Last updated: October 26 2026
1. Who is responsible
Controller under Article 4(7) GDPR:
NeoRebels GmbH, Dreiherrnsteinplatz 11, 63263 Neu-Isenburg, Germany Managing Director: Ufuk Ören · Amtsgericht Offenbach am Main, HRB 56637 · VAT ID DE 366959310 support@sqemes.com · +49 155 66067795
No data protection officer is appointed. For any question about your data, write to support@sqemes.com and it reaches the controller directly.
2. What this policy covers, and where to look
One page, two situations. Reading our website and entrusting a product with your team’s knowledge are different things, so they are kept apart here rather than blended into paragraphs that fit neither.
| If you are… | Read |
|---|---|
| just visiting sqemes.com | Part 1 — it is short, because almost nothing happens |
| using Sqemes — the app, the browser extension, the MCP server | Part 2 |
Sections 5 onwards apply to both.
Not covered: self-hosted installations. The Sqemes source is public and anyone may run their own instance. If you use somebody else’s, that operator is the controller, not us. We have no access to it and receive no data from it.
Part 1 — Visiting sqemes.com
3. What happens when you simply visit
Every visit produces a server log entry at our hosting provider: your IP address, the date and time, the page requested, the referring page if there was one, and your browser and operating system as your browser reports them.
Why: to deliver the page, keep the site working, and recognise attacks. A website cannot be operated without this. Legal basis: Article 6(1)(f) GDPR — our legitimate interest in a site that is available and secure. How long: kept briefly for security purposes, then deleted. Not combined with anything else and not used to build a profile of you.
This site loads nothing from third parties. No web analytics — no Google Analytics, no Matomo, no Fathom. No tracking pixel, no advertising network, no embedded widgets. Nobody counts you, and no outside company learns that you were here.
Cookies
Two, both strictly necessary, both set without asking because § 25(2) TDDDG allows exactly that:
| Cookie | What it does | Lifetime | |
|---|---|---|---|
wp-wpml_current_language | remembers which language you chose | 1 day | |
| our consent record | remembers what you decided, so you are not asked again | as shown in the banner |
The second one is worth a sentence: we have to store your decision somewhere, and storing it is the only way to honour it.
Where this site is hosted: Hostinger, on servers in Germany, under a data processing agreement in accordance with Article 28 GDPR.
Links that lead away from here
We link to GitHub, the Chrome Web Store and the Sqemes app. These are ordinary links — nothing is transmitted until you click one. Then you are on somebody else’s site and their policy applies.
Part 2 — Using Sqemes
4. What we process, and why
Your account. Email address, name, password (stored only as a hash), workspace membership and role, last sign-in. To give you an account and control who sees what. Article 6(1)(b) GDPR — performing the contract you entered into by registering.
What you put into your workspace. Playbooks (prompts and skills), personas, context files you upload, brand settings, tags, marketplace listings. This is the substance of the service and some of it may be sensitive — it is where a team keeps the knowledge it works with. We store it, show it to the people you granted access to, and deliver it to the surfaces you use. Article 6(1)(b).
Protecting sign-in. When you sign in, register, reset your password or ask for a new confirmation email, a check by Cloudflare Turnstile runs in your browser to tell people apart from automated attacks. To do that it evaluates technical signals from your browser and device, including your IP address. Most of the time you see nothing; occasionally it asks you to tick a box. We receive only the result — passed or not — never the signals themselves. It runs on those four forms and nowhere else in Sqemes. Article 6(1)(f) GDPR — our legitimate interest in protecting accounts against password guessing and automated sign-ups.
Chat. If you use the chat inside Sqemes we store the conversation so you can return to it: your messages, the responses, and which model produced them. Delete a conversation and it is gone from our database. Article 6(1)(b).
Web search in chat. If you switch on web search for a message, the search query the AI model writes from your message is sent to Linkup — or, if your workspace has added its own search key, to the provider of that key (Linkup or Brave Search). Pages the model decides to read are fetched by our servers, not by your browser, so those websites see our server and not your IP address. We keep the search queries and the addresses of the pages that were read together with the answer, so you can see what it is based on. We do not keep the search results or the contents of those pages. Web search runs only for the message you switched it on for. Legal basis: Art. 6(1)(b) GDPR.
Billing. Plan, subscription status, billing period, and the identifiers our payment provider assigns. We never see or store your card details — those go directly to Stripe. Article 6(1)(b) for the subscription, Article 6(1)(c) for the retention obligations under German commercial and tax law.
AI credit usage. If your plan includes Sqemes-funded credits we count how many you used, to enforce the monthly allowance. We count tokens, not content. Article 6(1)(b).
Technical logs and error reports. When something breaks, our error monitoring records the error, a stack trace and technical context about the browser. Configured narrowly and deliberately: error reporting only — no session replay, no performance tracing. Nothing records what you see on screen or what you type. Article 6(1)(f) — our legitimate interest in a product that works and in noticing when it does not.
Usage statistics (playbooks) To understand how playbooks are used and to improve Sqemes, we count how often a playbook is used: per workspace, per day, per channel (browser extension, Sqemes Chat, MCP connection) and per playbook. We store only the count — not who used the playbook, and no content. When you insert a playbook with the browser extension, the extension tells Sqemes which playbook was inserted in which workspace. It does not send your conversation or anything you typed. To stop the count from being inflated, we keep a short-lived counter per person and minute in pseudonymised form (a one-way value derived from the workspace and the account) and delete it after a few minutes at most. Legal basis: Art. 6(1)(f) GDPR — our legitimate interest in understanding and improving how our product is used, and give workspace administrators and editors insight into how their playbooks are used: per channel, the number of uses over the last seven days and the most-used playbook. The counts never show who used a playbook. Counts are kept for 25 months and then deleted. They are deleted earlier when the playbook or the workspace is deleted.
Marketplace submissions. When you submit a playbook to the Sqemes Marketplace, we check its text and every file it carries before a moderator reviews it: with automated checks on our servers and, as a second opinion, with the language model we also use for Sqemes AI (Mistral AI, EU), acting as our processor. The result is stored with the submission and shown to Sqemes moderators; it is advisory and never publishes or rejects anything by itself. Legal basis: Art. 6(1)(f) GDPR (keeping harmful content out of the Marketplace).
We do not use your content to train models. Where a request runs on Sqemes-funded credits the text of that request reaches Mistral AI, because producing an answer requires it — and we have opted out of Mistral using it for training. Requests on your own provider key are governed by your contract with that provider.
Support and feedback. When you report a problem or send feedback from inside the product, we receive what you wrote, the screenshot you chose to attach, your name and email address, the page you were on, and technical diagnostics from your browser (browser and version, screen size, recent console messages and recent network requests of the application). We use this to answer you and to fix the problem. We do not record your screen or your session — the feedback tool’s session replay is switched off.
Both parts
5. What leaves only because you tell it to
This is separate from the section above on purpose, because the difference is real: the following does not happen unless you set it up, and it goes to services you chose and hold the account for.
AI providers on your own key. Connect your own OpenAI, Anthropic, Google, Mistral, xAI, DeepSeek or OpenRouter key and your requests go to that provider under your contract. What they do with it is governed by their terms, not ours. We pass the request on and store your key encrypted.
Connectors. Connect Google Drive, Docs, Sheets, Calendar or Gmail; Microsoft Outlook, Outlook Calendar or OneDrive; Notion, GitHub, Nifty, Noota, Plaud or Shopify — or any other MCP server you add yourself — and Sqemes reads from those accounts on your instruction, at the scope you granted. Disconnect and that access ends. The Shopify Storefront connector needs no account: it reads a store’s public catalogue and policies.
Importing a skill from a public URL. Fetches the archive from that address, for example GitHub.
The browser extension. Runs on the AI sites you enable it for and inserts your templates there. It also keeps one history across those sites so you can find a conversation again: which platform it was, the conversation’s title, its link, and when you last saw it — not the messages. We never receive the content of your conversations on ChatGPT, Claude or Gemini.
6. How long we keep it
| Website server logs | briefly, for security, then deleted |
| Account and workspace content | until you delete it |
| Chat conversations | until you delete them |
| Billing records | up to ten years — § 147 AO and § 257 HGB. This one is not a choice |
| Error reports | 30 days |
| Contact enquiries | while the matter is open and a reasonable period after |
If your subscription ends: you can still sign in and download everything for 30 days; the data is then kept for a further 60 days and deleted 90 days after the subscription ended. Deleting your account deletes the workspace content immediately.
Abandoned workspaces: a workspace created but never used is warned by email after about 23 days and deleted after 30. The warning comes first and is a separate email — nothing is deleted without one.
7. Your rights
Access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), portability (Art. 20), and objection to processing based on legitimate interests (Art. 21). Where processing rests on consent you may withdraw it at any time with effect for the future.
Two of these you can exercise without asking us: export all your data from the app, and delete your account in the settings. Both remain available after a subscription ends.
Where you are a consumer you also have a right of withdrawal from the contract itself — separate from these rights, and set out in our Terms.
We do not use automated decision-making that produces legal effects for you (Art. 22). What the AI generates is a suggestion; nothing here decides anything about a person on its own.
You may complain to a supervisory authority — where you live, where you work, or where you believe the infringement happened. Ours, by our registered seat, is Der Hessische Beauftragte für Datenschutz und Informationsfreiheit, Postfach 3163, 65021 Wiesbaden.
8. Security
Transport encryption throughout. Passwords stored only as hashes. Provider keys encrypted at rest. Access to workspace content is enforced in the database by row-level rules tied to workspace membership, not by application code alone — so a defect in the interface does not by itself expose another workspace’s data. A content security policy prevents foreign scripts from running; the single exception is Cloudflare’s sign-in check on the four forms named in section 4.
9. Who processes data on our behalf
See Subprocessors for the current list, locations and transfer bases. We update it before a provider changes, and tell you in advance so you can object.
In short: the website is hosted by Hostinger in Germany; database, files and backend are in the EU; payments through Stripe Payments Europe in Ireland; funded AI through Mistral in France; web search in chat through Linkup; error monitoring in the EU; the sign-in check through Cloudflare; and transactional email through Resend in the United States, covered by the Standard Contractual Clauses.
10. Changes to this policy
We update it when the site or the product changes and record the date at the top. Material changes to providers or purposes are announced before they take effect. If we ever add something to the website that processes your data in a new way, it goes behind the consent banner first and into this text before it goes live — not afterwards.
11. If you think we got this wrong
Write to support@sqemes.com first — most questions are answered faster that way. You do not have to, and it does not affect your right to complain to a supervisory authority.
12. Subprocessors
We use the following providers to run Sqemes Cloud. They process data on our instructions and are bound by a data processing agreement.
| Provider | What it does | Location | Transfer basis |
|---|---|---|---|
| Supabase | Database, authentication, file storage, backend functions | European Union | — |
| Vercel | Delivery of the web application | Global CDN. The application is static — no personal data is stored there. Vercel processes IP addresses in access logs | Standard Contractual Clauses |
| Stripe Payments Europe Ltd., Ireland | Payments and subscriptions | European Union | — |
| Mistral AI, Paris, France | The model behind Sqemes-funded AI credits | European Union | — |
| Sentry | Error monitoring, 30-day retention | European Union | — |
| Plus Five Five, Inc. (“Resend”), San Francisco, USA | Transactional email — invitations, password resets, notices | United States | Standard Contractual Clauses (EU Module Two, and the UK addendum) |
| Linkup | Web search in sqemes Chat (search queries) | France; queries may be processed in the EU, USA, Canada or Asia-Pacific depending on load | Data processing agreement (Art. 28 GDPR) |
| Hostinger | Hosting of the website at sqemes.com (server logs only) | Germany | |
| Gleap GmbH, Austria | In-product feedback and bug reports: message, attachments, sender identity, browser diagnostics | European Union | — |
| Cloudflare, Inc., USA | Sign-in protection (Turnstile) on the sign-in, registration and password-reset forms: IP address and browser signals, evaluated to detect automated attacks | United States | EU-US Data Privacy Framework, and Standard Contractual Clauses |
Two providers are outside the EU, and we would rather say so than bury it. Transactional email is sent through Resend in the United States — what reaches it is what an email needs: a name, an address and the message itself. The sign-in check runs on Cloudflare’s global network — what reaches it is your IP address and technical signals from your browser at the moment you sign in. Neither ever receives your templates, your files or your chats.
Stripe acts in two capacities. Processing your payment on our behalf, it is our processor. For fraud prevention, anti-money-laundering checks and its own regulatory duties, Stripe is an independent controller — that processing is not on our instructions, and we can neither direct nor prevent it.
Sqemes-funded AI credits run on Mistral in the EU, and we have opted out of Mistral using that content for model training. Requests made on your own provider key go to that provider under your contract with them, not ours.
Changes. We update this page at least 30 days before adding or replacing a provider, so that customers with a data processing agreement can object in time.
Not on this list: the AI providers you connect with your own key, a search key you add yourself (Linkup or Brave Search), and any connector you link (Google, Microsoft, Notion, GitHub, Nifty, Noota, Plaud, Shopify, or an MCP server you add yourself). Those are not our processors — you grant that access and you can revoke it.