Privacy Policy

Where your data lives

Germany

Finland · EU

Slovenia · EU

Netherlands · EU

Germany · EU

Netherlands · EU

Happy Coffee GmbH, Theodor-Heuss-Str. 15, 53562 St. Katharinen, Germany Email: support@rechnungskit.de

Former waitlist (until 3 September 2026): email address, company name and the details about your setup that you enter in the form, plus the time and proof of your consent (double opt-in, IP address, timestamp). When you use the service, additionally: master data (name, company, contact details), contract and billing data, invoice and transaction data from connected sources (e.g. Stripe, Mollie, shop systems) and technical usage data (log files).

The former waitlist and the one-off message at launch are based on your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time with effect for the future. We process data from your use of the service to perform the contract (Art. 6(1)(b) GDPR), to meet statutory retention obligations, in particular under tax and commercial law (Art. 6(1)(c) GDPR), and on the basis of our legitimate interests in the security and further development of the service (Art. 6(1)(f) GDPR). If you do not confirm your email address within 3 days of signing up, we delete your account with its signup data automatically; you can sign up again at any time afterwards. When you sign up, request the demo or write to us through Kit, we also store which page of our website you came from, which external website referred you and, if the clicked link contained them, campaign details (utm parameters, for example from a newsletter or an ad). We store nothing on your device for this; the details are only passed along in the request or the clicked link. We use them to understand which content and channels lead to requests and customers (Art. 6(1)(f) GDPR). If you open the demo account through the link in the email, we also store when you opened it, how many pages and which areas you looked at, and for how long. That shows us what interests you, so we can tailor our reply to you (Art. 6(1)(f) GDPR).

Where we process invoice and order data on behalf of our customers, we do so under a data processing agreement pursuant to Art. 28 GDPR. Hosting is provided by Hetzner Online GmbH in the Falkenstein data center (Germany); client-side encrypted backups are stored with Hetzner in Helsinki (Finland), and only encrypted data ever reaches that location. BUNNYWAY d.o.o. (Slovenia) sits in front as the security and delivery layer. For sending emails (including confirmation and transactional emails) we use Brevo GmbH, which processes the recipient address and the message content. For Rechnungskit's system emails to you, such as confirming your email address or task reminders, Brevo tells us whether the email was delivered, opened or a link in it was clicked. We use this to spot delivery problems and to help you when a confirmation does not arrive (Art. 6(1)(f) GDPR). We store clicked links without the access codes they contain. To collect our own fees by SEPA direct debit we use Mollie B.V. (Amsterdam, Netherlands) as our payment service provider; Mollie processes the payment data in this respect as an independent controller, and Mollie's privacy notice also applies. All of the locations above are in the EU; we do not transfer data to third countries.

As a processor we handle order, invoice and payment data of our customers' end customers (e.g. name, address, email address, purchased items, amounts, payment status). The controller within the meaning of the GDPR is the respective merchant; the information duties under Art. 13, 14 GDPR toward end customers rest with the merchant. If you bought from one of our customers, please direct requests about your data to that shop. We do not process full payment instruments (e.g. card data). Our customers can connect their own accounts with payment services and shop systems, in particular: Mollie B.V. (Netherlands), Stripe Payments Europe Ltd. (Ireland), PayPal (Europe) S.à r.l. et Cie, S.C.A. (Luxembourg), Unzer E-Com GmbH (Germany), Klarna Bank AB (Sweden), GoCardless SAS (France), Shopify International Ltd. (Ireland), as well as Shopware and WooCommerce (which run on the merchant's own infrastructure or hosting). These services are contracted by the merchant, not by us: payment service providers process payment data as independent controllers, shop systems act as the merchant's processors depending on setup. They are not subprocessors of Rechnungskit. We retrieve data there exclusively on the merchant's documented instruction; with Rechnungskit Checkout we additionally transmit the order data required for payment to the merchant's chosen payment service. Our API calls are directed at the providers' European establishments. Any onward transfer to third countries by the providers themselves (for instance to group companies in the US, based on standard contractual clauses, binding corporate rules or the EU-US Data Privacy Framework) is governed by their own privacy policies.

To improve our offering and measure the reach of our website, we use the open-source software Umami, which we run on our own servers in the EU. Umami works entirely without cookies and without fingerprinting. No personal data is collected; in particular, IP addresses are not stored but only used in anonymized form to generate anonymous statistics that cannot be traced back to an individual. The data is not combined with other data sources or passed on to third parties. In the application (app.rechnungskit.de) we use Umami to count which pages are viewed, how often the chat with Kit is opened and a question is asked, and whether the question came from a suggestion. Before a measurement leaves your browser, we replace identifiers in the address, such as invoice and order numbers or email addresses, with a placeholder. Query parameters and page titles are not sent, and neither are the content of your messages or account data. The legal basis is our legitimate interest in a statistical evaluation of anonymized usage behavior to optimize our offering (Art. 6(1)(f) GDPR). Since no cookies are set and no personal data is processed, consent is not required. You can still object to the anonymous measurement at any time: on the website, the "Web analytics" entry in the footer opens a window where you can turn the measurement off with a toggle. In the application, the same toggle is under Settings → Account. The setting is stored only locally in your browser.

On our website and in the application we offer an AI assistant, "Kit", that answers questions about the product and guides you through setup. Answers are generated automatically by AI and are clearly labeled as such (Art. 50 AI Act); they are not tax advice. To generate answers, we transmit the content of your chat messages and the knowledge base needed to answer them to our processor, Nebius B.V. (Nebius Token Factory), Schiphol Boulevard 165, 1118 BG Schiphol, Netherlands. Processing takes place under a data processing agreement pursuant to Art. 28 GDPR. The language models we use run in data centers within the EU (Finland and France). When you use Kit in the application, Kit also retrieves information from your account to answer your question and transmits it to Nebius: the name of the company and of the active project, your role, whether test mode is active, and the number and type of open items (for example open tasks, missing details or orders awaiting shipment) and, when you ask for them, aggregated key figures of your project such as revenue, number of customers, subscription figures, incoming payments or fees, also split by VAT rate, country, sales channel or product (with product names). Names, email addresses and addresses of your customers and individual invoices are not included. Kit only has read access, and every access is logged. Please do not enter anything in the chat that you do not want processed, in particular no special categories of personal data. Nebius uses the transmitted content solely to provide inference and not to train its own AI models. In the configuration we use, inputs and outputs are not stored permanently (Zero Data Retention). The legal basis for using the assistant on the website is our legitimate interest in answering inquiries better (Art. 6(1)(f) GDPR); within the application, processing serves the performance of the user agreement (Art. 6(1)(b) GDPR). You are not obliged to use the assistant; you can always contact us directly through the contact form instead. With "Talk to a human" in the chat on our website you can send us a question directly. To answer you by email, we process your email address, your message, the page on which you opened the chat and your conversation with Kit so far. We store the request in our internal contact management so that we can handle and follow up on it. The legal basis is answering your request (Art. 6(1)(b) GDPR) and our legitimate interest in handling requests in an orderly way (Art. 6(1)(f) GDPR). We do not use it to send you advertising.

We store data from the former waitlist until 30 November 2026 at the latest, or until you withdraw your consent, and delete it afterwards, including in our customer management system. We store invoice and accounting data for the statutory retention periods (8 years for accounting records, § 147 AO, § 257 HGB as amended by the Fourth Bureaucracy Relief Act, Bürokratieentlastungsgesetz IV). Other data is deleted as soon as the purpose of processing no longer applies. Backups follow a tiered rotation (daily, weekly, monthly, yearly) and are overwritten after three years at the latest; deleted data may persist in backups until this rotation runs out, but is no longer actively processed there.

You have the right of access, rectification, erasure, restriction of processing, data portability and objection (Art. 15 to 21 GDPR), and the right to withdraw consent you have given at any time with effect for the future. You also have the right to lodge a complaint with a data protection supervisory authority, in particular the one responsible for us, the State Commissioner for Data Protection and Freedom of Information of Rhineland-Palatinate (Landesbeauftragter für den Datenschutz und die Informationsfreiheit Rheinland-Pfalz).

Our website and the application set only the technically necessary cookies listed below. We set no marketing or statistics cookies and do not embed any third-party services that set cookies. Reach measurement with Umami (section "Web analytics with Umami") works without cookies and without identifiers on your device. We also record referral and campaign details and the use of the demo account (section "Purposes and legal bases") without cookies. A consent banner is therefore not required.

The legal basis for storing and accessing this technically necessary information is § 25(2) no. 2 TDDDG; the associated processing of personal data is based on our legitimate interest in secure and functioning operation (Art. 6(1)(f) GDPR) or on the performance of the contract (Art. 6(1)(b) GDPR).