Version: 2026-10-17
Effective: 17 October 2026
Language: English (authoritative)
In plain language
We use your data to provide Intelext and personalize its results. Analytics and weekly email require separate consent. We do not sell personal data or use it for behavioral advertising.
1. Who is responsible
Stefan Rack, trading as Intelext, Oeder Weg 43, 60318 Frankfurt am Main, Germany. Contact: stefan@intelext.io.
We act as controller for accounts, the website, security, direct communications, and optional analytics. When we process personal data on an organization’s instructions, the DPA applies.
2. Data and purposes
We receive data from you, your browser, service providers, and the public sources described below. An account requires an email address and authentication details. Profile information, voice input, analytics, and weekly email are optional.
| Activity | Data and purpose | Legal basis |
|---|---|---|
| Account | Name, email, account identifier, and session records to create and operate your account. | Contract, Article 6(1)(b) GDPR. For organizational users, our legitimate interest in providing the requested service, Article 6(1)(f). |
| Research and personalization | Prompts, conversations, profile, preferences, watch topics, bookmarks, interactions, feedback, and memories to answer questions and personalize results and briefings. | Contract or legitimate interests in providing and improving relevant research support. |
| Contact and demos | Name, email, supplied company or role, and message to answer your request. Email notifications include your name, email, subject, and message. | Precontractual steps or legitimate interests in answering enquiries. |
| Weekly Monitoring email | Email, priorities, delivery settings, confirmation records, and email feedback to prepare and deliver your chosen updates. | Separate consent, Article 6(1)(a). Email confirmation is required. Unsubscribe through any email or Profile without closing your account. |
| Optional analytics | Page paths, pseudonymous identifiers, approved feature events, and limited browser/device context to understand product use. We exclude direct identifiers and raw searches. | Consent, Article 6(1)(a) GDPR and § 25 TDDDG. You can reject or withdraw it without losing access. |
| Security and legal records | IP addresses, request metadata, authentication, error and usage logs, rate-limit records, and Terms acceptance evidence to protect the service and document obligations. | Legitimate interests in security and legal claims, or legal obligation under Article 6(1)(c). |
Public regulatory documents can name officials, authors, speakers, or professional contacts. We index relevant names, roles, public professional details, and source links for attribution and regulatory research under legitimate interests. Article 14 GDPR governs notice for this data. Where its Article 14(5)(b) exception applies, this notice supplies public information. Contact us with a source URL if information about you needs correction or removal.
3. AI and personalization
OpenAI receives prompts, relevant recent conversation, professional profile text, preferences, memories, watch topics, and selected evidence for AI features. We do not add account IDs or user session tokens. Our backend handles authenticated retrieval. Free text can contain personal data. Do not submit patient data, other sensitive personal data, passwords, or access tokens.
Automatic skill selection sends TypeSafe your question, up to four recent messages of 400 characters each, and skill descriptions and exclusions. These can include your custom skills. We do not add account IDs, saved profiles, or memories. Manual skill selection bypasses TypeSafe.
You can inspect and delete saved memories in Profile. The Assistant Memory switch stops saved-memory use, new interest extraction, and contributions to shared learning. It also stops shared memory from shaping new answers and briefings. It does not delete existing memories or disable your explicit preferences. Shared patterns require signals from at least five accounts. Contribution events are pseudonymous, not anonymous, and omit feedback text and query tokens.
Personalization ranks information for you. We do not make solely automated decisions with legal or similarly significant effects under Article 22 GDPR. Browser voice input can send audio to your browser or operating-system speech provider. Intelext receives the transcript, not a stored audio recording.
4. Providers and international transfers
Supabase stores account and application data. AWS hosts the website and backend. OpenAI and TypeSafe provide the AI functions described above. Resend delivers email. Google mail receives messages in the operator inbox. PostHog receives analytics only after consent.
The Subprocessors page lists data flows, locations, and provider retention details. Some processing occurs outside the EEA. Transfers require an applicable adequacy decision or another lawful safeguard, such as EU Standard Contractual Clauses. Account-specific TypeSafe and mailbox safeguards remain unconfirmed. Contact us for information about available safeguards.
5. Retention and deletion
| Records | Normal retention |
|---|---|
| Account content, conversations, preferences, memories, and briefings | Until you delete the item or account. Active weekly subscriptions remain until unsubscribe or account deletion. |
| Contact and demo requests, email delivery logs | 12 months. Mailbox copies require separate deletion. |
| Local AI usage, briefing execution, lookup, and shared-memory contribution events | 90 days. |
| Duplicate assistant execution logs and unconfirmed email subscriptions | 30 days. |
| Expired email confirmation, feedback, and unsubscribe tokens | 30 days after expiry. Expired tokens cannot authorize an action. |
| Rate-limit identifiers | Until expiry, normally within 24 hours. |
| Unsubscribed email records and consent evidence | Three years after the end of the unsubscribe year. Account deletion removes linked subscription records earlier. |
| Terms acceptance evidence | Pseudonymized through the ordinary German limitation period, generally three years after the end of the account-closure year. |
Local cleanup runs hourly. Outages can delay it. Documented legal holds can extend retention where law permits. PostHog event retention is targeted at 12 months, but the provider setting still needs confirmation. Session replay is disabled. Provider logs and backups follow separate rules. Local deletion does not immediately remove every provider copy.
You can request a machine-readable export before account deletion. Exports exclude credentials, security secrets, and other users’ data. Account deletion removes or minimizes linked local data and revokes sessions. Provider cleanup can require a separate request or operator action.
6. Cookies and browser storage
| Purpose | Lifetime and control |
|---|---|
| Authentication | Necessary session storage persists until logout, expiry, session invalidation, or browser-data deletion. |
| Theme, interface choices, and analytics consent | Stored until changed or browser data is cleared. These records keep your requested settings. |
| Conversation pointers | Limited interface state remains until logout, conversation/account deletion, or browser-data deletion. Full conversations are stored in your account. |
| Preview and temporary form state | Preview choices expire after two hours or when the tab session ends. Other temporary flags end with the session or completed action. |
| PostHog analytics | Optional storage starts after consent. Withdrawal resets analytics browser state. |
Fonts load from Intelext hosting. Necessary browser storage supports the requested service under § 25(2) TDDDG. Analytics uses pseudonymous identifiers. Withdrawal does not affect processing that was lawful before withdrawal.
7. Your rights and contact
Depending on the circumstances, you can request access, correction, deletion, restriction, portability, or object to processing based on legitimate interests. You can withdraw consent at any time. Send requests to stefan@intelext.io. We may need information to verify your identity. We normally respond within one month. GDPR extensions and exceptions can apply.
You can complain to a supervisory authority where you live, work, or believe a breach occurred. Our local authority is the Hessian Commissioner for Data Protection and Freedom of Information (HBDI). It provides a complaint form.
We update this notice when processing changes. Material changes receive notice through the service or email where required. A changed notice does not replace consent where consent is required.