Privacy Policy

Data controller

NeuroGen Lab Softwareentwicklung & KI-Beratung, Gartenweg 2, 16515 Oranienburg, Germany.

Privacy contact: [email protected] · Phone: +49 1512 2582232 · Website: https://getgeofix.com

We have not appointed a Data Protection Officer.

Personal data we collect

• Email address and name (if provided) for your account, orders, delivery, and support.
• If you create an account: your password, stored only in hashed form, or, if you sign in with Google, your Google account identifier and the name Google shares with us.
• Website URL you submit — required to perform the service.
• Company and billing details when needed for invoices or B2B orders.
• Payment status and identifiers from Stripe Checkout. We do not store full card numbers.
• Messages you send us by email or phone.
• Your newsletter choice: whether you are subscribed, and how and when it was last set (see “Emails we send”).
• Usage data and analytics identifiers: PostHog product analytics (including session recordings with input fields masked) and, if you consent to optional cookies, Google Analytics and advertising identifiers.
• Internal order notes, delivery logs, and admin operational records.

Why we use data

• To perform the contract: run checks, prepare reports, deliver files, and coordinate optional implementation.
• To process one-time payments and comply with tax and accounting obligations.
• To respond to support, legal, and privacy requests.
• To secure our sites, prevent abuse, and improve the service.
• To send you our newsletter, only if you have subscribed (see “Emails we send”).
• For product analytics with PostHog — to see how visitors use the site and fix what does not work — on the basis of our legitimate interest (Art. 6(1)(f) GDPR). You can object at any time (see “Your right to object”).
• For Google Analytics and advertising only with your consent to optional cookies (see Cookie Policy).

Emails we send

Service emails. Emails about your account, checks, and orders — confirmation and sign-in links, the reports you request, file delivery, and payment receipts — are necessary to provide the service (Art. 6(1)(b) GDPR). We may also email you about changes to our terms or this policy, or about changes that affect your account or orders, such as price changes, discontinued features, or security issues (Art. 6(1)(f) GDPR, our legitimate interest in keeping customers informed). Service emails contain no advertising, do not depend on your newsletter choice, and are not stopped by unsubscribing from the newsletter.

Newsletter. If you subscribe, we email you articles about preparing websites for AI search, at most once a week. Where relevant to the topic, an article may refer to GEO Fix services; the newsletter contains no separate offers or discounts. We send the newsletter only with your consent (Art. 6(1)(a) GDPR; for users in the United Kingdom, the UK GDPR).

Subscribing is voluntary and is not required to use GEO Fix. You can subscribe in two ways: by ticking the newsletter box when you register with an email address and a password, or, while you are signed in, by turning on the newsletter setting in your account profile. The box and the setting are never pre-selected. If you subscribe at registration, we record your subscription only after you have confirmed that the address is yours by clicking the link in our confirmation email. If you subscribe in your profile, we record it for your account's email address, which has already been confirmed: by a link we emailed to it, or by Google if you sign in with Google.

You can withdraw your consent at any time, free of charge: turn off the newsletter setting in your account profile, use the unsubscribe link in any newsletter email — one click is enough — or write to [email protected]. Withdrawing consent does not affect the lawfulness of emails sent before you withdrew it.

For the newsletter we use your email address and, if you gave it to us, your name. We also keep a record of your current choice: whether you are subscribed, how it was last set (for example, at registration, in your account profile, through an unsubscribe link, or by us at your request), when the record was created, and when it last changed. We keep it to respect your decision and to be able to demonstrate your consent (Art. 6(1)(f) GDPR; proof of consent under Art. 7(1) GDPR). In this record your address is stored only as a one-way hash, a code calculated from the address. This is not anonymisation: the record is still personal data, and while you have an account it is linked to it.

While you are subscribed, the record is kept; if you delete your account while subscribed, it is deleted together with the account. When you unsubscribe, we stop sending the newsletter but keep the opt-out record, also after you delete your account, so that the address is not emailed again. We keep opt-out records for as long as we send marketing emails.

AI and automated processing

We may use external AI or LLM service providers (such as OpenAI, Anthropic, Google/Gemini, or Perplexity APIs) to help analyse public site content and prepare reports. We do not use automated decision-making that produces legal or similarly significant effects about you.

Do not submit special-category personal data through our forms or email.

Service providers

We use trusted providers that process data on our instructions, including:

• Stripe — one-time payments through Stripe Checkout and fraud prevention.
• Hosting Ukraine (adm.tools) — email, including service emails, support, and the newsletter, and database hosting.
• Netlify — hosting and CDN.
• Cloudflare — DNS, network protection, and content delivery for our site, and storage (R2) of the files we deliver to you.
• Google — sign-in, if you choose to sign in with Google.
• Google Tag Manager / Google Analytics 4 — analytics when enabled.
• PostHog — product analytics: page views, clicks, and session recordings with input fields masked, to understand how visitors use our site.
• Google Ads, Meta (Facebook) Pixel, and LinkedIn Insight Tag — marketing when enabled.
• AI service providers listed above for report preparation.

How long we keep data

We keep data only as long as needed for the purposes above: order and billing records for accounting and dispute periods, reports and delivery logs for support and service history, support messages for a reasonable period, and consent logs for compliance.

Newsletter consent and opt-out records are kept as described in “Emails we send”.

You may ask us to delete data where we have no overriding legal reason to keep it.

Your rights

You have the right to access, rectify, and erase your personal data, to restrict its processing, and to data portability (Art. 15–20 GDPR; for users in the United Kingdom, the UK GDPR). Where we rely on your consent — for optional cookies or the newsletter — you can withdraw it at any time; this does not affect processing carried out before the withdrawal.

Contact [email protected]. We respond within the time required by applicable law.

You may lodge a complaint with your local supervisory authority. In Germany, you may contact the data protection authority for Brandenburg or the Federal Commissioner for Data Protection and Freedom of Information (BfDI). In the United Kingdom, this is the Information Commissioner’s Office (ICO).

Your right to object

Where we process your data on the basis of our legitimate interests (Art. 6(1)(f) GDPR), you may object at any time on grounds relating to your particular situation (Art. 21(1) GDPR). We will then stop, unless we can demonstrate compelling legitimate grounds that override your interests, rights, and freedoms, or the processing is needed to establish, exercise, or defend legal claims.

You may object at any time, without giving reasons, to the use of your data for direct marketing, including the newsletter (Art. 21(2) GDPR). We will then no longer use your data for that purpose.

To object, write to [email protected]. For the newsletter, the unsubscribe link in any newsletter email is enough.

International transfers

Some providers may process data outside your country, including outside the EU/EEA. Where required, we rely on appropriate safeguards such as Standard Contractual Clauses or equivalent mechanisms.

Security

We use reasonable technical and organisational measures to protect personal data. No online service can be guaranteed 100% secure.

Customer accounts

You can create a customer account with your email address and a password, with a sign-in link sent to your email, or by signing in with Google. We use your account data to provide the account and the services you use through it (Art. 6(1)(b) GDPR).

In your account profile you can download a copy of your account data and delete your account. To protect you, deletion is confirmed through a link sent to your email address.

Deletion erases your profile and the personal details linked to your account. Some records remain: order and payment records we need for accounting, newsletter opt-out records (see “Emails we send”), internal logs of actions taken by our staff (including a note that the account was deleted), and copies of the files we delivered to you.

Children

Our services are aimed at businesses and adults. Do not use the service if you are under 18 without appropriate authority.

Changes

We may update this Privacy Policy. The date on this page shows the latest version.