Privacy Policy

iactus (Operator)
Email: info@iactus.de

We collect and process the following personal data:

• Registration & Authentication: Email address, encrypted password (bcrypt), first and last name, registration date, email verification status
• Subscription & Payments: Stripe Customer ID, Stripe Subscription ID, subscription tier (Basic/Premium/All-Star), subscription status and billing data. Payment method details are stored exclusively at Stripe and not on our servers.
• Token Usage: Number of AI tokens consumed per query, model used and API endpoint (for resource management and billing)
• Usage Data (optional): If analytics cookies are enabled, anonymised page view data may be collected via Google Analytics.
• Technical Data: IP address (processed by Vercel/CDN), user agent, server request logs (max. 30 days)

To provide the platform we use the following third-party services. Each of these providers may process personal data within their area of responsibility:

We use cookies in various categories. A detailed overview and the option to manage them can be found in our Cookie Settings.

Cookies:

Local Storage (localStorage):

In addition, iactus stores the following data in your browser's local storage. This data is never sent to servers:

• iactus-theme — Light/dark mode
• iactus_language — Language setting (de/en)
• iactus_ai_chat_history — AI chat history
• iactus_ai_model — Selected AI model
• dashboard-layouts — Dashboard layout configuration
• cockpit-recent-searches — Recent AI Cockpit searches

As a data subject you have the following rights:

• Access (Art. 15 GDPR): What data we have stored about you
• Rectification (Art. 16 GDPR): Correction of inaccurate data
• Erasure (Art. 17 GDPR): Deletion of your account and all stored data
• Restriction (Art. 18 GDPR): Restriction of processing
• Portability (Art. 20 GDPR): Receive data in machine-readable format
• Objection (Art. 21 GDPR): Object to legitimate interests
• Withdrawal (Art. 7 (3) GDPR): Withdraw given consents at any time

To exercise your rights contact: info@iactus.de

• User account data: Until account deletion or upon request
• Payment data: According to statutory retention obligations (min. 10 years)
• AI usage logs: Max. 90 days
• Server logs: Max. 30 days
• Essential cookies: Access token: 3 days; refresh token: max. 30 days; consent cookie: 365 days
• Optional cookies: According to cookie settings (7–365 days)

We implement technical and organisational measures to protect your data:

• HTTPS/TLS for all data transfers
• Bcrypt password hashing (no plaintext passwords)
• JWT with short lifetimes (15 min.) + refresh token rotation
• Payment data is processed exclusively at Stripe (PCI-DSS)
• Database access only via encrypted connections (SSL)

You have the right to lodge a complaint with a data protection supervisory authority. The competent authority varies by federal state. An overview can be found at www.bfdi.bund.de.

We reserve the right to update this Privacy Policy as necessary to reflect changes in legal requirements or our services. The current version is available on this page. Registered users will be notified by email of material changes.