Controller
Maximilian BerkefeldXenotonex
Gladbacher Straße 54
41462 Neuss
Germany
support@xenotonex.de
This notice applies to NeverseenVault.
Current advertising status
Advertising is currently disabled. The application loads no AdSense or CMP scripts and requests no ads.
Hosting, security and image delivery
The websites, databases and image delivery run on Cloudflare (Cloudflare, Inc., USA). Requests involve processing IP address, timestamp, requested URL, technical browser and connection information, and security or error data. This supports delivery, availability and abuse prevention under Art. 6(1)(f) GDPR.
The image buckets are set up in the EU. This does not mean all network, support or security data is processed exclusively in the EU. Upload Desk sign-in and administrator access are additionally protected by Cloudflare Access. Free downloads require no registration. The online withdrawal form limits automated abuse using a daily-changing hash of the IP address; that hash is cleared after about one hour in the next background run. The raw IP address is not stored in the application database for this purpose.
Our usage statistics
We count aggregate events such as page views, opened images and packs, downloads, filters, search terms and sister-site clicks. These statistics store no IP addresses, browser identifiers or individual browsing histories. Visits are estimated from entries. Known bots, available Cloudflare bot signals and prefetches are excluded where possible. Do Not Track and Global Privacy Control are respected. These totals improve the catalog under Art. 6(1)(f) GDPR.
Former statistics cookies are cleared on the next public page visit. Previously stored identifier hashes, visit days and session records are no longer used in the reports. The daily cleanup removes these records after their existing 400-day retention period.
Individual-image and pack downloads are counted separately as started server deliveries. One pack counts once; ZIP members are not additional image downloads. Random download authorizations support the preview workflow and are not linked to browser identifiers or IP addresses. They are valid for five minutes for an image and two hours for a pack, and are removed by the next daily cleanup. They support the download you request.
The private operational overview receives only approved calendar-day totals (Europe/Berlin) and catalog counts, without identifiers, search text, IP addresses or order data. The Upload Desk can also read Cloudflare network statistics or show manually entered reference values. Those may include bots and file requests and may use UTC day boundaries. No additional visitor identifiers are sent to Cloudflare for this comparison.
Search terms are shortened and stored with daily counters. Do not enter personal or confidential information in image search. These existing activity counters use UTC days. Statistics are not linked to payment profiles.
Functional browser storage
Your selected grid size can persist under “archive-grid-columns” in local browser storage until you change it or delete site data. During Checkout a random operation reference in session storage prevents a retry from creating a duplicate order. It is not an advertising or analytics identifier.
These functions support the display and purchase actions you request. Where strictly necessary for those actions, device storage relies on section 25(2) TDDDG; related personal-data processing relies on Art. 6(1)(b) or (f) GDPR. The consent and access services may additionally store consent choices or signed-in administrator sessions.
Purchases and Stripe Checkout
Paid offers redirect to Stripe Checkout, where payment details are entered. Our application stores no full card details. We store the order number, product and file scope, amount, payment status, Stripe references, email entered in Checkout and the terms confirmed before purchase with their timestamp.
Processing supports ordering, payment verification, delivery, payment issues and proof of the agreement under Art. 6(1)(b) and (f) GDPR, and statutory retention under (c). Stripe can also act as an independent controller for payments and fraud prevention. The relevant Stripe entities, including European Stripe entities and, where applicable, Stripe, LLC in the USA, are described in Stripe's Privacy Center.
Purchase emails and contact
Purchase confirmations are sent using Resend (Plus Five Five, Inc., USA) to the email entered in Stripe Checkout. Withdrawal receipts go to the address entered in the withdrawal form; in live operation the operator receives a copy. The provider receives the recipient address, subject and message, including order details, private download link and, where applicable, the attached contract terms. Delivery status and technical sending data support delivery and failure handling. Withdrawal statements contain your name, contract reference and confirmation email. These details, your statement and its receipt timestamp are retained to process the request and document receipt. These are purchase messages, not a newsletter; processing relies on Art. 6(1)(b) and, where necessary, (c) and (f) GDPR.
If you write to our public contact address, we process your message and contact details to respond. The mailbox uses mailbox.org / Heinlein Hosting GmbH, Berlin. Depending on the request, the legal basis is Art. 6(1)(b) or (f) GDPR.
Private downloads and sister sites
Your personal purchase link grants access to paid files and must not be publicly shared. We check the saved purchase and, if necessary, its payment status to authorize access. A free download increments the asset counter and daily total; it does not create a personal download profile.
NeverseenVault and SynthModelz have the same controller. Their homepages load small previews from the sister domain, which also receives the technical connection information needed for delivery. These links do not transfer your order to another seller.
Google AdSense and Google's consent message
The planned advertising uses Google AdSense and Google's Consent Management Platform. For EEA users the provider is Google Ireland Limited, Ireland; other Google entities and the ad partners named in the message may be involved. The Google message explains purposes, partners, legal bases and choices.
When advertising is enabled, loading the consent message can already establish a Google connection and transfer technical connection information. Our application initially pauses ad requests. It requests ads only after an appropriate consent-platform signal; without that signal, or if the service is blocked, it requests no ads.
Where required, advertising and personalization rely on Art. 6(1)(a) GDPR and device access on section 25(1) TDDDG. Other processing described in the message may rely on legitimate interests and can be objected to there. Non-personalized advertising can still require storage access and is not automatically exempt from consent.
You can consent, decline or manage purposes and partners, and later change your choices through “Privacy & cookies”. Consent is not a condition of buying or downloading free references. Google's message selects an available language based on device language; English and German are planned for the European message. Google manages regional US choices separately. The application also blocks ads when it detects Global Privacy Control or “Do Not Track”.
Editorial AI functions
Upload analysis and translation help the operator prepare catalog titles, descriptions, characteristics and tags. They use the operator's images and catalog text. Our purchase and email workflow sends no customer payment data or buyer email addresses to this editorial AI function. There is no automated decision about buyers producing legal or similarly significant effects.
Retention
Order and authorization data is retained while needed for the agreed download service, license evidence or claims. Statutory business and tax records follow the applicable document category; section 147 AO provides, in particular, six years for business correspondence, eight years for accounting vouchers and ten years for certain records. Periods generally start at the end of the relevant calendar year.
Contact messages are retained while needed for the request, legal obligations or claims. Technical security and delivery records follow the relevant provider's purpose- and service-specific periods. Personal data no longer needed must be erased or restricted to the legally necessary use.
Recipients and international processing
Access is given to the controller and providers used for hosting, payments, delivery or communication, for the purposes described. Data can be processed outside the EEA, particularly in the USA. Transfers must meet Art. 44 et seq. GDPR, for example through an applicable adequacy decision or suitable safeguards such as standard contractual clauses. Provider-specific details are in the linked privacy and processing terms; you can request further information from the controller.
Your email and necessary payment information are required for a purchase. Without them, paid delivery with a purchase email is not possible. Browsing and free downloads require no customer account.
Your rights and complaints
Subject to the legal conditions, you may request access, rectification, erasure, restriction and portability. You may object to legitimate-interest processing on grounds relating to your situation and to direct marketing at any time. Consent can be withdrawn for the future without affecting the lawfulness of earlier processing.
Contact support@xenotonex.de. You may also complain to a data protection authority, particularly where you live or where an alleged infringement occurred. For the operator in Neuss, a competent contact is the North Rhine-Westphalia data protection authority (LDI NRW): Kavalleriestraße 2–4, 40213 Düsseldorf, Germany, poststelle@ldi.nrw.de.
Change privacy settings
While advertising is disabled there is no active Google advertising choice. Once enabled, it is available through “Privacy & cookies” on the homepage.