Privacy Policy

1. Data Controller

Nikolaus Redl

Email: nik@specialtytokens.com

VAT ID: ATU82884407

(hereinafter “we”, “us”, or “Specialty Tokens”)

2. General Information

The protection of your personal data is important to us. This privacy policy informs you about the processing of your personal data on our website and in our application in accordance with the EU General Data Protection Regulation (GDPR) and the Austrian Data Protection Act (DSG).

3. Data We Collect

3.1 Account Data

When you register and use our service, we process:

• Email address
• Name (if provided)
• Profile picture (if provided by your SSO provider)
• WorkOS user ID (for authentication)

3.2 Usage Data

For billing and service improvement, we collect:

• Session data (start time, end time)
• Feature usage and configuration
• Connection status (not contents of connected systems)

3.3 Analytics Data

We use Google Analytics for website acquisition reporting, PostHog for website interactions, and Vercel Analytics for traffic reporting. We collect:

• Page views and navigation
• Feature usage and interaction events
• Device information (browser, OS, screen size)

We do not track terminal content, commands, source code, or any user-generated content.

PostHog is configured without cookies, DOM autocapture, or person profiles. It stores a random anonymous visitor identifier and the campaign tags of the link you arrived from (utm parameters) in your browser's local storage; this identifier is never linked to your name, email address, or anything you submit in a form. Session replay records how public pages are used, with every form field masked so typed text is never captured. It is disabled on private proposal, administration, and gated presentation pages.

Links we share in posts, comments and messages can carry a short reference code (st_ref). We attach it to any form you submit, so we can see which post or message led to an inquiry. Only if you accept cookies do we also attach it to these analytics events and keep it in local storage for up to 90 days; otherwise it is forgotten when you leave or reload the page.

Meta advertising measurement

If you allow advertising cookies, we use the Meta Pixel and Conversions API to measure page visits, how much of a video you watch, and accepted sales forms. Our server also forwards these events to Meta. We use the same Meta dataset as supercenter.dev. Meta receives browser and ad click identifiers, IP address, browser information, and hashed contact details to match lead events. For this we set the cookies _fbp, _fbc and st_mid (a random browser ID) for up to 90 days. We do not send your form message to Meta. You can reject this tracking or change your choice with Ad cookie settings. Forms work with either choice. We save your choice for 180 days.

Homepage AI assessment

When you complete the homepage AI assessment, we save your answers, calculated result, submission time, website environment and the campaign tags of the link you arrived from in our private internal system. You can complete it without contact details. Anonymous responses stay internal and are not sent to Slack or Attio. If you choose to leave your name and email for follow-up, these details are attached to your assessment. Submissions from the live website with contact details are shared with our team through Slack and Attio. This does not subscribe you to marketing emails.

3.4 Payment Data

Payments are processed through our payment processor as Merchant of Record. We do not store credit card data. The payment processor handles your payment information and issues invoices.

3.5 Contact Inquiry Data

When you use our contact form, we process the name, email address, phone number, company, topic, and message you provide. We use this information to respond to your inquiry. When requested through the form, we also send a transactional SMS copy of your submission to the phone number you provide.

4. Legal Basis

We process your data based on the following legal grounds (Article 6 GDPR):

• Contract performance (Art. 6(1)(b)): Account data, usage data, billing data
• Legitimate interest (Art. 6(1)(f)): Responding to contact inquiries, analytics for service improvement, security
• Consent (Art. 6(1)(a)): Optional marketing communications

5. Third-Party Processors

We use the following service providers to deliver our service:

• WorkOS Inc. (USA): Authentication
• Convex, Inc. (USA): Database and backend
• Google (USA): Website acquisition analytics
• PostHog, Inc.: Website analytics (EU cloud region)
• Cloudflare, Inc. (USA): CDN and security
• Vercel, Inc. (USA): Hosting
• ClickSend Pty Ltd (Australia): Transactional SMS delivery for contact-form confirmations

Where personal data is transferred outside the European Economic Area, we use appropriate safeguards, including Standard Contractual Clauses where applicable, pursuant to Article 46 GDPR.

6. Data Retention

• Account data: Until you delete your account
• Usage and billing data: 7 years (legal retention requirement under Austrian tax law)
• Analytics data: 2 years
• Contact inquiries: As long as needed to answer and manage the inquiry, or longer where required by law

7. Your Rights

Under the GDPR, you have the following rights:

• Access (Art. 15): Know what data we store about you
• Rectification (Art. 16): Correct inaccurate data
• Erasure (Art. 17): Delete your data
• Restriction (Art. 18): Restrict processing
• Data portability (Art. 20): Export your data
• Object (Art. 21): Object to processing
• Withdraw consent (Art. 7): Withdraw any given consent

To exercise your rights, contact us at: nik@specialtytokens.com

8. Cookies

We use technically necessary cookies for:

• Authentication and session management
• Security features

Google Tag Manager loads Google Analytics and the Meta Pixel only after you allow cookies. Google Analytics then uses analytics cookies for website measurement. PostHog does not use cookies; it keeps a random anonymous identifier in local storage, which you can clear at any time via your browser's site data settings. You can disable cookies in your browser settings.

9. Data Security

We implement technical and organizational measures to protect your data, including:

• Encrypted data transmission (TLS/HTTPS)
• Encryption for sensitive data (environment variables, API keys)
• Token-based authentication
• Isolated environments per workspace

10. Supervisory Authority

You have the right to lodge a complaint with the data protection authority:

11. Changes

This privacy policy may be updated from time to time. The current version is always available on this page. We will notify you of material changes by email.