Privacy policy

1. Controller

Maik Locke, I4Quality, Goethestr. 7, 78467 Konstanz, Germany
Phone: +49 160 4600559 · E-mail: maik.locke@i4quality.de
A data protection officer is not required by law and has therefore not been appointed.

2. Overview and legal bases

We process personal data on the following legal bases of the GDPR:

• Contract (Art. 6 (1) (b)): account, courses, subscriptions, certificates, consulting.
• Legal obligation (Art. 6 (1) (c)): invoices and retention for tax purposes.
• Legitimate interest (Art. 6 (1) (f)): secure operation, protection against misuse and fraud, fair self-tests.
• Consent (Art. 6 (1) (a)): only if we expressly ask for it, e.g. for a newsletter.

3. Hosting and server log files

The website and platform are operated by Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA; computing takes place in the Frankfurt am Main region. Each time a page is accessed, technically necessary data is processed: IP address, date and time, page requested, browser and operating system. This serves to deliver the page and to defend against attacks (legitimate interest). The log data is deleted after 30 days at the latest. A data processing agreement is in place with Vercel.

To protect against misuse (e.g. guessing passwords), we count sign-in, password and form attempts. For this purpose, instead of the IP address we store only a non-reversible check value (hash) and delete it after 2 days at the latest (legitimate interest, Art. 6 (1) (f) GDPR). We log admin changes with the person and the time.

4. Customer account

You create an account for the platform. We store your name, e-mail address, an encrypted password, your company where applicable, and the plans and courses you have booked. The database and sign-in are operated by Supabase Inc., 970 Toa Payoh North #07-04, Singapore 318992, on servers in Frankfurt am Main. A data processing agreement is in place with Supabase.

5. Courses, tests and certificates

So that you can continue where you left off, we store your learning progress, your answers in exercises and your test results.

Self-tests are evaluated exclusively automatically; this is necessary for carrying out the course (Art. 22 (2) (a) GDPR). You can request that a human checks whether the automatic evaluation was carried out correctly from a technical point of view (Art. 22 (3) GDPR); this does not include any correction or assessment of the content of your answers. To ensure fair self-tests, we log during the test whether the test window was left, full-screen mode was ended or copy functions were used – each with the time. Camera, microphone and screen content are not recorded.

Certificates contain your name, the course, the date and a verification code. Anyone who knows the verification code can check its authenticity on i4Q+ and will see the name, course and date of issue. Only you pass on the verification code.

6. i4Q RepGrid

Where is the data stored? i4Q RepGrid (Premium or add-on) runs via i4Q+; you save the content – elicitation set, participants, ratings, statements, notes, logos and report details – as working files in a storage location of your choice (folder or network drive, including a folder on your device synchronised by OneDrive, SharePoint or Google Drive) or only in the browser of your device. This content is not transmitted to i4Q+ and is not stored on our servers. You or your company are responsible for the content and for the lawfulness of the data collection – in particular for informing the people interviewed and, where necessary, obtaining their consent. We recommend recording respondents only by abbreviations or pseudonyms.

Online interview (encrypted mailbox). If you start an online interview, we store the questionnaire and the respondents' answers exclusively in encrypted form (AES-256, key exchange using ECDH P-256). Encryption takes place in the browser; the key to the questionnaire is contained only in the part of the interview link after the # character, which the browser does not send to the server, and the key to the answers only in your project file. We therefore cannot read the content. In addition, we process the following technical data: a random identifier of the interview, a non-reversible hash of each respondent's link, timestamps, the expiry date and, for a short time and to prevent misuse, a hash of the IP address (rate limit). The encrypted data is deleted when you end the interview, at the latest one day after the expiry date (no more than 12 months). The interview page sets no cookies and no trackers; to continue with the general link, the respondent's browser stores a random key locally. The legal basis is Art. 6 (1) (b) GDPR (towards you); with regard to the respondents you are the controller and we act as processor – we will provide a data processing agreement on request.

What else do we process? Your account, the check whether your plan includes i4Q RepGrid, and the time of this check. Storage locations are accessed directly from your browser, as with i4QFMEA (see 6a); collaborative work (presence file, change log, team details) works as with i4QSTAT (see 6b). So that i4Q RepGrid works without internet access, your browser stores the program files (not your content) in a cache.

6a. i4QFMEA

Where is the data stored? i4QFMEA runs via i4Q+; you save the FMEA content (structures, functions, failures, ratings, actions, team details, logos, library) as working files in a storage location of your choice – a folder or network drive of your company (including a folder synchronised by OneDrive, SharePoint or Google Drive) or only in the browser of your device (IndexedDB, optionally encrypted with a password). Your browser reads and writes these files directly; they are not transmitted via our servers and are not stored in logs, error reports or statistics. Excel import, Excel export and PDF are created locally in your browser. No AI services are used.

What do we process? Your account, the check whether your plan includes i4QFMEA, and the time of this check (contract, Art. 6 (1) (b) GDPR). If your company specifies a recommended storage location, we store only its type, link and display name. So that i4QFMEA works without internet access, your browser stores the program files (not your content) in a cache.

Synchronised cloud folders. If you use a folder that OneDrive, SharePoint or Google Drive synchronises on your device, i4QFMEA only reads and writes the files in that folder; synchronisation with the cloud is handled by the respective provider's program. i4Q+ has no connection to Microsoft or Google. Processing there is governed by your company's contracts with that provider.

Collaborative work and offline copies. So that others can see who is currently editing an FMEA, i4QFMEA creates a short lock file with name and time in the storage location. For working without internet access, your device keeps an encrypted working copy, which is deleted when the storage location is removed.

Team details. If you record team members (name, function, department, optionally e-mail), you or your company are responsible for these details. Record only what is necessary for the FMEA and inform the people concerned.

Backup files (.i4qfmea) are created by you; they contain your content and are encrypted only if you set a password.

6b. i4QSTAT

Where is the data stored? i4QSTAT (Premium) runs via i4Q+; you save the content – measurement data, projects, notes, attachments, logos, report details, team details and results – as working files in a storage location of your choice (folder or network drive, including a folder on your device synchronised by OneDrive, SharePoint or Google Drive) or only in the browser of your device (IndexedDB). Import, calculations, charts and the creation of PDF and Excel files take place locally in your browser. The content is not transmitted via our servers and is not stored in logs, error reports or statistics. No AI services and no trackers are used.

What do we process? Your account, the check whether your plan includes i4QSTAT, and the time of this check (contract, Art. 6 (1) (b) GDPR). i4QSTAT shares the storage location recommended by your company with i4QFMEA. So that i4QSTAT works without internet access, your browser stores the program files (not your content) in a cache.

Synchronised cloud folders work as with i4QFMEA (see 6a).

Collaborative work. So that others can see who currently has a project open, i4QSTAT creates a small presence file with name, e-mail address, device ID and time in the storage location; it is deleted when you leave. Changes are recorded with name and time in the project's change log. If you record team members (name, e-mail, role), you or your company are responsible for these details.

Encryption. Optionally, you can encrypt a project with a project password (AES-256, key derived from the password). The password does not leave your device; the key derived from it is stored on your device until you have it forgotten there. Offline working copies are encrypted with a device-bound key.

Personal data in measurement data. If your data contains personal data (e.g. names of inspectors or operators), you process it on your own responsibility; use abbreviations wherever possible.

7. Company accounts

If your employer has booked seats for you, the responsible person in the company (company admin) can see your name, your e-mail address, your course progress in per cent and certificates issued – but not your individual answers.

8. Payment

Payments are processed by Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland. You enter your payment details directly with Stripe; we do not receive full card or account numbers, only name, e-mail, billing address, amount and payment status. Stripe checks payments to protect against fraud and is itself responsible for this. If you pay with PayPal, PayPal (Europe) S.à r.l. et Cie, S.C.A., 22–24 Boulevard Royal, L-2449 Luxembourg, is also involved; with Apple Pay or Google Pay, the respective provider of your device.

9. E-mails and contact

We send you e-mails that are necessary for the contract (Art. 6 (1) (b) and (c) GDPR): account confirmation, password reset, order and contract confirmation, invoice, confirmations of receipt of withdrawal and cancellation, and notices about your subscription. We send emails through the mailboxes associated with our domain i4qplus.com (order@i4qplus.com, invoice@i4qplus.com, noreplay@i4qplus.com, support@i4qplus.com) at the hosting provider Site BV (site.de), Operetteweg 7, 1323 VJ Almere, Netherlands; the servers are located in the EU. Site BV processes the data on our behalf (Art. 28 GDPR). Name, e-mail address and the content of the message are processed. We store invoices as PDF in protected storage that only you and we can access, for the duration of the statutory retention obligations. We send advertising by e-mail only with your consent, which you can withdraw at any time.

If you write to us or request consulting, we process your details to handle the request.

10. Cookies and local storage

This start page sets no cookies. On the platform we use only technically necessary cookies so that you stay signed in (§ 25 (2) no. 2 TDDDG, German Telecommunications Digital Services Data Protection Act). We do not use any analytics, advertising or social media services. Fonts are loaded from our own server. i4QFMEA, i4QSTAT and i4Q RepGrid store your projects and settings in your browser's local storage (IndexedDB) because you are expressly using the tools – see sections 6, 6a and 6b.

11. Recipients and third countries

Your data is received only by the service providers named above, to the extent necessary for their task. Vercel and Supabase are based outside the EU; the data is stored on servers in Frankfurt, but access from third countries cannot be ruled out technically. The basis is the EU standard contractual clauses and, for US providers, the EU-US Data Privacy Framework.

12. Storage period

• Account data and learning progress: until your account is deleted, at the latest 12 months after the end of all subscriptions and course access.
• Encrypted online interviews of i4Q RepGrid: until the interview is ended, at the latest one day after its expiry date.
• Self-test logs: 12 months after the test.
• Certificate data: as long as the certificate is to remain verifiable; on request we delete it earlier.
• Invoices and accounting records: 8 years, business letters 6 years (statutory obligation).

13. Your rights

You have the right of access, rectification, erasure, restriction of processing and data portability (Art. 15–20 GDPR). You can withdraw consent at any time with effect for the future. An e-mail to kontakt@i4quality.de is sufficient.

Right to object (Art. 21 GDPR): Where we process data on the basis of legitimate interests, you can object at any time on grounds relating to your particular situation.

You can lodge a complaint with a supervisory authority, e.g. the State Commissioner for Data Protection and Freedom of Information of Baden-Württemberg, Lautenschlagerstraße 20, 70173 Stuttgart, Germany.

Providing your data is necessary for the contract; without an e-mail address we cannot create an account.

14. Security and changes

All connections are TLS-encrypted. Passwords are stored only in encrypted form. On request – mandatory for administrators – two-factor sign-in with an authenticator app protects the account; for this we store a secret key at Supabase. We adapt this policy when our services or the legal situation change; the version published here applies.

As of: November 2026