This site is static HTML and CSS. It sets no cookies, runs no scripts, loads nothing from anywhere else and has no form to submit. The only personal data processed when you visit is the server-log record that any web server keeps when it serves a page. This notice covers the website and the free check; it also says, further down, what the admin agent for Microsoft Azure does and does not do today.
The controller for the processing described here — the party that decides why and how it happens:
The same details, with the VAT position, are in the imprint.
Neopiq GmbH is established in Switzerland, so the revised Swiss Federal Act on Data Protection (revFADP) applies to the processing described here, and the competent supervisory authority is the Swiss Federal Data Protection and Information Commissioner (FDPIC) in Bern.
Whether the EU GDPR applies in addition turns on its Art. 3(2): it reaches a company outside the EU only if that company offers goods or services to people in the EU, or monitors their behaviour. Our assessment is that this site does neither, and that the GDPR does not apply to it. The site is addressed to businesses that run Microsoft Azure and Microsoft Dynamics 365 Supply Chain Management, not to consumers; nothing on it can be bought, ordered or signed up for; the free check runs entirely in your browser and sends us nothing; and there is no cookie, analytics or tracking of any kind, so no behaviour is monitored. A website being reachable from the EU does not, by itself, bring it within Art. 3(2).
This notice is nevertheless written to the fuller GDPR field list throughout: the rights below are stated in their broadest form, and legal bases are given for each processing operation. That is deliberate — it costs nothing, and it means nothing on this page becomes wrong if a court or authority ever reads Art. 3(2) more broadly than we do. The assessment will be revisited, and this notice rewritten, before anything on this site is offered to people in the EU rather than merely visible to them.
These are properties of how the site is built, not promises about how it is administered, so you can verify them rather than trust them.
No cookie is set by these pages, and nothing is written to local storage or session storage. There is no analytics service, no tag manager, no tracking pixel, no advertising network, no social plug-in and no cross-site identifier. You are not profiled, and no automated decision-making takes place.
The marketing pages of this site contain no JavaScript at all — not a single
script element. A page that runs no code cannot quietly measure you. The
site’s own build check fails the build if a script is ever added.
The only file these pages load is one stylesheet served from this same site. There is no content delivery network, no remote web font, no remote image, no embedded video and no map. Because nothing is requested from another server, no other company learns your IP address from your visit here.
There is no contact form, no sign-up, no newsletter subscription, no login and no payment on this website. Nothing on these pages submits anything anywhere, so browsing gives us no name, e-mail address or message to receive, store or lose.
There is a published e-mail address and telephone number, but they are ordinary contact routes, not a form: nothing is collected unless you choose to write. See writing to us.
You can confirm all of this in about a minute: open your browser’s network tab and load any page here, or read the page source. What you will see is the document itself and one stylesheet.
This site is published with GitHub Pages, so GitHub’s servers deliver these pages to your browser. Like every web server, they process the technical data that a request necessarily contains in order to answer it, and record it in server logs. That typically includes:
This is the only processing of personal data that actually happens when you use this site, and it is unavoidable: a server cannot send a page to an address it does not have. It is used to deliver the site, to keep it available, and to detect and defend against attacks and abuse. It is not used to identify you, to build a profile, or for marketing, and it is not combined with anything else — there is nothing else.
Where the GDPR applies, the legal basis is Art. 6(1)(f) — the legitimate interest in presenting a functioning, stable and secure website. Where Swiss law applies, the same processing is justified by the overriding private interest in the secure operation of the site. You can object to processing based on legitimate interests; see your rights below.
GitHub acts as the hosting provider for this site and, in data-protection terms, as a processor acting for the controller named above. The logs are generated and held by GitHub as part of operating its platform. We do not receive these logs, do not have an interface to query them, and cannot look up individual visitors.
The processor agreement for this is GitHub’s Data Protection Agreement, which forms part of the service terms under which this site is hosted and which GitHub publishes on its website. It commits GitHub to process personal data only to provide the service, to keep it confidential and secure, and to the transfer safeguards described in the next section. We have not negotiated anything beyond it, and nothing beyond it is needed for a site that consists of static pages.
The logs are kept by GitHub, not by us, on GitHub’s own schedule. GitHub’s documentation states that visitor IP addresses of Pages sites are logged and stored for security purposes; it does not publish a fixed number of days for these logs, and its privacy statement limits retention to what the collection purpose requires. We hold no copy at all, so there is nothing on our side to be kept or deleted.
GitHub is a company established in the United States and operates a global network, so the server-log data described above may be processed outside Switzerland and outside the European Economic Area. There is no other recipient: nothing else on this site sends anything anywhere.
The safeguard for that transfer is the EU standard contractual clauses (Commission Implementing Decision 2021/914), which Switzerland recognises for Swiss transfers subject to the FDPIC’s adaptations, and which are incorporated into GitHub’s Data Protection Agreement — the same published document named under hosting above, obtainable from GitHub’s website. GitHub is in addition certified under the Swiss–U.S. Data Privacy Framework. It is worth being precise about what actually travels under these safeguards: the request logs and IP addresses described above, and nothing more. No content of yours is transferred by this site, because none is collected — the free check uploads nothing.
A contact route exists: the e-mail address and telephone number published in the imprint. This section describes what happens if you use one.
E-mail to our contact address is carried and stored by a commercial e-mail hosting provider acting as our processor, under its standard data-processing terms. The published telephone number is a Swiss mobile number carried on a Swiss mobile network, and calls are not recorded. Large e-mail providers routinely operate infrastructure outside Switzerland and the EEA, including in the United States; for any correspondence processed there, we use only providers whose terms include the EU standard contractual clauses, as recognised by Switzerland with the FDPIC’s adaptations. We name the category rather than a brand because the provider may change; the safeguard is the commitment, and it will not. Ask at the contact address and we will tell you which provider holds your thread.
Correspondence is kept while an exchange is open and then for up to 24 months after the last message, so that the thread is still there if you come back to the same matter; after that it is deleted. The one exception is correspondence that becomes part of a contract or matters for the books, which Swiss accounting law (OR Art. 958f) requires us to keep for ten years.
The free planning check is a web page that reads the CSV files you choose, analyses them and displays the findings — all inside your browser, on your own machine. It has no network capability by construction: no upload, no background transmission, no telemetry, no error reporting, no “optional” cloud step.
Your files are never sent to us, never sent to the hosting provider beyond the ordinary request that fetched the page itself, and never stored by this site. Nothing is written to cookies, local storage, session storage or any browser database. The analysis lives in the page while the tab is open; closing the tab is the delete button.
Because your item master, vendor list and receipts are commercially sensitive, this is deliberately verifiable rather than merely promised: open the browser’s network tab while the check runs and nothing is requested, or disconnect from the network first and it still works.
The same claim, with the technical reasoning behind it, is on the how it works page.
Because the tool never transmits your data, we are not a controller or a processor of anything it reads. Whatever is in those exports remains entirely under your own control, on your own equipment, and under whatever obligations already apply to you as its controller.
This site also describes a second product: ChatAdmin, a chat-based agent that signs in to Azure, carries out administrative changes after an explicit approval, and writes an audit trail of what was asked, what was approved or declined, and what the platform did. That is a materially heavier processing story than a local browser tool.
What is true today, and only this:
This notice therefore covers the website, the free check and correspondence with us — and nothing else. It will be rewritten before the admin agent opens to customers; see changes to this notice.
For your visit to this site: nobody, apart from the hosting provider described above. Your data is not sold, rented, shared or disclosed. There is no advertising partner, no analytics vendor and no customer relationship system involved in this site, because there is no mechanism by which anything could reach them.
For correspondence: the mail and telephony providers that carry it, and nobody else — see writing to us.
For authorities: we disclose personal data to a court or authority only against a legally binding order that we are required to comply with. If we receive one, we check that it is valid and within the issuer’s powers, disclose no more than it compels, and inform the person concerned unless the order itself lawfully prevents that. In practice such an order would rarely have anything to reach: the only visit data that exists sits in GitHub’s logs, which we cannot query, so an authority wanting it would have to go to GitHub, which publishes its own guidelines for handling government requests. What we could actually be ordered to produce is correspondence you have sent us, and nothing else.
This website stores nothing itself: there is no database, no log of our own and no back end behind these pages. Only two retention periods exist, and both are stated in full earlier on this page:
In respect of personal data relating to you, you can ask to exercise the following rights. They are stated here in their broadest form, so that the answer does not depend on which framework finally applies.
In practice the honest answer to most access requests about this site is that we hold nothing about you: the only record of your visit sits in the hosting provider’s logs, keyed to an IP address we cannot query. A request would be forwarded to the provider to the extent it can be. If you have written to us, the correspondence itself is the exception — that we do hold, and it is what an access request would actually return.
No. You are not asked for any data by this site, and there is nothing to withhold. The technical data in the server logs is created by the act of requesting a page and cannot be separated from it, which is true of every website; if you would rather not generate it, do not open the page. If you write to us, you decide what to put in the message — we need only enough of an address to reply.
This notice describes the site as it is built today. It will change when the site changes — and in particular it must be rewritten before anything that collects data is added: a contact form, an account, a newsletter, a payment step, an embedded video, the cloud reporting step described on the pricing page as not yet open, or customer onboarding for the Azure admin agent.
The current version is always the one published on this page. There is no mailing list to announce changes through, because there is no mailing list.
This version is effective from 16 August 2026.