Privacy policy

1. Controller

2. Hosting and security logs

The website is hosted by ALL-INKL.COM – Neue Medien Münnich in Germany. Technically necessary logs may contain IP address, timestamp, requested URL, referrer, browser, operating system and HTTP status. They are processed to deliver and secure the service under Art. 6(1)(f) GDPR and retained only as long as needed for operations, security incidents or legal duties.

3. Accounts and authentication

For registration and account operation we process name, email address, password hash, preferred language, email-verification and password-reset data, plan and product-email choice. The legal basis is Art. 6(1)(b) GDPR. Security throttles and session data are processed under Art. 6(1)(f) GDPR. Passwords are stored only as hashes.

4. Projects, questions and measurements

Authenticated users can store companies, public website addresses, customer questions, question suggestions, measurement runs, answer excerpts, named alternatives, source links, technical scores, change events, actions and verification results. This data is required to provide the requested analysis, history, exports and monitoring under Art. 6(1)(b) GDPR.

5. AI providers and web search

Simply viewing a page does not send a request to an AI provider. AI measurements run exclusively inside the signed-in project of an account with an active plan and are started separately there. Depending on the selected and currently approved system, OpenAI, Google Gemini or Perplexity may process data. The customer question and the public company and website context required for measurement are transmitted. Do not enter confidential or unnecessary personal data. Answers, sources, model and usage information are stored for measurement traceability. The legal basis for the service explicitly requested by the user is Art. 6(1)(b) GDPR; security and abuse-prevention measures rely on Art. 6(1)(f) GDPR.

6. Security and abuse prevention

For abuse prevention, short-lived IP hashes produced with a secret application key are used in rate-limit stores for forms and measurements. For the free trial, Nalqerio additionally stores pseudonymous HMAC hashes of the canonicalised email address, a necessary first-party trial identifier and the IP address to detect repeated free-trial creation. The raw device value and raw IP address are not stored in the trial table; the email address itself remains stored separately as required account data. Trial-protection data are used only for security, cost control and abuse prevention, not advertising or cross-site tracking. The legal basis is Art. 6(1)(f) GDPR.

7. Necessary cookies and local storage

Laravel session and CSRF cookies protect sessions and forms. A necessary first-party trial identifier used only on nalqerio.com is set to protect the free trial against repeated abuse; it is not used for advertising or cross-site tracking. The trial identifier has a maximum lifetime of 730 days. Optional analytics consent is managed separately in local browser storage and honoured for at most 180 days; consent is requested again after expiry or a change of analytics integration. Necessary security and session functions remain separate from optional analytics.

8. Cloudflare Turnstile

Protected forms can use Cloudflare Turnstile. Cloudflare processes technical connection, device and challenge data to detect automated abuse. The widget is loaded only when configured. This security processing is based on Art. 6(1)(f) GDPR; international processing may occur under Cloudflare's applicable safeguards.

9. Contact and service emails

Contact messages are sent to support@nalqerio.com and processed to answer requests under Art. 6(1)(b) or (f) GDPR. Service emails include address verification, password reset and security-related messages. Optional material-change alerts are sent only when the user enables notifications and product emails.

10. Scheduled monitoring and optional emails

After monitoring is enabled for an eligible project and plan, active questions can be processed on the configured schedule. Starter and Pro include four complete cycles per billing period; the first full measurement uses one of these cycles. Each provider request remains subject to usage and cost checks. Optional weekly summaries use saved results and require the relevant plan and enabled email preferences. The newsletter is only sent after explicit consent and confirmation through the confirmation link (double opt-in). Unconfirmed subscriptions are deleted automatically. Every newsletter email contains an unsubscribe link that revokes consent at any time without logging in. Creating an account, purchasing, withdrawing or cancelling are independent of the newsletter and never a precondition for consent.

11. Payments

When you actively start Checkout, Stripe processes your name, billing address, country, customer type, any business tax ID and payment data. Nalqerio stores the billing profile encrypted, Stripe customer and subscription identifiers, plan, status, confirmed periods and the contract version accepted at Checkout. Full card details are not stored in Nalqerio. Public cancellation and withdrawal declarations are stored encrypted with their content and receipt time and processed for handling and acknowledgement to the email address provided. Contract and cancellation confirmations are required service messages independent of optional product emails. Processing is based on GDPR Article 6(1)(b) and (c); retention follows applicable contractual, evidentiary and statutory requirements.

12. Optional audience analytics with Google Analytics 4

Nalqerio uses Google Analytics 4 (GA4), an analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, only on the basis of your prior consent. The Google Analytics tag on nalqerio.com is loaded only after you choose “Allow Google Analytics” in the consent banner. If you decline optional analytics, the Google Analytics tag is not loaded and Nalqerio sends no Analytics measurement data to Google through that tag.

After consent, GA4 measures in particular page views, session and interaction data such as scrolls and outbound-link clicks, and technical browser and device information. GA4 may use first-party cookies such as _ga and _ga_<container-id> to distinguish users and persist session state. Google states a default expiry of up to two years for these cookies; browsers may shorten this period. Advertising functions are disabled at Nalqerio: ad_storage, ad_user_data and ad_personalization remain “denied”, and Google Signals and ad-personalisation signals are disabled.

The legal basis is your consent under Article 6(1)(a) GDPR and, where information is stored on or accessed from your terminal device, section 25(1) TDDDG. You can withdraw consent at any time with effect for the future through “Cookie settings”. Nalqerio then sets Analytics consent to “denied” and removes GA4 first-party cookies that are accessible for nalqerio.com. Withdrawal does not retroactively delete data already transmitted to and processed by Google.

As part of transmission to Google, the IP address is technically used. Google states that for traffic from the EU, Switzerland and the United Kingdom, IP addresses are used for geolocation before further processing and are then not logged or stored. Data may also be processed within the Google group and by subprocessors outside the European Economic Area; the applicable contractual and statutory transfer mechanisms apply. Google provides further information in its privacy and Google Analytics documentation.

Google Search Console: Nalqerio uses Google Search Console to monitor the discoverability, indexing and performance of nalqerio.com in Google Search and to identify technical search issues. Website ownership is verified through a static verification meta tag in the <head>. This verification tag executes no tracking code, sets no cookies and sends no additional visitor measurement data to Google when a page is viewed. Search Console reports on search and indexing data collected by Google as part of its search engine. No additional cookie-banner choice is therefore required for this static verification tag.

13. Recipients and international processing

Recipients used are ALL-INKL.COM – Neue Medien Münnich for hosting and email in Germany; OpenAI, Google Gemini (API) and Perplexity for the requested AI functions; Cloudflare for configured Turnstile security checks; Stripe for payment processing and invoices; and, only after Analytics consent, Google Ireland Limited for Google Analytics 4. AI, security and payment services may process data outside the European Economic Area. The specific contracting entity, role as processor or independent controller, and safeguards actually agreed for transfers require a service- and account-specific review; a general provider privacy page alone does not prove an effective agreement for this account. This contractual review must still be completed before commercial launch, particularly for analysing and storing Gemini responses grounded with Google Search. Contact support@nalqerio.com for information on the recipients used and agreed safeguards. Nalqerio currently keeps verified local backups on the hosting server; transfer to an independent backup provider has not yet been configured.

14. Retention, export and deletion

Account holders can export project evidence as included in their plan, delete individual projects and request account deletion through account settings. Statutory access and data-portability rights can be exercised independently of the plan by contacting support@nalqerio.com. By default, bounded raw provider evidence is removed after 90 days while normalized project measurements remain available for the requested history. For legacy anonymous public AI checks, the visitor hash and entered company, website and question snapshots are removed after 30 days. Pseudonymous records used to prevent repeated free trials are retained for no more than 730 days from the claim and are then deleted by the automated retention job. Legacy free-allowance records are likewise retained for no more than 730 days. Aggregated cost and reliability records remain without the legacy public inputs. These periods can be shortened in the service configuration. Deletion removes associated project data unless retention is required by law or an active billing relationship must first be ended; pseudonymous abuse-prevention evidence may remain separately until the stated protection period expires. Security and accounting records may be retained for the applicable legal period. Failed service emails and technical errors can be logged for troubleshooting.

15. Rights

Subject to legal requirements, you can request access, rectification, erasure, restriction, portability and object to processing. Contact support@nalqerio.com. You may complain to a data-protection authority; the competent authority is the Independent Centre for Privacy Protection Schleswig-Holstein (ULD), Holstenstraße 98, 24103 Kiel, Germany.

16. Automated results

The automated score and visibility classifications have no legal or similarly significant effect. No decision under Art. 22 GDPR is made. Users should review the stored evidence and methodology.

Note: The German version is authoritative. This translation and the full privacy setup require final legal review before public commercial launch.