Skip to content

Privacy policy

Last updated: 2026-08-12

1. Controller

Der Huber, Christian Huber
Odenwaldstraße 24, 69124 Heidelberg, Germany
Email: info@splityx.com
See also the legal notice.

No data protection officer has been appointed, because the conditions of § 38 BDSG (German Federal Data Protection Act) are not met.

2. What data we process

  • Account data: email address and a hashed password, on registration.
  • Waitlist data: email address, selected role, and signup time, when you request early access.
  • Profile and demographic data (voters): year of birth, gender, country, and interests. All of it is voluntary and is used to match you to suitable tests. At the moment you cast a vote, your age group, gender, and country are stored with that vote as a snapshot, so that later profile changes cannot retroactively alter results that have already been reported.
  • Usage data: votes cast, free-text reasons, tests created, and variants uploaded.
  • Analytics data: pages visited, page titles, referrers, query parameters, session duration, entry and exit pages, browser and operating system, screen resolution, device type, country and region, and UTM campaign parameters, including whether a waitlist signup was completed.
  • Billing data: credit purchases, balance movements, and payout details (PayPal address or IBAN).
  • Quality and abuse signals: timestamps, time spent on a test, the result of the attention check, and a quality score calculated from them. These serve to detect automated or abusive voting.

No automated decision-making producing legal effects within the meaning of Art. 22 GDPR takes place. Suspicious accounts are only flagged for manual review; a human always decides on a suspension or on the release of a payout.

3. Purposes and legal bases

  • Performance of a contract (Art. 6(1)(b) GDPR): operating the account, running tests, voting, and payouts.
  • Legitimate interests (Art. 6(1)(f) GDPR): fraud and quality checks, security and stability of the platform, and anonymous measurement and improvement of the website.
  • Legal obligation (Art. 6(1)(c) GDPR): retention under tax and commercial law, § 147 AO and § 257 HGB.
  • Consent (Art. 6(1)(a) GDPR): managing the early access waitlist and sending access updates.

4. Recipients and processors

  • Convex (Convex, Inc., USA) — database, authentication, file storage, and execution of the server functions. All of the data named above is held here.
  • Hetzner (Hetzner Online GmbH, Germany) — hosting and delivery of the marketing site and web application, including our self-hosted Rybbit analytics instance. The server location selected for Splityx is in Germany.
  • Polar (Polar Software Inc.) — payment processing when credits are bought. Payment data is collected there; we receive only the order number, the product reference, and the amount.
  • Resend (Resend, Inc., USA) — sending transactional email, for example a password reset or the status of a payout.

Payouts are made by PayPal or SEPA transfer. You supply the details needed for this yourself; they are passed to the relevant payment institution.

5. Transfers to third countries

Convex, Polar, and Resend may process data in the United States. Transfers are made on the basis of the EU standard contractual clauses under Art. 46(2)(c) GDPR, unless the provider in question is certified under the EU-US Data Privacy Framework. Hetzner hosts Splityx at the selected server location in Germany. You can obtain copies of the safeguards through the contact address given above.

6. Retention periods

  • Account and profile data: until the account is deleted.
  • Waitlist data: until you ask us to remove it or the waitlist closes. We then delete it.
  • Analytics data: only for as long as it is needed to analyze and improve the website. We then delete or aggregate it.
  • Votes, comments, and test results: after an account is deleted, direct identifiers and demographic data are removed. The records retain a pseudonymous internal account reference because completed test results would otherwise be changed after the fact for the customers who paid for them.
  • Balance movements and payouts: ten years from the end of the relevant calendar year, because of the retention duties under § 147 AO and § 257 HGB. During that time they are blocked from any further processing.

7. Deleting your account

You can request account deletion yourself under "Account" in the app. Active tests must be closed first so unused test credits return to your balance. An open payment checkout must finish or expire, normally within 24 hours, before deletion can start. This removes your email address, credentials, demographic data, and uploaded images, and locks the account. Any remaining balance is forfeited unless it was paid out beforehand; the payout threshold is stated in the terms and conditions. Records that must be kept for commercial law remain under section 6.

8. Your rights

You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20), and objection (Art. 21 GDPR). To exercise them, contactinfo@splityx.com.

You can also lodge a complaint with a supervisory authority. The competent one is der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg, Lautenschlagerstraße 20, 70173 Stuttgart, Germany.

9. Cookies and analytics

We use Rybbit to measure visits and improve the website. Rybbit is hosted by us at rybbit.derhuber.com on a Hetzner server in Germany. The analytics data remains on this server.

Rybbit records the analytics data listed in section 2. It uses the IP address temporarily to determine an approximate country and region and to create an anonymous visitor identifier. The raw IP address is not stored. We do not use Rybbit to identify signed-in users or send email addresses to it.

Rybbit does not set cookies or use local storage for tracking. The app sets only technically necessary cookies for signing in. The legal basis for analytics is our legitimate interest in measuring and improving the website under Art. 6(1)(f) GDPR. You can object to this processing by contactinginfo@splityx.com.