Privacy Policy
Last updated: October 29, 2026
Introduction
This Privacy Policy explains how NeoGen Solutions GmbH processes personal data when you use NeoSatoshi. We are a Swiss company and primarily comply with the Swiss Federal Act on Data Protection (FADP/revDSG). Where applicable (for example in the EU/EEA/UK), we also process personal data in accordance with the GDPR. This Policy applies to our website and Service.
Controller
Data controller: NeoGen Solutions GmbH, c/o Hub Bern AG, Spitalgasse 28, 3011 Bern, Switzerland. Contact: info@neosatoshi.com.
Collection and Processing of Personal Data
We process the following categories of personal data: account data (such as email address and user ID), subscription and payment data (processed by our payment provider, for example Stripe), usage and analytics data (for example events and device/app information), marketplace integration data (such as shop domain, marketplace settings, and OAuth tokens stored securely), user content (such as uploaded card photos and listing notes), and support communications.
Purposes of Data Processing and Legal Bases
We process personal data to provide and operate the Service (including card detection and exports), manage accounts, process payments and subscriptions, provide customer support, prevent abuse and ensure security, improve and develop the Service, and comply with legal obligations. Depending on the context and applicable law, processing is based on contract performance, consent, legitimate interests, and/or legal obligations.
Cookies / Tracking and Other Technologies
We use essential cookies and similar technologies to provide the Service (for example authentication and security). We may use analytics (for example Firebase Analytics) to understand how the Service is used and to improve it. Depending on your location and applicable law, we may request consent before enabling non-essential analytics. You can control cookies in your browser settings and change your choices anytime via 'Cookie settings' in the footer or dashboard.
Data Sharing and Data Transfer Abroad
We share personal data with service providers that help us operate the Service (processors), such as hosting and cloud providers (for example Google/Firebase and AWS) and our payment provider (for example Stripe). For the optional AI support assistant we use Anthropic PBC (USA); details are in the section on the AI support assistant. We also use Anthropic for the automated analysis described in the section on operations monitoring. If you connect marketplace integrations (such as eBay or Shopify), data is exchanged with those services as needed to perform the actions you request. Some providers may process data outside Switzerland (for example in the EU/EEA or the USA). Where required, we use appropriate safeguards for international transfers.
Duration of Personal Data Storage
We retain personal data as long as necessary for the purposes described in this Policy, including the duration of your account and any applicable legal retention periods. You can delete certain data within the Service (for example listing archive entries). We may retain security logs for a limited period and longer where required by law or to enforce our Terms.
Data Security
We take appropriate technical and organizational security precautions to protect your personal data against unauthorized access and misuse, such as IT and network security solutions, access controls and restrictions, encryption of data carriers and transmissions, and monitoring.
Obligation to Provide Personal Data
As part of our business relationship, you must provide the personal data that is necessary for the establishment and implementation of a business relationship and the fulfillment of the associated contractual obligations (as a rule, you have no legal obligation to provide us with data).
Profiling
We do not use automated decision-making that produces legal effects about you. We may use aggregated usage analytics to improve the Service.
Rights of the Data Subject
Subject to applicable law (FADP/revDSG and, where applicable, GDPR), you may have rights such as access, correction, deletion, restriction, objection, and data portability. To exercise your rights, contact us at info@neosatoshi.com. You may also have the right to lodge a complaint with a competent supervisory authority.
Changes
We may amend this Privacy Policy at any time without prior notice. The current version published on our website shall apply. If the Privacy Policy is part of an agreement with you, we will notify you by e-mail or other appropriate means in the event of an update.
Advertising performance measurement (ChatGPT Ads)
We advertise through ChatGPT Ads (OpenAI). To see which ads actually bring new customers, we report two events to OpenAI: that an account was created, and that a subscription was taken out. This report is sent from our server and contains only the kind of event and a timestamp. It contains no e-mail address, no name, no customer number and no IP address. For deduplication we use a computed identifier from which your account cannot be derived. In addition we may load a script from OpenAI in your browser that connects an ad click to a later registration. That script is loaded only if you explicitly agree to the Marketing category, and never without your consent. You can withdraw that consent at any time in the cookie settings, after which no further events are transmitted. The legal basis for the script is your consent; for the server-side measurement without personal data it is our legitimate interest in spending advertising budget effectively.
AI support assistant
In the dashboard, registered users can use an optional AI assistant. It answers questions about NeoSatoshi and, if you ask it to, forwards feedback, bug reports and feature requests to us. The assistant is a language model (Claude by Anthropic), not a human, and its answers can be wrong. You can hide it under Settings > Account and contact us by e-mail instead. What is processed: your messages, the conversation so far, and context we add so that the answer fits your account (plan, remaining scan credits, interface language, connected marketplaces, the selected trading card game, the page you are on and its state, for example the listing step, the number of cards in your batch and the last error message shown). When you ask about a problem with your own account, the assistant can also read its status (plan, connections, the automated price sync, the stock sync, your recent direct listing runs and the analytics sync, without passwords, access tokens, e-mail addresses or buyer data) and uses it for the answer. When you ask it to prepare a change, it also reads your listing templates and price rules; a change is only saved when you apply it. If you use "Share view", "Screenshot" or "Image" in the assistant, the content you confirmed in the preview is processed as well, for example the cards of your current listing batch with their prices, your analytics totals and profit estimate, or a picture of your screen. Screenshots blur API keys, e-mail addresses and shop domains; please check the preview anyway. We do not send your name or e-mail address to Anthropic; to prevent abuse, Anthropic receives a pseudonymous identifier computed from your user ID. Please do not enter passwords, API keys or personal data of other people, such as your buyers' names or addresses. Recipient and transfer abroad: the language model is provided by Anthropic PBC, USA, which processes these data as our processor under a data processing agreement. The transfer to the USA is based on the EU Standard Contractual Clauses including the Swiss addendum. Under its commercial terms Anthropic does not use these data to train its models and generally deletes them within 30 days, unless longer retention is needed to investigate misuse or is required by law. Storage periods: conversations are stored in our database (Google Firebase) and deleted automatically 90 days after each message; you can delete a conversation earlier in the chat menu. Shared views and screenshots are part of the conversation; screenshots are kept in our file storage (Google Firebase) and deleted with the conversation, at the latest after 91 days. Feedback you ask the assistant to forward and answers you report are stored with your user ID, e-mail address and plan and sent to our team by e-mail so that we can get back to you; we delete them after 24 months. Questions the assistant could not answer are logged with your user ID for 12 months to improve our help content. Usage counters (number of messages and cost per month) are kept for 13 months, the confirmation of the one-time notice for 12 months after its last update. When you delete your account, all of these data are deleted. Legal basis: performance of the contract for answering support questions and handling feedback; our legitimate interest in improving the Service and preventing abuse for the log of unanswered questions, the usage limits and the pseudonymous identifier. We also analyse conversations automatically for problems and feature requests, see the section on operations monitoring and product improvement.
Technical error reports
If the app runs into a technical error in your browser (for example a script error or a failed request to our servers), it sends us a short report so we can find and fix the problem: the error message, the page, the browser type and version, and the app version. E-mail addresses, access tokens and URL parameters are removed before sending. We do not store your IP address or your user ID with it, only a value that changes daily and cannot be traced back to you, to count how many sessions were affected. We keep these reports for 30 days. If you use the AI support assistant, the last technical errors of your browser tab can also go with your question to Anthropic, and with a bug report you ask it to forward to us. Legal basis: our legitimate interest in a working and secure service. We also analyse error reports automatically by cause, see the section on operations monitoring and product improvement.
Emails to customers, objection and suppression list
We send you emails that are part of using the Service, for example about your account, your subscription, payments or support requests. If you take out a paid subscription, we also use the email address you provide to occasionally inform you about our own similar NeoSatoshi features and offers, for example new features or shortly before a cancelled subscription ends. The legal basis is our legitimate interest in maintaining the customer relationship (Art. 6(1)(f) GDPR; Section 7(3) UWG in Germany; Art. 3(1)(o) UWG in Switzerland; and corresponding rules in other countries). You can object to this use at any time without incurring any costs other than the transmission costs at the basic rates: a short reply to one of our emails or a message to info@neosatoshi.com is enough. We point this out when you subscribe and in every such email. If you have expressly agreed to receive news by email (email preferences in your account), we inform you on that basis; you can withdraw your consent there or by email at any time. If you object or ask us to delete your data, we keep only a hash of your email address, not the address itself, in a suppression list so that we do not contact you again by mistake. The legal basis is our legitimate interest in permanently respecting your objection (Art. 6(1)(f), Art. 17(3)(b) and Art. 21(3) GDPR). We use the suppression list for this purpose only.
Operations monitoring and product improvement
So that we notice problems early and can improve NeoSatoshi, we additionally analyse some data that we already hold, automatically: (1) Conversations with the AI support assistant (see the section on the AI support assistant): we detect whether a conversation points to a problem, a malfunction or a feature request, and summarise recurring topics. (2) Technical error reports (see the section on technical error reports): we group them by cause. (3) Emails to us (for example to info@neosatoshi.com or contact@neosatoshi.ch): we detect whether an email needs a reply and whether it contains a feature request or a bug report. For this analysis we use a language model (Claude by Anthropic PBC, USA) as a processor, with the safeguards described in the section on the AI support assistant. Before anything is sent, we automatically remove names, email addresses, phone numbers, postal addresses and shop domains or replace them with placeholders. The model receives no credentials and cannot change anything in your account. Only the result is stored (category, urgency and a short summary), for 13 months; the original texts stay where they are already stored, with the retention periods stated there. There is no automated decision-making that has legal effects on you or similarly significantly affects you; only we read the results. The legal basis is our legitimate interest in a functioning, secure service and in improving it (Art. 6(1)(f) GDPR; Swiss FADP). You can object to this analysis at any time by emailing info@neosatoshi.com.