Privacy Policy
Last updated: May 20, 2026 GDPR · Art. 13 & 14
Your GDPR Rights
If you are in the EEA — you have the right to access, rectification, erasure, restriction of processing, data portability, and objection to processing. Request: privacy@jaidax.com
1. Who processes your data
The data controller is JAIDAX (Hamburg, Germany), the company operating the platform and Salaria AI product. For all matters related to personal data, contact us at privacy@jaidax.com.
2. What data we collect
- Account data — Email, password hash, registration date, role, plan.
- Session data — IP address, browser User-Agent, login date, refresh token hash.
- Security data — Browser fingerprint hash (canvas, WebGL, timezone) — only for fraud prevention.
- Analytics (with consent) — Pages visited, interface actions — via Plausible and Umami on our servers.
- Transaction data — Subscription plan, payment history, energy balance.
3. Legal basis for processing (GDPR Art. 6)
- Contract performance (Art. 6.1.b) — Registration, authorization, service provision.
- Legitimate interest (Art. 6.1.f) — Fraud prevention, security fingerprinting, IP logs.
- Consent (Art. 6.1.a) — Behavioral analytics.
- Legal obligation (Art. 6.1.c) — Transaction data retention under tax law.
4. Data retention periods
| Data type | Period |
|---|---|
| Account data | Until account deletion + 30 days |
| Session logs | 90 days |
| Security data (fingerprint) | 180 days |
| Transaction data | 5 years (tax law) |
| Analytics | 24 months, then aggregated |
5. Sharing data with third parties
We do not sell your data. Sharing happens only in the following cases:
- Payment providers — to process transactions (only necessary data).
- Cloud infrastructure — data storage servers (processors under DPA).
- By legal requirement — only with a lawful order.
Analytics (Plausible + Umami) runs on our own servers. Data never leaves our infrastructure.
6. Data transfers outside the EEA
Core data is processed on servers in the EU. Where transfers outside the EEA are needed, we use Standard Contractual Clauses (SCC) in line with GDPR Art. 46.
7. Your rights (GDPR Art. 15–22)
- Access (Art. 15) — Get a copy of your data.
- Rectification (Art. 16) — Correct inaccurate data.
- Erasure (Art. 17) — "Right to be forgotten".
- Restriction (Art. 18) — Limit processing.
- Portability (Art. 20) — Receive data in a machine-readable format.
- Objection (Art. 21) — Object to processing.
To exercise rights: privacy@jaidax.com. Response within 30 days. You also have the right to lodge a complaint with the supervisory authority in your country.
8. Cookies
Detailed information about cookies used — in our Cookies Policy. Strictly necessary cookies do not require consent. Analytical cookies are activated only after your consent.
9. Security
We use password encryption (bcrypt), HTTPS, refresh token hashing, login attempt rate limiting, and suspicious activity monitoring via device fingerprinting.
10. Contacts and complaints
Data controller: JAIDAX, Hamburg, Germany Email for privacy requests: privacy@jaidax.com
If you believe your rights have been violated, you have the right to lodge a complaint with the data protection supervisory authority in Germany — BfDI, bfdi.bund.de.