Privacy Policy

Last updated: October 2026

1. Data controller

Nupact GmbH
c/o Nitin Sahai, Ehrenbergstraße 2
10245 Berlin, Germany
Email: contact@nupact.ai

For full legal details see our Impressum.

2. What data we collect and why

Server logs. When you visit nupact.ai, our hosting provider (Vercel, see section 3) automatically records your IP address, browser type, referring URL, and the pages you request. This data is used solely to ensure technical operation and security of the website. Legal basis: Art. 6(1)(f) GDPR (legitimate interest). Vercel deletes this log data after the limited period set by its retention rules.

Contact by email. If you contact us at contact@nupact.ai, we store your email address and message content to respond to your enquiry. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in handling enquiries). Data is deleted once the enquiry is resolved, unless a contractual relationship follows.

Site analytics (Plausible, no cookies). We use Plausible Analytics (Plausible Insights OÜ, Estonia; data hosted in the EU) to measure how this website is used; it sets no cookies and stores nothing on your device. It processes the page address including campaign parameters, the referring page, approximate location (country, region and city), browser, operating system, device type, time on page, scroll depth, and clicks on links to other websites, file downloads and form submissions (only that a form was sent, not what you entered). Unique visitors are counted with a hash of your IP address and browser that changes daily; IP addresses are not stored, Plausible cannot recognise you across days, devices or websites, and we see only aggregated statistics. Plausible keeps the individual events, without IP addresses, until we delete them or close our Plausible account. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in understanding how the website is used).

Google Analytics (on consent only). If you accept cookies, we use Google Analytics (via Google Tag Manager) to collect pseudonymised data about how visitors use this site — pages visited, session duration, and general location (country/city level). Legal basis: Art. 6(1)(a) GDPR and § 25(1) TDDDG. You can withdraw consent at any time via "Cookie Settings" in the footer.

Ad measurement (Meta Pixel, on consent only). If you accept cookies, we use the Meta Pixel to measure our ad campaigns on Facebook and Instagram, so we can count site visits that come from our ads. Each page view sends Meta your IP address, browser and device details, the page address (including any ad click ID), the referring page and the Pixel cookie IDs. If you are logged in to Facebook or Instagram in the same browser, Meta can link the visit to your account and use it for its own advertising purposes. We send only page views; we do not send your name, email address or other contact details to Meta. Meta gives us only aggregated reports; we do not receive or keep data about individual visitors. Legal basis: Art. 6(1)(a) GDPR and § 25(1) TDDDG. You can withdraw consent at any time via "Cookie Settings" in the footer.

Meeting bookings (Calendly). The "Book a Demo" buttons link to calendly.com. Nothing from Calendly loads on this website. If you book a meeting there, Calendly, Inc. (USA) collects your name, email address and the time slot you pick, and processes them on our behalf to arrange the meeting. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in arranging the meeting you requested). Booking details are deleted once the meeting and any follow-up are complete, unless a contractual relationship follows. Calendly's privacy policy: calendly.com/privacy.

3. Third-party services

Hosting (Vercel). Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA, hosts this website and processes the server-log data described above on our behalf (Art. 28 GDPR). Data may be processed in the USA. Vercel participates in the EU–US Data Privacy Framework.

Plausible Analytics. Plausible Insights OÜ, Västriku tn 2, 50403 Tartu, Estonia. Processes the usage data described above on our behalf (Art. 28 GDPR) and stores it on servers in the EU. Plausible's data policy: plausible.io/data-policy.

Google Tag Manager & Google Analytics (on consent only). Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland. Pseudonymised usage data may be transmitted to Google's servers in the USA. Google LLC participates in the EU–US Data Privacy Framework. Google's privacy policy: policies.google.com/privacy. Google Tag Manager loads only after you accept cookies, and Consent Mode v2 keeps analytics storage off until then.

Meta Pixel (on consent only). Meta Platforms Ireland Ltd., Merrion Road, Dublin 4, D04 X2K5, Ireland. The Pixel loads only after you accept cookies. For collecting data on this website and sending it to Meta, Nupact GmbH and Meta are joint controllers (Art. 26 GDPR) under Meta's Controller Addendum (facebook.com/legal/controller_addendum): we are responsible for obtaining your consent and for providing this information, and Meta Platforms Ireland handles requests about the data it stores, as set out in the Controller Addendum. You can exercise your rights with either of us; we forward requests concerning that data to Meta. Meta alone decides how it uses the data afterwards and how long it keeps it, as set out in its privacy policy. Data may be transmitted to Meta Platforms, Inc. in the USA, which participates in the EU–US Data Privacy Framework. Meta's privacy policy: facebook.com/privacy/policy.

Calendly (on calendly.com). Calendly, Inc., 271 17th St NW, Atlanta, GA 30363, USA. Used only when you follow a "Book a Demo" link to calendly.com, where Calendly processes the booking on our behalf. Calendly participates in the EU–US Data Privacy Framework.

No other third-party services are used on this website. Fonts are served directly from nupact.ai (self-hosted).

4. Cookies

We use one first-party cookie (nupact_cookie_consent) to store your consent choice for 12 months. If you accept, Google Analytics may set _ga and _ga_* cookies (up to 2 years), and the Meta Pixel sets _fbp and, when you arrive from a Meta ad, _fbc (up to 90 days). Clicking Decline, including later via "Cookie Settings", stops further Google Analytics and Meta Pixel collection and deletes their cookies on this site. It does not delete data already sent to Google or Meta, or cookies Meta sets on its own domains; to have that data deleted, contact us, Google or Meta. Plausible (see section 2) uses no cookies and is not affected by this choice. Calendly sets its own cookies on calendly.com, not on this website. You can review or change your choice at any time via "Cookie Settings" in the footer.

5. Nupact platform — processing of advertising data

Separate from this website, Nupact GmbH operates the Nupact platform, a campaign-management platform for advertisers. This section describes the data the Nupact platform processes for business clients. It does not apply to visitors of this website.

What we process. When a client connects its advertising accounts (for example, Meta or Google Ads) to the Nupact platform, we access — with the client's authorization, through the platforms' official interfaces (such as the Meta Marketing API and the Google Ads API) — the client's campaign configuration and settings, ad performance metrics (such as impressions, clicks, spend, conversions, and reach), and advertising account metadata. For the person who connects an advertising account, we also process their platform user ID and, where the platform provides them, their name and email address. For people who use the Nupact platform, we also process their sign-in email address and account identifier, the conversations they hold with the platform's assistant, and the actions they take on the platform, such as changes they approve, notes they add and the business context they enter.

Role and legal basis. We process this data on behalf of and at the direction of the client, to perform our contract with the client (Art. 6(1)(b) GDPR). A data processing agreement with the client governs the details.

Purposes. Providing the contracted services to that client: campaign management, reporting dashboards, performance monitoring, AI-assisted analysis and optimization recommendations for the client's own campaigns, and applying changes the client approves.

Usage analytics. With the user's consent, we record which screens of the platform they open, to improve the platform. We are responsible for this processing ourselves. The legal basis is the user's consent (Art. 6(1)(a) GDPR). A user can withdraw consent at any time from Cookie settings in the platform.

Purpose limitation. Data from a client's advertising accounts is used only for that client, and only for that client's campaigns on the advertising platform the data came from. We do not:

• sell or license this data;
• use it to build or augment user profiles;
• use it for retargeting;
• combine one client's data with another client's;
• feed data obtained from one advertising platform into another platform's targeting or bidding systems.

Storage and security. Client data is stored in the European Union, segregated per client, and protected by administrative, physical, and technical safeguards. Access is limited to the client and persons acting on the client's behalf.

Service providers. We use service providers that act as our processors under written agreements: cloud hosting in the European Union, AI model providers, data-ingestion providers, and web analytics providers, only with the user's consent. Our AI model providers do not use client data to train their models.

Jurisdiction and international government access. Nupact GmbH is established in Berlin, Germany, and is governed by the laws of the Federal Republic of Germany and the European Union. We do not voluntarily disclose this data to any government or public authority; we respond only to valid legal process under German and European Union law, we challenge requests that are unlawful or overbroad, and our agreements with data-ingestion service providers require them to process this data within the European Union.

Retention and deletion. We delete a client's advertising data when it is no longer needed to provide the services, when the client terminates the contract, or upon a deletion request by the client or by the advertising platform (for example, Meta) concerning that client's data. We carry out this deletion by deprovisioning the client's resources. A person whose personal data we hold, including through a request that Meta passes on for one of its users, can have their own data deleted, as described in How to remove access or request deletion below. In that case we delete only that person's data. Disconnecting an advertising account in Nupact revokes Nupact's direct access immediately.

How to remove access or request deletion. You can remove access or request deletion in these ways:

1. Where Nupact connects to your account directly, disconnect it in Nupact: open Setup and select Disconnect in the Meta Ads section. If Setup shows no Meta Ads section, Nupact has no direct connection to disconnect. This step does not stop the reporting connection.
2. Remove the Nupact app from your Meta Business Integrations settings. This step does not stop the reporting connection.
3. A client can email contact@nupact.ai to request deletion. We then stop every connection to its accounts, including the reporting connection, and delete its data. Anyone else whose personal data we hold can email the same address to have their own data deleted. We verify the request first. We act on a request within 30 days, and remaining copies are removed within a further 30 days.

6. Reporting security vulnerabilities

If you believe you have found a security vulnerability in this website or in the Nupact platform, please email security@nupact.ai. We acknowledge reports promptly and address confirmed issues with priority. See also security.txt.

7. Your rights under GDPR

You have the right to:

• Access the personal data we hold about you (Art. 15)
• Rectification of inaccurate data (Art. 16)
• Erasure ("right to be forgotten") (Art. 17)
• Restriction of processing (Art. 18)
• Data portability (Art. 20)
• Object to processing based on legitimate interest (Art. 21)
• Withdraw consent at any time without affecting the lawfulness of prior processing (Art. 7(3))

To exercise any of these rights, contact us at contact@nupact.ai.

8. Right to lodge a complaint

You have the right to lodge a complaint with a supervisory authority. The competent authority for Berlin is:

Berliner Beauftragte für Datenschutz und Informationsfreiheit (BlnBDI)
Friedrichstr. 219, 10969 Berlin
www.datenschutz-berlin.de