SuplorisDeutschStart for free
Menu
DeutschSign in

Privacy policy

Version 1.2, Last updated 30 October 2026

This is a translation. Only the German version is legally binding.

Controller

Neuralis GmbH i.G., Stephansplatz 8/20, 1010 Wien, Österreich
Email: kontakt@neuralis.at, phone: +43 1 3058463

Overview

This website presents Suploris. You can start a self-test for a domain, sign up, order a plan or request a quote for Enterprise. We process as little data as possible. We do not use advertising or analytics tools, and we set no cookies on the public website.

Visiting the website

When you visit the website, your browser transmits technically necessary data, such as IP address, time, the page requested and browser identifier. We need this data to deliver the page and to protect it against attacks. We do not store access logs with IP addresses. The legal basis is our legitimate interest in secure operation (Art. 6(1)(f) of the General Data Protection Regulation, GDPR (DSGVO)).

The website is currently an internal preview. It runs on our own server in Austria. Access goes through Cloudflare (see “Recipients”). Cloudflare checks whether you are authorised to access it.

Self-test

For the self-test, you enter a domain. We only check publicly visible information about this domain. We store the domain, measured values, result, time and the version of the rule set. We do not store any information about you for this. Results can be reached through a random link and are deleted after 7 days.

To prevent misuse, we count the tests per source. For this, we derive a key value from your IP address that changes daily. The address cannot be calculated back from it. We delete it after at most 26 hours. The legal basis is our legitimate interest in protection against misuse (Art. 6(1)(f) GDPR).

We use Cloudflare Turnstile for bot protection. The check script only loads when you use the form. It processes browser and device data at Cloudflare. The legal basis is also Art. 6(1)(f) GDPR.

Enterprise request

For an Enterprise request, we process your business email address and your company and, if you wish, your role and the number of your suppliers. We use this data to contact you, prepare a quote and show you Suploris. After you confirm, our team receives an internal message with company and time only. We use the data only for this request, not for advertising, and do not pass it on. The legal basis is your consent (Art. 6(1)(a) GDPR).

Your request only counts once you click the link in our confirmation email. We delete unconfirmed requests after 7 days. We store when you agreed to which text. You can withdraw your request at any time through the link in every email or by writing to us. We then delete all details of the request at once.

Sign-up and account

When you sign up, we process your company, country, name and business email address. We use them to create your organisation and send you an invitation to set it up. After that, we store your password only as a hash, the second factor in encrypted form and the data you enter in Suploris.

The legal basis is the contract with you, and before it is concluded, steps taken at your request (Art. 6(1)(b) GDPR). An invitation that is not accepted expires after 72 hours. We delete an organisation without a set-up account after 7 days. An account remains until it is cancelled. We then delete the organisation's data, unless we have to keep it (see ordering and payment).

To prevent abuse, we count sign-ups per network and per email address. For this, we store the network address only shortened and as a hash, for at most 26 hours. The legal basis is our legitimate interest in preventing abuse (Art. 6(1)(f) GDPR).

Ordering and payment via Stripe

You order the Team and Business plans via Stripe Checkout. The provider is Stripe Payments Europe, Limited, 1 Grand Canal Street Lower, Dublin 2, Ireland. You enter card details and other payment methods directly with Stripe. We neither see nor store them.

We store your Stripe customer and subscription numbers, the plan, the payment status and the term. Stripe informs us of changes to the subscription automatically. We only take plan, status and term from these messages. The legal basis is the contract (Art. 6(1)(b) GDPR). We keep billing data for seven years from the end of the calendar year, because the law requires it (Art. 6(1)(c) GDPR in conjunction with section 132(1) of the Austrian Federal Fiscal Code, BAO). You can find Stripe's privacy notice at stripe.com/at/privacy.

Contact by email

When you write to us, we process your details to answer your enquiry. The legal basis is Art. 6(1)(b) GDPR for enquiries about a contract, otherwise Art. 6(1)(f) GDPR.

Recipients

  • Cloudflare, Inc. (USA) with Cloudflare Germany GmbH: access protection for the preview, forwarding of requests to our server, Turnstile bot protection.
  • Stripe Payments Europe, Limited (Ireland): ordering and payment of the Team and Business plans.

We will name further recipients here before we use them. For public operation, we plan a server in a data centre in the EU.

Transfers to third countries

Cloudflare, Inc. has its registered office in the USA. The company is certified under the EU-US Data Privacy Framework. The transfer is therefore based on the adequacy decision of the European Commission (Art. 45 GDPR). Cloudflare's data processing agreement also contains standard contractual clauses (Art. 46(2)(c) GDPR).

Stripe may also transfer data to the USA. This is based on the adequacy decision for the EU-US Data Privacy Framework (Implementing Decision (EU) 2023/1795, Art. 45 GDPR) and standard contractual clauses (Art. 46(2)(c) GDPR).

Storage periods

  • Self-test results: 7 days.
  • Counters against misuse of the self-test: at most 26 hours.
  • Unconfirmed Enterprise requests: 7 days.
  • Confirmed Enterprise requests: 12 months after the last contact, earlier if you withdraw the request.
  • Invitations to set up an account: 72 hours.
  • Organisations without a set-up account: 7 days.
  • Account and data of the organisation: until cancellation.
  • Counters against misuse of the sign-up: at most 26 hours.
  • Billing data: 7 years from the end of the calendar year (section 132(1) BAO).
  • Emails: as long as the enquiry requires, at most until the end of statutory retention periods.

Your rights

You have the right of access, rectification, erasure, restriction of processing and data portability (Art. 15 to 20 GDPR). You can withdraw your consent at any time with effect for the future. To do so, write to kontakt@neuralis.at. We reply within one month.

Right to object (Art. 21 GDPR). Where we process data on the basis of our legitimate interest, you can object on grounds relating to your particular situation. As the owner of a domain, you can also object to the check of your domain. The self-test information page explains how.

You can lodge a complaint with the supervisory authority. In Austria, this is the Austrian Data Protection Authority (Datenschutzbehörde), Barichgasse 40-42, 1030 Wien, dsb@dsb.gv.at, www.dsb.gv.at.

Changes

We update this policy when we introduce new functions or service providers. The version published here applies.