Privacy Policy

neomatch digital GmbH ("datakant", "we", "us") is an AI-powered web analytics platform headquartered in Germany. We are committed to protecting your privacy and processing personal data in compliance with the EU General Data Protection Regulation (GDPR), the German Federal Data Protection Act (BDSG), and the ePrivacy Directive.

This Privacy Policy applies to:

• Customers who create a datakant account and use our analytics dashboard, API, and related services
• Website visitors whose interactions are collected by the datakant tracking snippet installed on our customers' websites
• Visitors to datakant.ai who browse our marketing pages

For customer account data: neomatch digital GmbH is the data controller. We determine the purposes and means of processing your account information, billing data, and usage of our platform.

For website visitor analytics data: Our customers are the data controllers. datakant acts as the data processor under Article 28 GDPR. We process visitor data exclusively on behalf of and according to the instructions of our customers. A Data Processing Agreement (DPA) is available on request and is included in Enterprise plans.

3.1 Customer Account Data

When you create a datakant account, we collect:

• Email address and full name
• Password (stored as a bcrypt hash; we never store plaintext passwords)
• Company name and billing address (when you subscribe to a paid plan)
• Payment information (processed and stored by Stripe; we do not store card numbers)

3.2 Analytics Data (Website Visitor Data)

When your visitors interact with a website that has the datakant tracking snippet installed, we collect the following categories of data on behalf of the website owner:

• Page context: URL, page title, referrer, hostname, path
• Device and browser: viewport dimensions, device pixel ratio, screen orientation, user agent string (parsed for browser, OS, and device type)
• Interaction data: click targets, element selectors, DOM paths, visible text of clicked elements, scroll position
• Consent signals: consent state from the website's Consent Management Platform (Cookiebot, OneTrust, Usercentrics, Borlabs, Consentmanager, Cookie Information)

3.3 What We Do NOT Collect or Store

• IP addresses: The raw IP address is extracted from the request, anonymized (last octet set to zero), used solely for city-level geolocation lookup, and immediately discarded. The raw IP is never written to our database.
• Cross-site tracking: datakant uses first-party tracking only. We do not set third-party cookies or track visitors across different websites.
• Fingerprinting for identification: Our element fingerprinting system is used exclusively for event replay context (matching interactions to DOM elements), not for identifying or profiling individual visitors.

3.4 Geolocation and Consent Gating

City-level geolocation is only resolved when the visitor has granted analytics consent through the website's CMP. If consent is not granted, the geolocation field remains empty. When consent is granted mid-session, geolocation is retroactively resolved for that session only.

4.1 Customer Account Data

• Providing and operating the Service, including authentication, billing, and support
• Sending transactional emails: verification, password reset, invoice receipts, billing notifications
• Communicating product updates, security alerts, and policy changes
• Improving the Service through aggregated, anonymized usage analytics

4.2 Analytics Data

• Rendering analytics dashboards, charts, and reports for our customers
• Powering AI-driven insights, anomaly detection, and natural-language queries
• Generating event replay context for the Event Mapper feature
• Forwarding to Google Analytics 4 or Meta Conversions API if configured by the customer and gated on the appropriate consent signals

We do not use analytics data for advertising, profiling, or any purpose other than providing the Service to the website owner.

We process personal data on the following legal bases under GDPR:

• Contract performance (Art. 6(1)(b)): Processing customer account and billing data to provide the Service
• Legitimate interest (Art. 6(1)(f)): Security monitoring, fraud prevention, service improvement through aggregated analytics
• Legal obligation (Art. 6(1)(c)): Tax and accounting records, law enforcement requests
• Consent (Art. 6(1)(a)): Marketing communications (opt-in only)
• Data processor agreement (Art. 28): Processing website visitor analytics data on behalf of our customers

We do not sell, rent, or trade personal data. We share data only with the following categories of sub-processors, all bound by data processing agreements:

• Stripe, Inc. (San Francisco, USA; EU SCCs in place) — Payment processing, subscription management, invoice generation
• Mailgun / Sinch (EU endpoint: api.eu.mailgun.net) — Transactional email delivery
• Microsoft Azure OpenAI (EU region) — AI analytics engine (processes aggregated query results only, never raw visitor-level data)
• Hetzner Cloud (Germany) — Infrastructure hosting, data storage, backups
• MaxMind (bundled GeoLite2-City database, processed locally) — IP-to-city geolocation lookup; no data is sent to MaxMind servers

We may also disclose data when required by law, court order, or government request, or to protect the rights, property, or safety of datakant, our customers, or the public.

All customer and analytics data is stored exclusively on servers located within the European Union (Hetzner Cloud, Germany). Data never leaves the EU.

We implement the following technical and organizational measures:

• Encryption in transit (TLS 1.2+) and at rest
• Passwords stored as bcrypt hashes with individual salts
• Role-based access control (RBAC) with five permission levels (Owner, Admin, Manager, Viewer, Elastic View)
• Daily automated backups stored on a separate encrypted volume
• 24/7 automated infrastructure monitoring with alerting
• Bot and Puppeteer detection at the tracker level to prevent synthetic data contamination

• Customer account data: Retained for the duration of the account plus 30 days after deletion request
• Analytics event data: Retained according to the customer's subscription plan
• Property snapshots (HTML/assets): Retained for 30 days
• Invoices and billing records: Retained for 10 years as required by German tax law (AO § 147)
• Server logs: Retained for 7 days, then automatically purged
• Backups: 7-day rolling retention on a separate encrypted volume

If you are located in the European Economic Area, you have the following rights:

• Right of access (Art. 15): Request a copy of the personal data we hold about you
• Right to rectification (Art. 16): Correct inaccurate or incomplete data via your account settings
• Right to erasure (Art. 17): Delete your account and all associated data from Account Settings. Deletion is cascading and permanent.
• Right to restriction (Art. 18): Request that we limit processing of your data
• Right to data portability (Art. 20): Export your analytics data in machine-readable format
• Right to object (Art. 21): Object to processing based on legitimate interests
• Right to withdraw consent (Art. 7(3)): Withdraw consent at any time without affecting the lawfulness of prior processing

To exercise these rights, contact us at privacy@datakant.ai. We respond to all requests within 30 days.

For website visitors: If you want to exercise your data subject rights regarding analytics data collected on a customer's website, please contact the website owner directly. They are the data controller for that data.

You can permanently delete your datakant account at any time from Account Settings. Account deletion triggers a cascading removal of:

• Your user profile and authentication credentials
• All properties and their configurations
• All analytics events, sessions, and dashboard data
• All property snapshots and associated assets
• All element groups and custom dimensions

A confirmation email is sent after deletion. This action is irreversible. Billing records are retained as required by German tax law.

datakant.ai website: We use essential cookies for authentication and session management. We do not use advertising or profiling cookies on our own website.

datakant tracking snippet: The tracker uses first-party localStorage for session continuity (session ID and visitor ID). It does not set third-party cookies. The tracker respects the visitor's consent preferences as signaled by the website's CMP.

All primary data processing occurs within the EU. Where sub-processors are based outside the EU (Stripe, Inc.), we ensure appropriate safeguards are in place:

• EU Standard Contractual Clauses (SCCs) adopted by the European Commission
• Assessment of the sub-processor's data protection practices
• Supplementary technical measures (encryption, access controls)

The Service is not intended for individuals under 16 years of age. We do not knowingly collect personal data from children. If we become aware that we have collected data from a child under 16, we will delete it promptly.

We may update this Privacy Policy to reflect changes in our practices, legal requirements, or the Service. We will notify customers of material changes by email at least 30 days before they take effect and update the "Last updated" date at the top of this page.

If you believe that our processing of your personal data violates applicable data protection law, you have the right to lodge a complaint with a supervisory authority, in particular in the EU member state of your habitual residence, your place of work, or the place of the alleged infringement.

For questions about this Privacy Policy or to exercise your data subject rights:

neomatch digital GmbH
Email: privacy@datakant.ai
Web: datakant.ai