Privacy policy

1. Controller

ProjectXY
Leipziger str. 22
04109 Leipzig
info@Projectxy.de

2. What data we process

Account: E-mail address, name, password (stored only as a hash), preferred language, time of registration and sign-ins, optionally the two-factor secret.

Company data: Company details, tax numbers, bank details, logo, customer and supplier data, documents, payments, uploaded files. You enter this data as a user; it is processed exclusively to provide the application.

Logs: For security and traceability we log sign-ins (including failed ones) with IP address as well as essential changes (e.g. finalising an invoice, deletions) with user and time. Failed sign-in attempts are deleted after 15 minutes.

Server logs: On every request, our hosting provider’s web server records the IP address, the time, the requested address and the browser identifier in an access log. This serves operation, troubleshooting and defence against attacks (Art. 6(1)(f) GDPR); the data is not combined with other data. The hosting provider deletes these logs after [PLACEHOLDER – Retention period of the server logs at the hosting provider (e.g. “7 days”)].

Addresses not found: To find broken links, we record the requested address, the referring page, the number of requests and the time – without IP address and without any visitor identifier. The entries are deleted after 90 days.

E-mails: Documents you send and system messages are logged in the outbox with recipient, subject and text.

Contact form: Name, e-mail address, message and IP address for answering the request. We send an automatic confirmation of receipt, without the text of your message, to the address you give; to prevent abuse we count these confirmations per address for one day, without storing the address itself.

Newsletter and promotional emails: If you subscribe to the newsletter (website, contact form or invoice generator), we store your email address, your name and company if given, the language and, as proof of your consent, the time, your IP address and the wording of the consent. You only receive the newsletter after clicking the link in our confirmation email (double opt-in); without confirmation we delete the data after 30 days. We occasionally send customers information about our own similar services as long as they do not object (§ 7(3) UWG) – can be switched off in the profile and via the link in every promotional email. We count clicks on links in a promotional email via our own redirect per recipient to see which content is of interest; there is no tracking pixel and no measurement of whether an email was opened. Anyone who unsubscribes is put on a block list with their email address so that they no longer receive promotion.

Free invoice generator: We use the details in the form only to create the PDF: your own details to fulfil your request (Art. 6(1)(b) GDPR), the details about your customer on the basis of the legitimate interest in creating the requested invoice (Art. 6(1)(f) GDPR). We are the controller for this; there is no data processing agreement for the free invoice generator. The details are not stored and are discarded once the file has been delivered. To limit free use to five invoices per day, we record your IP address and the time of each invoice created (Art. 6(1)(f) GDPR) and delete both after 30 days at the latest.

3. Purposes and legal bases

Provision of the contractually agreed service (Art. 6(1)(b) GDPR), system security and abuse prevention (Art. 6(1)(f) GDPR), fulfilment of statutory retention obligations (Art. 6(1)(c) GDPR). Where you process data of your customers and suppliers, you are the controller; we act as processor on the basis of the data processing agreement.

4. Cookies, browser storage and statistics

Whatever is needed for sign-in, security and your own settings is stored without consent (Section 25(2) no. 2 TDDDG). Visitor statistics only run if you agree (Art. 6(1)(a) GDPR). You can withdraw your consent at any time with effect for the future (Art. 7(3) GDPR) – here, just as easily as you gave it. There is no tracking, no advertising cookies and no third-party scripts or fonts.

Visitor statistics: From the IP address, the browser identifier and a random value that changes daily we form a short code that cannot be reversed. We do not store the IP address itself for this, and from the next day no visit can be linked to an earlier one. Only the operator sees the figures, in aggregated form; they are not passed on.

Record of your choice: We store every choice with the random identifier from the cookie and the time – without an IP address and without any link to your account. We delete these entries after three years.

5. Recipients and processors

Hosting: ProjectXY. The hosting provider operates the servers running the application and the database and keeps the server logs (section 2). It acts as a processor on the basis of a data processing agreement.

E-mail dispatch: System messages and documents you send go out via the e-mail server set up by the operator – or via your own if you enter it in the settings. The sub-processors for hosting and e-mail dispatch, with their registered offices, are named in the data processing agreement.

Payment service: Only if you pay an invoice from the operator online: the payment link leads to the checkout page of Mollie B.V., Amsterdam (Netherlands). We transmit the amount, currency, invoice number and the address you return to after payment. What you enter on the checkout page is processed by Mollie as an independent controller under its own privacy notice; without online payment, Mollie receives nothing.

Account retrieval: Only if you connect a bank account under bank reconciliation: you log in to your bank in the form of finAPI GmbH, Munich (Germany), an account information service authorised by BaFin; only finAPI receives your bank credentials, not us. On our behalf, finAPI retrieves accounts (name, IBAN, account holder) and transactions (date, amount, payment reference, name of the counterparty), as a processor on the basis of a data processing agreement; you give finAPI your consent to the account retrieval in the form. If you disconnect, we delete the connection at finAPI; transactions already retrieved stay in bank reconciliation until you remove them.

Maps and routes (route planning): Only if you use route planning: your browser loads the map tiles directly from MapTiler AG, Zurich (Switzerland); MapTiler receives your IP address and the displayed map section in the process. For address search we transmit the address of a stop to MapTiler; we store the result with the contact so that it is not searched again each time. For driving times and distance we transmit only coordinates – without names – to openrouteservice of HeiGIT gGmbH, Heidelberg (Germany). Both act as processors on the basis of a data processing agreement. We do not record the drivers' location: only the times at which a stop is marked as arrived, completed or with a problem are stored, plus, if desired, photo, signature and name of the recipient as proof of delivery.

Receipt recognition (AI): Only if your company has switched on receipt recognition: photos and PDFs of incoming invoices that you upload or send to your receipt mailbox are transferred to Anthropic PBC, San Francisco (USA) for analysis; for customers in the EEA, Anthropic Ireland Limited, Dublin, is the contracting party. Anthropic reads supplier, date, receipt number, amounts, tax rate, payment term and bank details from them and acts as a processor on the basis of a data processing agreement with the EU Commission’s standard contractual clauses. The transferred receipts are deleted at Anthropic within 30 days at the latest and are not used to train models. We store the result and the service’s answer (without the image) with the receipt so that it remains traceable where the details came from. The owner can switch off receipt recognition at any time; receipts can always be recorded by hand as well.

AI assistant: Only if your company has switched on the AI assistant (consent by the owner on first use): for suggestions – an appointment, invoice, quote, document or route from one sentence, a text for sending or a reminder, the answer to a question about your key figures or about the help, and the weekly rota suggestion – we send your entry and only the details needed for it to Anthropic PBC, San Francisco (USA); for customers in the EEA, Anthropic Ireland Limited, Dublin, is the contracting party. Depending on the feature, these are today’s date, units, tax rates, templates and fields, the type, number, amounts and deadlines of a document, for questions about your figures the key figures of your company including customer names and revenue, and for the weekly suggestion first names, working hours and days of absence. We match customer, item and employee names from the answer with your data ourselves. Anthropic acts as a processor under the standard contractual clauses of the European Commission (Art. 46(2)(c) GDPR), deletes the data after 30 days at the latest and does not use it to train models. Only what you confirm yourself after checking is saved; for billing we record the time, purpose, number of tokens and costs of each request, without content. The owner can switch off the AI assistant at any time.

Off-site backup copy: The operator can have a copy of the database backup sent to a mailbox managed by him. It is encrypted with a password (AES-256-GCM) known only to the operator; the mailbox provider cannot read it.

Third country: Transfers to countries outside the EU and the EEA take place in two cases only: for map and address search of the route planning we use MapTiler in Switzerland, for which an adequacy decision of the EU Commission exists (Art. 45 GDPR). For receipt recognition – only if your company has switched it on – we transfer receipts to Anthropic in the USA on the basis of the EU Commission’s standard contractual clauses (Art. 46 para. 2 lit. c GDPR). Our other processors process the data exclusively in the EU under their contracts with us.

6. Retention period

Account data until the account is deleted. Company data until you delete the company account; mind your own statutory retention periods (usually 8 or 10 years). Deleted data stays for another 90 days in a recycle bin from which the operator can restore it – after that it is removed for good. Backup copies are overwritten regularly. We delete contact requests after processing, at the latest after 180 days; requests that were never processed at the latest after 360 days. If you delete your account, we remove the name, e-mail address and text of your requests.

In detail, these periods apply; the values come from the software itself, which applies them daily.

7. Your rights

You have the right to access, rectification, erasure, restriction of processing, data portability and objection (Art. 15–21 GDPR) as well as the right to lodge a complaint with a supervisory authority. You can export your data yourself at any time in the application (CSV, PDF, ZIP); delete the company account under Settings → Data.

Right to object (Art. 21 GDPR): Where we process data on the basis of Art. 6(1)(f) GDPR – server logs, login log and login throttling, application log, contact enquiries without a contractual context, details of third parties in the free invoice generator – you may object at any time on grounds relating to your particular situation. We will then no longer process the data unless we can demonstrate compelling legitimate grounds which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims. Send your objection to the address given in section 1.

You can object to the use of your data for advertising and withdraw your consent at any time without giving reasons – via the link in every promotional email, in your profile or by sending us a message (Art. 21(2) and Art. 7(3) GDPR).

Obligation to provide data: You are neither legally nor contractually obliged to provide us with data. Without an e-mail address and password, however, we cannot run an account, without details of your company we cannot create documents, and without sender details we cannot answer an enquiry (Art. 13(2)(e) GDPR).

8. Security

Encrypted transmission (HTTPS), password hashing, optional two-factor sign-in, sign-in locks, Content Security Policy, separate storage per company, access logs and regular backups.

Version 13 · As of 21/10/2026 (draft)