Privacy policy

1. Controller

Email: service@noxadmin.de

2. Hosting and delivery

The website and the application are delivered through the infrastructure of our hosting provider Lovable. When pages are accessed, technically necessary connection data is processed so that the pages can be delivered and operations secured.

• IP address of the requesting device
• date and time of access
• requested address and amount of data transferred
• delivery status information
• browser type and operating system in general form

The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest lies in stable, secure and uninterrupted operation.

3. Contacting us

If you contact us by email, we process your details in order to handle the enquiry and any follow-up questions. The legal basis is Art. 6(1)(b) GDPR for contract-related enquiries, otherwise Art. 6(1)(f) GDPR.

4. Registration for NoxAdmin

An account is required to use the software. We process in particular name, email address, studio details, encrypted credentials and sign-in metadata.

The legal basis is Art. 6(1)(b) GDPR, as the processing is necessary to provide the user account.

5. Use of the NoxAdmin software

Within the application we process data required for the studio workflow: requests, appointments, client data, consent records, tattoo and material documentation, aftercare and healing progress, as well as logs of security-relevant events.

6. Studio and client data (processing on behalf)

Where studios process personal data of their own clients in NoxAdmin, the respective studio is the controller. In this respect we act as a processor under Art. 28 GDPR and process such data solely on the studio's instructions.

For information about such data, data subjects should contact the respective studio.

7. Health-related information in the studio workflow

As part of anamnesis, consent and healing follow-up, studios may record information that can constitute special categories of personal data under Art. 9 GDPR. Collecting this data and establishing the legal basis — regularly the explicit consent of the data subject — is the responsibility of the respective studio.

NoxAdmin only provides the technical processing and does not make any medical assessment.

8. Payment processing via Stripe

We use Stripe to process paid subscriptions. Payment and invoicing data is transmitted to and processed by Stripe. We do not store complete payment method details.

The legal basis is Art. 6(1)(b) GDPR for performance of the contract.

9. Payment fraud prevention

During the payment process, data is processed in order to detect and prevent abusive transactions. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in preventing payment default and misuse.

10. Transactional emails

We send operationally necessary emails, for example regarding registration, appointments, consent, documentation or aftercare. Delivery uses the email infrastructure provided by Lovable with Mailgun and processing in the EU.

We process the recipient address, the message content and delivery information. The legal basis is Art. 6(1)(b) and (f) GDPR.

Contact: service@noxadmin.de

11. Personal links for clients

Request forms, consent forms, documents and PDF downloads use personal links with randomly generated access tokens. These links are time-limited and are stored server-side as hash values only.

12. Technically necessary storage and cookies

We only use technically necessary storage mechanisms, in particular for sign-in, session handling and storing the selected language. The legal basis is § 25(2) TDDDG in conjunction with Art. 6(1)(f) GDPR.

13. Web analytics with Google Analytics 4 (consent-based)

This website uses Google Analytics 4, a web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. The purpose is the analysis and improvement of our website: we want to understand which pages are visited and how visitors navigate the site.

Google Analytics is only loaded and executed after you have explicitly consented to the “Analytics” category. Without consent no Google script is loaded and no data is transmitted to Google. The legal basis is your consent under Art. 6(1)(a) GDPR and, where information is accessed on your device, § 25(1) TDDDG.

We deliberately do not send personal plain-text data to Google. No names, email addresses, phone numbers, form contents, client data, health data or request contents are sent to Google Analytics. The standard page view data collected is:

• page URL and page title
• referrer and approximate location derived from the IP address
• technical information about device, browser and language
• pseudonymous identifiers stored in cookies to distinguish sessions

According to Google, IP addresses are not logged or stored in Google Analytics 4. We do not use advertising features, Google Signals, remarketing or a link to Google Ads accounts. Event data retention follows the settings in our Google Analytics account (default: 14 months); Google Analytics cookies remain on the device for up to 24 months unless you delete them earlier.

Processing by Google infrastructure outside the EU/EEA, in particular in the USA, cannot be ruled out. Google relies on the EU Commission's standard contractual clauses and additional measures for such transfers; Google LLC is also certified under the EU-US Data Privacy Framework.

Your consent is voluntary and can be withdrawn at any time with effect for the future via the “Cookie settings” link in the footer of this website. After withdrawal no further analytics data is collected.

14. Marketing with the Meta Pixel (consent-based)

This website uses the Meta Pixel, a technology provided by Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland. The purpose is to measure and optimise our advertising on Facebook and Instagram: we want to understand which page views and which successfully started trials originated from an advertisement.

The Meta Pixel is only loaded and executed after you have explicitly consented in the “Marketing” category. Without consent no Meta script is loaded and no data is transferred to Meta. The legal basis is your consent under Art. 6(1)(a) GDPR and, where information on your device is accessed, Section 25(1) TDDDG.

We deliberately do not transmit personal data in clear text to Meta. We do not send names, email addresses, phone numbers, form contents, client, health or request data. Only the following standard events are transmitted:

• PageView – a page view with URL, referrer and technical details about device and browser
• StartTrial – only when a trial has been started successfully, without any details about the person or the studio
• pseudonymous identifiers in cookies used to recognise the device

Meta also processes this data outside the EU/EEA, in particular in the USA. Meta relies on the EU Commission's standard contractual clauses for such transfers; Meta Platforms, Inc. is also certified under the EU-US Data Privacy Framework. For the processing of these event data we and Meta are joint controllers within the meaning of Art. 26 GDPR.

Your consent is voluntary and can be withdrawn at any time with effect for the future via the “Cookie settings” link in the footer of this website. After withdrawal no further data is transmitted to Meta.

15. Processors

We use carefully selected service providers that process data on our instructions:

• Lovable – hosting, database and application infrastructure
• Mailgun (EU) – delivery of transactional emails via the Lovable infrastructure
• Stripe – payment processing for paid subscriptions
• Google Ireland Limited – web analytics with Google Analytics 4, only after consent
• Meta Platforms Ireland Limited – reach and advertising measurement with the Meta Pixel, only after consent

The data protection agreements required for these services are in place.

16. International data transfers

Where the services used involve processing outside the EU or EEA, this takes place on the basis of the European Commission's standard contractual clauses or another permitted transfer instrument under Chapter V GDPR.

17. Retention

We store personal data only for as long as necessary for the respective purposes or as required by statutory retention obligations. Afterwards the data is deleted or processing is restricted.

18. Documentation and audit records

Completed documentation, consent records and security-relevant logs are retained unchanged for evidence purposes. Subsequent content changes to completed records are not intended.

19. Security measures

We apply technical and organisational measures to protect processed data, including transport encryption, role-based access rights, studio-level access restrictions, time-limited access tokens and logging of security-relevant events.

20. Supporting features without automated decision-making

Features such as rule-based artist matching, duration and price suggestions or material recognition when scanning are used to prepare decisions. Results are reviewed and confirmed in the studio. There is no solely automated decision-making within the meaning of Art. 22 GDPR.

21. Your rights

Subject to the statutory requirements, you have the right to:

• access to the processed data (Art. 15 GDPR)
• rectification of inaccurate data (Art. 16 GDPR)
• erasure (Art. 17 GDPR)
• restriction of processing (Art. 18 GDPR)
• data portability (Art. 20 GDPR)
• object to processing based on legitimate interests (Art. 21 GDPR)
• withdraw consent with effect for the future (Art. 7(3) GDPR)

Contact: service@noxadmin.de

22. Right to lodge a complaint

You have the right to lodge a complaint with a data protection supervisory authority, in particular in the country of your habitual residence, place of work or the place of the alleged infringement.

23. Changes to this privacy policy

We adapt this privacy policy when processing activities or legal requirements change. The version published on this page applies.