Privacy notice
Last updated 20 September 2026 · applies to rex-optics.com, the REX-Optics Coating Designer (designer.rex-optics.com) and REX Analyze (analyze.rex-optics.com)
1. Who is responsible
The controller for the processing described here is:
REX-Optics B.V.
Drienerlolaan 5, 7522 NB Enschede, The Netherlands
Chamber of Commerce (KvK) 97561029 · VAT NL868110899B01
info@rex-optics.com
2. Summary
We do not use advertising, behavioural analytics or tracking technologies, and we do not sell or share personal data for marketing. We do process a limited amount of data in four situations: when you visit the site (server logs), when you run a simulation in the Coating Designer (the calculation is performed on our server), when you contact us or request a quotation (the details you send us), and when you use REX Analyze (a signed-in service: your email address, the measurement files you upload, and processing by our language-model provider).
REX Analyze is the one part of our service that needs an account. It sets a single sign-in cookie, which is strictly necessary for it to work and therefore needs no consent banner. Nothing on rex-optics.com or in the Coating Designer sets a cookie at all.
3. What we process, and why
| Situation | Data | Purpose & legal basis | Retention |
|---|---|---|---|
| Visiting any page | IP address, date and time, requested URL, referring page, browser and device type — in our hosting provider's server logs | Delivering and securing the website, diagnosing faults and detecting abuse. Legitimate interest, Art. 6(1)(f) GDPR | Kept by our hosting provider for a short period (in the order of weeks) and then deleted automatically |
| Running a simulation in the Coating Designer | The coating parameters you submit (materials, thicknesses, roughness, angles, wavelength range) plus the technical log data above | Performing the calculation you requested and returning the result. Legitimate interest, Art. 6(1)(f) GDPR — the parameters are ordinarily technical data, not personal data | Processed in memory to answer the request. We do not store submitted designs in a database or link them to a user |
| Anonymous usage counters | Aggregate counts of events such as "an example design was loaded" or "a quote was requested", per day. No IP address, no identifier, no design content | Understanding which features are used so we can improve the tool. Legitimate interest, Art. 6(1)(f) GDPR | Stored as running totals only; individual events are never recorded |
| Signing in to REX Analyze | Your email address, a one-time sign-in code, the time you verified it, and a session cookie in your browser. For administration we also keep how many analyses that address has used | Operating an access-controlled service, enforcing the free monthly allowance and preventing abuse of a service we pay for. Performance of a contract, Art. 6(1)(b) GDPR, and legitimate interest, Art. 6(1)(f) GDPR | The sign-in code expires within minutes; the session lasts seven days or until you sign out. The address, the record of which version of the terms you accepted, the approval record and a minimal usage ledger are deleted twelve months after your last sign-in, or earlier if you ask us |
| Running an analysis in REX Analyze | The measurement file you upload, the sample description you write, the fitted models, figures and the report produced from them | Performing the analysis you asked for. Performance of a contract, Art. 6(1)(b) GDPR. The content is ordinarily technical measurement data rather than personal data | Not shared with other users; accessible to authorized operators when needed to run or support the service; deleted automatically after 30 days, and deletable by you at any time from your history. A minimal usage ledger (date, cost, outcome) is retained, and is itself deleted with your account twelve months after your last sign-in |
| Protecting the REX Analyze sign-in | A keyed digest of your IP address — not the address itself, and not reversible without a secret held on our server — together with the time of the attempt | Limiting how often codes can be requested and guessed from one address or one connection. Legitimate interest, Art. 6(1)(f) GDPR | Deleted automatically after 48 hours |
| Emailing us or using "Request this coating" | Your name and email address, your organisation if you give it, the message, and any coating design or specification you choose to include | Answering your enquiry and, where relevant, preparing a quotation and assessing manufacturability. Steps prior to a contract, Art. 6(1)(b) GDPR, and legitimate interest, Art. 6(1)(f) GDPR | Kept for as long as needed to handle the enquiry and any resulting business relationship, and thereafter as required by Dutch commercial and tax law (generally seven years for invoicing records) |
The Request this coating button in the Coating Designer opens a pre-filled message in your own email programme. Nothing is transmitted to us until you choose to send it.
4. Shareable design links
The Coating Designer can encode a complete design into a link so you can reopen or send it. That design is held in the fragment part of the address — the portion after the # — which browsers do not transmit to our server. We therefore never receive the contents of a share link.
Treat a share link as public. Anyone who receives it can open the design, and links routinely end up in browser history, corporate proxies, email systems and chat previews. Do not use share links for confidential, customer-owned or export-controlled coating designs.
5. Who else is involved
We keep the number of parties to a minimum. All page content, including images and fonts, is served from our own site — no third-party fonts, analytics, advertising networks, social plugins or content-delivery scripts are loaded.
- Hosting and delivery (processor): Netlify, which hosts rex-optics.com and designer.rex-optics.com, performs the Coating Designer calculations on our behalf and maintains the server logs described above.
- REX Analyze hosting (processor): Hetzner Online GmbH, on a server in Finland. Your uploaded files, reports and account records are stored there, inside the European Economic Area.
- Sign-in email delivery (processor): Resend (Resend, Inc., United States) delivers the one-time access codes for REX Analyze. It processes the destination email address and delivery information. Measurement files and analysis reports are never included in these messages. The transfer to the United States is covered by the European Commission's Standard Contractual Clauses in our agreement with Resend.
- Language model (processor): OpenAI, under a contract with OpenAI Ireland Ltd. When you run an analysis we send its API: numerical evidence extracted from your measurement, the sample description you wrote, your answers to the follow-up questions it asks, and plots of your curve and of candidate fits, so that the model can choose which structures to test and write the interpretation. Processing may take place in the United States under the Standard Contractual Clauses. We use the API under terms that do not permit your content to be used to train models, and with the provider's own retention switched off where we can; OpenAI may nevertheless retain API inputs and outputs for up to 30 days for abuse monitoring, so deleting an analysis in REX Analyze does not delete that copy. The free curve and Fourier preview never calls the AI provider.
- Business mailbox (processor): our email provider, for correspondence you send to info@rex-optics.com. It is not used to send REX Analyze sign-in codes.
Some of these providers may process data outside the European Economic Area. Where that happens, transfers are covered by the European Commission's Standard Contractual Clauses or another lawful transfer mechanism. You may ask us for details of the safeguards in place.
6. Deletion, and what a backup keeps
You can delete the file and the report of any analysis yourself, at any time, from your history in REX Analyze. To delete your whole account — the address, the approval and the usage ledger — write to info@rex-optics.com and we will remove it within 30 days. A self-service button is planned.
We keep encrypted backups of the REX Analyze database and its stored files so the service can be restored after a failure. Backups are deleted after 30 days, so content you deleted can persist in a backup for up to that long before it disappears with the backup itself.
7. What we do not do
- No advertising, analytics or tracking cookies anywhere, and therefore no cookie banner. rex-optics.com and the Coating Designer set no cookies at all; REX Analyze sets one strictly necessary sign-in cookie, which carries no identifier beyond your own session.
- No advertising, profiling, behavioural analytics, or cross-site tracking.
- No sale or disclosure of personal data to third parties for their own purposes.
- No automated decision-making producing legal or similarly significant effects.
- We do not use the designs, measurements or reports you submit to train models, and we do not publish or reuse them.
- Other users of REX Analyze cannot see your files or reports. An administrator can see verified addresses and usage totals, not automatic access to your measurement data.
8. Security
The site, the Coating Designer and REX Analyze are served exclusively over HTTPS with HTTP Strict Transport Security. Access to any enquiry correspondence is limited to the people at REX-Optics who need it to answer you. If you send us a design under a non-disclosure agreement, please say so in your message so we can handle it accordingly.
For REX Analyze specifically: sign-in is by one-time code to a verified address, session tokens are stored as hashes rather than as usable tokens, uploaded files and reports are readable only by the account that created them, each analysis runs in an isolated container with no privileges and a read-only filesystem, and the web server keeps no access log.
9. Your rights
Under the GDPR you may request access to your personal data, rectification of inaccurate data, erasure, restriction of processing, and data portability. Where processing is based on our legitimate interest, you have the right to object to it. Write to info@rex-optics.com and we will respond within one month.
You also have the right to lodge a complaint with the Dutch supervisory authority, the Autoriteit Persoonsgegevens, or with the authority in your country of residence.
10. Changes
We may update this notice as the site, the Coating Designer and REX Analyze develop. The date at the top always shows when it was last changed. Material changes will be described here rather than made silently, and where they affect REX Analyze the service asks you to read the revised terms before your next analysis.