1. Who is responsible

The controller under the GDPR is:

Javi Morales
Lensux
Lange Str. 75
76530 Baden-Baden
Germany

Email: info@lensux.com
Contact form: lensux.netlify.app/#contact

2. Hosting and server logs

The website is hosted by Netlify, Inc., 512 2nd Street, San Francisco, CA 94107, USA. When you open a page, Netlify's servers automatically process your IP address, the date and time, the page requested, the referrer and your browser's user agent to deliver the page and keep it secure. Legal basis: Art. 6(1)(f) GDPR (secure, reliable delivery). Netlify is certified under the EU-U.S. Data Privacy Framework; we have a data processing agreement with Netlify.

3. Account, sign-in and app data

Accounts and app data are stored with Supabase (Supabase, Inc., USA) on servers in Ireland (EU). We process your email address, a hashed password, your plan, the websites you add, audit results, support messages and technical error reports. Legal basis: Art. 6(1)(b) GDPR (providing the service). We keep this data while your account exists and delete it when you ask us to delete your account, unless the law requires us to keep it longer. Supabase acts as our processor under a data processing agreement with Standard Contractual Clauses.

Sign in with Google (optional): if you choose it, Google Ireland Limited shares your name and email address with us. Legal basis: Art. 6(1)(b) GDPR.

4. Payments

Payments are handled by Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Dublin 2, Ireland. Stripe processes your payment details; we only receive a customer ID, your plan and the subscription status — never your full card number. Legal basis: Art. 6(1)(b) and (c) GDPR. Billing records are kept for 10 years as required by German tax law (§ 147 AO).

5. Emails

We send service emails (welcome email, monitoring alerts, cancellation confirmations) through Resend, Inc., USA, as our processor under Standard Contractual Clauses. Legal basis: Art. 6(1)(b) GDPR.

6. Free instant scan

When you scan a URL on our homepage, we fetch that public page and analyse its HTML. We store the domain, the score and a salted, one-way hash of your IP address to limit abuse. The hash cannot be turned back into your IP address and is deleted after 30 days. Legal basis: Art. 6(1)(f) GDPR (preventing abuse).

7. Website audits and AI features

Lensux only fetches public pages of the websites you add. If you use the AI audits (design psychology, trends, visitor simulation, predicted heatmap), we send a screenshot and the page text of the audited website to the AI provider whose API key you entered (OpenAI, Anthropic, Google or OpenRouter) under your own contract with that provider. On the Enterprise plan we use our own provider account. Your API keys are stored in your account and can only be read by you and our server functions.

Website chat assistant: messages you type in the chat are sent to an AI provider (OpenAI, Anthropic, Google or OpenRouter, depending on configuration) to write the reply. We don't store the conversation. To limit abuse we keep a one-way hash of your IP address with an hourly counter. Please don't share sensitive personal data in the chat. Legal basis: Art. 6(1)(f) GDPR.

8. Heatmap tracking snippet for customers

Customers can add a small script to their own website to collect click positions (as a percentage of the page), scroll depth and the page path. It uses no cookies and stores no IP addresses or identifiers. For the visitors of those websites, our customer is the controller and we act as processor under Art. 28 GDPR (see section 10 of our terms).

9. Contact form and support

If you write to us, we process your name, email address and message to answer you. Legal basis: Art. 6(1)(b) or (f) GDPR. We delete messages once the matter is resolved, unless we must keep them for legal reasons.

10. Anonymous product statistics

To see which steps of the sign-up work, we count anonymous events (for example “scan started”) together with the page and language. No cookies, no IP addresses and no identifiers are stored, so these statistics are not personal data. They are deleted after 13 months.

11. Cookies and browser storage

We don't use advertising or tracking cookies, so there is no cookie banner. Your browser stores a few items locally (theme, language, the URL you scanned before signing up, and your sign-in session) because you asked for these functions. This is permitted without consent under § 25(2) no. 2 TDDDG.

12. Cancellation requests

If you use the cancellation page, we store your name, email address, the type of cancellation and the time we received it, to process it and prove that we did. Legal basis: Art. 6(1)(c) GDPR with § 312k BGB. We keep these records for 3 years.

13. Your rights

You have the right to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21). You can withdraw consent at any time with effect for the future. Write to the contact details above.

You can also complain to a supervisory authority, for example the one responsible for us: Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg, Lautenschlagerstraße 20, 70173 Stuttgart, Germany.

14. Other information

We don't use automated decision-making that has legal effects on you (Art. 22 GDPR). Providing data is neither legally nor contractually required, but without an email address we can't create an account. We update this policy when our processing changes.

Last updated: