Last updated: 6 October 2026
This privacy policy explains which personal data is processed when you visit extractional.com (including our blog at /blog and our documentation at /docs) or contact us, why this happens, and which rights you have. We keep it short because we collect very little: there is no advertising, no analytics and no tracking on this website.
1. Who is responsible
The controller for the processing described here is:
Extractional International Distribution S.à r.l.
32, rue d’Oetrange
L-5333 Moutfort, Luxembourg
Luxembourg Trade and Companies Register (RCS) B303110
Email: info@extractional.com
For any question about your data or to exercise your rights, write to info@extractional.com.
2. Visiting the website
When you open a page, your browser automatically sends technical data to the server: your IP address, the date and time, the page requested, the referring page, and your browser and operating system. This is necessary to deliver the website, to keep it secure and stable, and to detect attacks. Legal basis: our legitimate interest in a secure, working website (Art. 6(1)(f) GDPR). The hosting provider keeps these server logs for a short period only and then deletes them.
All fonts, images and thumbnails on extractional.com are served from our own server. The homepage does not load content from Google, YouTube or any other third party.
3. Hosting, content delivery and security
- Host Europe GmbH (Cologne, Germany, part of the GoDaddy group) hosts the website on servers in the European Union, as our processor under a data processing agreement.
- Cloudflare delivers the website through its content delivery network and protects it against attacks and bots. Requests, including your IP address, pass through Cloudflare servers, which may be located outside the EU, in particular in the United States. Cloudflare, Inc. is certified under the EU-U.S. Data Privacy Framework; standard contractual clauses also apply.
- Wordfence (security plugin) checks visits and login attempts to block attacks. It processes IP addresses and request data for this purpose and may compare them with threat information provided by its developer, Defiant Inc. (USA).
Legal basis: our legitimate interest in delivering a fast and secure website (Art. 6(1)(f) GDPR).
4. Cookies
The website itself sets no cookies for visitors and uses no tracking or advertising cookies. Cloudflare sets one strictly necessary cookie, __cf_bm, which distinguishes humans from bots and expires after 30 minutes. Because it is strictly necessary for the security of the website, no consent is required (Art. 5(3) of the ePrivacy Directive). If you log in to the administration area, WordPress sets the cookies needed for that session.
5. Contact form and email
If you use the contact form, we process your first and last name, your email address, your message and your consent confirmation, as well as the date, the page and your IP address and browser information (to prevent abuse). The message is stored in the website database and sent by email to our team; you receive a confirmation email. If you write to us by email (for example to request a free trial), we process the data contained in your email.
We use this data only to answer your request and, if you wish, to prepare an offer or a trial. Legal basis: steps prior to a contract at your request (Art. 6(1)(b) GDPR) and our legitimate interest in answering enquiries (Art. 6(1)(f) GDPR). Spam is filtered with an invisible check on our own server; no external captcha service is used.
Messages received through the form are deleted from the website after 12 months. Emails are kept as long as needed for the enquiry and any business relationship that follows, and in line with legal retention obligations (for example commercial and tax law). Our email is hosted on our own mail server in the European Union.
6. Videos and external links
Our videos are hosted on YouTube. The homepage only shows preview images stored on our own server; nothing is loaded from YouTube until you click a video. The video then opens on youtube.com, operated by Google Ireland Limited, whose own privacy policy applies (policies.google.com/privacy). The same applies to links to our LinkedIn and YouTube pages: data is only transferred to these platforms when you follow the link.
Our documentation at /docs currently loads its fonts from Google Fonts (Google Ireland Limited). When you open the documentation, your browser therefore connects to Google’s servers and transmits your IP address. Legal basis: our legitimate interest in a readable documentation (Art. 6(1)(f) GDPR). We plan to serve these fonts from our own server as well.
7. No profiling, no sale of data
We do not use your data for automated decision-making or profiling, we do not sell it, and we do not use it for advertising.
8. Your rights
Under the GDPR you have the right to access your data, to have it corrected or deleted, to restrict its processing, to data portability, and to object to processing based on our legitimate interest. Where processing is based on your consent, you can withdraw it at any time with effect for the future. To exercise these rights, write to info@extractional.com.
You also have the right to lodge a complaint with a supervisory authority. In Luxembourg this is the Commission nationale pour la protection des données (CNPD), 15, Boulevard du Jazz, L-4370 Belvaux, cnpd.public.lu.
9. The Extractional software
This policy covers the website only. Extractional is installed on our customers’ own servers; the documents and data processed with it stay with the customer, who is responsible for that processing. Where we access customer systems for support, this is governed by the customer agreement.
10. Changes
We update this policy when our website or our processing changes. The date at the top shows the current version.