Privacy Policy

SchemaX (“we”, “us”, “our”) operates the website schemax.io and the SchemaX services. The data controller for personal data processed through this website is:

Nico Geisler
hi@schemax.io

• Sign-ups and enquiries: information you actively provide, such as your email address, name, company, website, and product interest where applicable.
• Server logs: standard web server logs including IP address, browser type, and requested pages. These are retained for up to 30 days for security and diagnostic purposes.
• Public site scanner: when you submit a public URL, we retain the normalized hostname (for example, example.com) and high-level scan information such as the latest scan status, score, pages sampled, detected schema types, issues, and detected agent files. The scanner-intelligence record does not contain the submitted path or query string, your IP address, Google Analytics or cookie identifiers, or a user identity.
• Website analytics, only with your consent: Google Analytics may collect pseudonymous usage information such as page views, referrer, device/browser information, approximate location, session and engagement information, scroll milestones, and selected product interactions. We do not send names, email addresses, scan targets, or other form input to Google Analytics through our website analytics events.

Under the GDPR, we process your data on the following legal bases:

• Consent (Art. 6(1)(a) GDPR): for optional Google Analytics measurement and for communications where you explicitly opt in. Analytics remains disabled until you choose “Allow analytics” in our cookie banner. You can withdraw that choice at any time.
• Legitimate interest (Art. 6(1)(f) GDPR): server logs are processed for security and reliable operation. Domain-level scanner intelligence is processed to operate and improve the scanner, understand product demand, and prioritize account-level product and business-development research. We do not link this record to an analytics profile or other user identity.

• To provide and improve SchemaX
• To respond to enquiries and send updates you requested
• To understand how visitors use the site and which product flows are useful, when analytics consent is granted
• To understand which public domains are being scanned and identify organizations that may benefit from SchemaX
• To maintain the security and stability of our website

We do not sell, rent, or trade your personal data to third parties.

We use the following service providers:

• Resend (Resend, Inc.): transactional email delivery where applicable.
• Vercel (Vercel Inc.): website hosting and edge delivery.
• Sanity (Sanity AS): content management and storage of aggregated scanner-domain intelligence.
• Google Analytics (Google Ireland Limited / Google LLC): optional website analytics under measurement ID G-3MGF5VBN7X. The Google Analytics script is not loaded until you grant analytics consent. Advertising storage, ad user data, ad personalization, Google signals, and ad-personalization signals are disabled in our tag configuration.

Sign-up and enquiry data is retained for as long as needed to provide the requested service or until you request deletion, subject to legal retention obligations. Server logs are retained for up to 30 days. Scanner intelligence is kept as one rolling aggregate per normalized domain rather than as a visit-by-visit history and is retained only while it remains relevant to product analysis or business-development research. Analytics data is retained according to the retention settings of our Google Analytics property and Google’s applicable service terms.

Under the GDPR, you have the right to:

• Access the personal data we hold about you
• Correct inaccurate data
• Request deletion of your data
• Withdraw consent at any time without affecting prior lawful processing
• Data portability where applicable
• Lodge a complaint with your local data protection authority

To exercise these rights, email hi@schemax.io.

Essential storage is used for site preferences such as language and for remembering your privacy choice. Optional analytics storage is used only after consent.

• loopful-locale: first-party functional cookie used to remember your language preference.
• schemax-analytics-consent-v1: localStorage entry recording whether you allowed or rejected optional analytics.
• _ga and related _ga_* cookies: Google Analytics first-party identifiers created only after analytics consent. Google states that the main _ga cookie can persist for up to two years.

Our analytics records page views and engagement automatically, plus scroll milestones at 25%, 50%, 75%, 90%, and 100%, and selected SchemaX product interactions such as starting/completing the site scanner or copying the agent prompt. We do not use Google Analytics for advertising or cross-site ad personalization.

You can change or withdraw your analytics choice at any time: Cookie settings.

More information: Google Privacy Policy · Google cookie information.

Some service providers, including Google and Vercel, may process data outside the EU/EEA. Where required, transfers are protected through applicable adequacy mechanisms and/or contractual safeguards. Google states that it participates in the EU-U.S. Data Privacy Framework and uses Standard Contractual Clauses where required.

We may update this policy from time to time. We will update the “Last updated” date above when we do.

Data controller: Nico Geisler
Email: hi@schemax.io