Privacy Policy

neomatch digital GmbH ("datataste", "we", "us") is an AI-powered web analytics platform headquartered in Germany. We are committed to protecting your privacy and processing personal data in compliance with the EU General Data Protection Regulation (GDPR), the German Federal Data Protection Act (BDSG), and the ePrivacy Directive.

This Privacy Policy applies to:

• Customers who create a datataste account and use our analytics dashboard, API, and related services
• Website visitors whose interactions are collected by the datataste tracking snippet installed on our customers' websites
• Visitors to datataste.ai who browse our marketing pages

For customer account data: neomatch digital GmbH is the data controller. We determine the purposes and means of processing your account information, billing data, and usage of our platform.

For website visitor analytics data: Our customers are the data controllers. datataste acts as the data processor under Article 28 GDPR. We process visitor data exclusively on behalf of and according to the instructions of our customers. A Data Processing Agreement (DPA) is available on request and is included in Enterprise plans.

3.1 Customer Account Data

When you create a datataste account, we collect:

• Email address and full name
• Password (stored as a bcrypt hash; we never store plaintext passwords)
• Company name and billing address (when you subscribe to a paid plan)
• Payment information (processed and stored by Stripe; we do not store card numbers)

3.2 Analytics Data (Website Visitor Data)

When your visitors interact with a website that has the datataste tracking snippet installed, we collect the following categories of data on behalf of the website owner:

• Page context: URL, page title, referrer, hostname, path
• Device and browser: viewport dimensions, device pixel ratio, screen orientation, user agent string (parsed for browser, OS, and device type)
• Interaction data: click targets, element selectors, DOM paths, visible text of clicked elements, scroll position
• Consent signals: consent state from the website's Consent Management Platform (Cookiebot, OneTrust, Usercentrics, Borlabs, Consentmanager, Cookie Information)

3.3 What We Do NOT Collect or Store

• IP addresses: The raw IP address is extracted from the request, anonymized (last octet set to zero), used solely for city-level geolocation lookup, and immediately discarded. The raw IP is never written to our database.
• Cross-site tracking: datataste uses first-party tracking only. We do not set third-party cookies or track visitors across different websites.
• Fingerprinting for identification: Our element fingerprinting system is used exclusively for event replay context (matching interactions to DOM elements), not for identifying or profiling individual visitors.

3.4 Geolocation and Consent Gating

City-level geolocation is only resolved when the visitor has granted analytics consent through the website's CMP. If consent is not granted, the geolocation field remains empty. When consent is granted mid-session, geolocation is retroactively resolved for that session only.

4.1 Customer Account Data

• Providing and operating the Service, including authentication, billing, and support
• Sending transactional emails: verification, password reset, invoice receipts, billing notifications
• Communicating product updates, security alerts, and policy changes
• Improving the Service through aggregated, anonymized usage analytics

4.2 Analytics Data

• Rendering analytics dashboards, charts, and reports for our customers
• Powering AI-driven insights, anomaly detection, and natural-language queries
• Generating event replay context for the Event Mapper feature
• Forwarding to Google Analytics 4 or Meta Conversions API if configured by the customer and gated on the appropriate consent signals

We do not use analytics data for advertising, profiling, or any purpose other than providing the Service to the website owner.

datataste offers optional integrations that let customers connect their own advertising accounts — currently Meta Ads and Google Ads — to a datataste property. These integrations are strictly opt-in: datataste accesses no advertising data until an authorized user of the customer's account explicitly completes the advertising platform's OAuth authorization flow.

5.1 What we import

After authorization, datataste imports the following data from the connected advertising account on the customer's behalf: campaign metadata and campaign names, ad and ad-set metadata, aggregated performance metrics (such as impressions, clicks, and spend), and advertising account metadata (account ID, account name, currency, and the email address of the authorizing platform user). We request read-only API scopes only; datataste never creates, modifies, or publishes ads.

5.2 Credential storage

The OAuth access and refresh tokens issued by the advertising platform are stored encrypted at rest (AES-256-GCM), are never returned to any browser or client, and are used exclusively to perform the read-only imports described above.

5.3 How this data is — and is not — used

• Imported advertising data is used solely to provide reporting, campaign matching, and analytics features to the customer who connected the account.
• We do not sell advertising data — or any other personal data (see section 7).
• Each customer's advertising data is stored isolated within their account and is accessible only to that customer's authorized users under our role-based access control.
• We never use one customer's advertising or campaign data to benefit another customer, to build cross-customer datasets or benchmarks, or to train AI models.

5.4 Disconnecting and deletion

Customers can disconnect an advertising integration at any time from the Ad platforms tab in the property's settings in the datataste dashboard. Disconnecting revokes datataste's future access and immediately and permanently deletes the stored OAuth access and refresh credentials. Previously imported reporting data remains available in the customer's account so that historical reports stay intact; customers may request its deletion at any time as described on our data deletion page.

5.5 Retention of imported advertising data

Imported advertising reporting data is retained for as long as the connected property exists and is permanently removed as part of property or account deletion (see sections 9 and 11). Data belonging to integrations that remain disconnected may additionally be pruned by periodic retention cleanup. Deletion requests are honored within 30 days, subject to statutory retention duties.

5.6 Sub-processors and roles

Advertising data is hosted exclusively on our EU infrastructure (Hetzner Cloud, Germany) and is covered by the same sub-processor commitments listed in section 7; where AI-powered features are used on campaign data, Microsoft Azure OpenAI processes aggregated query results only. Meta Platforms and Google are independent controllers of the data processed on their own platforms and are not sub-processors of datataste. For advertising data imported on behalf of a customer, the customer is the data controller and neomatch digital GmbH acts as their data processor under Art. 28 GDPR (see section 2); for the OAuth connection metadata attached to the customer's datataste account, neomatch digital GmbH is the controller.

datataste's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Our use of data received from Meta's APIs complies with the Meta Platform Terms and Developer Policies.

We process personal data on the following legal bases under GDPR:

• Contract performance (Art. 6(1)(b)): Processing customer account and billing data to provide the Service
• Legitimate interest (Art. 6(1)(f)): Security monitoring, fraud prevention, service improvement through aggregated analytics
• Legal obligation (Art. 6(1)(c)): Tax and accounting records, law enforcement requests
• Consent (Art. 6(1)(a)): Marketing communications (opt-in only)
• Data processor agreement (Art. 28): Processing website visitor analytics data on behalf of our customers

We do not sell, rent, or trade personal data. We share data only with the following categories of sub-processors, all bound by data processing agreements:

• Stripe, Inc. (San Francisco, USA; EU SCCs in place) — Payment processing, subscription management, invoice generation
• Mailgun / Sinch (EU endpoint: api.eu.mailgun.net) — Transactional email delivery
• Microsoft Azure OpenAI (EU region) — AI analytics engine (processes aggregated query results only, never raw visitor-level data)
• Hetzner Cloud (Germany) — Infrastructure hosting, data storage, backups
• DB-IP (db-ip.com) — IP-to-city geolocation lookup. Only a truncated IP address (last octet removed, e.g. 91.36.0.0) is sent to DB-IP’s API; the full IP address is never transmitted or stored

We may also disclose data when required by law, court order, or government request, or to protect the rights, property, or safety of datataste, our customers, or the public.

All customer and analytics data is stored exclusively on servers located within the European Union (Hetzner Cloud, Germany). Data never leaves the EU.

We implement the following technical and organizational measures:

• Encryption in transit (TLS 1.2+) and at rest
• Passwords stored as bcrypt hashes with individual salts
• Role-based access control (RBAC) with four permission levels (Owner, Admin, Manager, Viewer)
• Daily automated backups stored on a separate encrypted volume
• 24/7 automated infrastructure monitoring with alerting
• Bot and Puppeteer detection at the tracker level to prevent synthetic data contamination

• Customer account data: Retained for the duration of the account plus 30 days after deletion request
• Analytics event data: Retained according to the customer's subscription plan
• Imported advertising data (Meta Ads, Google Ads): Retained while the connected property exists; deleted with property or account deletion, or earlier on request (see section 5)
• Property snapshots (HTML/assets): Retained for 30 days
• Invoices and billing records: Retained for 10 years as required by German tax law (AO § 147)
• Server logs: Retained for 7 days, then automatically purged
• Backups: 7-day rolling retention on a separate encrypted volume

If you are located in the European Economic Area, you have the following rights:

• Right of access (Art. 15): Request a copy of the personal data we hold about you
• Right to rectification (Art. 16): Correct inaccurate or incomplete data via your account settings
• Right to erasure (Art. 17): Delete your account and all associated data from Account Settings. Deletion is cascading and permanent.
• Right to restriction (Art. 18): Request that we limit processing of your data
• Right to data portability (Art. 20): Export your analytics data in machine-readable format
• Right to object (Art. 21): Object to processing based on legitimate interests
• Right to withdraw consent (Art. 7(3)): Withdraw consent at any time without affecting the lawfulness of prior processing

To exercise these rights, contact us at privacy@datataste.ai. We respond to all requests within 30 days.

For website visitors: If you want to exercise your data subject rights regarding analytics data collected on a customer's website, please contact the website owner directly. They are the data controller for that data.

You can permanently delete your datataste account at any time from Account Settings. Account deletion triggers a cascading removal of:

• Your user profile and authentication credentials
• All properties and their configurations
• All analytics events, sessions, and dashboard data
• All property snapshots and associated assets
• All element groups and custom dimensions
• All advertising platform connections (including stored OAuth credentials) and imported campaign data

A confirmation email is sent after deletion. This action is irreversible. Billing records are retained as required by German tax law.

datataste.ai website: We use essential cookies for authentication and session management. We also run our own datataste analytics tracker on datataste.ai and in our signup flow to measure use of our site — it stores a session ID and visitor ID in first-party localStorage and records page and interaction events, as described in section 3.2. It is not active in the customer dashboard. It sets no third-party cookies, and we do not use advertising or profiling cookies on our own website.

datataste tracking snippet: The tracker uses first-party localStorage for session continuity (session ID and visitor ID). It does not set third-party cookies. The tracker respects the visitor's consent preferences as signaled by the website's CMP.

All primary data processing occurs within the EU. Where sub-processors are based outside the EU (Stripe, Inc.), we ensure appropriate safeguards are in place:

• EU Standard Contractual Clauses (SCCs) adopted by the European Commission
• Assessment of the sub-processor's data protection practices
• Supplementary technical measures (encryption, access controls)

The Service is not intended for individuals under 16 years of age. We do not knowingly collect personal data from children. If we become aware that we have collected data from a child under 16, we will delete it promptly.

We may update this Privacy Policy to reflect changes in our practices, legal requirements, or the Service. We will notify customers of material changes by email at least 30 days before they take effect and update the "Last updated" date at the top of this page.

If you believe that our processing of your personal data violates applicable data protection law, you have the right to lodge a complaint with a supervisory authority, in particular in the EU member state of your habitual residence, your place of work, or the place of the alleged infringement.

For questions about this Privacy Policy or to exercise your data subject rights:

neomatch digital GmbH
Email: privacy@datataste.ai
Web: datataste.ai