Privacy policy

1. Controller

IBA-TEC | IT-Systemhaus GmbH, Möhnestrasse 55, 59755 Arnsberg, represented by the managing director Christian Sauer (see legal notice). E-mail address: support@wandlix.com. Please send questions about data protection to this address.

2. Files you upload

We process uploaded files solely to produce the result you chose (Art. 6(1)(b) GDPR). They exist only in memory, are never written to a disk, are not logged and are discarded after the result is delivered. To protect against malware, every file is scanned automatically (Art. 6(1)(f) GDPR). We do not read your files and do not pass them on.

3. Hosting

The website and all processing run on a server at Hostinger in a data center in Germany. A data processing agreement exists with the hosting provider; it is an integral part of its terms of use.

4. Server logs

Our web server keeps no access log: your IP address, the pages you open and the times of your visits are not recorded. The application only writes technical error messages that contain no file names, no contents and no IP addresses. To protect the server itself, the software fail2ban notes failed login attempts at the server access, with the sender’s IP address, in the system log, which the operating system deletes regularly as part of its usual log rotation (Art. 6(1)(f) GDPR, security of the system). Our hosting provider may keep its own technical logs at network level; see its privacy notices for details.

5. Abuse protection and free quota

To protect the services from abuse and to limit the daily free quota, your IP address is processed only briefly: it is immediately converted into an anonymous identifier using a daily-changing salt. The identifier is kept in memory for three days at most (Art. 6(1)(f) GDPR). The IP address itself is not stored.

6. Usage statistics

We count how often each tool is used (number, success, duration, data volume, error codes) and how many different people use it. No file names, contents, IP addresses or cookies are used; the figures cannot be traced back to individuals.

7. Short links and QR codes

When you create a short link we store the target address, the time of creation, the validity period and, for signed-in users, the link to the account. We also store a hash of your IP address formed with a secret value (no readable IP address) so that we can limit misuse (Art. 6(1)(f) GDPR, legitimate interest in preventing misuse). The hash is deleted together with the link; expired links are deleted at the latest 30 days after expiry, links of accounts immediately on request. When a short link is opened we only count the number of visits; IP addresses and the time of single visits are not stored. Your browser is sent on to the target without a referrer to our site. QR codes without a short link are not stored.

8. Speed test

The speed test transfers random data that is discarded at once. So that the test cannot be misused as a data pump, we count the transferred volume per anonymised identifier (see the section “Abuse protection and free quota”) in memory until the end of the day. Your measurement results are stored only by your own browser, where you can delete them.

9. Account and sign-in

For an account we store your e-mail address, your language, the time of sign-in, your credit balance and the journal of your credit bookings (Art. 6(1)(b) GDPR). We send the sign-in code by e-mail through the service provider Resend (processor, servers in the EU, company based in the USA – see the section on recipients and third countries). In your account you can download all data stored about you as a file and delete the account yourself at any time; we then keep order data without personal reference for the statutory retention periods.

10. Programming interface and AI assistants

We store API keys only as a checksum; in your account you see the name, the beginning and the last use. For the operations overview we log, for each call made with a key, the number of the key, the tool, the result, the duration and the amount of data – without file names, contents or IP addresses – and delete these entries after 30 days. If you use the interface through an AI assistant (MCP) or an automation such as n8n, Make or Zapier, you transfer your files to us; which data your assistant or automation service passes on to its own provider is decided by that provider, not by us.

11. Payments

You buy credits via Stripe Payments Europe, Ltd. (Ireland). Stripe does not pass payment details to us; we receive the order number, amount and payment status. We keep invoice and order data for up to ten years as required by law (Art. 6(1)(c) GDPR).

12. Contact by e-mail

When you write to us, we process your e-mail address, your name and the content of your message to answer your request (Art. 6(1)(f) or (b) GDPR). We delete the messages once the matter is settled and no retention duty applies. We do not use a third-party ticket system. Our mailbox support@wandlix.com is operated by Hostinger International Ltd. (Cyprus); incoming e-mails are stored there on servers in the EU, and a data processing agreement is in place with the provider.

Contact form: if you write to us through the contact form, we process your name, e-mail address, the topic and your message only to answer your request (Art. 6(1)(b) or (f) GDPR). The message is sent to us by e-mail through our mail provider and is not stored on this website; for abuse protection a short-lived counter per anonymised address limits the number of messages. We delete correspondence once the request is dealt with and no retention duty applies.

13. Cookies and local storage

Without your consent we only use technically necessary storage on your device (section 25(2) no. 2 TDDDG). A session cookie keeps you signed in (12 hours, 30 days with “stay signed in”). An access cookie unlocks the site for invited people during the test phase. The storage of your browser (localStorage) only holds convenience data: whether you closed the language hint, sender details for invoices if you asked to keep them (only on your device, never on our server), the history of your speed tests and your choice in the consent banner (12 months). You can delete this data at any time in your browser settings. We do not use tracking or advertising cookies without your consent.

Web analytics with Google Analytics and ad measurement with Google Ads (only with your consent): if you choose “Allow measurement” in the consent banner, we use Google Analytics 4 (provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; parent company: Google LLC, USA). It measures which pages are viewed, from which country and on what kind of device so that we can improve Wandlix. For this Google sets cookies (_ga and _ga_ with our identifier, lifetime up to two years) and receives details such as the page viewed, time, browser, device type, approximate location (derived from the IP address, which Google Analytics 4 does not store) and a pseudonymous identifier. The measurement does not run in your account, sign-in or admin and never with your files, file names or entries. Advertising features and Google signals are switched off, and we do not use a user ID. In addition, we use the ad measurement of Google Ads (conversion measurement) to find out whether a click on one of our Google ads led to a visit or purchase on Wandlix. For this Google may set cookies (_gcl_au, _gcl_aw and similar, up to 90 days) and receives details of the ad click and of the visit and purchase. Personalised advertising (remarketing) and Google signals are switched off.

The legal basis is your consent (Art. 6(1)(a) GDPR, section 25(1) TDDDG). It is voluntary; without it you can use Wandlix in full. You can withdraw it at any time with effect for the future: with the “Cookie settings” link in the footer, which also deletes the cookies on your device. We remember your choice for 12 months in your browser and ask again afterwards. If your browser sends the “Global Privacy Control” signal, we treat it as a refusal.

A data processing agreement exists with Google (Google data processing terms). Data may be transferred to the USA; Google LLC is certified under the EU-US Data Privacy Framework, and standard contractual clauses apply in addition. Google keeps event data for us for at most two months. More information: https://policies.google.com/privacy.

14. No profiling, no AI processing of your files

We do not build user profiles and make no automated decisions with legal effect. Your files are processed by machines; no person sees them. We do not pass your files or entries on to AI services and do not use them to train models. An exception is web analytics with Google Analytics, which only runs with your consent and evaluates page views pseudonymously (see the section “Cookies and local storage”).

15. Recipients and third countries

Recipients are our service providers for hosting (Hostinger), e-mail delivery (Resend) and payments (Stripe). Resend (Plus Five Five, Inc., San Francisco, USA) sends our e-mails through servers in the EU; because the company is based in the USA, the transfer relies on the EU standard contractual clauses, which are part of its data processing agreement, and on its participation in the EU-US Data Privacy Framework. Where further data is transferred outside the EEA (for example at Stripe), this happens on the basis of appropriate safeguards such as standard contractual clauses. Payments are handled by Stripe Payments Europe, Ltd. (1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland) as an independent controller; data passed on to Stripe, Inc. (USA) is protected by the EU standard contractual clauses and by participation in the EU-US Data Privacy Framework. With your consent also Google (web analytics, see the section “Cookies and local storage”). If you use Wandlix through an AI assistant (for example Claude by Anthropic or ChatGPT by OpenAI), your requests and files also pass through that assistant’s provider, who is a separate controller for this; their terms and privacy notices apply. For the connection we store the name of the application, timestamps and checksums of the access tokens (to perform the contract, Art. 6(1)(b) GDPR); we do not store files. You can disconnect connections in your account at any time.

16. Retention periods at a glance

Uploaded files and results: in memory only, discarded after the result has been delivered, gone at once on a restart.

Anonymous identifier for the free quota and limits: at most 3 days, in memory only.

Sign-in codes: valid for 10 minutes, stored only as a checksum.

Account: until you delete it. Order and invoice data: up to ten years under the statutory retention periods.

API call log: 30 days.

Short links: until expiry and 30 days after, links of accounts until you delete them.

Usage statistics: counters only, with no personal reference.

Web analytics (only with consent): at Google at most two months; your choice in the banner: 12 months in your browser.

17. Your rights

You have the right of access, rectification, erasure, restriction of processing, data portability and the right to object to processing based on legitimate interests. You can withdraw any consent at any time with effect for the future. The easiest way to get access and portability is the data export in your account; otherwise write to the e-mail address in the imprint. You can also complain to a data protection supervisory authority, for example the one responsible for your place of residence. The authority responsible for us is the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia (Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen), Kavalleriestraße 2–4, 40213 Düsseldorf, Germany (www.ldi.nrw.de).

18. Changes to this policy

We adapt this privacy policy when our services or the law change. The date of the latest version is shown below.

Status

October 2026 (draft).