Privacy Policy

Introduction

We take the protection of your personal data very seriously. This privacy policy explains what data we collect when you use Optysys (the "Service"), how we use it, and what rights you have regarding your data.

1. Controller

The controller responsible for data processing is:

Newmatik GmbH, Am Markt 1, 55619 Hennweiler, Germany. Email: service@newmatik.com, Phone: +49 6752 16998-0.

2. Data Protection Officer

Our Data Protection Officer is Dominik Ottenbreit. You can reach the DPO at service@newmatik.com.

3. Data We Collect

When you use the Service, we collect and process the following personal data:

• Account data: email address, full name (optional), password (stored as a hash, never in plain text), avatar URL
• Organization data: team memberships, roles (admin/member), space and project assignments
• Inspection data: uploaded images, image metadata (camera settings, GRBL coordinates, timestamps), annotations (geometry, labels, styles), annotation comments
• AI model data: ONNX model files and metadata uploaded by team administrators
• Technical data: IP address, browser user agent, error logs, and performance traces (via Sentry)
• Consent records: timestamp, version, IP address, and user agent when you accept terms or privacy policy

4. Legal Basis for Processing

• Contract performance (Art. 6(1)(b) GDPR): Processing your account data, inspection data, and organization data is necessary for providing the Service you signed up for.
• Consent (Art. 6(1)(a) GDPR): When you agree to the Terms & Conditions and acknowledge this Privacy Policy during registration.
• Legitimate interest (Art. 6(1)(f) GDPR): Error monitoring via Sentry to maintain service reliability and security. Our legitimate interest is ensuring the stability and security of the Service.

5. Hosting and Data Processors

We use the following third-party services to operate the Service:

6. OAuth Authentication

If you sign in using GitHub or Microsoft Azure, we receive your email address, name, and avatar URL from the OAuth provider. This data is used solely for authentication and populating your profile. We do not share your data back with these providers. The OAuth flow is handled by Supabase Auth.

7. Cookies and Local Storage

The Service uses the following cookies and local storage:

• optysys_locale: Stores your language preference (English or German). Strictly necessary for providing the Service in your preferred language.
• Supabase authentication tokens: Session tokens for maintaining your login state. Strictly necessary for authenticated access to the Service.
• cookie_consent_dismissed: Records whether you have dismissed the cookie information banner. Stored in localStorage.

We do not use any marketing, advertising, or analytics cookies.

8. AI Processing

Optysys supports AI-powered optical inspection. ONNX model files are stored in our cloud storage (Supabase). However, all AI inference (running models on images) is performed locally on the user's machine in the Optysys Desktop application. No inspection images or inference results are sent to any external AI service. The web dashboard only manages AI model metadata and file storage.

9. Data Retention and Deletion

Account deletion removes login, profile, memberships, and consent records. Team-owned inspection evidence is retained and structured account attribution is removed. Free text and personal information inside evidence need a separate reviewed request. Team-admin image deletion starts a 30-day recovery period; evidence pinned by inspections or configuration is retained. Unpinned originals are removed through a retryable Storage cleanup process after the recovery period.

10. Your Rights

Under the GDPR, you have the following rights regarding your personal data:

• Right of access (Art. 15 GDPR): You can request information about what personal data we process.
• Right to rectification (Art. 16 GDPR): You can request correction of inaccurate data.
• Right to erasure (Art. 17 GDPR): You can request deletion of your data. Use the "Delete my account" feature in your dashboard or contact us.
• Right to data portability (Art. 20 GDPR): You can download your data in a machine-readable format (JSON) from the Security settings in your dashboard.
• Right to restriction of processing (Art. 18 GDPR): You can request that we restrict processing of your data.
• Right to object (Art. 21 GDPR): You can object to processing based on legitimate interest.
• Right to lodge a complaint: You can file a complaint with a supervisory authority. The competent authority for Newmatik GmbH is the Landesbeauftragte für den Datenschutz und die Informationsfreiheit Rheinland-Pfalz.

To exercise any of these rights, contact us at service@newmatik.com.

11. International Data Transfers

Your primary data is stored in the EU (Supabase, Frankfurt). Cloudflare may temporarily cache content at edge locations worldwide but does not permanently store personal data outside the EU. Sentry ingests data via its EU endpoint. Where data is transferred outside the EU/EEA, appropriate safeguards are in place, including EU Standard Contractual Clauses (SCCs).

12. Fonts

The Inter font used on this website is self-hosted on our servers. No data is transmitted to Google or any external font provider when you visit our website.

13. Changes to This Policy

We may update this privacy policy from time to time. If we make material changes, we will notify you by requiring re-acceptance through the Service. The date of the last update is shown at the top of this policy.