Privacy Policy

1.1 Downloading the Application

When downloading the Application, certain required information is transmitted to the app store selected by you (e.g. Google Play or Apple App Store); in particular, your username, email address, customer number of your account, the time of download, payment information, and the individual device identifier may be processed. The processing of this data is carried out exclusively by the respective app store and is beyond our control.

1.2 Automatically Collected Data

In the course of your use of the Application, we automatically collect certain data that is necessary for the use of the Application. This includes:

1. IP address of the requesting device
2. Date and time of access
3. Type and version of the operating system used
4. Device type and identifier
5. Language and region of the device

This data is automatically transmitted to us but not stored, (1) in order to provide you with the service and the associated features; (2) to improve the features and performance characteristics of the Application; and (3) to prevent and remedy misuse and malfunctions.

This data processing is justified by the fact that (1) the processing is necessary for the performance of the contract between you as the data subject and us pursuant to Art. 6(1)(b) GDPR for the use of the Application, or (2) we have a legitimate interest in ensuring the functionality and error-free operation of the Application and in being able to offer a market- and interest-oriented service, which in this case outweighs your rights and interests in the protection of your personal data within the meaning of Art. 6(1)(f) GDPR.

1.3 User Account (Registration and Login)

When you create a user account or log in, we use your access data (email address and password) to grant you access to your user account and to manage it ("mandatory information"). Mandatory information during registration is marked with an asterisk and is required for the conclusion of the usage agreement. If you do not provide this data, you cannot create a user account.

In addition, you may provide voluntary information during registration (e.g. first and last name).

We use the mandatory information to authenticate you upon login and to process requests to reset your password. The data you enter during registration or login is processed and used by us (1) to verify your authorization to manage the user account; (2) to enforce the terms of use of the Application and all related rights and obligations; and (3) to contact you in order to send you technical or legal notices, updates, security alerts, or other messages relating to the management of the user account.

Voluntary information is used to display [such information according to your selected settings within the Application and to make it accessible to other users of the Application upon your request].

This data processing is justified by the fact that (1) the processing is necessary for the performance of the contract between you as the data subject and us pursuant to Art. 6(1)(b) GDPR for the use of the Application, or (2) we have a legitimate interest in ensuring the functionality and error-free operation of the Application, which in this case outweighs your rights and interests in the protection of your personal data within the meaning of Art. 6(1)(f) GDPR.

1.4 Use of the Application

Within the Application, you can enter, manage, and edit various information, tasks, and activities. This information includes in particular data on financial planning, your own financial situation, business goals & processes, as well as learning and development progress.

The Application additionally requires the following permissions:

1. Internet access: This is required to store your entries on our servers.
2. Camera and gallery access: This is required so that the corresponding data can be extracted from the images.

The processing and use of usage data is carried out for the provision of the service. This data processing is justified by the fact that the processing is necessary for the performance of the contract between you as the data subject and us pursuant to Art. 6(1)(b) GDPR for the use of the Application.

3.1 Law Enforcement and Authorities

If it is necessary for the investigation of unlawful or abusive use of the Application or for the pursuit of legal claims, personal data will be forwarded to law enforcement authorities or other authorities and, where applicable, to injured third parties or legal advisors. However, this only takes place if there are indications of unlawful or abusive conduct. A disclosure may also take place if this serves the enforcement of terms of use or other legal claims. We are also legally obligated to provide information to certain public bodies upon request. These are law enforcement authorities, authorities that prosecute administrative offences subject to fines, and the tax authorities.

Any such disclosure of personal data is justified by the fact that (1) the processing is necessary for compliance with a legal obligation to which we are subject pursuant to Art. 6(1)(f) GDPR in conjunction with national legal requirements for the disclosure of data to law enforcement authorities, or (2) we have a legitimate interest in disclosing the data to the aforementioned third parties where there are indications of abusive conduct or for the enforcement of our terms of use, other conditions, or legal claims, and your rights and interests in the protection of your personal data within the meaning of Art. 6(1)(f) GDPR do not prevail.

3.2 Service Providers

We rely on the following external companies and service providers for the provision of our service:

Auth0 (Okta Inc.) – Authentication and identity management. Auth0 processes your login data (email address, password) for secure authentication. The processing is carried out on the basis of Art. 6(1)(b) GDPR. Further information: https://www.okta.com/privacy-policy/

Stripe Inc. – Payment processing. Stripe processes your payment data to handle payment transactions. The processing is carried out on the basis of Art. 6(1)(b) GDPR. Further information: https://stripe.com/de/privacy

Any such disclosure of personal data is justified by the fact that we have carefully selected our external companies and service providers within the framework of Art. 28(1) GDPR as processors, regularly reviewed them, and contractually obligated them to process all personal data exclusively in accordance with our instructions. Reference is made to our data processing agreement.

3.3 Corporate Restructuring

In the course of the further development of our business, it may happen that the structure of our company changes by way of a change in legal form, or that subsidiaries, parts of the company, or components are established, acquired, or sold. In such transactions, customer information may be transferred together with the part of the company to be transferred. Whenever personal data is disclosed to third parties to the extent described above, we ensure that this is done in accordance with this privacy policy and the applicable data protection law.

Any such disclosure of personal data is justified by the fact that we have a legitimate interest in adapting our corporate form to the economic and legal circumstances as needed, and your rights and interests in the protection of your personal data within the meaning of Art. 6(1)(f) GDPR do not prevail.

7.1 Right of Access

You have the right to obtain from us at any time, upon request, information about the personal data concerning you that is processed by us, within the scope of Art. 15 GDPR. To do so, you may submit a request by post or email to the address indicated below.

7.2 Right to Rectification of Inaccurate Data

You have the right to demand from us the immediate rectification of personal data concerning you, insofar as such data is inaccurate. Please contact us at the contact addresses indicated below.

7.3 Right to Erasure

You have the right, under the conditions described in Art. 17 GDPR, to demand from us the erasure of personal data concerning you. These conditions provide in particular for a right to erasure where the personal data is no longer necessary for the purposes for which it was collected or otherwise processed, as well as in cases of unlawful processing, the existence of an objection, or the existence of an obligation to erase under Union law or the law of the Member State to which we are subject. For the data retention period, please also refer to Section 5 of this privacy policy. To exercise your right to erasure, please contact us at the contact addresses indicated below.

7.4 Right to Restriction of Processing

You have the right to demand from us the restriction of processing in accordance with Art. 18 GDPR. This right exists in particular where the accuracy of the personal data is contested between the user and us, for the duration required to verify the accuracy, and in the event that the user requests restricted processing instead of erasure where a right to erasure exists; furthermore, in the event that the data is no longer necessary for the purposes we pursue, but the user requires it for the assertion, exercise, or defense of legal claims, as well as where the successful exercise of an objection between us and the user is still contested. To exercise your right to restriction of processing, please contact us at the contact addresses indicated below.

7.5 Right to Data Portability

You have the right to receive from us the personal data concerning you, which you have provided to us, in a structured, commonly used, and machine-readable format in accordance with Art. 20 GDPR. To exercise your right to data portability, please contact us at the contact addresses indicated below.