Privacy Policy

Controller

The data controller is JadeMind GmbH, Keutschacherstrasse 116, 9220 Velden am Wörthersee, Austria · hello@flexyield.io, operating the FlexYield service.

What we collect

• Account data: e-mail address, password (hashed), optional profile and billing details (name, phone, address, tax ID) you provide.
• Usage metadata: per-request timestamps, chain, method name, status, and latency, associated with your API key — required for metering, billing, rate limiting, and reliability. Request/response payloads are relayed, not stored.
• Waitlist entries: e-mail, self-selected qualifier, referral source.

How we use it — and on which legal basis (Art. 6 GDPR)

To provide and bill the service, enforce limits and caps you configure, and send transactional e-mail (invitations, usage alerts, password resets) — on the basis of contract performance (Art. 6 (1)(b)). Metering records and invoices are kept under legal obligation (Art. 6 (1)(c)). Abuse prevention, rate limiting, and service reliability rest on our legitimate interest (Art. 6 (1)(f)) in operating a secure, fair service. Occasional product updates — sent only to people who ticked the optional product-updates box when joining the waitlist — to waitlist and funnel contacts rest on consent (Art. 6 (1)(a)) — you can opt out at any time.

Cookies

We use essential cookies only (session sign-in, security). No analytics, no tracking, no advertising cookies — which is why you see no cookie banner.

Processors

We share the minimum necessary data with these processors: Hetzner Online GmbH (hosting and backups, data centres in the EU), Stripe (payments; Stripe Payments Europe Ltd., Ireland, with Stripe Inc., USA), Attio (CRM — contact e-mail and funnel stage; UK/USA), Resend (transactional e-mail delivery; USA), upstream infrastructure providers (your relayed requests, without your identity), and — when enabled — Sentry (error tracking with personal data scrubbing on; USA). We do not sell personal data. Transfers to processors outside the EU/EEA rest on adequacy decisions (EU–US Data Privacy Framework, UK adequacy) or EU standard contractual clauses.

Website visitor logs

When you visit this website, our servers record technical access data: IP address, date and time, requested page, referrer, browser and operating system identifiers. We process these logs on the basis of our legitimate interest (Art. 6 (1)(f) GDPR) in operating a secure, reliable website and in defending against abuse. They are not merged with your account data and are deleted after 30 days unless an incident requires a longer hold for its investigation.

Retention

Raw request metadata is deleted after 30 days; aggregated hourly usage (no payloads) is retained for billing history. Account data is deleted on account closure, subject to statutory retention duties — invoices and bookkeeping records are kept for seven years under § 132 BAO.

Your rights (GDPR)

You can request access, correction, export, or deletion of your personal data, and object to or restrict processing, by writing to hello@flexyield.io. You may also lodge a complaint with your supervisory authority — in Austria the Datenschutzbehörde (dsb.gv.at). You can also delete your account yourself in the dashboard; personal data is erased immediately, subject only to statutory retention (anonymized billing records).

Contact

Data controller: JadeMind GmbH (details above) · hello@flexyield.io. A full legal-entity imprint will replace this notice upon incorporation.