Privacy Policy

1. Data Controller

The controller responsible for data processing on this website and in the ZUGFeRD-Bereit service is: Radom UG (haftungsbeschränkt) Telemannstr. 2 60323 Frankfurt am Main Germany Email: support@zugferd-bereit.de

For questions about data protection and to exercise your rights, contact us at this email address or via our contact form.

2. Hosting and Server Log Files

We host our website and the service with Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany. The servers are located in the data centre in Nuremberg, Germany. Hetzner processes the data on our behalf (Art. 28 GDPR).

When you visit our website, our web server (nginx) processes technically necessary access data such as your IP address, the time of access, the requested address and your browser identifier (server log files). We use the server log files for operation and to prevent abuse; they are rotated daily and deleted after 14 days.

If a page violates our Content Security Policy, your browser automatically sends a report to our server (/api/csp-report); we log only the affected directive and the host of the blocked resource, not the address of the page you visited; counting to prevent abuse happens in memory only and is discarded every hour (Art. 6(1)(f) GDPR).

The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest is the secure and stable operation of the service.

3. Strictly Necessary Cookies and Storage

For the functions you request, we use strictly necessary cookies and entries in your browser's storage:

• next-auth sign-in cookie (session token): set when you use the sign-in, keeps you signed in for up to 30 days after your last activity.
• next-auth security cookies (CSRF token and return address): session cookies set when you use the sign-in and deleted when you close the browser.
• Language cookie NEXT_LOCALE: a session cookie that stores the language in which you use the website.
• Your analytics choice in your browser's localStorage (zugferd_analytics_consent_v1), so the consent banner does not reappear on every visit. The entry remains until you change your choice or clear your browser storage.
• If you choose “Forgot password?” on the sign-in page: the email address you entered, in your browser's sessionStorage (zugferd-reset-email), so it is already filled in on the reset form. The entry is deleted once you submit the request, or at the latest when you close the tab.

These cookies and storage entries are strictly necessary to provide the service you have explicitly requested; they are not used for tracking. They require no consent (Section 25(2) No. 2 TDDDG). The legal basis for the subsequent processing is Art. 6(1)(b) GDPR or Art. 6(1)(f) GDPR (legitimate interest in a working website).

4. User Account

If you create an account, we process your name, your email address, your password and the status of your plan. We store the password only as a bcrypt hash, never in plain text.

Account data is kept in an SQLite database on our server at Hetzner. We back up the database daily and store a backup copy, transferred over an encrypted connection, on a second Hetzner server in Nuremberg. Both backups are kept for 14 days.

We store your account data for as long as your account exists. After the account is deleted, it remains in the backups for up to 14 days.

The legal basis is Art. 6(1)(b) GDPR (providing your account and the selected plan). Backups are made on the basis of Art. 6(1)(f) GDPR; our legitimate interest is protection against data loss.

5. Quotas and Abuse Prevention

If you use the service without an account, we derive an identifier from your IP address (for IPv6, from the /64 network) using a secret key and store the number of your conversions and file analyses in the current calendar month. We do not store the IP address itself. If you use an account, we link these counters to your account; usage within the free quota and within a paid plan is counted separately.

For sign-in and password reset requests, we count attempts in hashed form to prevent abuse.

We delete the counters 30 days after the last use.

The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is a fair distribution of the free quotas and the security of the service.

6. Processing of Invoice Data

When you use the generator, we process the source files you upload and the invoice data you enter in order to create e-invoices from them. Invoices may contain personal data, such as names, addresses and bank details of the invoice issuer and recipient.

For business use, you are the controller for the invoice data; we process it solely on your behalf and on your instructions (processing on behalf, see the next section).

Source files and generated results are stored under an identifier without your name or email address; the file contents remain unchanged. We keep them to answer queries and to correct processing errors within the scope of the order: for 7 days when used as a guest and for 90 days when used with an account. They are then deleted automatically. You can request earlier deletion at any time via support@zugferd-bereit.de.

The generated e-invoices and PDF/A files are validated locally on our own server; no data is transferred to third parties in the process.

If you use our free tool “E-invoice checker & viewer”, the uploaded file is processed on our own server only to check it and show the result and is discarded afterwards, i.e. neither retained nor passed to the AI extraction or to third parties; to prevent abuse we only count the number of checks, as described in the section “Quotas and Abuse Prevention”.

Where we exceptionally process invoice data as a controller (e.g. guest use by private individuals), the legal basis is Art. 6(1)(b) or (f) GDPR.

7. Processing on Behalf of Business Customers

For business use, our data processing agreement under Art. 28 GDPR (AVV) applies. It forms part of our terms and is concluded by accepting the terms: when signing up, or for existing accounts at their next use.

We use the following sub-processors:

• Hetzner Online GmbH (hosting, Germany)
• Microsoft Ireland Operations Ltd. (Azure OpenAI, region Sweden Central)
• Google Ireland Limited (Google Workspace; only if you send files or invoice data to support by email)

We use Google for our own email communication and, as listed above, for email to support; we use Stripe only for billing our plans.

8. AI-Assisted Invoice Extraction (Microsoft Azure OpenAI)

When you upload and convert a single file, the file name and file contents may be sent to the Microsoft Azure OpenAI Service of Microsoft Ireland Operations Ltd. to extract the invoice fields. This applies to PDF files and images, to CSV and Excel files where automatic column detection does not succeed, and to XML files that are not recognized as ZUGFeRD/Factur-X XML (CII), e.g. XRechnung in UBL format.

Processing takes place via an Azure OpenAI resource in the region Sweden Central (EU). Under its data protection terms, Microsoft acts as our processor or, for business use, as a sub-processor (Art. 28 GDPR). The transmitted contents are not used for training under Microsoft's contractual terms. Microsoft may store inputs and outputs for up to 30 days to detect abuse and, in suspected cases, have them reviewed by authorised employees.

Batch processing of CSV and Excel files does not use AI.

For business use, this processing takes place on your behalf; where we act as a controller, the legal basis is Art. 6(1)(b) GDPR.

9. Payment Processing (Stripe)

We bill paid plans through Stripe Payments Europe, Ltd., Dublin, Ireland. For the payment page we pass your email address and an internal identifier of your account to Stripe. You enter your payment details, your billing address and, if you provide it, your VAT ID on Stripe's payment page; Stripe uses the address and the VAT ID to calculate VAT (Stripe Tax). Stripe processes payment data under its own terms, partly as an independent controller and partly as a processor. Stripe may transfer data to Stripe, Inc. in the USA; this is based on the EU-US Data Privacy Framework or standard contractual clauses.

Stripe informs us of the status of your subscription, which we link to your account. If you open Stripe's customer portal via “Manage subscription”, we pass your Stripe customer ID to Stripe for that purpose; you manage payment methods, invoices and your subscription there, at Stripe.

The legal basis is Art. 6(1)(b) GDPR. We keep invoices and payment records for eight years, counted from the end of the calendar year in which they were created, under the statutory retention obligations (Section 147 AO and Section 257 HGB); the legal basis for this is Art. 6(1)(c) GDPR.

10. Contact Form, Support and Email (Google Workspace)

If you contact us via the contact form or by email, we process your details (name, email address, subject and message) to handle your request. Messages from the contact form are forwarded by email to our support mailbox.

For support and for transactional emails, such as password reset emails, we use Google Workspace from Google (contracting party based in Ireland). A transfer of personal data to Google LLC in the USA cannot be ruled out; it is based on the EU-US Data Privacy Framework or standard contractual clauses.

The legal basis is Art. 6(1)(b) GDPR where your request relates to your account, a contract or its preparation, and otherwise Art. 6(1)(f) GDPR; our legitimate interest is answering the requests sent to us. We delete requests once they have been fully handled, unless statutory retention obligations apply.

11. Analytics Only With Your Consent (Umami and PostHog)

We load analytics services only after you agree via our consent banner. They help us measure page views, product journeys and errors. We have configured the services so that URL parameters, filenames, email addresses and invoice content are not sent to them.

Umami is an analytics tool that works without cookies. We run Umami ourselves on our own server at Hetzner in Germany, at the address analytics.konverter-pro.de. Analytics data collected with Umami (page views, events and sessions) is automatically deleted 14 months after it was collected.

PostHog is a service of PostHog Inc. We use PostHog's EU cloud (eu.i.posthog.com). After your consent, we store a random identifier in your browser's sessionStorage (zb_ph_zugferd-bereit_sid) to group the events of a session; it is deleted when you close the tab. Where data is transferred to the USA, this is based on the EU-US Data Privacy Framework or on standard contractual clauses of the European Commission.

The legal basis is your consent under Art. 6(1)(a) GDPR and Section 25(1) TDDDG. You can withdraw your consent at any time with effect for the future via the “Privacy settings” button.

12. VAT ID Check (VIES)

If you use our tool for checking VAT identification numbers, we query the VAT ID you enter with the European Commission's VIES service to check its validity. Recipients are the European Commission (VIES) and the tax authority of the member state concerned.

The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is providing the check you requested.

13. Required Information

Your name, email address and password are required for registration, and all mandatory fields are required for the contact form; without this information we cannot create an account or handle your request. Otherwise, you are not obliged to provide any data.

14. Your Rights

Under the GDPR you have the following rights:

• Access to the data we process about you (Art. 15 GDPR)
• Rectification of inaccurate data (Art. 16 GDPR)
• Erasure of your data (Art. 17 GDPR)
• Restriction of processing (Art. 18 GDPR)
• Data portability (Art. 20 GDPR)
• Objection to processing (Art. 21 GDPR, details in the next section)

You can withdraw any consent you have given at any time with effect for the future (Art. 7(3) GDPR). To do so, contact support@zugferd-bereit.de or use our contact form.

16. Right to Lodge a Complaint With a Supervisory Authority

You have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), for example with the Hessian Commissioner for Data Protection and Freedom of Information, which is responsible for our registered office in Frankfurt am Main.

17. No Automated Decision-Making

We do not use automated decision-making, including profiling, within the meaning of Art. 22 GDPR.