Privacy policy

2. Our two roles

• As controller we process the data of your user account, your personal days abroad, the website’s data, the data for billing the subscription and the data we need to keep the service secure. This policy covers that processing.
• As processor we process the bookkeeping data a business records in SelbstFinanz – including the data of its clients and suppliers and of people named in receipts or emails. The business is the controller of that data; we process it only on its instructions under the data processing agreement. Please contact the business about that data; we support it.

3. What data we process

• Account: email address, password (stored only as a hash), a two-factor authentication factor if you set one up, language and preferences, your memberships and roles in businesses, and records of the legal texts you accepted (version and time). If an admin invites you to a business, we receive your email address from them.
• Business data (as processor): the business’s name, address, VAT ID, bank details, contact details and logo; invoices, credit notes, payments, expenses, trips (with the traveller), mileage and VAT figures; receipts and documents; data of the business’s clients and suppliers.
• Personal days abroad (as controller): if you use “My days abroad”, we process your home country; the countries whose day limits you track, with the chosen rule set and your “non-resident since” date there; your alert threshold; the stays you record yourself (country, dates – planned ones too – and a note); and the alerts we sent you about them. From the trips of the businesses you belong to on which you are entered as the traveller, we show you there only the country, the dates and the business’s name. When such a membership ends – because you leave, are removed, or the business is closed or deleted – we keep these three details as a copy in your days abroad, even if you have not used “My days abroad” until then; deleting your own account makes no copy. We never record your device’s location and never import a location history. Your days abroad are not shown to the businesses you belong to, their members, admins or tax advisers – not during support access either, and not in our administration console.
• Mailbox import (optional): if a business connects a mailbox, we store the app password encrypted and read newly received emails every 10 minutes (sender, subject, content, attachments) to import receipts. The business chooses the mailbox and its provider.
• Usage: the business’s activity log (who made which change when) and the number of uses of individual features per business and person (such as AI receipt scans or sent emails) for the fair-use limits.
• Technical data: IP address, browser and device information, requested addresses and times in the server logs; delivery events of sent emails (delivered, bounced, spam report) with the recipient address.
• Push notifications (iOS, optional): if you allow notifications in the iOS app, we store the device identifier (push token) with your account.
• Billing: for a business’s subscription, its name, billing email address and address, VAT ID, language, subscription status, invoices and payments. You enter card details only on Stripe’s pages; we never receive them.
• Contact: the content and sender of messages you send us.
• Face ID and Touch ID: the optional app lock of the iOS app runs entirely on your device; we receive no biometric data.

4. Purposes and legal bases

• Providing SelbstFinanz, your account and the subscription: performance of a contract (Art. 6(1)(b) GDPR).
• Processing the business data: on behalf of and on the instructions of the business (Art. 28 GDPR); the business, as controller, determines the legal basis.
• Keeping our billing records: legal obligation (Art. 6(1)(c) GDPR, § 132 BAO).
• Security of the service, protection against abuse and automated access, fair-use limits, error analysis and server logs: our legitimate interest in a secure and economically viable service (Art. 6(1)(f) GDPR).
• Emails about your account, the subscription, new versions of the legal texts and retention: performance of a contract and legal obligations.
• Personal days abroad: we count your days per country under the rule set you choose, show how they compare with its day limits, alert you before a limit is reached and keep the copy of your travel days when a membership ends – for your own purposes, not for a business: performance of a contract (Art. 6(1)(b) GDPR).
• Push notifications: you switch them on in the iOS app yourself and can switch them off at any time in the device settings.

We do not use your data for advertising, do not sell it and do not build profiles for advertising or analytics. There is no automated decision-making within the meaning of Art. 22 GDPR; results of the AI receipt recognition are suggestions you check, and your days abroad show day counts and presumptions under the chosen rules – not a decision on your tax residency and not tax advice.

5. Recipients

• Supabase (Supabase, Inc.): database, sign-in and file storage. As long as our own sending for them is not active, Supabase also sends the sign-in emails (invitations, password resets). Stored in Frankfurt am Main; downloaded files are cached for up to 1 hour at nodes of the content delivery network (Cloudflare) near the person downloading them.
• Vercel (Vercel Inc.): runs the web app and the website. The server functions run in Frankfurt am Main; requests reach them through Vercel’s global network, which also keeps the server logs.
• Anthropic (Anthropic PBC): AI reading of receipts, invoices, mileage logs and mailbox attachments, and the answers of “Ask your books” (your question and the figures computed for it, including client names and open amounts). Processing in the USA.
• Twilio SendGrid (Twilio Inc.): sending emails – invoices, payment reminders and recurring invoices businesses send through SelbstFinanz (with the PDF), invitations, notices and alerts about your days abroad (with the country, the rule and the days left) – and the delivery events. Processing in the USA. Open and click tracking are switched off.
• Google Maps Platform (Google Ireland Limited): address suggestions and driving distances in the mileage log. Our server sends the address text you type and the places you choose, not your IP address. Google’s global infrastructure.
• Google Firebase Cloud Messaging (Google Ireland Limited) and Apple Push Notification service (Apple Inc.): delivering push notifications to the iOS app, such as “Invoice paid – Muster GmbH: Invoice 2026-014 is now fully paid.” The notification text with the business’s name and the invoice number, and the device identifier, pass through Google and Apple for this. The app registers the device with Firebase only once you allow notifications. Alerts about your days abroad name neither a country nor a day count in the notification text.
• Stripe (Stripe Payments Europe, Limited, Ireland): payment processing for the subscription, in the web app only – business name, billing email address and address, VAT ID, language, invoices; on Stripe’s pages also card data and device information for fraud prevention. Stripe also processes data in the USA.
• Cloudflare Turnstile (Cloudflare, Inc.): protection against automated access at sign-in, password reset, registration, the beta request, accepting an invitation, and when you re-enter your password before sensitive actions (deleting the account, closing a business, support functions). On these pages your browser loads a script from Cloudflare that evaluates your IP address and browser and device signals; at registration, the beta request and invitations our server also sends your IP address to Cloudflare for the check. The other pages of the website do not load Turnstile.
• Frankfurter (a public service for the European Central Bank’s reference rates): receives only a currency code and a date, no personal data.
• Providers the business chooses: if a business stores its own email provider (SendGrid or Resend) or connects a mailbox, those providers receive the data as the business chooses, under the business’s own contract.
• Our support accesses a business’s data only with an admin’s consent or in a security incident or under a legal obligation – read-only unless the admin explicitly allows read-write, time-limited and under the staff member’s own identity with two-factor authentication. Every access is logged and visible to the business’s admins. Your personal days abroad are never part of it.
• Authorities and courts receive data only where we are legally obliged to disclose it.

The list of sub-processors with purpose, data categories and place of processing is at Sub-processors.

6. Location and transfers to third countries

Your data is stored and processed in Frankfurt am Main (EU). For AI receipt recognition and some other features we use providers outside the EU, mainly in the USA: Anthropic (AI receipt recognition, “Ask your books”), SendGrid (email delivery), Google (address suggestions, push notifications), Apple (push notifications) and Cloudflare (protection of sign-in). Supabase and Vercel are companies based in the USA; their global networks route requests and briefly cache downloaded files.

Transfers to the USA rely on the European Commission’s adequacy decision on the EU-U.S. Data Privacy Framework (Art. 45 GDPR) where the recipient is listed under it, and otherwise on Standard Contractual Clauses (Art. 46(2)(c) GDPR).

7. Retention

• Business data: while the subscription runs; afterwards read-only for the statutory retention of seven years from the end of the calendar year of the latest bookkeeping entry (§ 132 BAO), then deleted after two advance notices. Automatic deletion after the retention period is not switched on yet; until it is, such businesses stay stored read-only.
• Closing a business on request: deletion no earlier than 30 days after the request.
• User account: until you delete it – in the web app or the iOS app under “My account”. Your name and email address as recorded in a business’s records (log entries, issued documents) remain part of those records.
• Personal days abroad: your stays and tracked countries until you delete them or your account; the record of the alerts we sent you, your home country and your alert threshold until your account is deleted or you ask us to delete them. Stays from a business’s trips are shown while you are a member and the business keeps the trip; the copy made when a membership ends stays after the business is closed or deleted, until you delete it.
• Push device identifiers: until Firebase reports them as invalid, you sign out on that device or your account is deleted.
• Export archives: 7 days after they are made available.
• Database backups: deleted data remains in encrypted backups for at most 8 days.
• Our billing records: seven years (§ 132 BAO).
• Server logs and copies at providers (such as the delivery logs of the email service): under each provider’s retention periods.

8. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20), and the right to object to processing based on legitimate interests (Art. 21). You may withdraw consent at any time with effect for the future. Write to us at privacy@selbstfinanz.at.

You can view, correct and delete your stays yourself under “My days abroad”, change your settings there and download all of your days abroad – at any time, also when you no longer belong to any business. The page is open to you as soon as we hold a stay for you, such as a copy made when a membership ended, even if you have never used it. You correct the stays you recorded yourself; details from a business’s trips are corrected by that business, and the copy made when a membership ended can be deleted but not changed. The record of the alerts we sent you (country, rule, tax year and date), your home country and your alert threshold are deleted together with your account, or earlier if you ask us at privacy@selbstfinanz.at; until then the record ensures that no alert is sent twice.

If your request concerns data a business recorded in SelbstFinanz, please contact that business.

You may lodge a complaint with the Austrian Data Protection Authority (Datenschutzbehörde): Barichgasse 40–42, 1030 Vienna, www.dsb.gv.at.

9. Security

We transmit data only encrypted. In the database each business’s data is separated from other businesses’ data by row-level policies; files are held in private storage and delivered only through short-lived signed links. Two-factor authentication is open to everyone and mandatory for our platform administrators. Your personal days abroad belong to your account; the database’s row-level policies release them only to your own sign-in – not to other members, admins, support or our administration console.

10. Cookies and similar technologies

We set only strictly necessary cookies: for the sign-in session, for your language choice, – during registration – for a beta code you entered and – in the iOS app, once you allow notifications – for the device’s notification token, so that signing out stops notifications on that device. There are no analytics, advertising or tracking cookies and no tracking services. Cloudflare Turnstile reads browser and device signals on the pages named in section 5 to detect automated access; this is needed for a secure sign-in. The iOS app stores settings such as the app lock on the device only.

11. Obligation to provide data

An account cannot be created without an email address and a password. The mailbox import, push notifications, the AI features and the personal days abroad are optional.

12. Changes

This interim version will be replaced by the reviewed privacy policy. We publish future versions with a version number and date on this page; earlier versions remain available.