Privacy Policy

Neithra Technologies – Fabian Lorenz, Thaler Weg 2a, 51647 Gummersbach, Germany. Email: [email protected]. Phone: +49 2266 4889976 (Germany), +1 332 287 9966 (USA). No data protection officer is required under Art. 37 GDPR; please direct requests to the address above.

When you visit the website, our server and the upstream service Cloudflare automatically process your IP address, the date and time, the requested URL, the status code returned, the browser used and the referring page. This serves to deliver the page, defend against attacks and troubleshoot errors (Art. 6 (1) (f) GDPR — legitimate interest in secure operation). Cloudflare supplies the country a request comes from; we use it only to show the page in the matching language and country presentation – a language you have chosen takes precedence – and the IP address is not stored for this purpose. Logs on our server are deleted after 14 days at the latest unless a security incident requires them to be retained.

The website and the application run on servers of netcup GmbH in Karlsruhe (registered office), data centre in Nuremberg, Germany, which acts as our processor under Art. 28 GDPR.

All requests reach our server through the Cloudflare network (Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA). Cloudflare accepts the connection, fends off attacks and forwards it to our server through an encrypted tunnel; the server cannot be reached directly from outside. Cloudflare acts as our processor under Art. 28 GDPR. For transfers to the USA Cloudflare is certified under the EU-US Data Privacy Framework (Art. 45 GDPR); the EU Standard Contractual Clauses (Art. 46 (2) (c) GDPR) apply in addition.

This website sets strictly necessary cookies, which require no consent. Only with your consent in the notice “Where your visit came from” is one more cookie added that records where your visit came from (section “Origin of orders”).

• qx_locale, qx_market and qx_country: store your choice of language and country. They are set once you choose a language in the selector (qx_locale), open the other language from the language notice or close that notice (qx_locale), or open an address that names a language or country explicitly – for example through an order button on a language version; qx_country then remembers one of the following countries: the United States, the United Kingdom, Canada, Australia or New Zealand. Merely visiting a language version sets no cookie. Lifetime: twelve months.
• Application session cookie: keeps you signed in. Deleted on sign-out or when the session expires.
• Cloudflare may set a strictly necessary security cookie to fend off automated attacks (e.g. __cf_bm, lifetime 30 minutes).
• No third-party analytics or advertising cookies and no click identifiers of advertising networks; qx_origin (below) only with your consent. No external fonts or tracking pixels are embedded; audience measurement (section 15) loads a script from our own server and sets no cookies.
• On the order page – and only there – our payment service provider Stripe sets its own cookies once its payment form loads. They are used for payment processing and fraud prevention and are technically required for this (section 7).
• The order page keeps the company details you enter in the order form, together with the plan and payment method, in the session storage of your browser tab until the order is completed, at the latest until you close the tab; they are not transmitted to us in the process.
• qx_consent: stores your decision in the notice “Where your visit came from” (allowed or declined) so we do not ask again. Strictly necessary. Lifetime: twelve months.
• qx_origin: only if you agree in the notice “Where your visit came from” and your browser sends no Global Privacy Control or Do Not Track signal. Contains the campaign tags of the link that brought you here (utm_source, utm_medium, utm_campaign, utm_content) and the name of the referring website (for example google.com), not its full address. Applies to quotrail.com and app.quotrail.com and ends when you close the browser; withdrawing deletes it immediately.

When you contact us through the contact form or by email, we process your name, company, email address, optionally a phone number, and the content of your message in order to answer your inquiry and prepare a proposal (Art. 6 (1) (b) GDPR — pre-contractual measures; otherwise Art. 6 (1) (f)). Stating a request volume is optional. To prevent abuse, the number of submissions per sender is limited; a hash of the email address is stored briefly for that purpose. To keep out automated submissions, the contact form and the appointment request also check a small computation that your browser solves when you send the form, a field that is invisible to people, and the time taken to fill in the form — without third-party services and without cookies.

Inquiries are deleted twelve months after the correspondence ends unless a contract is concluded or statutory retention obligations apply.

To send emails — account confirmation, password, invitations and forwarding your contact request to us — we use Resend (Plus Five Five, Inc., 2261 Market Street #5039, San Francisco, CA 94114, USA) as our processor under Art. 28 GDPR. Emails are sent via Resend’s EU region (Ireland); where data is transferred to the USA in the process, Resend is certified under the EU-US Data Privacy Framework (Art. 45 GDPR), and the EU Standard Contractual Clauses apply in addition (Art. 46 (2) (c) GDPR).

To use the application, you create an account. We process your name, work email address, company, company location, team role and a hashed password, as well as sign-in timestamps and security-relevant events (Art. 6 (1) (b) GDPR). Failed sign-in attempts are counted for a short period to defend against attacks (Art. 6 (1) (f) GDPR).

We retain legally required evidence for its specific purpose with restricted access: commercial and business correspondence generally for six years, invoices and accounting vouchers generally for eight years, from the end of the relevant calendar year. Statutory extensions and documented legal disputes remain reserved; other account data is removed under the deletion process described below.

Accounts without an order, payment or ongoing checkout are deleted no earlier than 30 days after registration and seven days after sending the deletion notice by email. You can delete your account yourself in the account area at any time and download your data as a ZIP archive first.

Within the application, you process data about your own customers: requests, contacts, catalogs, terms and quotes. For this data, you are the controller; Neithra Technologies acts as processor under Art. 28 GDPR solely on your instructions, based on a data processing agreement that we provide with the proposal.

Access is strictly limited to your own tenant (workspace). You can export your tenant data as a ZIP archive in account management. After the contract ends, your data is deleted within 30 days unless you request earlier deletion.

When you connect an IMAP mailbox, Quotrail initially retrieves unread messages, then tracks new messages by message identifier (UID) and folder identifier (UIDVALIDITY), including messages you have already opened. Replies are attached to existing requests where message identifiers or request numbers permit a match. Connection details, sender, subject, message content and required attachments are stored. Mailbox and sending passwords are encrypted (AES-256-GCM) and decrypted only for the respective connection. Marking messages as read can be disabled; processed messages can optionally be moved to a folder. Quotrail does not delete messages from the connected mailbox.

Sending an approved quote transmits the recipient, message and quote PDF through the selected mailbox. With IMAP/SMTP, Quotrail attempts to save a copy in the existing Sent folder; failure to save that copy does not undo sending. Notifications and account emails are sent through Resend. Where delivery feedback is configured, we store the provider identifier, delivery status, timestamp and failure reason. Provider acceptance alone does not prove arrival in a mailbox; no read receipt is requested.

Delete contact removes or clears the contact record and cleans contact references and associated sender fields in requests, messages and intake lists. It does not fully delete message text, original files, approved quote versions or earlier audit entries; they may still contain personal data. This function therefore does not replace handling a complete erasure request. The customer as controller must review remaining records and applicable retention obligations and arrange separate deletion or restriction where needed. Technical contact cleanup does not imply a blanket legal obligation to retain all messages.

Companies on individually agreed invoice plans pay by invoice and bank transfer. For the invoice we process the company name, billing address, VAT identification number and billing email address and record them in our accounts (Art. 6 (1) (b) and (c) GDPR; retained for the statutory periods). We keep invoices and accounts with Lexware (Haufe-Lexware GmbH & Co. KG, Munzinger Straße 9, 79111 Freiburg, Germany), which acts as our processor under Art. 28 GDPR in Germany.

Companies that order online pay through Stripe (Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Dublin 2, Ireland; parent Stripe, Inc., USA). Stripe processes payment data as an independent controller; payment details never reach our systems. For card payment, your browser loads Stripe’s payment form after you click “Continue to payment” – embedded in our order page (the Stripe.js script from js.stripe.com) or on Stripe’s payment page. Stripe then receives your IP address and sets its own cookies, which are technically required to process the payment and to prevent fraud; Stripe sets no cookies on our other pages. When you pay with Apple Pay or Google Pay, Apple or Google processes the payment data under its own terms; we receive no card data. For the invoice we pass Stripe the company name, billing address, billing email and VAT ID; Stripe checks an EU VAT ID against the EU database (VIES) (Art. 6(1)(b) and (c) GDPR). For transfers to the USA Stripe is certified under the EU-US Data Privacy Framework (Art. 45 GDPR).

Quotrail prepares and proposes: it reads requests, matches lines against the customer’s catalogue and applies stored pricing rules. Every match carries its reasoning, every price its rule. A person always makes the approval decision. No automated decision with legal effect within the meaning of Art. 22 GDPR takes place.

Matching runs inside the application and is rule-based and statistical. We do not use customer data to train models. For requests that these rules cannot read there is an automatic recognition help using AI. It is only active if the customer’s administrator has expressly approved it, and it then runs without a further click when such a request arrives (upload, forwarding, mailbox, re-reading). Before transmission the application uses fixed patterns to remove email addresses, phone numbers, bank details, web addresses, recognisable postal addresses, signatures, confidentiality notices and quoted earlier messages, and replaces the names stored for the request with placeholders; the assignment of the placeholders is not stored. The text of the affected document cleaned in this way, which may still contain personal data of the person making the request, and up to five of the customer’s catalog items without prices are transmitted via our central service Neithra to Google Gemini (Gemini API). There is no substitute provider for this feature: if Gemini cannot be reached, nothing is transmitted to another provider and the request stays open for manual handling. The sole purpose is to recognise the line items of the request. Every piece of data is checked against the original text; fully evidenced data is added automatically as a line that still has to be reviewed, everything else remains an open question. Item matching, prices, review and approval of a quote remain with the customer and its staff. Fully recognised requests are not transmitted. We do not promise processing exclusively within the EU or processing without any logging at this provider for this feature.

Recipients of personal data are exclusively the processors named in this policy. We do not share data for advertising and we do not sell data. Where data is transferred outside the European Economic Area this relies on an adequacy decision or the EU Standard Contractual Clauses; copies of the safeguards are available on request.

Server logs: 14 days. Contact inquiries: twelve months after completion. Account data: contract term plus statutory retention periods. Application data of your tenant: up to 30 days after the contract ends. Accounts without an order, payment or ongoing checkout: no earlier than 30 days after registration and seven days after sending the deletion notice. Notices of termination as business correspondence: six years from the end of the year in which they were received, unless a longer statutory retention period applies (e.g. Section 147 of the German Fiscal Code, Section 257 of the German Commercial Code); they are then deleted or anonymised. Termination and contract-end information is restricted and retained for longer only where it is a necessary part of a statutory record category. Security counters for sign-in attempts and form submissions: 48 hours at most. Backups: deleted data may remain in encrypted backup copies for up to 14 days and is then overwritten as backups rotate.

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection to processing based on legitimate interests (Art. 21). You can withdraw any consent you have given at any time, with effect for the future. To exercise these rights, please contact us at the address above.

If you are located in the European Economic Area you may lodge a complaint with a supervisory authority; the authority competent for the controller is the Data Protection Commissioner of North Rhine-Westphalia (LDI NRW), Kavalleriestraße 2–4, 40213 Düsseldorf, Germany.

Under the California Consumer Privacy Act (as amended by the CPRA) you may have the right to know which categories of personal information we collect and the purposes for which we use them, to request deletion or correction, and not to be discriminated against for exercising these rights. The data categories, purposes, recipients and retention periods are described throughout this notice, including account and contact identifiers, professional and billing details, technical logs and customer-provided workspace content. We do not sell personal information, and we do not share it for cross-context behavioral advertising. Rights requests may be sent through the contact channels below.

To exercise your rights, email [email protected] or use the contact form on our home page. We verify requests proportionately as described in the international-rights section below. An authorized agent may submit a request on your behalf with your written permission.

Residents of states with comprehensive privacy laws (including Virginia, Colorado, Connecticut, Utah, Texas, Oregon and others) may have rights to access, correct, delete and obtain a copy of their personal data, and to opt out of targeted advertising, sale or profiling. We do none of the latter. Send requests to the address above; if we decline a request you may appeal by replying to our decision, and we will respond within the period the applicable law requires.

The service is intended for businesses and is not directed at children under 16. We do not knowingly collect personal information from children.

All transmission is encrypted (TLS). Passwords are stored only as hashes. Access to application data is tenant-bound and logged; quote approvals are logged with person and time, and log entries cannot be edited in the application.

We update this policy when processing changes — for example when a new provider is engaged. The version published here applies; the date of the last change is shown at the top of the page.

We measure how this website is used with the open-source software Umami, which we operate ourselves on a server of netcup GmbH in Germany. Umami sets no cookies and stores no identifier on your device. Your IP address is used only briefly to determine your approximate location (country, region, city) and to form a daily rotating identifier that cannot be traced back to you; it is not stored. We store the pages viewed, referring page, browser, operating system, device type, language, approximate location and events such as opening the checkout or submitting a form. Data is transmitted via Cloudflare, which we use to deliver our websites. The legal basis is our legitimate interest in improving our offering (Art. 6(1)(f) GDPR). Data is deleted after 24 months. If your browser sends “Do Not Track” or “Global Privacy Control”, no measurement takes place.

When you book a call on this site, we process the details from the form (name, company, email address, optionally phone number and your message), the chosen time, your time zone and the page language, solely to arrange and hold this call. The legal basis is Art. 6(1)(b) GDPR (steps prior to entering into a contract at your request) and your consent under Art. 6(1)(a) GDPR, which you may withdraw at any time with effect for the future.

Quotrail is offered by Neithra Technologies – Fabian Lorenz; the controller is the provider named in the legal notice. All products share one appointment calendar on our own servers in Germany so that no time is booked twice.

For the invitation and the video link we use Google Calendar and Google Meet (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland) as a processor; Google receives your name, email address and the appointment. A transfer to the USA is possible; Google LLC is certified under the EU-US Data Privacy Framework (adequacy decision of the European Commission of 10 July 2023). For our own scheduling we also copy the appointment with your name and company to the owner's Apple iCloud calendar (Apple Distribution International Ltd., Ireland). Confirmation and reminder emails are sent via our email service provider.

You can reschedule or cancel the appointment yourself at any time using the link in the confirmation. We automatically delete your details 180 days after the appointment; only a record without personal data remains. The booking does not subscribe you to any marketing.

Additional international rights: applicable US state law may give you rights to access, correction, deletion and a portable copy, and rights concerning sale, targeted advertising or certain profiling. Applicability depends on the law, its thresholds and the processing concerned; business contact data is not automatically excluded in California. We do not sell personal data or use it for cross-context behavioural advertising. Browser Do Not Track signals do not change the necessary processing described here; our service does not use cross-site advertising tracking. This is distinct from legally recognised opt-out preference signals such as Global Privacy Control. Send a rights request to the contact in this notice or the legal notice, without needing a paid account. An authorised agent may act with evidence of authority. We verify identity proportionately to the request, normally through the known account or contact address; we request additional evidence only where necessary and do not disclose another person’s data. We explain any refusal and applicable exceptions. You may request a review by replying to that decision; we handle requests and any statutory appeal within the applicable legal deadlines and explain any permitted extension. We do not discriminate for exercising privacy rights. Where UK GDPR or Swiss data protection law applies, their rights and safeguards also remain available; you may contact the UK Information Commissioner (ico.org.uk) or the Swiss FDPIC (edoeb.admin.ch), respectively. For data controlled by a customer, we forward or assist with the request as its processor. Changes to these practices are shown with the updated date of this notice; material changes affecting existing accounts are also communicated through the account or contact address before they take effect, with consent where required. If Canadian privacy law applies, you may also use the same contact to request access or correction, withdraw consent where applicable or complain about our handling; you may contact the competent federal or provincial privacy authority (priv.gc.ca). A professional email address alone does not exclude all related account or usage data from protection.

When you start an order on the order page, we report to our own operating system (Neithra, run by the same controller) that an order was started, with plan and time; after payment also the amount, currency, time and Stripe's reference number and, where applicable, refunds. Your name, email address, postal address, IP address and browser identifiers are not transmitted. This is how we count how many orders are started and paid (Art. 6(1)(f) GDPR; legitimate interest in evaluating our sales).

Only if you agreed in the notice “Where your visit came from” is the origin added: source and medium (for example Instagram, organic search), the campaign and creative from the link, and the plan. This shows us which content leads to orders. The legal basis is your consent (Section 25(1) TDDDG, Art. 6(1)(a) GDPR). It is voluntary; without it, if you decline, or if your browser sends a Global Privacy Control or Do Not Track signal, we count orders without their origin only. You can withdraw at any time via “Cookie settings” at the bottom of the website; withdrawal applies to the future. No profile, no advertising on other websites, no sharing with advertising networks.

The support dialogue processes questions using public product information (GDPR Article 6(1)(f): answering product questions). Without AI, the conversation stays in the open browser. With AI enabled, Neithra stores a limited conversation context and unresolved support cases under pseudonymous identifiers for follow-up and handling. Short-lived abuse counters contain a hashed client key. Only with your explicit selection and an enabled AI feature are the question and up to six previous messages sent to central Neithra support and from there to the providers described here: Anthropic for answers and OpenAI as a technical fallback (processing in the USA is possible) for an answer, based on consent (Article 6(1)(a)), withdrawable for future questions by unchecking the option. Provider terms, data processing and possible international transfers must be reviewed and specified here before activation. Without activation no such transfer occurs. Preparing an enquiry copies only your last three questions and stated requirements into an editable form. A draft crossing pages uses browser session storage, is deleted after transfer and is no longer used after ten minutes. Submitting the form stores the contact request; existing contact retention periods apply. Contact and call requests may be transferred to the same controller’s Neithra Office for central processing. No automatic newsletter subscription. Limited central bot cases are cleaned up after 30 days without activity during regular operation. Separately submitted contact emails follow their own retention periods. With separate consent in authenticated administrator support, the stored plan and local access status from the authorized workspace are sent to the named AI services. The read time is not a payment verification; receipt of payment remains unknown without current evidence. Pseudonymous account and caller references bind the central request. The AI model receives only the limited facts without account, payment or email identifiers. Invoice files and customer records are not attached. Signed-in users can also save personal support requests. Subject, message, status and reply are linked to the user account and customer number and accessible to that user and the operator. A separately authenticated support system can retrieve these data and save replies. They are not automatically sent to the AI model. Requests are included in the account export and deleted with the tenant; completed requests are removed within twelve months of their last change. Limited central bot cases are cleaned up after 30 days without activity during regular operation. Separately submitted contact emails follow their own retention periods.