How we handle personal data. The legal texts are being finalized with counsel; this page describes the technical practice.
Connecting software is a technical authorization. Choosing data categories is permission to process them. Approving a licence is permission to commercialize. Any personal data additionally needs its own lawful basis. We record each of these separately and keep a versioned history.
Fields such as names, contact details, addresses, identifiers, bank and card data are removed before storage by a configurable field list. Detected identifiers in free text are masked; secrets are removed; health and other special-category data are held for human review.
Data partners can download all data we hold about their company, pause or revoke connections, and request deletion of data not used in a licence. Data-subject requests (access, rectification, erasure, objection) are tracked with a 30-day deadline. Contact privacy@ our domain.
We use hosting, database, email and banking providers under data processing terms. Our primary database is hosted in the EU (Frankfurt). A current list of subprocessors is available on request.
Supplier records are not sent to third-party AI models for cleaning or classification. Detection is deterministic and runs on our own infrastructure.