Privacy policy

This page is available in German and English. In case of any discrepancy, the German version prevails.

Overview

Controller

BEST-XP, Bernhard Strasser, Wiedner Hauptstraße 53/16, 1040 Vienna, Austria.
Privacy contact: office@best-xp.com. We have not appointed a data protection officer because we are not required to.

Calculators and file analyses

The calculators, the catalogue analysis and the feed validator run entirely in your browser. Your prices, costs and product files are not sent to our servers and we cannot see them. So that a reload does not lose your work, the browser keeps the loaded file (content and name, up to 1.5 MB) and your settings in its session storage, together with a list of file fingerprints you have already unlocked; all of this stays on your device and is deleted when you close the tab. When you unlock the Pro analysis of a file, only an irreversible fingerprint (SHA-256 hash) of the file is sent to us and stored with your purchase, so that the same file is not charged twice – never its content.

The calculators write your inputs into the page address so that you can bookmark or share a result. They reach our server only if you open or reload such an address; the URL parameters are not stored in our logs or statistics.

Some future premium tools may need to process a file on our server. Such files are stored with a random name, are not shared with anyone and are deleted automatically after 60 minutes at the latest.

Usage statistics

To understand how our website is used and to tell visitors apart from automated crawlers, our server counts page requests – without cookies, without storing anything on your device and without third-party services. From your IP address, your browser identifier and a random value that changes every day, the server forms a one-way hash (a pseudonym). Under this pseudonym it records for the current day only: whether the requests came from a browser or from a crawler (for crawlers: which one and whether it was verified), how many pages were viewed, the first page of the day, the website that linked to us (domain only), campaign tags in the link (utm_source, utm_medium, utm_campaign), the country (country code only, provided by our CDN), the device type (mobile, tablet, desktop) and which steps of a tool were used (for example opened, result shown, export) – never your inputs. With the first request of the following day the random value is deleted and these entries are combined into daily totals without personal data and deleted, so visits on different days cannot be linked. If we test variants of a page (for example a different wording), the server assigns a variant from this daily pseudonym and notes it in the same daily entry; the assignment changes every day, no cookie is used, and prices are never part of such tests. Afterwards only totals per variant remain.

We never write IP addresses to disk. They exist only in the server's memory – for a few seconds and, if a request claims to come from a search engine or AI crawler, for up to 24 hours to verify that claim. For this, the server compares the IP address with the address lists published by the crawler operators (for example Google, Bing, Apple, OpenAI, Anthropic, Perplexity; downloaded daily without any visitor data) or performs a reverse DNS lookup through our hosting provider's name servers (Hetzner). In addition, a small script in your browser reports when a tool is used and loading-speed measurements (Core Web Vitals) as aggregated values. If your browser sends a Global Privacy Control or Do Not Track signal, nothing is recorded except an anonymous counter that such a signal was received. Legal basis: our legitimate interest in a secure website, in distinguishing people from automated access and in improving the service (Art. 6(1)(f) GDPR).

Calculators embedded on other websites

Other websites can embed some of our calculators (for example the profit, discount and ROAS calculators). When you open a page with such a calculator, your browser loads it directly from our server. As with any page of ours, this technically transmits your IP address to us and to our providers for delivery (Cloudflare, Hetzner – see Hosting); we do not store it. The embedded calculator sets no cookies and stores nothing on your device, and your inputs stay in your browser. We count the use in the same way as on our own website (see Usage statistics) and additionally record that the visit came from an embedded calculator and the domain of the embedding website – not its full address. Legal basis: our legitimate interest in providing and improving the calculator (Art. 6(1)(f) GDPR). The operator of the embedding website decides whether to embed the calculator and informs its visitors about it in its own privacy policy.

Payments

Payments are handled by Stripe Payments Europe, Ltd. (Dublin, Ireland) on a payment page operated by Stripe. Stripe collects the data needed for the payment, such as your e-mail address, name, payment details and billing country, and processes it as an independent controller under its own privacy policy. We receive the payment status, amount, currency, country and Stripe reference numbers – never your card details. We keep these records for seven years because accounting law requires it (Art. 6(1)(c) GDPR, § 132 BAO). Legal basis for the purchase itself: performance of the contract (Art. 6(1)(b) GDPR). Stripe may transfer data to the United States; Stripe relies on the EU–US Data Privacy Framework and standard contractual clauses.

Purchases from the United Kingdom and India. For buyers from countries in which we sell through Stripe Managed Payments (planned for the United Kingdom and India), Link (Stripe) acts as the seller and merchant of record: Link concludes the sales contract with you, calculates and pays the local VAT/GST, issues receipts and invoices and handles payment support. Link processes your payment and contact data as an independent controller under the Stripe privacy policy. We receive the same information as for other purchases (status, amount, currency, country, reference numbers).

Purchase confirmation and “My purchases”

We also store the e-mail address you entered at checkout together with your purchase. We use it to send you one purchase confirmation with a personal link and – only when you request it on the “My purchases” page – a login link, so you can use your purchase on other devices without a password (see “Optional account” below). Login links are valid for a limited time; we store only an irreversible fingerprint (hash) of each link. Legal basis: performance of the contract (Art. 6(1)(b) GDPR). We keep the address as long as the purchase grants access, at most together with the purchase records (seven years). These e-mails are sent through our e-mail service provider (see the notification list below); we do not use your address for advertising.

Pro subscription e-mails

If you take out a Pro subscription, Stripe stores your e-mail address and your payment method so that the subscription can be renewed and you can manage it in Stripe's customer portal (Stripe acts as an independent controller, see “Payments”). We receive the status of your subscription, the end of the current period and whether it has been cancelled. For yearly plans we use the e-mail address from the checkout to remind you about 30 days before each renewal, with the date, the amount and how to cancel. For this we store the address, your language, the renewal date and the announced amount; the entry is deleted after 400 days. Legal basis: performance of the contract and the related information duties (Art. 6(1)(b) and (c) GDPR). These e-mails are sent through our e-mail service provider; we do not use the address for advertising.

Cancellation form

If you use the form “Cancel contracts here”, we store your name, the e-mail address you enter, your language, the contract you chose, the type of cancellation, the reason (only for an extraordinary cancellation), the end date you want and the date and time we received it. We use this only to find your contract, carry out the cancellation, confirm it to you by e-mail and prove later that we received and handled it. To find your contract we compare the e-mail address with the address from your purchase. If the cancellation can be carried out automatically, we tell Stripe to end your subscription at the end of the paid period. Otherwise the details are sent by e-mail to our own inbox so a person can handle them. We do not store your IP address; it is only used for a few minutes in memory to limit the number of submissions. The entry is deleted 3 years after receipt. Legal basis: performance of the contract and our legal duty to accept and confirm cancellations (Art. 6(1)(b) and (c) GDPR, § 312k BGB), and our legitimate interest in being able to prove a cancellation (Art. 6(1)(f) GDPR).

Optional account

You never need an account to buy or to use the free tools. If you sign in with a link sent to your e-mail address, we create an account consisting of that address. We then store your e-mail address, the date of the first and last login, a list of signed-in devices with a coarse label (e.g. “Chrome · Windows”, no IP address, no full browser identifier) and their last-active date, and which purchases are linked to the account. A technically necessary cookie (ms_acct, 90 days) keeps the device signed in; it contains only a random value whose hash we store. Legal basis: performance of the contract – providing the account you asked for (Art. 6(1)(b) GDPR).

You can sign out single devices and delete the account under “My account”. After you confirm by e-mail, we delete your address and every link to it (account, devices, login links, notification-list entries). Trial records are kept without your address to prevent abuse. Purchase records are kept without any reference to your address for the statutory retention period (seven years, § 132 BAO). Payment data held by Stripe is not affected – Stripe is responsible for it.

Contact by e-mail

If you write to an address at mysolute.com (e.g. hello@, support@ or privacy@), Cloudflare (our e-mail routing provider, see Hosting) passes the message to our server and forwards a copy to our office mailbox. We store sender, subject and text (no attachments) to answer your request. Legal basis: your request and our legitimate interest in answering it (Art. 6(1)(b) and (f) GDPR). We delete these e-mails after 12 months at the latest, unless they are needed longer for an ongoing matter or legal retention duties.

Feedback form

If you send us feedback, a bug report or an idea, we store your message, the category, the page or tool you came from, your language, the device type (mobile, tablet, desktop) and the browser family – no IP address, no full browser identifier and no account. To protect the form against spam, your browser solves a small computing task before sending; nothing is stored on your device for this. A screenshot you attach is re-encoded (image metadata such as location removed), visible only to our team and deleted after 90 days. Your optional e-mail address is used only after you confirm it by link, and only for questions or status updates about this feedback; unconfirmed addresses are deleted after 7 days. Legal basis: our legitimate interest in improving the service (Art. 6(1)(f) GDPR); for the e-mail address your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time.

Voting on the public wish list (/roadmap) needs no cookie or account: we count one vote per item and person per day using a pseudonym (a hash of IP address and browser with a random value that changes daily) that is discarded after the day; no IP address is stored. If you ask for status e-mails about a wish-list item, we store your address only after you confirm it by link and delete it when you unsubscribe (link in every e-mail); unconfirmed requests are deleted after 7 days. Legal basis: our legitimate interest (Art. 6(1)(f) GDPR) for voting, your consent (Art. 6(1)(a) GDPR) for status e-mails.

Notification when Pro launches (optional)

If you enter your e-mail address in the form “Get notified when Pro launches” (or tick the optional box when starting the free trial) and give your consent, we store your e-mail address, the page where you signed up, your language, the date and the version of the consent text. We then send you an e-mail with a confirmation link (double opt-in). Only when you confirm is your address added to the list. Unconfirmed sign-ups are deleted automatically 48 hours after the confirmation e-mail was sent; if it cannot be sent right away, we send it as soon as possible and delete the sign-up after 30 days at the latest. We use the address only to e-mail you once when Pro features become available – no newsletter, no advertising, no sharing with third parties except the e-mail service named below. Legal basis: your consent (Art. 6(1)(a) GDPR). You can withdraw your consent at any time by e-mail to office@best-xp.com; we then delete your address immediately. We delete the list after sending the launch e-mail, at the latest 12 months after your sign-up.

E-mail service. We send these e-mails through Resend (Resend, Inc., San Francisco, USA), which processes your e-mail address and the content of the e-mail on our behalf as our processor (Art. 28 GDPR). Transfers to the United States rely on the EU standard contractual clauses.

Free Pro trial

If you start the free Pro trial, we store your e-mail address, the start and end date of the trial, the page where you started it, your language and a non-reversible, keyed hash of your IP address. We use this data only to provide the trial and to make sure that every person can use it once (one trial per e-mail address, a limited number per network). Legal basis: performance of the trial agreement and our legitimate interest in preventing abuse (Art. 6(1)(b) and (f) GDPR). We do not send you advertising because of the trial; only if you additionally tick the optional box do we send you a confirmation e-mail for the launch notification described above. We delete trial data 12 months after the trial has ended, or earlier on request.

Cookies and storage on your device

We only use technically necessary cookies. They are signed or contain only random values, so they cannot be forged, and they are set only when you use the function they belong to:

• ms_claims – which premium features you have purchased or are trying on this device; set after a purchase or when you start the free trial; up to 12 months.
• ms_co – remembers in which browser a checkout was started, so that only this browser can take over the purchase; set when you go to the payment page; 2 days.
• ms_acct – keeps a device signed in to the optional account; set after you sign in with a login link; 90 days.

We do not use advertising, analytics or third-party cookies and, apart from the session storage described under “Calculators and file analyses”, store nothing else on your device, so we do not ask for cookie consent (§ 165 (3) Austrian Telecommunications Act 2021).

Abuse protection and error logs

To protect the service against automated abuse, the number of requests per IP address is counted for a few minutes in the server's memory; it is never written to disk. Technical errors are logged without IP addresses, e-mail addresses or other personal data. We do not keep an access log. The encrypted connection tunnel between Cloudflare and our server logs only failed connections with time and page address – without your IP address and with URL parameters removed before writing.

Backups. We back up the database every night on our server. Backups contain the data described above (for example purchase records and e-mail addresses) and are deleted automatically after 14 days.

Hosting

• Hetzner Online GmbH, Gunzenhausen, Germany (server in Helsinki, Finland (EU)) – hosting of the website, database and backups
• Cloudflare, Inc. / Cloudflare Germany GmbH (global network; data processing agreement with EU standard contractual clauses) – secure delivery (TLS), caching and protection against attacks; receives IP addresses for this purpose

Hetzner and Cloudflare process data on our behalf as our processors (Art. 28 GDPR). Cloudflare, Inc. is based in the United States; transfers rely on the EU–US Data Privacy Framework and the EU standard contractual clauses. Legal basis: our legitimate interest in a secure and reliable website (Art. 6(1)(f) GDPR).

Your rights

You have the right to access, rectification, erasure, restriction of processing, data portability and to object to processing based on our legitimate interests, and to withdraw any consent you have given with effect for the future. If you use the optional account, you can see and delete it yourself under “My account”. Otherwise, because we do not store IP addresses, we usually cannot link data to you; if you made a purchase, the Stripe receipt number helps us find it, and if you signed up for the launch notification, your e-mail address does. You also have the right to lodge a complaint with a supervisory authority – in Austria the Datenschutzbehörde (www.dsb.gv.at).

We do not use automated decision-making or profiling.