Privacy Policy

Iconicorp, trading as Selectronyx ("Selectronyx", "we", "us"), is the data controller for the personal data described in this policy.

This policy covers both our public website (www.selectronyx.com) and our product, the FairSpec platform ("the Service"). Where a section applies to only one, we say so. If you are a website visitor and not a FairSpec account holder, sections 3.1 to 3.6 are the ones that apply to you.

3.1 Website enquiries (contact form)

We collect your name, email, and message, and optionally your phone number and company, to respond to your enquiry and follow up about it. Lawful basis: legitimate interest in responding to business enquiries (Art. 6(1)(f)). If you tick the optional box to receive occasional updates, we rely on your consent (Art. 6(1)(a)) and you can withdraw it any time.

3.2 Booking a demo (GoHighLevel calendar)

Our booking calendar is provided by GoHighLevel (LeadConnector). It loads only when you choose to open it. If you book, GoHighLevel processes your name, email, and scheduling details on our behalf. Lawful basis: legitimate interest / consent when you choose to load and use it.

3.3 Analytics

We use Simple Analytics, a privacy-friendly, cookieless analytics tool. It produces aggregate, non-identifying statistics and does not set cookies or build cross-site profiles. Lawful basis: legitimate interest in understanding site usage (Art. 6(1)(f)). You can opt out of Simple Analytics. We also honour Do Not Track when your browser sends it.

3.4 Marketing attribution

When you arrive from an advertisement, we store campaign parameters (utm_source, utm_medium, utm_campaign, utm_content, utm_term, and the Google click identifier gclid) in your browser's sessionStorage so we can measure which campaigns lead to interest. This is cleared when you close the tab and is not used to track you across other websites. Lawful basis: legitimate interest in measuring our own marketing (Art. 6(1)(f)).

3.5 Instant Check (no account)

When you use the Instant Check without an account:

• We receive the manufacturer part number (MPN) you submit, and a one-way hash of your IP address used only for rate limiting.
• We do not store your IP address. The hash is retained for 7 days, then deleted.
• We look up the MPN via Altium LLC (Nexar/Octopart) and may cache the result against that MPN for 7 days. The cache is not linked to you or your IP hash.
• We keep daily aggregate counts of Instant Check usage (no IP, no MPN).
• We use Cloudflare Turnstile to distinguish humans from bots.
• Lawful basis: legitimate interests (Art. 6(1)(f) GDPR) — operating and protecting a free public tool. We do not profile you or use Instant Check data for marketing.
• If you later create an account, the name and email you provide are processed under 3.7 FairSpec app (account holders).

If you ask us to email the result, we use your email to deliver that requested result (and related transactional follow-up about it). Lawful basis: legitimate interest in fulfilling your request (Art. 6(1)(f)). If you separately tick the optional box for occasional FairSpec updates, we rely on your consent (Art. 6(1)(a)) for that marketing only; you can withdraw it any time. Delivery of the result is not conditioned on marketing consent. Processors for CRM and email delivery are listed in section 5 (GoHighLevel and, where used, Resend). Retention and rights are in sections 7 and 8.

3.6 Server logs

Our hosting and API functions record technical logs including IP addresses for security and operation. Lawful basis: legitimate interest (Art. 6(1)(f)). Retention in section 7.

3.7 FairSpec app (account holders)

For the Service we process:

• Account details (name, email, organisation) for sign-in via Google OAuth or email
• Bills of materials and analysis results you upload or generate
• Usage records, feature interactions, and API request logs (for enterprise users)
• Payment-related identifiers via Stripe (we do not store full card numbers)
• Session and authentication tokens in HTTP-only cookies

Lawful basis: performance of contract (Art. 6(1)(b)) to deliver the Service, and legitimate interest in securing and improving it (Art. 6(1)(f)).

We do not set non-essential cookies. Our analytics is cookieless. We use your browser's sessionStorage only for the marketing attribution described in 3.4, which clears when you close the tab.

Because nothing non-essential loads without your action, we do not use a cookie consent banner. Third-party embeds (the GoHighLevel booking calendar) load only when you click to open them and may then set their own cookies, governed by GoHighLevel's own policy; we disclose this at the point of use. You can opt out of analytics as described in 3.3.

FairSpec app: authentication cookies are strictly necessary for signed-in users and cannot be disabled without losing access to your account.

This is our group sub-processor register, covering both www.selectronyx.com and the FairSpec app. Each processor acts on our instructions under a data-processing agreement.

The website's Montserrat font is self-hosted at build time (via next/font), so it does not cause a runtime request to Google Fonts and is not a data-sharing event.

Some processors above are based in the United States. Where personal data is transferred outside the EEA, we rely on the European Commission's Standard Contractual Clauses and equivalent safeguards.

• Website enquiries and leads: 24 months after last contact
• Contact API and server logs: 30 days
• Analytics: aggregate and non-identifying, retained per our Simple Analytics settings
• Instant Check IP hash (rate limiting): 7 days; we do not store the raw IP address
• Instant Check MPN response cache: 7 days; keyed by part number only, not linked to an IP hash
• Instant Check usage aggregates: daily counts with no IP and no MPN
• FairSpec app data: as set out in the Terms of Service

You have the right to access, rectify, erase, restrict, and port your personal data, to object to processing, and to withdraw consent. To exercise any right, email privacy@selectronyx.com. We aim to respond within 30 days.

You also have the right to lodge a complaint with the Dutch supervisory authority, the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl).

We use encryption in transit, access controls, and other measures aligned with ISO/IEC 27001 principles (we are not certified). If a personal data breach is likely to result in a risk to your rights, we will notify the supervisory authority within 72 hours as required.

We will post any changes here with an updated date.