EN
DeutschDE TürkçeTR EnglishEN NederlandsNL FrançaisFR
Book a demo Start for free
Language
DETRENNLFR
Colour scheme
Start for free Book a demo Log in

Privacy policy

What data we process on this website, for what purpose and for how long – and what rights you have.

This translation is provided for convenience; in case of discrepancies the German version prevails.

1. Controller

FUBER LTD, 71-75 Shelton Street, Covent Garden, London WC2H 9JQ, United Kingdom
Email: hello@fubexa.com

We have not appointed a data protection officer.

2. Overview

This website presents FUBEXA and accepts enquiries for the free error scan. In doing so, we only process the data that is necessary to operate the website and to handle your enquiry. Fonts and icons are hosted on our own server; no data is transferred to providers such as Google Fonts when you open the pages. We never load analytics or advertising tools without your consent (section 12). Section 9 also applies to the FUBEXA ONE web application and the “FUBEXA ONE” app.

3. Hosting and server log files

The website runs on a server that we have rented from a hosting provider in Istanbul (Türkiye). The provider only supplies the server; we manage the data on the server ourselves.

Each time a page is accessed, the server automatically stores: IP address, date and time, the requested address, the amount of data transferred, status code, the previously visited page (referrer) and the browser identifier. The purpose is secure and stable operation, for example defending against attacks. The legal basis is Art. 6(1)(f) GDPR. The log files are rotated daily and deleted after 14 days.

We are a company based in the United Kingdom; the data generated when you access the website, in particular the log files, is processed directly on this server in Türkiye. There is no adequacy decision by the European Commission for Türkiye, so the level of data protection there is not recognised as equivalent. We protect this data through encrypted transmission (HTTPS) and by storing only what is necessary for operation.

Your browser sends the information you enter in the website’s forms directly and in encrypted form to our FUBEXA ONE platform (app.fubexa.com) in London, where it is stored (section 6). It is not processed or stored in readable form on this server in Türkiye. The only platform data that reaches this server is the nightly backup copy, which is encrypted with AES-256 on the platform beforehand; the decryption key is not stored on this server. These copies are deleted after 30 days.

4. Cloudflare

The website is delivered via the network of Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA. Cloudflare forwards page requests to our server, protects against attacks and speeds up delivery. In doing so, Cloudflare processes in particular your IP address and technical connection data. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is secure and fast operation. Cloudflare is certified under the EU-US Data Privacy Framework (adequacy decision pursuant to Art. 45 GDPR). Further information: cloudflare.com/privacypolicy.

5. Storage in your browser

In your browser’s local storage, we only store what is strictly necessary for functions you have requested (§ 25(2) no. 2 of the German Telecommunications Digital Services Data Protection Act, TDDDG):

  • fubexa-theme: your chosen colour scheme (light, dark, system).
  • fx-attr (session storage, not a cookie): which campaign or website brought you to us; deleted when you close the tab (section 12).

We do not use any other cookies or similar technologies. A cookie banner is therefore not necessary.

6. Requesting the error scan

If you request the error scan, we process the information from the form: name, company, phone number, email address, number of branches, systems used and optional information on software and comments.

  • Purpose: handling your enquiry and preparing the error scan.
  • Legal basis: Art. 6(1)(b) GDPR (pre-contractual steps taken at your request). For contacting you by email and phone, we additionally obtain your consent (Art. 6(1)(a) GDPR).
  • Proof of consent: we store the time, the wording and version of the consent text, the browser identifier as well as a pseudonym (hash value) of your IP address generated with a secret key and the truncated network (e.g. 203.0.113.0/24). We do not store the full IP address. This enables us to demonstrate that you have given your consent (Art. 7(1) GDPR).
  • Protection against misuse: a hidden field and a rate limit per hash value of the IP address protect the form against automated requests. We do not use any third-party service for this.
  • Campaign data: if you come via one of our ads, we store the campaign parameters from the page address (such as utm_campaign) with your enquiry. This tells us which ad leads to enquiries. The parameters contain no information about you personally and are kept in your browser for the duration of your visit at most (section 12).
  • Storage location: your browser sends the enquiry directly to our FUBEXA ONE platform (app.fubexa.com), where it is stored. The platform runs in an Oracle Cloud Infrastructure data centre in London (United Kingdom); Oracle only supplies the servers, we manage the data ourselves. There is an adequacy decision by the European Commission for the United Kingdom pursuant to Art. 45 GDPR; it is valid until 27 December 2031.
  • Storage period: your enquiry is automatically deleted 12 months after receipt, together with the proof of your consent. If a contract is concluded, we keep the contract documents for as long as required by law.
  • Withdrawal: you can withdraw your consent at any time with effect for the future by email to hello@fubexa.com.

7. Contact by email

If you send us an email, we process your message and your contact details in order to reply to you (Art. 6(1)(b) or (f) GDPR). Our mailboxes are operated for us by the email service provider MXroute.

8. Confirmation check

With the Confirmation check, the PDF files you select are read and compared exclusively in your browser. The files and their content are not transferred to us or to third parties.

9. FUBEXA ONE – web application and app

This section applies to the FUBEXA ONE web application (app.fubexa.com and the companies' addresses under fubexa.com) and the “FUBEXA ONE” app for Android and iOS.

  • Roles: The data your company manages in FUBEXA ONE (orders, customer data, payments, stock, alerts) is processed on behalf of your company (Art. 28 GDPR); your company is the controller. We are the controller for your user account, the security of the service and the free demo account.
  • User account: name, email address, optionally phone number, profile photo and signature, password (stored only as a secure hash), language and appearance, and an encrypted key if two-factor sign-in is on. Purpose: sign-in and providing the service (Art. 6(1)(b) GDPR).
  • Sign-in and security: for each session we store the time, IP address, device or browser identifier and last use; sign-ins and changes are logged. Purpose: preventing misuse and traceability (Art. 6(1)(f) GDPR). An app session ends after 60 days without use; you can end sessions at any time in your profile.
  • Free demo account: when you register (on the web or in the app) we process the business name, city, country, number of stores, your name, email address, phone number, selected interests and the time and wording of your consent (Art. 6(1)(a) and (b) GDPR). We also store the origin of the sign-up (campaign or referring website, or the app; section 12). The demo account contains sample data only.
  • Camera, microphone, speech recognition, unlocking (app): the app uses the camera only to scan QR codes and barcodes; images are analysed on the device and not transmitted. In voice mode your device's speech recognition (Google or Apple) turns your voice into text; the app stores no recordings, and only the text of your question reaches us. Unlocking with fingerprint or face happens only on your device. All permissions are optional and can be withdrawn in the device settings.
  • Assistant and daily briefing (AI): your question and the necessary extracts of your company's data are processed by the language model assigned to your company. The default is our own model on our servers, with no transfer to third parties. An external AI provider is only switched on by agreement with your company; we will then name it here in advance, with its location and the legal basis of the transfer.
  • Hosting: FUBEXA ONE runs on Oracle Cloud Infrastructure servers in the London data centre (United Kingdom); the EU Commission has issued an adequacy decision for the United Kingdom (Art. 45 GDPR). Delivery runs through Cloudflare (section 4). All transfers are encrypted (HTTPS). An AES-256-encrypted backup copy is also kept on a server rented by us in Istanbul (Türkiye); the key is not stored on that server, and the copy is deleted after 30 days.
  • No ads, no tracking: the app and the web application contain no advertising and no analytics or tracking tools; we do not sell data. The only exception is the demo account sign-up page: there, advertising and measurement tools may be loaded – only if enabled and only with your consent (section 12). FUBEXA ONE is meant for businesses, not for children.
  • Deleting your account: you can delete your account yourself at any time – in the app under More → Settings → Delete account, on the web under Profile → Delete account; instructions are at https://app.fubexa.com/delete-account. Your name, email address, phone number, password, profile photo, signature and two-factor key are deleted and every session is ended. Orders, payments and documents stay with your company without your name. If yours is the only account of a company, the company is locked and marked for deletion; a free demo account is deleted immediately with all its data. Invoices and accounting records are kept as long as the law requires (up to 10 years, German Fiscal Code § 147, Commercial Code § 257); security logs are kept without your contact details. Backups on the platform server are deleted after 14 days, and the encrypted backup copy in Istanbul after 30 days. Without access, write to support@fubexa.com from your account's email address.
  • Retention: we keep account data as long as the account exists, and afterwards as described above. We delete your company's data after the end of the contract on your company's instruction, unless the law requires us to keep it.

10. Your rights

You have the right of access (Art. 15 GDPR), to rectification (Art. 16), to erasure (Art. 17), to restriction of processing (Art. 18), to data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21). You can withdraw consent at any time with effect for the future (Art. 7(3)). To do so, write to us at hello@fubexa.com.

You can also lodge a complaint with a data protection supervisory authority, in particular in the EU Member State in which you live or work (Art. 77 GDPR).

No automated decision-making, including profiling, takes place.

11. Changes

We adapt this policy whenever the website or the legal situation changes. Last updated: 18 October 2026.

12. Marketing and measurement (only with your consent)

12.1 Origin of your visit (without cookies)

If you reach us via an ad, a link or another website, we keep the following in your browser's session storage for the duration of your visit (fx-attr, not a cookie; deleted when you close the tab): the campaign details from the address (utm_source, utm_medium, utm_campaign, utm_term, utm_content), any click identifier of the ad (gclid, gbraid, wbraid, fbclid, msclkid), the name of the referring website (domain only, such as www.google.com) and the landing page. This information is not passed to any third party. If you open the sign-up for the free demo account (app.fubexa.com), it is passed to that page; if you create a demo account, we store it with your sign-up. If you sign up in the app, we instead store that the sign-up came from the app (Android or iOS).

  • Purpose: to see which campaigns lead to demo accounts and to steer our advertising accordingly.
  • Legal basis: our legitimate interest in measuring our campaigns (Art. 6(1)(f) GDPR). You can object at any time (Art. 21 GDPR).
  • Storage period: as long as your sign-up or demo account is stored (section 9).

12.2 Advertising and measurement tools (only with consent)

If we have enabled them and you agree to “Marketing and measurement” in the cookie settings, we load the following tools on this website and on the demo account sign-up page. Before that, none of these tools is loaded and no connection to them is made. None of these tools is currently enabled, which is why no consent request appears.

  • Google Ads conversion tracking and Google Analytics (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland): measures whether an ad led to an enquiry or a demo account and how the site is used. We use Google's consent mode with the default setting “denied”. Cookies: _gcl_au (90 days), _ga, _ga_* (up to 2 years).
  • Meta Pixel (Meta Platforms Ireland Limited, Merrion Road, Dublin 4, Ireland): measures whether an ad on Facebook or Instagram led to an enquiry or a demo account. Cookie: _fbp (90 days). We are jointly responsible with Meta for the collection (Art. 26 GDPR).

We do not send names, email addresses or phone numbers to these tools; they are only told that a sign-up was sent or a demo account was opened. Google and Meta may transfer data to the USA; both are certified under the EU-US Data Privacy Framework (adequacy decision under Art. 45 GDPR). The legal basis is your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG). You can withdraw it at any time with effect for the future via “Cookie settings” in the page footer; the tools are then no longer loaded.

13. Payment (Stripe)

You pay invoices through a secure payment link from Stripe, which we send you in the invoice after the contract is concluded. No payments are processed and no payment data is collected on this website itself.

Payment service provider: Stripe (Stripe Payments Europe, Ltd., Dublin, Ireland, and Stripe, Inc., USA). Stripe processes the payment data (such as card data or IBAN, name and amount) as our processor under Art. 28 GDPR and, for certain purposes such as fraud prevention and legal obligations, under its own responsibility; Stripe’s privacy policy applies to that (stripe.com/gb/privacy). Card data is not stored by us.

Legal basis and storage period: Art. 6(1)(b) GDPR (performance of a contract). We keep invoice and payment data for as long as statutory retention periods require. A transfer to the USA is possible; it relies on the European Commission’s standard contractual clauses or the EU-US Data Privacy Framework.