and may show our ads to previous visitors. To do this, an ad click is linked to your later signup with statycs. The platforms may combine the data with their own user profiles and use it for their own purposes (§ 05).

A consent lasts 12 months, a refusal of every category 6 months; after that we ask again, and also when providers or purposes change. If your browser sends the Global Privacy Control signal, we treat it as a refusal of marketing.

Changing and withdrawing. Cookie settings in the footer of every page opens the settings with your current choice and its date, where you can switch off any category at any time with effect for the future. Whatever the switched-off category stored on this website is then deleted from your browser. Cookies a provider has set on its own domain are beyond our reach; you remove those in your browser settings. You can also email [email protected].

The statycs application. The application stores nothing on your device for analytics - no analytics cookies, no local storage. The only cookie it sets is the session cookie that keeps you signed in, which is strictly necessary to deliver the service and is deleted when you sign out, together with any app data held on the device. Because nothing non-essential is stored on your device there, the application shows no cookie banner.

Product analytics in the application. We measure which features are used, so we can see what helps and what does not. Session recording, automatic click capture, heatmaps and IP address collection are switched off, and the contents of your financial data are never part of what we measure. We do this on the basis of our legitimate interest under Art. 6(1)(f) GDPR - understanding and improving a product we are contractually bound to operate well.

Your right to object. You can object to product analytics at any time and without giving a reason, under Settings → Profile → Data protection in the application. The switch takes effect immediately and no further measurement takes place. Objecting has no effect on your access to the platform or on any part of the service.

What this website stores on your device.

Which cookies the providers set on their own domains is described in their own cookie lists; the banner's settings link to them for each provider.

We share personal data only with the service providers needed to run the website and the platform. Which of them receives data depends on whether you are using the website or the application.

On this website.

• Cloudflare (Cloudflare, Inc., USA) - delivering the website (CDN) and protecting the forms against bots and spam (Turnstile); as processor, and as independent controller for improving Turnstile
• Zero (Zero Technologies Oy, Finland) - CRM for your requests through the contact and demo forms; as processor
• Chatwoot (Chatwoot Inc., USA) - live chat for website visitors
• YouTube (Google Ireland Limited, Ireland) - embedded videos, only after your click on play or with your consent (Functional); Google also uses the data for its own purposes, as independent controller
• PostHog (PostHog Inc., USA; PostHog Cloud EU hosted in Germany) - website analytics (Statistics); as processor
• Google Analytics (Google Ireland Limited, Ireland) - website analytics (Statistics); as processor
• Google Ads (Google Ireland Limited, Ireland) - conversion measurement and remarketing (Marketing); as independent controller
• Meta (Meta Platforms Ireland Limited, Ireland) - Meta Pixel for conversion measurement and audiences (Marketing); jointly responsible with us for the collection and transmission, see below
• LinkedIn (LinkedIn Ireland Unlimited Company, Ireland) - Insight Tag for conversion measurement and audiences (Marketing); as independent controller
• OpenAI (OpenAI Ireland Limited, Ireland) - Measurement Pixel for ads in ChatGPT (Marketing); as independent controller

Advertising platforms. Google, LinkedIn and OpenAI process the data from their tags as independent controllers and also for their own purposes, such as delivering and optimising ads and building audiences; they may combine the data with profiles you have with them. How they do this, and your rights there, is set out in their privacy policies (policies.google.com/privacy, linkedin.com/legal/privacy-policy, openai.com/policies/eu-privacy-policy). If you consented to marketing and then signed up with statycs, we report the completed signup to the platform whose ad you clicked last - with the identifier of that click and, for Meta, also the identifiers from the Meta cookies and your browser type (user agent), but without your name or email address.

Joint controllership with Meta. For collecting data through the Meta Pixel on this website and transmitting it to Meta, we are jointly responsible with Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland (Art. 26 GDPR). We have concluded an agreement with Meta for this (Controller Addendum): we inform you through this privacy policy, and Meta answers requests under Art. 15 to 20 GDPR concerning the data Meta stores after the transmission. You can exercise your rights against us as well as against Meta. What Meta does with the data afterwards is Meta's sole responsibility; for that, and for your rights against Meta, see facebook.com/privacy/policy.

In the application.

• Hetzner (Hetzner Online GmbH, Germany) - hosting
• Cloudflare (Cloudflare, Inc., USA) - TLS termination and bot protection for app.statycs.com
• Hanko (Hanko GmbH, Germany) - authentication
• PostHog (PostHog Inc., USA; PostHog Cloud EU hosted in Germany) - product analytics
• Stripe (Stripe Payments Europe Ltd., Ireland; Stripe, LLC, USA) - payment processing and subscription billing. For executing payments and meeting its own regulatory duties, Stripe acts as an independent controller rather than on our instructions
• Google, Meta, LinkedIn, OpenAI - only if you consented to marketing on the website: the report of your completed signup, as described above under advertising platforms

Each provider is contractually bound to comply with the GDPR. Of the providers listed under the application, Hetzner, Cloudflare and Hanko process customer content on our customers' behalf and are the sub-processors named in §06 of our Data Processing Agreement. PostHog processes usage events for product analytics, for which statycs is the controller, and Stripe acts as an independent controller for payments.

Transfers to third countries. Some recipients are located in the United States or transfer data there. For Google LLC, Meta Platforms, Inc., LinkedIn Corporation, PostHog Inc. and Cloudflare, Inc. we rely on the European Commission's adequacy decision for the EU-US Data Privacy Framework (Art. 45 GDPR), under which these companies are certified; otherwise, for example for OpenAI, on the EU Standard Contractual Clauses as appropriate safeguards (Art. 46 GDPR). A copy of the safeguards is available on request at [email protected].

We do not sell your personal data to third parties.

Under the GDPR, you have the following rights in respect of your personal data:

• Right of access - to confirm whether your data is being processed and to request a copy
• Right to rectification - to correct inaccurate or incomplete data
• Right to erasure - to request deletion of your data where no compelling reason justifies further processing
• Right to restrict processing - to limit how your data is used in certain circumstances
• Right to data portability - to receive your data in a structured, machine-readable format
• Right to object - to object to processing based on legitimate interests
• Right to withdraw consent - to withdraw your consent at any time, without affecting the lawfulness of processing already carried out

To exercise any of these rights in respect of the processing for which statycs is the controller, please contact us at [email protected]. We will respond within one month of receipt. Where a request concerns content uploaded to the platform by one of our customers, that customer is the controller: we will forward the request to it without undue delay and assist it in responding, as set out in §05 of our Data Processing Agreement. This period may be extended by up to two further months where necessary, taking into account the complexity and number of requests, in accordance with Art. 12(3) GDPR; where that happens, we will inform you within the first month of the extension and the reasons for it.

Automated decision-making. We do not use automated decision-making or profiling within the meaning of Art. 22 GDPR.

Right to lodge a complaint. You have the right to lodge a complaint with a supervisory authority. In Austria, the competent authority is the Austrian Data Protection Authority (www.dsb.gv.at).

We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction. These measures are regularly reviewed and updated.

We retain personal data only as long as needed. The main categories and retention periods are:

• Account data: deleted from live systems 30 days after the contract ends, and purged from encrypted backups within the following backup cycle. Content uploaded to the platform follows the same schedule under §11 of the Data Processing Agreement, where the customer is the controller.
• Invoicing and accounting records: 7 years, as required by §132 BAO.
• Marketing contact data: until you withdraw consent or unsubscribe.
• Support communications: for as long as needed to resolve and document the issue.
• Usage and analytics data: up to 14 months.
• Campaign and latest ad click in your browser (stcs_attr): 90 days.

After the applicable period, data is securely deleted or anonymized.

We may update this privacy policy from time to time to reflect changes in our practices, services, or legal obligations. Updates are published on this page, with the effective date clearly indicated at the top.

If you have any questions about this privacy policy or our data practices, please contact us at [email protected] or write to statycs GmbH, Liechtensteinstrasse 59, 1090 Vienna, Austria.