Privacy policy

Controller

What we process

Account data (name, email address, phone number if provided), the company and invoice data you enter, technical log data (IP address, timestamp, user agent) and an audit trail of actions performed in the portal.

Purpose and legal basis

Processing serves the performance of our contract with you (Art. 6 (1) (b) GDPR) and our legitimate interest in secure, traceable operation (Art. 6 (1) (f) GDPR). Invoice records are retained to satisfy statutory retention obligations (Art. 6 (1) (c) GDPR).

Cookies

The portal sets only technically necessary cookies: a session token, a refresh token, a remember-me flag, your active company and your colour-mode preference. No advertising, tracking or third-party analytics cookies are used.

Hosting and processors

The portal runs on our own servers in Germany. Document rendering, authentication and email delivery are handled by our own internal services. Uploaded receipts are processed by our own OCR system and are not sent to third-party cloud services. Card payments are processed by Stripe Payments Europe Ltd. as a processor; only the billing relationship is transmitted — never your invoices, documents or customer data.

Retention

Account data is kept for the life of the account. Invoice data is subject to statutory retention periods under German commercial and tax law. Audit entries are retained to preserve the integrity of the trail.

Your rights

You have the right to information, rectification, erasure, restriction of processing, data portability and objection, and the right to lodge a complaint with a supervisory authority. To exercise these rights, contact us using the details above.