Privacy policy

1. Controller

The controller responsible for data processing on this website within the meaning of the General Data Protection Regulation (GDPR, German: DSGVO) and the German Federal Data Protection Act (Bundesdatenschutzgesetz, BDSG) is:
OnlineBuilders LLC, Legalinc Corporate Services Inc., 131 Continental Dr, Suite 305, Newark, DE 19713, United States.
Contact: [email protected]. Further details: Legal notice (Impressum).

2. Data protection at a glance

Personal data is any data by which you can be personally identified. The following information provides an overview of the processing of personal data on this website and of your rights under the GDPR.

3. Hosting and content delivery networks (CDN)

This website is hosted by an external service provider (hoster). The personal data collected on this website is stored on the hoster’s servers.

Cloudflare

We use the service of Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA, to deliver our website faster and more securely. Cloudflare acts as a content delivery network (CDN) and as a security service. When you visit our website, your connection is routed via Cloudflare’s servers in order to deliver the content faster and to protect the site against malicious attacks. In the process, data such as your IP address, pages visited, date and time of the visit and technical information such as browser and operating system are processed. Cloudflare stores and processes this data in accordance with the requirements of the GDPR. Further information can be found in Cloudflare’s privacy policy: https://www.cloudflare.com/privacy/. Cloudflare is used on the basis of our legitimate interest in the secure and efficient provision of our web content pursuant to Art. 6(1)(f) GDPR.

Hetzner Online

The application runs on servers of Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, in data centres in Germany. Technical data such as IP address, time of access and requested URLs are processed in the process. A data processing agreement pursuant to Art. 28 GDPR (Auftragsverarbeitungsvertrag) has been concluded with Hetzner. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in secure and reliable operation). Further information: Hetzner’s privacy policy.

4. General information and legal bases

We treat your personal data confidentially and in accordance with the GDPR, the BDSG and this privacy policy. Processing is carried out in particular on the basis of: performance of a contract (Art. 6(1)(b) GDPR), consent (Art. 6(1)(a) GDPR), legitimate interest (Art. 6(1)(f) GDPR) or a legal obligation (Art. 6(1)(c) GDPR), as specified in the following sections.

Security of your data

We use technical and organisational measures to protect your data. Details and reporting of security vulnerabilities: Security policy.

5. Data collection on this website

Firebase and Google Cloud services

We use various services of Google Firebase and Google Cloud Platform to operate our application:

Firebase Authentication

We use Firebase Authentication for user management and authentication. Your email address and an encrypted password are stored in the process. The data is processed on the basis of your consent (Art. 6(1)(a) GDPR) and for the performance of our contract with you (Art. 6(1)(b) GDPR).

Firestore Database

We use Firestore as a database to store your receivables data, debtor information and other data required for using the application. This data is processed in EU data centres and is subject to the data protection standards of the GDPR. It is stored in encrypted form and with strict access controls.

File storage

We store uploaded and generated files (e.g. contracts, dunning letters, invoice PDFs, e-invoices, receipts and DATEV exports (export files for the German accounting software DATEV)) on our own servers of OnlineBuilders LLC (hosting in Germany), not with Google. The storage is not publicly accessible; files are only delivered after login and verification of authorisation via short-lived, signed links and are accessible only to you.

Firebase Analytics

This website uses Firebase Analytics, a web analytics service provided by Google. Firebase Analytics uses cookies that enable an analysis of your use of the website. The information generated is stored on servers in the EU or in countries with an adequate level of data protection. You can object to data collection by Firebase Analytics by adjusting the corresponding settings in your browser or by using add-ons such as “Privacy Badger”.

Firebase Performance Monitoring

We use Firebase Performance Monitoring to monitor and improve the performance and stability of our application. In the process, anonymised data on app usage and possible errors is collected. The data is processed on the basis of our legitimate interest in optimising our services (Art. 6(1)(f) GDPR).

Payment service providers

Stripe

We bill subscriptions via Stripe (Stripe Payments Europe, Limited, 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland). When you take out a subscription, your name, email address, billing address, payment method and amount are transmitted to Stripe. Stripe does not pass payment data such as card numbers on to us. Stripe may also transfer data to the USA; this is based on the EU-US Data Privacy Framework and standard contractual clauses. Legal basis: Art. 6(1)(b) GDPR (performance of a contract). Further information: Stripe’s privacy policy.

Email delivery (Mailgun)

We send system emails (e.g. confirmation of registration, password reset, weekly report) and payment reminders that you send to your debtors via DebtFlow through Mailgun (Mailgun Technologies, Inc., 112 E Pecan St. #1135, San Antonio, TX 78205, USA). The recipient address, subject and content of the email as well as technical delivery data (time, delivery status) are transmitted. Processing takes place in the USA on the basis of the EU-US Data Privacy Framework and standard contractual clauses; a data processing agreement has been concluded with Mailgun. Legal basis: Art. 6(1)(b) GDPR for emails to you; for emails to debtors, the creditor’s legitimate interest in enforcing its claim (Art. 6(1)(f) GDPR). Further information: Mailgun’s privacy policy.

Letters by post (Briefdiener and PixelLetter)

If you send a dunning letter (Mahnung) or another letter by post (manually or via the automatic dunning run), DebtFlow passes the letter to Briefdiener (briefdiener.de), a service of OnlineBuilders LLC. Briefdiener creates a PDF from it and commissions PixelLetter GmbH & Co. KG, Boschstraße 6, 82178 Puchheim, with printing, enveloping and posting with the postal service. Your sender details, the debtor’s name and address, subject and letter text (including the details of the claim) as well as the selected shipping method (e.g. registered mail (Einschreiben)) are transmitted. We receive the shipping and delivery status in return. The data is processed in Germany. Legal basis: Art. 6(1)(b) GDPR in relation to you; for the debtors’ data, the creditor’s legitimate interest in enforcing its claim (Art. 6(1)(f) GDPR).

External data sources and research tools

Residents’ registration office enquiries (Einwohnermeldeamtabfragen)

As part of our receivables management services, we offer the option of carrying out residents’ registration office enquiries via our application. These enquiries are carried out lawfully on the basis of a legitimate interest (Art. 6(1)(f) GDPR) in the enforcement of claims. To carry out these enquiries, we work with specialised service providers who have the corresponding legal authorisations. The enquiries are carried out exclusively in cases where there is a lawful interest in determining an address, for example where a claim is due and the debtor cannot be reached at the known address. If you use our application to carry out a residents’ registration office enquiry, the data required for this (such as the debtor’s name, last known address and, where applicable, date of birth) is transmitted to the relevant service provider. The results of the enquiry are stored in your DebtFlow database to help you with the further processing of the claim.

SocialChecker – social media research

Via its partner service providers, DebtFlow offers the option of searching for publicly accessible information on social media (“SocialChecker”). This function enables the automated searching of public profiles on social networks in order to find contact information or other relevant data that can help in enforcing legitimate claims. Only information that social media users have made publicly accessible is collected. The tool respects the privacy and usage terms of the respective social networks. The legal basis for this processing is Art. 6(1)(f) GDPR (legitimate interest). The information obtained via SocialChecker is used only for making contact in the context of receivables management and is stored in your DebtFlow database. You may use this information only within the limits permitted by law.

Credit reports (Bonitätsauskünfte) and Schufa

As part of receivables management, DebtFlow offers the option of obtaining credit reports on debtors. For this purpose, we work with various providers such as SCHUFA Holding AG and other credit reference agencies (Wirtschaftsauskunfteien). If you use this function, the required identification data of the debtor (name, address, where applicable date of birth) is transmitted to the relevant credit reference agency. The agency then transmits creditworthiness data, which is stored in your DebtFlow database. Credit reports are used exclusively within the legally permissible framework and only where there is a legitimate interest pursuant to Art. 6(1)(f) GDPR. Before any credit report is obtained, it is checked whether a legitimate interest exists and whether the enquiry is proportionate. Please note that, as a user of DebtFlow, you are responsible for the lawful use of credit reports and must ensure that a legitimate interest exists for each enquiry.

Artificial intelligence services

Google Gemini AI

Our DebtFlow application uses Google Gemini (formerly Google Bard/PaLM), an AI technology for the automatic generation of recommendations and the analysis of receivables data. If you use the “GläubigerKI” function (creditor AI), your receivables data is transmitted to Google Cloud for processing. Google processes this data in accordance with the requirements of the GDPR and stores it only temporarily for processing purposes. This data is not used to train the AI models, but exclusively to answer your specific requests.

Other AI services

For specific functions of our application, we may also use other AI services, for example for text analysis, the automatic categorisation of documents or the extraction of data from scanned documents. All of these services process your data only for the purpose for which you use them and are subject to strict data protection and security measures. Processing is based on our legitimate interest in providing advanced functions (Art. 6(1)(f) GDPR) and on the performance of our contract with you (Art. 6(1)(b) GDPR).

Data security in AI processing

We have concluded data processing agreements (Auftragsverarbeitungsverträge, AVV) with all providers of AI services, which ensure the GDPR-compliant processing of your data. Data is transmitted in encrypted form, and the providers are contractually obliged to take appropriate technical and organisational measures to protect your data.

Your right to object

You have the right at any time to object to the use of AI services for the processing of your data. In this case, we will deactivate the corresponding functions for your account. Please contact us using the contact details given in the legal notice if you wish to exercise this right.

Cookies

Our website uses cookies. These are small text files that your web browser stores on your device. Cookies help us to make our offering more user-friendly, effective and secure. We use both session cookies, which are automatically deleted at the end of your browser session, and persistent cookies, which are deleted after a predefined period. You can set your browser so that you are informed about the setting of cookies and allow cookies only in individual cases, exclude the acceptance of cookies for certain cases or in general, and activate the automatic deletion of cookies when closing the browser.

Cloudflare Turnstile

On the login, registration and password reset pages, we use Cloudflare Turnstile, a service of Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA. Turnstile protects these forms against automated access (bots), spam and abuse without you having to solve picture puzzles.

To do this, Turnstile checks your browser in the background. In particular, your IP address and browser and device characteristics (e.g. browser type, operating system, language setting and technical signals from the browser) are processed in order to distinguish humans from bots. During registration, we additionally verify the result on our server with Cloudflare, transmitting your IP address in the process.

The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest is to protect our platform and our users’ accounts against abusive automated access. Cloudflare is certified under the EU-US Data Privacy Framework; the transfer to the USA is based on the adequacy decision of the European Commission.

Further information can be found in Cloudflare’s privacy policy for Turnstile: https://www.cloudflare.com/turnstile-privacy-policy/

6. Analytics tools and advertising

Matomo (audience measurement without cookies)

We measure the use of this website with Matomo, which we operate ourselves on our own servers of OnlineBuilders LLC(track.onlinebuilders.biz, hosting in Germany). Matomo does not set cookies and does not store anything on your device. The following are processed: pages accessed (without URL parameters), time, length of visit, referring page, browser, operating system, screen resolution and an IP address shortened by two bytes. Data is not passed on to third parties. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in designing our offering in line with demand) and § 25(2) no. 2 TDDDG (German Telecommunications Digital Services Data Protection Act), as your terminal equipment is not accessed.

GlitchTip (error reports)

If a technical error occurs on the website or in the application, an error report is transmitted to our self-hosted GlitchTip (log.onlinebuilders.biz, hosting in Germany): error message, affected code location, page accessed without URL parameters, browser and operating system and, where applicable, your internal user ID. Form contents, receivables and debtor data, cookies and IP addresses are not transmitted. The reports are deleted after 90 days. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in error-free and secure operation).

Firebase Analytics and Performance Monitoring

In addition to the use of Firebase Analytics described above, we use Performance Monitoring to monitor the performance of our application. In the process, anonymised usage data is collected that helps us to identify errors and improve usability. The legal basis for this is our legitimate interest in optimising our services pursuant to Art. 6(1)(f) GDPR.

7. Plugins and tools

We use various tools and services for the functionality of our platform. All services used process data exclusively within the EU or in countries with an adequate level of data protection.

Google Fonts

We use Google Fonts for the uniform display of fonts. These are loaded directly into your browser when you access our website. In the process, data such as your IP address is transmitted to Google. They are used on the basis of our legitimate interest in a uniform and appealing presentation of our online offering (Art. 6(1)(f) GDPR).

Tailwind CSS

We use the CSS framework Tailwind for the design of our website. It is integrated locally on our server and no data is transmitted to third parties.

8. Data transfer when using GläubigerKI

When you use our GläubigerKI function (creditor AI), the following data is transmitted to Google Cloud for processing by the Gemini AI:

• Amount of the claim
• Due date
• Description of the claim
• Status of the claim (paid/unpaid)
• Phase in receivables management
• Dunning level (Mahnstufe)
• Information on whether an enforceable title (Titel) has been obtained for the claim
• Information on whether the claim is pending before a court

No sensitive personal data such as full names, addresses, contact details or bank details are transmitted to the AI services. Only a pseudonymised identifier is used to identify the debtor.

The AI’s responses are stored in our Firebase database in order to provide you with a history of the recommendations. You can view and delete these recommendations at any time in your account.

9. Your rights (rights of the data subject)

You have the following rights vis-à-vis us with regard to the personal data concerning you. You can exercise them using the contact details given in the legal notice.

• Right of access (Art. 15 GDPR): right to obtain, free of charge, information about your stored data, its origin, its recipients and the purpose and duration of the processing.
• Right to rectification (Art. 16 GDPR): right to have inaccurate data rectified without undue delay.
• Right to erasure (Art. 17 GDPR): right to erasure, unless the processing is necessary for compliance with a legal obligation or for the establishment of legal claims.
• Right to restriction of processing (Art. 18 GDPR): right to restriction under the statutory conditions.
• Right to data portability (Art. 20 GDPR): right to receive your data in a commonly used, machine-readable format or to have it transmitted to another controller.
• Right to object (Art. 21 GDPR): you have the right to object, on grounds relating to your particular situation, to the processing (in particular processing based on Art. 6(1)(f) GDPR).
• Withdrawal of consent (Art. 7(3) GDPR): you may withdraw any consent you have given at any time; the lawfulness of processing carried out before the withdrawal remains unaffected.
• Right to lodge a complaint with a supervisory authority (Art. 77 GDPR): you have the right to lodge a complaint with a data protection supervisory authority (e.g. in the Member State of your habitual residence) if you consider that the processing of your data infringes the GDPR.

Storage period

Personal data is stored only for as long as the purpose of the processing requires or statutory retention periods apply. After termination of the contract, your data is generally deleted after expiry of the statutory periods or after a 30-day retention period (export option), unless longer storage is required by law.