Privacy Policy
Last updated: June 2026
This Privacy Policy explains how marbl.energy ("we", "us"), the operator of PEXim, processes your personal data in accordance with the EU General Data Protection Regulation (GDPR / DSGVO) and the Austrian Datenschutzgesetz (DSG).
1. Data Controller
marbl.energy
Austria
Email: info@marbl.energy
2. Data We Collect
| Category | Data | Legal Basis (Art. 6 GDPR) |
|---|---|---|
| Account | Name, email, hashed password | Contract performance (Art. 6(1)(b)) |
| Usage | API calls, actions consumed, agent configurations | Contract performance (Art. 6(1)(b)) |
| Billing | Payment information (processed by Stripe) | Contract performance (Art. 6(1)(b)) |
| Technical | IP address, browser type, access logs | Legitimate interest (Art. 6(1)(f)) |
3. How We Use Your Data
- Provide and operate the PEXim simulation platform
- Process payments and manage subscriptions
- Send service-related communications (account, billing, security)
- Monitor and improve platform performance and security
- Comply with legal obligations
We do not sell your personal data. We do not use your data for automated decision-making or profiling.
4. Data Processors
| Processor | Purpose | Location |
|---|---|---|
| Hetzner Online GmbH | Infrastructure hosting | Germany (EU) |
| Cloudflare, Inc. | CDN, DDoS protection, DNS | EU/US (EU SCCs) |
| Stripe, Inc. | Payment processing | EU/US (EU SCCs) |
5. Data Retention
- Account data: retained while your account is active, deleted within 30 days of account deletion
- Usage data: retained per your plan's data retention period (7 or 90 days)
- Billing records: retained for 7 years as required by Austrian tax law (BAO § 132)
- Server logs: retained for 90 days
6. Your Rights
Under the GDPR, you have the right to:
- Access your personal data (Art. 15)
- Rectify inaccurate data (Art. 16)
- Erase your data ("right to be forgotten") (Art. 17)
- Restrict processing (Art. 18)
- Data portability ‐ receive your data in a machine-readable format (Art. 20)
- Object to processing based on legitimate interest (Art. 21)
- Withdraw consent at any time without affecting prior processing (Art. 7(3))
To exercise these rights, contact info@marbl.energy. We will respond within 30 days.
7. Cookies
We use only essential cookies required for the Service to function (session authentication). We do not use tracking cookies, analytics cookies, or advertising cookies. No cookie consent banner is required for strictly necessary cookies under the ePrivacy Directive.
8. Data Security
We protect your data with:
- Argon2id password hashing
- TLS encryption for all data in transit
- Encrypted storage at rest
- Role-based access controls
9. Supervisory Authority
You have the right to lodge a complaint with the Austrian Data Protection Authority:
Datenschutzbehörde
Barichgasse 40-42, 1030 Vienna, Austria
dsb@dsb.gv.at
10. Changes to This Policy
We will notify you of material changes via email at least 30 days in advance. The current version is always available at /privacy.
11. Contact
For privacy-related questions, contact info@marbl.energy.