HomeAbout usContact

Language

Privacy Policy

Learn how we protect and use your data

Last updated: September 30, 2026

The German version of this policy is the only legally binding version.

Introduction

At InvisibleX, we process personal data only in accordance with applicable data protection law, in particular the General Data Protection Regulation (GDPR). Where we provide the email-alias service, the German Telecommunications Digital Services Data Protection Act (TDDDG) and telecommunications secrecy (Fernmeldegeheimnis) also apply. This Privacy Policy explains which personal data we process, for which purposes, on which legal bases, and which rights you have.

What Data We Collect

We process personal data that you provide when using our website, creating an account, placing an order, signing documents electronically, using the email-alias service, or contacting us. Where certain information is required for concluding or performing a contract, we identify it accordingly. Without such mandatory information, we may be unable to conclude the contract or fully provide our services:

  • Personal identification data such as name, address, date of birth, email address(es), and phone number(s)
  • Payment and billing data required for transaction processing
  • Usage, device, and security-related technical data generated when using our website
  • Communication data and content of enquiries that you send to us
  • Alias addresses, verified destination inboxes, and the content and metadata of messages forwarded or answered through the email-alias service, including data of third parties who write to an alias

How We Use Your Data

We process your data in particular to initiate, perform, and administer contracts, manage your customer account, process payments, prepare and document deletion requests, provide and secure the email-alias service, communicate with you, ensure IT security, and comply with statutory retention and documentation obligations. Depending on the processing activity, the legal bases are in particular Art. 6(1)(b) GDPR (contract and pre-contractual steps), Art. 6(1)(c) GDPR (legal obligation), Art. 6(1)(f) GDPR (legitimate interests in secure and efficient operation), and, where applicable, Art. 6(1)(a) GDPR (consent). Where the email-alias service involves telecommunications, we also rely on the TDDDG, in particular section 3 (telecommunications secrecy and system protection), section 9 (traffic data required for forwarding, replies, or billing), and section 12 (fault and abuse prevention). We do not sell your personal data.

How We Protect Your Data

We implement appropriate technical and organisational measures to protect your personal data. These include, in particular, access restrictions, encryption, secure transmission channels, and measures to ensure confidentiality, integrity, and availability. We store personal data only for as long as necessary for the relevant purposes. Contract and billing data are retained beyond that period where statutory retention obligations apply; after that, the data is deleted or restricted. Data from enquiries is generally deleted once the matter has been resolved, unless statutory or contractual retention obligations require longer storage. Message contents of the email-alias service are retained only as long as needed to forward or discard them. We do not store subject lines long-term. We delete traffic and routing data as soon as they are no longer required for replies, technical operation, abuse prevention, or legal obligations. Alias addresses that have already been issued may be retained longer so that the same address is not assigned again. Our application server is located in Germany. Outgoing alias messages are sent over a TLS-secured connection.

Third-Party Providers

To provide our services, we use external service providers as recipients or processors. Personal data is disclosed only where this is necessary for the relevant service, where a valid legal basis exists, and where applicable data protection requirements are met. The service providers we use can in particular be assigned to the following categories:

Payment service providers

For payment processing, payment service providers may process payment and billing data to the extent necessary for contract performance and payment handling.

Signature and document service providers

For the electronic signing and provision of contract-related documents, such providers may process identification, contact, contract, and signature data.

Hosting and infrastructure providers

For the technical operation of our platform, hosting and infrastructure providers may process account, usage, and system data. The application server for our platform is located in Germany.

Security and network service providers

To provide, secure, and protect our website against misuse, security and network service providers may process IP addresses and technical connection or device data.

Communication service providers

For sending and receiving service-related communications, and for receiving, briefly storing, and sending messages in the email-alias service, we use communication service providers. These providers assist in providing the telecommunications service and may process email addresses, message content, attachments, and technical delivery or security data. This includes spam and virus scanning. Outgoing messages in the alias service are sent with TLS. Whether an incoming message already arrives with TLS depends on the sending system. Processing takes place in the European Union.

Security and breach check (Have I Been Pwned)

On our website we offer a voluntary instant check that lets you test whether your email address has appeared in known data breaches. If you actively run this check, the email address you enter is transmitted to the “Have I Been Pwned” service and compared against known data breaches there. The query is performed exclusively server-side through our secured interface, so that API access remains protected and the transmission is encrypted; the result is only cached briefly and is not sold to any further third parties. We process your email address for this check solely on the basis of your explicit consent (Art. 6(1)(a) GDPR), which you give via the corresponding checkbox before the check starts. Entry is voluntary and is not required to use our other services; you can withdraw your consent at any time with effect for the future by no longer using the check.

Email aliases

As part of an active subscription you may use optional email aliases. An alias is a randomly generated address that forwards incoming messages to a destination inbox you verify. Replies can be sent so that the other party does not see your real address. This is not a mailbox: you cannot sign in with the alias address, and you cannot start new conversations from an alias; you can only reply to messages that were forwarded to you. Use is voluntary and is not required for data-broker deletion requests. InvisibleX is the controller for this service within the meaning of the GDPR. The alias service is a telecommunications service. The content and circumstances of communications that pass through it are protected by telecommunications secrecy under section 3 TDDDG.

  • Your alias address, the verified destination inbox, the status (pending, active, inactive), and technical verification data for confirming the destination inbox (time-limited codes and links)
  • Messages sent by third parties to the alias that we process in order to forward or discard them, including sender, Reply-To, message ID, content and attachments, as well as technical delivery and security verdicts, in particular spam and virus checks. We do not store the subject or message text as mailbox content
  • Replies you send via the alias, and limited routing data needed to match a reply to the correct other party
  • A record of alias addresses already issued, so that an address once assigned is not given to another account

Purpose and legal bases

We process this data to provide the alias service, forward or discard messages, enable replies from the alias, verify the destination inbox, prevent abuse, and keep issued addresses unique. The legal basis vis-à-vis you as a customer is Art. 6(1)(b) GDPR (performance of the contract) and, where telecommunications are involved, the TDDDG. Where we process data of third parties who write to an alias without being a contracting party, and where we scan messages for spam, malware, and authenticity, we rely on Art. 6(1)(f) GDPR and on sections 3(3) and 12 TDDDG (system protection and abuse prevention). We do not use message contents for advertising, do not use them for deletion requests to data brokers, and do not sell them. We do not take knowledge of communications beyond what is required to provide and secure the service.

Telecommunications secrecy

Telecommunications secrecy covers the content of communications that pass through the alias service and their circumstances, including unsuccessful or discarded delivery attempts. Staff and service providers may take knowledge of this only as far as required to provide, operate, or protect the service. Use for other purposes, in particular advertising, profiling, or deletion requests to data brokers, is not permitted. We do not operate a mailbox and do not provide an interface for viewing message contents after they have been forwarded. That does not mean technical access is impossible; it is limited to what is required and is protected by criminal law.

Retention

Message contents are retained only as long as needed to forward or discard them and are then deleted from temporary storage. We do not store subject lines. Discarded messages cannot be recovered. We store reply-routing data, in particular sender and message ID, only for a limited period while replies via the alias should remain possible, and then delete them. We store log and delivery data only briefly, as far as required for technical operation, abuse prevention, or legal obligations. We retain the record of issued alias addresses even after deactivation or account deletion so that the same address is not assigned again; erasure of that address string may therefore be refused within the statutory framework.

Recipients

For receiving, sending, briefly storing the raw message, and security checks we use communication and infrastructure providers in the European Union; they assist in providing the service. Hosting providers in Germany may process account and alias master data. The destination inbox you choose and its provider receive the forwarded messages. When you reply, the original other party receives the message sent from the alias. We cannot guarantee confidentiality at the destination provider or for incoming connections without TLS.

Notes on your rights

Access, rectification, and erasure cover in particular your alias mapping and destination inbox. We can no longer access message contents that have already been discarded. We delete traffic data as soon as it is no longer required for forwarding, replies, operation, abuse prevention, or legal obligations. The record of issued alias addresses may be stored longer for the reasons set out above.

Family plan

With the family plan, the person who takes out and pays for the subscription (main account) can invite up to four further adults (members). Every member gets their own account, grants their own power of attorney and has their own deletion requests. InvisibleX is the controller within the meaning of the GDPR for the processing described below. In connection with the family plan we additionally process:

  • The invited person's email address, an invitation link stored only as a cryptographic hash, the time of sending, expiry and acceptance, and the time at which the main account confirmed the invited person's agreement
  • The assignment of members to the main account's family plan, including the joining date and, where applicable, the time and reason of removal
  • The data required to create the members' accounts and to send their deletion requests; the other sections of this privacy policy apply accordingly
  • Payment data of the main account only. Members pay nothing; their data is not transferred to payment service providers

Invitations

We do not receive the invited person's email address from that person but from the main account. The main account may only invite people who are adults and have agreed beforehand to receive the invitation by email, and must confirm this before sending. We use the address solely to send a single invitation with a personal link valid for 24 hours and to check the sign-up. If an InvisibleX account with a running subscription already exists for the address, we only tell the main account when inviting that an invitation is possible once that subscription has ended; the main account receives no further information about the account. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest and that of the main account is to enable the contractually agreed invitation of family members. The invited person receives the information required by Art. 14 GDPR with the invitation email. We do not send reminders and do not use the address for advertising. To prevent abuse, we limit the number of invitations and of sign-up attempts. If an invitation is not accepted, we delete the email address and the other invitation data no later than 30 days after the invitation expired or was withdrawn. You can object to this processing at any time, for example by email to [email protected]; we will then delete your address without delay.

What the main account sees

In the dashboard, the main account sees each member's first and last name, email address and joining date. For pending invitations it sees the invited email address and the time of sending and expiry. It does not see, in particular, the number, status or recipients of the deletion requests, the companies' replies, identification data such as address, date of birth or further contact details, whether and when a power of attorney was granted, the power of attorney itself, or email aliases. Members see the first and last name and the email address of the main account. This disclosure is part of the family plan, which we point out to members before they create their account, and serves the performance of the user agreement with the member and of the subscription with the main account (Art. 6(1)(b) GDPR) as well as our legitimate interest and that of the main account in managing the paid places (Art. 6(1)(f) GDPR). A member who no longer wants this visibility can leave the family plan at any time; the visibility ends immediately.

Dependency on the main account's subscription

Members' protection depends on the main account's family plan. If that subscription ends or is suspended, if the main account switches to another plan or removes a member, or if a member leaves the family plan, no new deletion requests are sent for the affected member. If the main account removes a member, we inform the member by email (Art. 6(1)(b) GDPR). If only the main account's subscription ends, members stay assigned to the family until they leave or are removed, and are protected again as soon as the subscription is renewed. In all cases the member's account continues as a standalone account; the general rules of this privacy policy then apply. For support and the administration of family plans, authorised InvisibleX staff can view the assignment of main account, members and pending invitations in an internal overview (Art. 6(1)(b) and (f) GDPR).

Leaving the family plan

Members can leave the family plan at any time in the dashboard. Their account, including identification and contact data, the power of attorney and previous deletion requests, continues as a standalone account; only the assignment to the family plan ends. From then on the main account no longer sees any information about the member, and no new deletion requests are sent through the family plan. The member can take out their own subscription. We store that and when a membership ended in order to be able to trace the scope of services (Art. 6(1)(b) and (f) GDPR). You can request the deletion of your account and data at any time under Art. 17 GDPR, for example by email to [email protected]; statutory retention and evidence obligations remain unaffected. Deletion requests already sent to companies cannot be withdrawn.

Notes on your rights

Members and invited persons have all the rights listed in the section "Your rights" without restriction. Their point of contact is InvisibleX, not the main account. The main account has no access to information requests or other requests a member sends to us.

Your Rights

Subject to the statutory requirements, you have the following rights. You may also withdraw any consent you have given at any time with effect for the future. In addition, you have the right to lodge a complaint with a data protection supervisory authority, in particular at your place of habitual residence, work, or the place of the alleged infringement. Discarded messages of the email-alias service cannot be restored; alias addresses that have already been issued may be retained longer so that they are not assigned again:

  • Right of access to your stored data and to rectification of inaccurate data
  • Right to erasure and restriction of processing within the statutory framework
  • Right to data portability and to object to processing based on legitimate interests
  • Right to withdraw consent and to lodge a complaint with a supervisory authority

Cookies, Local Storage and Tracking

We use technically necessary cookies and local storage where required to provide the website, store your language settings, enable login functions, document your cookie choices, and temporarily save unfinished checkout entries as a draft on your device. We do not use non-essential tracking or marketing measurement tools. Browser data and local-storage entries can also be deleted via your browser or device settings.

Contact Us

The controller for the processing of personal data is: InvisibleX (Simon Walz, Kevin Hahn, Richard Weissgerber & Nico Weissgerber GbR) Am Alten Sportplatz 20 35423 Lich Germany Email: [email protected] Phone: +49 173/7010357 If you have any questions about this Privacy Policy or wish to exercise your rights, you may contact us at any time.