Privacy policy
1 · Who we are
FPO Intelligence is a sales-intelligence service for scientific-instrument companies. It is run by Ethan Morkel and David Britz, trading together as FPO Intelligence, Cuxhavener Straße 15, 10555 Berlin, Germany, who act jointly as controllers of the data described here (Article 26 GDPR) while the company FPO Intelligence GmbH is being founded. We decide together what we process and why, we are both responsible for everything in this notice, and you can exercise your rights with either of us. When the GmbH has been founded, it becomes the controller and this notice will name it. For anything in this notice, write to contact@fpo-intelligence.com.
2 · Who this notice is for
Visitors to this website; people who contact us or request a sample; people at companies we contact, and those who open a dossier on our dossier site; and researchers whose published professional information appears in our database and products. If you are a researcher, section 7 is written for you.
3 · Visiting the website
Hosting. The website is hosted by Vercel Inc., USA, which is certified under the EU-US Data Privacy Framework. To deliver a page and keep the site secure the host records your IP address, the time, the page requested and your browser type. We use this only for security and error analysis. Legal basis: Article 6(1)(f) GDPR, our legitimate interest in a secure website. Retention: 14 days.
Fonts. The site's fonts are served from our own servers. No request goes to a third-party font service.
Analytics, only with your consent. We use PostHog to understand how the site is used — which pages are visited, from what kind of device, and how visitors move through the site. PostHog runs only if you agree in the banner when you first visit; until then, and if you decline, it is not loaded and sets no cookie. Your IP address is discarded before storage. The data is processed by PostHog Inc. on servers in the European Union (Frankfurt). Legal basis: your consent, Article 6(1)(a) GDPR, and §25(1) TDDDG for the cookie. You can withdraw consent at any time in the site's cookie settings; withdrawing also deletes what PostHog stored in your browser. PostHog's cookie lasts 12 months, and we keep analytics data for 12 months.
What consenting includes. With your consent PostHog also records where on a page you click and how far you scroll, which we read as a combined map over all visitors rather than person by person; and it makes a replay of your visit — a reconstruction of the pages as they appeared to you and of your clicks, scrolling and mouse movement, so we can see where the site confuses people. A replay is not a video of your screen and it carries no sound and no camera. Nothing you type is in it: every form field is masked in your own browser before anything is sent, so the content of the request and sample forms never reaches PostHog through analytics at all. It reaches us only when you submit the form yourself, as section 4 describes. Replays are kept for 30 days and then deleted; the maps and page views are kept for 12 months. All of this stops the moment you withdraw consent, and none of it happens if you decline.
Necessary cookies. The site sets only the cookie that remembers your banner choice, so we do not ask again. It lasts 12 months. Legal basis for that one: §25(2) TDDDG.
4 · Contacting us or requesting a sample
If you email us or use the request form, we process your name, work email address, company and message, to reply and, if you asked for a sample, to send it and follow up. Legal basis: Article 6(1)(b) GDPR for steps taken at your request, and Article 6(1)(f) for the follow-up. Retention: 12 months after our last exchange; if a contract follows, the periods in section 10 apply. What you send in the form reaches us as an email, sent by Resend, which also sends you a short confirmation that we have it. Our mailboxes and documents run on Google Workspace (section 8).
5 · The dossier site
We show dossiers to the companies we work with on dossier.fpo-intelligence.com, through a private link for each company. Before the dossier opens, the visitor accepts our terms of use on the company's behalf. We record that the terms were accepted through that company's link, when, and which version, but not who the visitor is. To remember the acceptance in that browser, the site sets one cookie, needed for the service you asked for (§ 25(2) no. 2 TDDDG). It lasts at most 30 days, and we use no other cookies and no analytics there. We also log when each link is used: when its access page is opened, when the terms are accepted, when the dossier is opened and when its interest page is opened, and whether a form sent there held contact details or a message, never what, by time only and without recording who used it. We use this log to know whether a company has opened what we sent it and to trace a copy back to its link (Article 6(1)(f) GDPR, our legitimate interest in following up our offer and in protecting the dossier), and delete it when the link expires or is withdrawn.
Each dossier's last page links to a page where the company can tell us it is interested in our next edition. If you leave your name, work email address or a message there, all optional, we use them only to reply to you about that edition: legal basis Article 6(1)(b) GDPR, steps taken at your request. They are kept on our server in Germany, apart from the log above, and deleted 90 days after you send them; if we then write to each other, section 4 applies.
To deliver the pages and keep the site secure, our server processes your IP address and the time of each request. Legal basis: Article 6(1)(f) GDPR, our legitimate interest in a secure service. We keep no access log with the page addresses, and any security log for 14 days at most. The site runs on our own server at Hetzner in Germany.
6 · People at companies we contact
We approach scientific-instrument companies, not individuals privately. For that we hold the names, roles and work contact details of people at those companies, taken from the company's own website, from public professional profiles, or given to us in person. Legal basis: Article 6(1)(f) GDPR, our legitimate interest in offering our services to businesses, weighed against the limited intrusion of a professional approach on a work channel. Object at any time (section 11) and we stop. If we send you a private link to a dossier, section 5 says what is recorded when you open it.
7 · Researchers whose published information appears in our products
What we hold. Your name; your institution and lab; the titles, years, venues and co-authors of your publications; the titles, funder, dates, amounts and co-investigators of your public research grants; where and when you present at a scientific meeting, as its organiser publishes it; the scientific equipment named in your own open-access publications, cited to the paper; and a short description of your lab's research derived from those facts.
What we do not hold. Your email address, phone number or postal address. Anything from behind a login. The text or findings of conference abstracts. Health data or any other special category. Photographs. Anything from a third party's customer records.
Where it comes from. Publicly accessible scholarly and funding sources and published conference programmes — including PubMed and Europe PMC, OpenAlex, NIH RePORTER, CORDIS, and the programmes meeting organisers publish. All of it is information you or your institution made public about your professional work.
What we use it for. To produce reports for companies that make scientific instruments about research activity in their field: which labs are active, what they publish, what public funding they hold, what equipment their papers name, and where they present. We do not contact researchers, and our reports are not a tool for anyone to contact you through us.
Legal basis. Article 6(1)(f) GDPR, legitimate interests: ours in running a lawful business that assembles public professional information, and our customers' in knowing which publicly presenting, publicly funded researchers work in their field, weighed against yours in a written assessment. The data is your published professional activity, used in a business-to-business context; we hold no contact details and no special categories; and you can object at any time and be removed from every product. We do not rely on consent and we do not sell lists.
Who receives it. Companies that have accepted our terms of use, to buy a report or to evaluate a free edition, as independent controllers. The terms limit use to the company's own sales and marketing planning by its own sales and marketing staff; forbid copying, bulk export, enrichment services, AI tools, resale, republishing and any use to harass anyone; require the company to make any removal we tell it about within 14 days; and point to this notice. They view the report on our site and cannot download it. Companies outside the EU are bound by the EU standard contractual clauses or the EU-US Data Privacy Framework. Our service providers (section 8), including an AI language-model service that produces the short description from the facts we supply.
Why we tell you here rather than individually. Article 14 GDPR requires us to inform you of this processing. The information comes from public databases covering very large numbers of researchers, and we hold no way to reach you without collecting contact data solely for that purpose; informing each person individually would involve disproportionate effort (Article 14(5)(b)). So we publish this notice, link it from our homepage, and place a link to it in every report we deliver.
How long. For as long as we offer products covering your field, refreshed as the public sources change; a record we have not been able to refresh from a public source for 36 months is deleted. If you object, your entry is removed from every product within 14 days; the removal is kept permanently so you are not re-added, and customers who hold your data from us are told.
8 · Recipients and service providers
| Who | Role | What for | Where and on what basis |
|---|---|---|---|
| Hetzner Online GmbH | Processor | Servers and database; the dossier site | Germany |
| Vercel Inc. | Processor | Website hosting | USA — EU-US Data Privacy Framework |
| PostHog Inc. | Processor | Website analytics, click and scroll maps and session replay, all with your consent | EU servers (Frankfurt); data-processing agreement with standard contractual clauses for any support access from the USA |
| Google Ireland Ltd (Google Workspace) | Processor | Email and documents | EU; Google's standard transfer terms for any onward transfer |
| Resend (Plus Five Five, Inc.) | Processor | Sending the emails our website forms produce, and the confirmation to the sender | USA — EU-US Data Privacy Framework, with standard contractual clauses in its data-processing agreement; the mail itself is sent from EU servers (Ireland) |
| Anthropic PBC | Processor | Producing lab descriptions from facts we supply | USA — standard contractual clauses under its data-processing agreement; our inputs are not used for training |
| Our customers, and companies evaluating a free edition | Independent controllers | Recipients of reports, under our terms of use | EU and USA |
Each processor is bound by a data-processing agreement and acts only on our instructions. Customers and companies evaluating a free edition are not processors; they are responsible for their own use within our terms.
9 · Transfers outside the EU
Where data goes to the United States we rely on the EU-US Data Privacy Framework for certified recipients (Vercel, Resend) and on the European Commission's standard contractual clauses otherwise (Anthropic, PostHog support access, and any company in the USA that receives a report or a free edition, through the clauses in our terms of use), with a transfer assessment on file.
10 · Retention
| Website logs | 14 days |
| Analytics data (PostHog) | 12 months |
| Session replays (PostHog) | 30 days |
| Enquiries and sample requests | 12 months after the last exchange |
| Business contacts at companies | While the company is a prospect or customer; 24 months after the last contact |
| Researcher information | While we offer products in the field; deleted after 36 months without a refresh from a public source; removals on objection kept permanently |
| Dossier site security logs | 14 days |
| Dossier site visit log, per link | Until the link expires or is withdrawn |
| Records of accepted terms (per company, no personal data) | Six years |
| Requests from the dossier site's interest page (name, work email, message) | 90 days |
| Encrypted backups | About ten weeks; data we remove is gone from them by then |
| Contracts and invoices | As tax and commercial law require, up to 10 years |
11 · Your rights
You can ask what we hold about you, have it corrected, deleted or restricted, or receive it in a portable form. You can object at any time to any processing based on our legitimate interests, and withdraw any consent you have given. Write to contact@fpo-intelligence.com; we answer within a month and act on objections within 14 days. You may also complain to a supervisory authority; ours is the Berliner Beauftragte für Datenschutz und Informationsfreiheit, Alt-Moabit 59–61, 10555 Berlin.
12 · No automated decisions
We make no automated decisions about you with legal or similarly significant effect. Labels in our reports describe how strong the evidence for a statement is; they are not decisions about you.
13 · Changes
This notice is dated 23 October 2026. We update it when our processing changes; the current version is always at this address. A German version is in preparation.