Privacy Policy

1. Controller

Minonexus GmbH
Isartalstr. 32
80469 Munich
Germany

Contact: Markus Hauser [email protected]

2. Hosting & processors

Our website and SaaS services are operated by Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany. These servers are located exclusively in data centres in Germany or elsewhere in the EU.

We have concluded a data processing agreement with Hetzner under Art. 28 GDPR. Hosting does not involve any transfer of personal data to third countries.

Sign-in, user accounts and the database of the protected areas are operated for us by Supabase Pte. Ltd., 65 Chulia Street #38-02/03, OCBC Centre, Singapore 049513, in a data centre in the EU (Stockholm, Sweden). The data processing agreement under Art. 28 GDPR forms part of Supabase's terms of service. Access from countries outside the EU cannot be ruled out; the European Commission's Standard Contractual Clauses apply to it (Art. 46(2)(c) GDPR).

The websites minonexus.com and minonexus.de are delivered through the network of Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA, which protects them against attacks and makes them load faster. In doing so, Cloudflare processes the technical access data described in section 3, in particular your IP address. The data processing agreement under Art. 28 GDPR forms part of Cloudflare's terms of service. For transfers to the USA, Cloudflare is certified under the EU-US Data Privacy Framework; the Standard Contractual Clauses apply in addition (Art. 45, 46(2)(c) GDPR).

Our e-mail mailbox is operated by Zoho Corporation B.V., Beneluxlaan 4B, 3527 HS Utrecht, the Netherlands, in data centres in the EU. It holds e-mails to us, messages sent through the contact form and feedback sent from within the applications (section 5). We have concluded a data processing agreement with Zoho under Art. 28 GDPR.

3. Access data (server logs)

When you visit our pages, we process technical access data (e.g. IP address, date and time, user agent, requested URL, referrer) to ensure stability and security (e.g. to fend off attacks).

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in secure operation). Retention: typically 14 days.

4. Cookies & consent

We use necessary cookies for technical operation. Optionally – with your consent – we use analytics cookies to improve our offerings. Your choice is stored locally and can be changed at any time.

• Necessary: sign-in, session state, security (cannot be deselected).
• Analytics (optional): anonymous usage statistics.

Legal bases: Art. 6(1)(c) GDPR (security obligations), Art. 6(1)(f) GDPR (technically necessary processing), Art. 6(1)(a) GDPR (consent for analytics).

4a. Web analytics with Google Analytics (GA4)

Status: active (after consent)

We use Google Analytics (GA4), an analytics service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland ("Google"), to better understand and improve the use of our website.

Consent Mode v2: The Google Analytics script is technically loaded when a page is opened, but with consent denied by default (Google Consent Mode v2). In this state no personal data is collected and no cookies are set. Only after your explicit consent (Art. 6(1)(a) GDPR) is the consent status updated to "granted" and data collection activated.

Cookies: Once you have given consent, Google Analytics sets the following cookies:

• _ga – distinguishing unique users (lifetime: 2 years)
• _ga_<ID> – storing the session state (lifetime: 2 years)

Data categories (when active): page views, interactions, pseudonymous IDs, approximate location (country/region), device/browser, referrer, session duration and custom events (e.g. registration, use of our products MinoSketch/MinoCheck/MinoDrain, contact form submission, appointment booking). GA4 does not store IP addresses; IP addresses are used solely for geolocation (country/region) and then discarded.

Recipient: Google as processor. We have concluded the data processing terms for Google Analytics with Google under Art. 28 GDPR. Transfers to third countries (in particular the USA) may occur; Google uses Standard Contractual Clauses (SCC) for this.

Withdrawing consent: You can withdraw your consent at any time via the cookie settings (see section 4). After withdrawal, data collection stops immediately, the consent status is reset to "denied" and the analytics cookies (_ga, _ga_<ID>) are deleted automatically.

Retention (when active): 14 months.

5. Contacting us

When you contact us by e-mail, we process your details (e.g. name, e-mail address, content of the message) to handle your request.

Messages sent through our contact form and feedback sent from within the applications are delivered via the e-mail service Brevo (Sendinblue SAS, 9–17 rue Salneuve, 75017 Paris, France). The data processing agreement under Art. 28 GDPR forms part of Brevo's terms of service. Processing takes place in the EU.

We also use Brevo to send e-mails about your account (section 6) and about consultation appointments (section 6b). For all e-mails we send via Brevo, Brevo records the delivery and whether the e-mail was opened and a link in it was clicked; for this, the links pass through a Brevo redirect.

E-mails to us, messages sent through the contact form and feedback sent from within the applications are kept in our mailbox at Zoho (section 2).

Legal bases: Art. 6(1)(b) GDPR (pre-contractual/contractual enquiries), Art. 6(1)(f) GDPR (general enquiries). Retention: 6 months after your request has been closed (section 8).

Feedback from within the applications

When you are signed in, you can send us feedback from within the applications. Together with your message, we transmit details of what it refers to: the page and the application, where applicable the design (identifier, title and version of the design method) and, in MinoCheck, MinoSite and MinoDrain, where applicable the address, land parcel and coordinate. In addition, we include the portal version, your browser, the time, your account (identifier, role and e-mail address) and whether you have objected to the evaluation under section 6. The dialog shows you which details are included before you send; you can deselect details on the application, the design and the location there. By default, we attach a screenshot of the page; you see it before sending and can deselect it. It may also show neighbouring buildings or addresses and goes only to our mailbox, not into the confirmation.

Your feedback is sent by e-mail via Brevo to our mailbox, and a confirmation to the e-mail address of your account; the mailbox is operated by Zoho (section 2). We keep feedback in this mailbox and delete it 24 months after the last exchange about it.

So that we can work on and track feedback, we also store it in our database at Supabase (section 2) — with the same information as in the e-mail, but without the screenshot. Only our administrators have access. There, too, we delete feedback 24 months after the last exchange about it; if you delete your account, your feedback is removed from the database immediately.

We use feedback to handle and answer your request and to improve our products. To this end, we also evaluate feedback on designs qualitatively, as part of the quality assurance and further development under section 6. If you have objected to it, we do not include your feedback in this evaluation; it is still handled and answered.

Legal bases: Art. 6(1)(b) GDPR (handling and answering within your user agreement), Art. 6(1)(f) GDPR (legitimate interest in improving our products and in the quality assurance of our design methods). You can object to the evaluation at any time — in your account under “Meine Daten” (My data) or informally at [email protected]. Retention: 24 months after the last exchange (section 8).

6. User account & SaaS use

In the protected area (after sign-in) we process, to perform the contract, among other things: identification data (e.g. name, e-mail address), access data (password hash), logs/metadata (e.g. sign-in/sign-out, change histories), usage data (e.g. design processes carried out).

We use your e-mail address and phone number to contact you about your account, booked appointments and your projects. We do not send advertising.

E-mails about your account, such as confirming your registration or resetting your password, are sent via Brevo (section 5). For this, Brevo receives your e-mail address and the content of the e-mail including the confirmation link.

Legal basis: Art. 6(1)(b) GDPR (contract/provision of services) and Art. 6(1)(f) GDPR (prevention of misuse and fraud, IT security).

Protecting sign-in. On the pages for signing in, registering and “forgot password”, Cloudflare Turnstile (Cloudflare, Inc., section 2) checks whether the page is being used by a person or an automated program. This protects accounts against mass password guessing and our system against automatically created accounts. When these pages are opened, your browser loads a script from Cloudflare and transmits technical characteristics: IP address, browser identifier (user agent), characteristics of the encrypted connection and the website visited. The check usually runs unnoticed; only if it is inconclusive does a box to click appear. Cloudflare processes this data on our behalf as a processor and additionally, as its own controller, uses it to improve bot detection — according to Cloudflare, not to identify individuals or build profiles.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in protecting accounts and our system against misuse). Access to information in your browser is strictly necessary for this protection (Section 25(2) no. 2 TDDDG). For transfers to the USA, the information in section 2 applies.

Quality assurance and further development. We evaluate the designs created in the protected area internally in order to review and further develop the quality of our design methods. This uses the design data itself — room programme, plot layout, geometry and the key figures of the result. Your name and contact details are not part of this evaluation. The technical review is carried out exclusively by persons bound to confidentiality; individual designs are neither published nor passed on to third parties. If you delete designs or projects, fully computed designs are detached from your account and continue to be used for this purpose without any link to you — unless you have objected; in that case we delete them completely.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in quality assurance and further development of our services). You can object to this processing at any time — in your account under “Meine Daten” (My data) or informally at [email protected] (section 9). An objection has no effect on your use of our services.

Entering the provisions of a development plan yourself

Where the provisions of a development plan (Bebauungsplan) are not available in machine-readable form, you can enter them yourself, e.g. site coverage ratio, storeys, heights or roof shape. For this we store the plan, the parcel and the point at which you made the entry, the name of the sub-area, the values with their references in the plan and your note, together with your account, as well as the processing status, the result of our review and whether a value came from an AI suggestion. Storage is with Supabase (section 2). You can view and delete your entries under “Meine Festsetzungen” (My provisions). Your browser remembers in its local storage which sub-area applies to a plot; this choice stays there until you change it or clear your browser data.

Until we have reviewed an entry, it applies only to you. At our end, only the persons who review entries can see it. If we confirm the values, we make them available to all users of our services and pass them on to partners (Terms, clause 7(6)), in each case without any information about you.

Suggestion from the plan. On request, an AI reads the values from the plan documents. For this, our geodata service transmits the public plan documents to Anthropic (Anthropic PBC, USA), but no information about you or your account. We store the suggestion per plan so that it is available immediately the next time it is requested. For the allowance of one suggestion per week, we log when you requested a suggestion for which plan and whether it succeeded.

Legal basis: Art. 6(1)(b) GDPR (entry, display and suggestion under your user agreement), Art. 6(1)(f) GDPR (legitimate interest in reviewed, complete plan information and in keeping to the allowance). Remembering the sub-area in the browser is strictly necessary for the function you requested (Section 25(2) No. 2 TDDDG). Retention: until you delete an entry, at most as long as your account exists. If you close your account, we delete entries that have not been reviewed or were rejected; confirmed values and the log of suggestions remain without any link to you (section 8).

6a. Use through AI assistants (connector)

Through our connector – a server based on the open Model Context Protocol (MCP) at mcp.minonexus.com – you can connect an AI assistant from another provider to your Minonexus account. The assistant then calls our tools on your behalf. We provide instructions for the following assistants:

• ChatGPT – OpenAI Ireland Ltd., Dublin, Ireland (privacy policy)

Other assistants that support MCP can connect in the same way; this section applies to them accordingly.

Connection and sign-in

You grant the connection by signing in with your Minonexus account and allowing access on our consent page (OAuth). In doing so, we store with our sign-in service (Supabase, section 2) the details with which the assistant registers (the name and redirect address it provides itself), your consent and the access keys issued. You can disconnect at any time in the assistant; if you also want to revoke the connection with us, a message to [email protected] is sufficient.

What we process

• Tool inputs that the assistant passes on from the conversation – such as addresses, coordinates, land parcels, building plots or room wishes – and the results we compute from them.
• Account data as in the portal: product access, usage credit and bookings, as well as projects and designs you create through the assistant. Section 6 applies to them.
• Files such as IFC exports are provided via a download link that is valid for no more than 30 minutes.
• Technical logs per call: time, name of the tool, identifier of your account and of the assistant, duration and result. We do not log inputs, results or access keys. Retention as for the server logs (section 3).

Some tools provide a view (e.g. the 3D terrain) that the assistant displays in its interface. It loads data from our servers and a graphics library from cdn.jsdelivr.net; the respective server receives your IP address in the process.

The assistant as a separate controller

What you write in the conversation and what our tools return to the assistant is processed by its provider under its own responsibility and in accordance with its privacy policy – including outside the EU, where the provider does so. We transmit results only to the assistant you have connected, and only when it calls our tools. We have no influence on the processing by the provider.

Legal basis: Art. 6(1)(b) GDPR (execution of the calls you initiate); for the logs, Art. 6(1)(f) GDPR (secure operation, prevention of misuse).

6b. Consultation appointments with a Minonexus architect

In the portal and through the connector (section 6a) you can request a free 30-minute consultation with an architect from Minonexus. The consultants are part of Minonexus GmbH. We do not pass on your data for this purpose to other architecture firms or any other third parties.

What we process

• your first and last name, your e-mail address and, if stored in your account, your phone number,
• the chosen appointment and, if you provide one, your note on the topic of the conversation,
• the link to the design you want to discuss, if you request the appointment from a design,
• your two consents, together with the time at which you gave them.

Who receives the data

Your request, with these details, is received by the architect who holds the chosen appointment, by e-mail and in our system. We send the e-mails via Brevo (section 5). The conversation takes place by phone or video conference; we agree on the channel with you. If we use a video service for this, we name the provider in the invitation.

Should we work with external architecture firms in the future, we will name them before you make a request and ask for your consent to this separately.

Your consents

A request is only possible if you yourself give two consents: that the architect may contact you about this appointment, and that your contact details may be passed on to them for this purpose. If you use an AI assistant, you give both in the appointment view that the assistant displays; the assistant cannot give them on your behalf. You can withdraw your consents at any time with effect for the future by cancelling the appointment under “Meine Termine” (My appointments) or informally at [email protected].

Legal basis: Art. 6(1)(a) GDPR (consent) and Art. 6(1)(b) GDPR (holding the consultation you requested). Retention: section 8.

7. Embedded content & third parties

Apart from the security check on the sign-in pages (Cloudflare Turnstile, section 6), we currently do not embed any external content that transmits data to third parties without consent. Should we embed, for example, YouTube videos, maps or external widgets in the future, this will only happen after your consent and with separate information.

8. Retention

We store personal data only for as long as is necessary for the respective purpose:

Statutory retention obligations remain unaffected.

9. Your rights

• Access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18)
• Data portability (Art. 20)
• Objection (Art. 21) to processing based on Art. 6(1)(e) or (f)
• Withdrawal of consent given (Art. 7(3)) with effect for the future
• Right to lodge a complaint with a supervisory authority (Art. 77)

To exercise your rights, please contact [email protected].

10. Data security

We take appropriate technical and organisational measures (e.g. TLS encryption, access controls, backups) to protect personal data against loss, misuse and unauthorised access.