Privacy Policy
This website and the Susi customer portal (āthe serviceā) is operated by Xikaku Inc. and LP-Research Inc. (see the Imprint for contact details). This page explains what personal data we process, why, and what rights you have.
Who is responsible
The data controller is Xikaku Inc. / LP-Research Inc. For any privacy request, contact us at the address given in the Imprint.
What we process, and why
Account data. Username, email address, name, a hashed password (Argon2id), and - if you enable it - an encrypted two-factor authentication secret. Processed to provide your portal account (contract performance).
Login and session data. When you sign in we store session records including the IP address and a short browser label, plus a list of browsers you have signed in from. Processed to secure your account against unauthorized access (legitimate interest in security). Sessions expire after 30 days at the latest and after 7 days of inactivity; remembered browsers expire 180 days after last use.
Shop orders. Name, email address, shipping address, and the items ordered. Processed to fulfil your purchase (contract performance) and to meet accounting obligations (legal obligation). Payment itself is handled by Stripe - we never see or store card numbers.
Contact form. Name, company, email address, and your message, sent to us by email so we can answer you (steps prior to a contract / legitimate interest). Submissions are protected by Cloudflare Turnstile.
Newsletter. Your email address, only if you have actively opted in. Every mail contains a one-click unsubscribe link; unsubscribing takes effect immediately (consent, revocable at any time).
License data. License keys and activated machine identifiers, processed to provide license management (contract performance).
Audit records. Administrative actions on the portal are logged with the acting account name for security and traceability (legitimate interest). Audit entries are deleted after 12 months.
Cookies, analytics and advertising
The service itself uses only technically necessary browser storage (your session token and preferences such as the color theme). Analytics and advertising tags (Google Analytics, Google Ads, Reddit pixel) load only after you accept them in the cookie banner. If you decline, no third-party tracking request is made. You can change your mind at any time by clearing this siteās data in your browser, which shows the banner again.
Processors and recipients
We use the following processors under data processing agreements:
- Amazon Web Services - hosting (servers located in Tokyo, Japan) and file storage
- Stripe - payment processing for shop orders
- Dropbox - encrypted off-site backups (archives are encrypted before upload)
- Google - email delivery for sign-in codes, notifications and (if configured) the newsletter
- Cloudflare - contact form abuse protection (Turnstile)
Some of these providers process data outside the EU/EEA and Japan; transfers rely on the providersā standard contractual clauses or an adequacy decision.
Retention
- Account data: for the life of the account, deleted on account deletion
- Sessions: at most 30 days, or 7 days after last activity
- Remembered browsers: 180 days after last use
- Audit records: 12 months
- Newsletter delivery records: personal data removed 12 months after a mailing
- Shop orders: name, email and shipping address are removed 3 years after the order; amounts remain for accounting
Your rights
You have the right to access, rectify, and erase your personal data, to receive it in a portable format, to restrict or object to processing, and to withdraw consent at any time. From your portal account you can download all data linked to your account and delete the account yourself; deletion also removes or anonymizes your data in newsletter, ticket and audit records. You can also lodge a complaint with a supervisory authority.
To exercise any of these rights, contact us via the details in the Imprint.