Privacy Notice

The controller responsible for processing personal data in connection with necst is:

Christiane Bachl
Email: hello@necst.studio

necst is a Customer Success Maturity & Readiness Assessment. The current version is operated as a closed, invitation-only beta with a limited group of adult B2B testers.

Access to necst is currently limited to invited individuals. The email address is processed for access control and authentication. Login takes place using a time-limited one-time password (OTP).

Supabase is used for authentication and the management of access permissions.

The email address and authentication data are processed separately from the stored assessment data. No email address or Supabase user ID is stored in the assessment records.

Once an assessment has been fully completed, the following information may be stored:

• scope of the area being assessed (Assessment Scope)
• role of the respondent
• company size category
• size of the Customer Success team
• answers to the assessment questions
• component, Readiness and Maturity scores calculated from those answers
• selected Business Priorities

An optionally provided company name is not stored together with the completed assessment record.

Each stored assessment is assigned an independent random identifier. This identifier does not contain an email address or any other directly identifying information and is not linked to the authentication record.

The assessment data is used in particular to provide assessment results and to enable future aggregate analyses and benchmarks relating to Customer Success Maturity and Readiness.

Aggregate analyses are not intended to identify individual people or companies.

Technically necessary session information may be processed to operate necst securely and enable login.

OpenAI Sites automatically records traffic for deployed Sites and provides the site owner with aggregate statistics, including total unique visitors and page views over time. These aggregate metrics are used to understand the general use of the Site, including public content such as the Risk Flags Field Guide.

necst does not add a separate analytics SDK and does not use advertising tracking or marketing cookies.

Assessment records do not contain IP addresses or browser or user-agent information.

The following technical service providers are currently used in particular to operate necst:

• Supabase for authentication, access management and database infrastructure
• Resend for sending login codes by email
• OpenAI Sites for hosting the application and providing aggregate traffic statistics
• STRATO for domain and email infrastructure

Where service providers process personal data on behalf of necst, this is carried out in accordance with the applicable data protection requirements.

The fonts used by necst are hosted locally. No fonts are loaded from Google Fonts when the application is accessed.

Personal authentication and access data is retained only for as long as necessary to operate the private beta, manage access or comply with legal obligations.

Assessment data without direct identifiers may be retained for a longer period where necessary for aggregate analyses and the further development of necst.

Subject to the statutory requirements, data subjects have in particular the right of access, rectification, erasure, restriction of processing and data portability, as well as the right to object to processing.

Requests may be sent to hello@necst.studio.

Data subjects also have the right to lodge a complaint with a competent data protection supervisory authority.

This Privacy Notice may be updated if necst, the services used or the processing of data changes.