Privacy policy

The learning lab calculates locally in your browser. After sign-in, the internal area uses a necessary session cookie. Audience measurement uses server logs with truncated IP addresses.

1. Controller

NyxAI GmbH
Reiterkasernstraße 2a
85049 Ingolstadt, Germany
E-mail: privacy@nyxai.com

2. Hosting and server log files

The website is hosted on a server that NyxAI GmbH operates at Hetzner Online GmbH in Germany. Whenever you access the website, your browser necessarily transmits data to this server, which is stored in server log files.

Your browser necessarily transmits your IP address, which is processed to deliver the page. We store it in the server log files only in truncated form: the last two bytes are removed for IPv4, and only the first 32 bits are kept for IPv6. The log files also contain date and time, the requested page, the referrer, the browser identifier and the status code. They are deleted automatically after 14 days at the latest.

Processing is based on Art. 6(1)(f) GDPR. Our legitimate interest is the secure and stable operation of the website and the detection and prevention of abuse. Hetzner Online GmbH acts as our processor for hosting (Art. 28 GDPR).

3. Audience measurement from server log files (Matomo, no cookies)

To understand how our website is used and to improve it, we analyse the server log files statistically with the open-source software Matomo.

No cookies, no access to your device: For this analysis we set no cookies and run no JavaScript. We neither store information on your device nor read any from it. We only evaluate the data that your browser transmits to our server anyway when it requests a page. Consent under Section 25(1) TDDDG (German Telecommunications and Digital Services Data Protection Act) is therefore not required.
Truncated IP address: We truncate the IP address before the data is passed to Matomo. The last two bytes are removed for IPv4 (e.g. 203.0.x.x), and only the first 32 bits are kept for IPv6. Matomo never receives your full IP address. From the truncated address, Matomo derives only the approximate country (IP Geolocation by DB-IP, https://db-ip.com, "IP to Country Lite" database, licensed under CC BY 4.0); region and city are not determined.
Data processed:
- truncated IP address
- date and time
- requested page; of the URL parameters we keep only language and campaign parameters such as "utm_campaign"
- referrer, domain and path only
- browser identifier and the browser, operating system and device class derived from it
Requests from search engines, bots and our own technical monitoring are filtered out.
No profiles, no combination: We group page views into visits, for example several pages within 30 minutes. For this we use a checksum of the truncated IP address and browser characteristics that does not allow individuals to be identified. We do not create user profiles, do not combine the statistics with other data and make no attempt to identify visitors.
Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest is to measure the reach of the website and its content, to understand the effectiveness of links and campaigns, and to improve our offering. The IP address is truncated, and we do without cookies and access to your device. In our assessment, your interests therefore do not override ours.
Retention: We delete the individual statistical records (visits and page views) after 13 months. Aggregated reports derived from them, which no longer relate to individuals, may be kept longer. The underlying server log files are deleted after 14 days at the latest.
Where the data is processed: Matomo runs on our own server at Hetzner Online GmbH in Germany (processor, see above). The data is not transmitted to the maker of Matomo or to any other third party, and it is not transferred to third countries.
Right to object: You may object to this processing at any time (Art. 21 GDPR); we honour your objection without requiring reasons. The easiest way is to enable the "Global Privacy Control" (GPC) or "Do Not Track" signal in your browser. We automatically exclude requests that send either signal (Art. 21(5) GDPR). You can also send your objection informally to privacy@nyxai.com.

4. Internal access and necessary session cookie

Access is restricted to authorised internal users and requires a PIN. Successful sign-in sets the __Host-vd_internal cookie with a random session identifier valid for up to eight hours. It is HTTPS-only, limited to this website and inaccessible to JavaScript. Signing out revokes the session and removes the cookie.

To limit sign-in attempts, we store a keyed hash of the IP address and attempt times for approximately one hour. PIN entries and cookie contents are not recorded in access logs. Expired server-side sessions are cleaned up regularly, or on the next service start.

Processing supports access control and abuse prevention (Art. 6(1)(f) GDPR). The cookie is necessary for the explicitly requested internal access (Section 25(2)(2) TDDDG). It is not used for audience measurement. There is no public registration.

5. External links

Pages link to original sources (for example sec.gov) and to external websites. Only when you follow a link does the privacy policy of that provider apply.

6. E-mail contact

If you e-mail us, we process your details to handle the request (Art. 6(1)(b) or (f) GDPR) and delete them when they are no longer needed.

7. Your rights

Subject to the legal requirements, you may request:

access, correction, deletion or restriction;
data portability or objection to processing; and
review by a data protection supervisory authority.

Contact: privacy@nyxai.com

Last updated: Sep 28, 2026

Interactive valuation lab

Calculations use JavaScript locally in your browser. Your parameters are not sent to our server or third parties and are not saved in cookies or browser storage. An optional CSV export creates a file on your device. Reloading restores the fictional defaults.