XelluxLegal
Privacy Policy
Last updated: June 6, 2026
1. Controller
The controller responsible for data processing on this website is: Xellux Owner: Can Yigit Bgm.-Reuter-Str. 10 28327 Bremen Germany Email: [email protected]
2. Data collection
2.1 When visiting the website When you access our website, your browser automatically sends information to our server. This information is temporarily stored in a log file: • IP address of the requesting device • Date and time of the request • Name and URL of the retrieved file • Referrer URL • Browser and operating system used 2.2 When using our contact form When you contact us through the form, a valid email address is required so that we can assign and respond to your request. All further details are voluntary.
5. Web analytics (Umami)
We use the web analytics software Umami, which we operate ourselves on our own infrastructure under the subdomain unami.xellux.com. Umami works without cookies and without cross-device tracking and collects only aggregated usage statistics (e.g. pages visited, referrer, browser and device type, country). No data is transferred to third parties and no full IP addresses are stored permanently; identifying individual visitors is not possible. The legal basis is Art. 6 (1) lit. f GDPR. Our legitimate interest lies in the privacy-friendly, low-footprint analysis of how our website is used in order to improve our offering. As no personal profiles are created and no cookies are set, consent pursuant to § 25 TDDDG is not required.
6. AI features
Where our products include artificial intelligence features, these process personal data only to the extent necessary to provide the respective feature (Art. 6 (1) lit. b GDPR) or where there is a legitimate interest in providing and improving the feature (Art. 6 (1) lit. f GDPR). AI features are labelled as such (cf. Art. 50 of Regulation (EU) 2024/1689). We do not use our users' personal data to train our own AI models. Where external AI providers are engaged as processors, this takes place on the basis of contracts pursuant to Art. 28 GDPR; the providers used in each case are transparently disclosed in the respective product. Decision-making based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you (Art. 22 GDPR) does not take place.
7. Referral and partner programme
7.1 Invitation links and invitation page When you open an invitation link (for example xellux.com/app/r/… or a link with “?ref=”), we store the invitation code for 90 days in a first-party cookie (xlx_ref) so that you receive the benefit of the invitation if you sign up later. The cookie contains only the code. We count visits to a link once per code, day and visitor; we never store your IP address or browser identifier in plain text, only a one-way hash of them. The legal basis for the cookie is Section 25(2) no. 2 TDDDG, for the counting Art. 6(1)(f) GDPR (legitimate interest in correct attribution and in preventing abuse). The invitation page shows only the details the inviting person has chosen to share (for example first name, company, photo). That choice is their consent under Art. 6(1)(a) GDPR and can be withdrawn at any time in the settings; their e-mail address is never shown there. 7.2 Signing up through an invitation If you create an account or a subscription through an invitation, we pass the invitation code and hashes of your IP address and device to our payment provider Stripe to attribute the benefit and prevent abuse. The inviting person only learns that a company started through their link and sees figures such as “invited” and “paying”, never your name or contact details. The legal basis is Art. 6(1)(b) GDPR (granting the benefit and the credit) and Art. 6(1)(f) GDPR (preventing abuse). 7.3 Partner programme To take part in the partner programme we process the details from the application: company, name, address, country, VAT ID or tax number, small-business status and bank details. We store the IBAN encrypted. Partners see no customer data, only figures and amounts without names. The legal basis is Art. 6(1)(b) GDPR (contract) and, for tax-relevant records such as credit notes, Art. 6(1)(c) GDPR together with Section 147 AO; we keep these for ten years.
8. Your rights
You have the right to: • Request information about the data we process (Art. 15 GDPR) • Request correction of incorrect data (Art. 16 GDPR) • Request deletion of your data (Art. 17 GDPR) • Request restriction of processing (Art. 18 GDPR) • Receive your data in a portable format (Art. 20 GDPR) • Object to processing (Art. 21 GDPR) • File a complaint with a supervisory authority (Art. 77 GDPR)
9. Data security
When you visit our website, we use SSL encryption (Secure Socket Layer) with the highest level of encryption supported by your browser. You can recognise an encrypted transmission by the lock icon in the status bar of your browser.
10. Changes to this policy
This privacy policy is current as of October 2026. Due to the further development of our website or changes to statutory or regulatory requirements, it may become necessary to update this privacy policy.