Privacy Policy

§ 1 Controller

The controller for the processing of personal data in connection with the KlaroFin application is:

Kay Maik Fotografie Kay Maikowske Tönisberger Str. 33 47509 Rheurdt, Germany Phone: +49 176 42939687 E-mail: info@kaymaikfotografie.de

A data protection officer is not required by law.

§ 2 General information & legal bases

KlaroFin is a web-based finance and accounting application (invoices, offers, dunning, expenses, household budgeting, taxes, among others). We process your personal data solely to provide these functions.

Legal bases are the performance of the user contract (Art. 6(1)(b) GDPR), compliance with legal obligations (lit. c, e.g. tax retention), your consent (lit. a, e.g. for optional integrations) and our legitimate interests in secure, reliable operation and abuse prevention (lit. f).

§ 3 Your rights

As a data subject you have the following rights:

• Access to the data stored about you (Art. 15 GDPR)
• Rectification of inaccurate data (Art. 16 GDPR)
• Erasure (Art. 17 GDPR), unless retention obligations apply
• Restriction of processing (Art. 18 GDPR)
• Data portability in a common, machine-readable format (Art. 20 GDPR)
• Objection to processing based on legitimate interests (Art. 21 GDPR)
• Withdrawal of consent with effect for the future (Art. 7(3) GDPR)

§ 4 Hosting & infrastructure (processors)

To provide KlaroFin we use the following service providers as processors (Art. 28 GDPR):

• Supabase, Inc. — database, authentication and server functions. Data location: EU (West EU region, Ireland).
• Cloudflare, Inc. — storage of uploaded files (company logos, receipts, documents) via Cloudflare R2; data localization EU.
• Google Ireland Ltd. / Google LLC (Firebase Hosting) — delivery of the application; technical access data is generated (see § 5).

§ 5 Server log files

When the application is accessed, technical access data transmitted by your browser is automatically collected (server log files). The purpose of this processing is the technically secure and stable operation of the application as well as the detection and prevention of misuse and attacks; the legal basis is our legitimate interest therein (Art. 6(1)(f) GDPR). The application is delivered via Firebase Hosting (Google Ireland Ltd. / Google LLC), during which this access data is generated. The log data is deleted as soon as it is no longer required for the stated purposes, at the latest after 30 days. In detail, the following is processed:

• IP address
• Browser type and version
• Operating system used
• Referrer URL
• Date and time of access

§ 6 Registration & user account

To use the service you create an account. We process your e-mail address, your password (encrypted only) and optionally company name, address, VAT ID, tax number and bank details. Legal basis: Art. 6(1)(b) GDPR.

To prevent repeated abuse of the free trial, we additionally store a cryptographic hash (SHA-256) of your e-mail address (Art. 6(1)(f) GDPR). Deviating from the general deletion period (§ 15), this hash is stored for up to 24 months for abuse prevention and then automatically deleted, provided it can no longer be assigned to an existing account.

§ 6a Protection against automated access (Cloudflare Turnstile)

The sign-in, registration and password reset forms use Cloudflare Turnstile to check whether a human is operating them. This prevents automated scripts from creating accounts in bulk, testing stolen passwords, or flooding other people’s email addresses with reset messages. The check usually runs unnoticed; an additional task only appears if the behaviour looks suspicious.

The provider is Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA. From Cloudflare we receive only the result of the check – passed or not passed. We do not receive the data that was evaluated to reach it.

The legal basis is our legitimate interest in the security of our systems and in preventing abuse (Art. 6(1)(f) GDPR). Without a successful check, signing in, registering and resetting a password cannot be completed.

Cloudflare is based in the USA, so processing outside the EU is possible. Section 13 of this policy applies to the legal basis for that transfer. Which data Cloudflare processes in detail, and for how long it is stored, is set out in Cloudflare’s privacy policy at https://www.cloudflare.com/privacypolicy/.

When you open one of these forms, a script is loaded from Cloudflare. Your browser transmits the following to Cloudflare in particular:

• IP address
• browser type and version, operating system and language setting
• interaction patterns on the page (e.g. mouse, keyboard and touch events)
• technically necessary cookies or values in your browser’s local storage

§ 7 Your content data in the application

In KlaroFin you process your own business data, which may include personal data of third parties (e.g. your customers). In particular, the following are processed:

• Company data (company name, address, tax number, VAT ID)
• Customer/contact data (name, address, VAT ID, contact details)
• Invoice, offer and dunning data
• Expenses, income and uploaded receipts/documents

§ 7a Feedback and roadmap board

You may optionally use our feedback/roadmap board (feature requests, bug reports, comments, votes). Posts, comments and attachments you create there are visible to all signed-in users. Please do not enter any confidential information or personal data of third parties there. The legal basis is our legitimate interest in improving the service (Art. 6(1)(f) GDPR); contributions are deleted as soon as they are no longer required for this purpose or when you delete your account.

§ 8 AI-assisted data recognition (optional)

If you use optional AI features, we transmit the respective input to Google Cloud Vertex AI (Gemini model), provided by Google Ireland Ltd. / Google LLC, for automatic extraction. Processing takes place exclusively within the European Union (Google Cloud EU multi-region). The data is used only for extraction or structuring. Legal basis: Art. 6(1)(b) and (f) GDPR.

This concerns in particular: "analyze/scan receipt" (contents of the uploaded receipt, e.g. merchant name, amounts, addresses, VAT ID), contact recognition (entered or scanned contact data such as name, address, contact details, possibly VAT ID) and appointment/calendar parsing (appointment text and any names contained therein).

§ 9 Payment processing

Paid subscriptions are processed via Stripe Payments Europe, Ltd. (Ireland). We process your e-mail address, a customer identifier and the payment status. Payment data (e.g. card number) is entered directly with Stripe; we do not receive it.

More information: https://stripe.com/privacy

§ 10 Google Calendar & Google sign-in (optional)

If calendar synchronization or "sign in with Google" is enabled, we process data from your Google account (e.g. appointments, attendee e-mail addresses, profile and login data) via Google services. The legal basis is your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time by disconnecting.

The access tokens stored for this purpose are kept protected and are not accessible to the application itself in plain text.

§ 11 Stock and market data (portfolio tool, optional)

In the optional portfolio tool we retrieve price data via Finnhub or Yahoo Finance (providers based in the USA). The retrieval is performed server-side; neither personal data nor your IP address is transmitted, only security identifiers (e.g. ISIN/ticker).

§ 11a Notifications & push messages

KlaroFin displays notices about due invoices, appointments and system events within the application. In addition, you can enable push messages. For this purpose your browser generates a device-specific push address; we store this address together with the associated encryption keys and the browser identifier in order to be able to deliver messages to you.

For technical reasons, delivery runs via the push service of your browser or device manufacturer — Google for Chrome and Android, Mozilla for Firefox, Apple for Safari and iOS. These services may also process outside the EU. The content of the message is encrypted and cannot be read by the push service; it only knows that delivery to a particular device is intended.

The legal basis is your consent (Art. 6(1)(a) GDPR). You can withdraw it at any time with effect for the future by disabling push notifications in the settings or revoking the permission in your browser. The stored push address is then deleted.

§ 12 Cookies & local storage

We do not use tracking or analytics tools (e.g. Google Analytics, Meta Pixel). Fonts are served from our own server; they are not loaded from a third-party provider.

We use only technically necessary cookies and local storage techniques. No consent is required for this (Sec. 25(2) no. 2 TDDDG); the legal basis for the associated processing is Art. 6(1)(b) and (f) GDPR. In detail, these are:

• Login and session management: after you sign in, our authentication service stores your session data so that you remain logged in. Without this storage the protected area cannot be used.
• Language setting: if you actively switch the language, we remember your choice locally in your browser. Nothing is stored unless you switch.
• Appearance mode: your choice between light and dark appearance is stored locally in your browser.
• Offline function (Progressive Web App / Service Worker): within the signed-in area, your browser stores parts of the application in a local cache so that KlaroFin works as an installable app and without a continuous connection. No such cache is created on the publicly accessible pages.
• Form abuse protection: on the sign-in, registration and password pages, Cloudflare Turnstile is loaded, which evaluates technical details of your device for bot detection (see § 6a). This serves the security of the sign-in process.

§ 13 Transfer to third countries

Your account, content and receipt data is stored within the EU. With the optional Google services (calendar synchronization, sign in with Google) and the delivery via Firebase Hosting, processing may also take place in the USA. The same applies to the spam and abuse protection of the sign-in, registration and password forms via Cloudflare Turnstile (Section 6a). In the optional portfolio tool, price data is retrieved from Finnhub/Yahoo Finance (USA); only security identifiers and no personal data are transmitted (see § 11).

Where no adequacy decision applies, the transfer is based on the EU Standard Contractual Clauses or a certification under the EU-US Data Privacy Framework. Access by US authorities cannot be ruled out.

§ 14 Order processing

Insofar as you process personal data of third parties in KlaroFin (see § 7), you are the controller and we act on your behalf. We provide you with a data processing agreement (DPA) pursuant to Art. 28 GDPR, which becomes part of the terms of use upon conclusion of the contract and governs, among other things, the sub-processors used and the technical and organizational measures.

§ 15 Storage duration & deletion

We store your data for as long as your account exists. Termination ends the billing, not the storage: your account and data remain until you trigger the deletion. You can delete your account yourself at any time in the settings; alternatively, an informal message to the address named in § 1 is sufficient — we will then delete within 30 days.

The deletion is complete: finalized invoices, receipts and uploaded documents are removed as well. Please note that the statutory retention obligations (Sec. 147 AO, Sec. 14b UStG — generally 10 years) apply to you as an entrepreneur, not to us; we do not retain anything on your behalf after deletion. Therefore, export your tax-relevant data before deletion using the export function in the settings.

Independently of account deletion, we delete automatically: account activity log data after 180 days, payment provider events after 90 days, read notifications after 90 days, server log files after 30 days, and the e-mail hash for abuse prevention after 24 months (§ 6).

§ 16 Data security

Your data is transmitted encrypted via TLS/HTTPS. Access to your data is secured by tenant-separated access rules at the database level (Row Level Security); sensitive access tokens are stored protected.

§ 17 Minors

The offer is aimed exclusively at entrepreneurs within the meaning of § 14 BGB. Persons under 18 may not use the service.

§ 18 Changes to this privacy policy

We adapt this privacy policy if the legal situation or our processing activities change. The version published on this page applies.

§ 19 Right to lodge a complaint

You have the right to lodge a complaint with a data protection supervisory authority. The competent authority is:

Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen Kavalleriestraße 2-4 40213 Düsseldorf, Germany