Privacy policy (Datenschutzerklärung)
Information on how your data is processed, under Article 13 GDPR.
Current status
Draft pending professional legal review. No legal text is published without that review.
Operator details missing
The owner still has to fill in: name or company name, street and number, postcode, town, country, Email.
Controller
[pending: name or company name][pending: street and number]
[pending: postcode] [pending: town]
[pending: country]
- [pending: Email]
- Phone
- [pending: Phone]
Data protection officer
[pending: data protection officer]
What data we process
Account data: name, email address, password (as a hash only) and, if you turn it on, two-step verification. Return data: profile, answers, business trips and the values you confirm. Documents you upload and the data read from them. Technical data: IP address and browser linked to your session, and security logs with the IP address pseudonymised.
Waiting list
If you join the waiting list, we store your email address, your language, the consent text you accepted, and the date and pseudonymised IP address of your request and of your confirmation, so that we can prove your consent. Legal basis: your consent (Article 6(1)(a) GDPR). Unconfirmed requests are deleted after 7 days; when you unsubscribe, we delete your address from the list. Emails are sent via Brevo (Sendinblue SAS, Francia).
Purposes and legal bases
To provide the service you ask for, that is, preparing your return: Article 6(1)(b) GDPR. To protect the service against misuse (security logs): legitimate interest, Article 6(1)(f) GDPR. To send you account emails (confirmation, password, security notices): Article 6(1)(b) GDPR.
Special categories of data
Preparing the return may involve specially protected data (Article 9 GDPR), such as membership of a religious community (church tax) or illness costs. Pending legal review: the applicable legal basis, for example explicit consent (Article 9(2)(a) GDPR).
Who receives your data
Hosting: Cloudflare, Inc. (Cloudflare Pages, Workers y D1). Email delivery: Brevo (Sendinblue SAS, Francia). Document reading (OCR) and the virus scanner run on our own servers: documents are not sent to third parties. We do not transmit returns to the tax authorities. There are no payments during the beta.
Transfers outside the European Economic Area
Cloudflare, Inc. is based in the US and runs a worldwide network, so transfers outside the European Economic Area can't be ruled out when this website is served. Waiting-list sign-ups are stored in the European Union. Pending legal review: the basis for those transfers (for example the EU-US Data Privacy Framework or standard contractual clauses).
How long we keep it
Account data, return data and documents are kept until you delete your account; they are then erased. Security logs are deleted after 90 days. The IP address and browser are stored with the session while it exists (deletion of expired sessions still to be defined). Records of test payments made before the beta are kept pseudonymised for 8 years (§ 147 AO).
Cookies
We only use the session cookie, which is technically necessary for signing in (§ 25 Abs. 2 Nr. 2 TDDDG). We use no analytics or tracking.
Security
Documents are stored encrypted (AES-256-GCM), and so are the identity details read from them. Passwords are only stored as a hash.
Your rights
You have the right of access, rectification, erasure, restriction, portability and objection (Articles 15 to 21 GDPR), and you can withdraw consent at any time (Article 7(3)). Under “Account” you can download your data and delete your account. You can also lodge a complaint with a supervisory authority (Article 77 GDPR): [pending: supervisory authority].
Automated decisions
The check of your case and the calculation are automated but only for guidance: they have no legal effect and do not replace the tax office's decision (Article 22 GDPR).
Do you have to provide your data?
There is no legal obligation. Without it we cannot prepare your return.
This website and the waiting list
This website is served as static pages from Cloudflare Pages, and the waiting list runs on Cloudflare Workers; sign-ups are stored in Cloudflare D1 under EU jurisdiction. Cloudflare, Inc. acts as a processor. When you visit the website, Cloudflare processes your IP address and technical connection data to deliver the pages and protect them against abuse. This website sets no cookies of its own and uses no analytics or tracking. While the confirmation email isn't active yet, we store requests without sending any email; the 7-day period to confirm starts when we send you the link. Pending legal review: the data processing agreement with Cloudflare.