Privacy Policy

1. Controller

DeinHans is operated by Ariel Ben Shushan ERP Consultant, Frankfurter Allee 108a/Fabrikgebäude 2. Hof, 10247 Berlin, Germany; contact: hello@deinhans.de. The operator is the controller for its own website, enquiries, account administration, billing and platform-security processing. For customer bookkeeping data processed on instructions, DeinHans generally acts as processor; the customer remains controller. Section 12 explains these roles.

2. Scope of this policy

This policy explains how we process personal data when you visit public DeinHans pages, submit an access request, book a call, communicate with us, or use the product after we accept and onboard you. If a signed data processing agreement or customer agreement applies, that agreement may add product-specific processing terms.

3. Data protection contact

No separate data protection officer contact is published at this time. Privacy requests can be sent to the controller contact above. If a separate data protection officer contact is appointed or legally required, we will update this page. We route requests internally and respond according to applicable data protection law.

4. Data we process

Depending on your interaction with DeinHans, we may process the following categories of personal data.

• Contact and request data: name, email, phone number, company name, role, message, selected path, source volume, accountant status, urgency and selected package.
• Business and bookkeeping context: company profile, bank and payment context, documents, invoices, receipts, contracts, payout reports, comments, tasks, exceptions and monthly bookkeeping status shared after onboarding.
• Scheduling data: selected meeting type, time, timezone, booking status, rescheduling/cancellation data, meeting link, Cal.com identifiers and booking webhook payloads.
• Account and authentication data: sign-in identifiers, email-code or Google identity-provider status where chosen, invitation status, organization relationship, role, access state and security events where product access is granted.
• Attribution data: pathname-only landing route, sanitized referrer hostname, UTM source, medium, campaign, content and term, signup method, an opaque signup event identifier, signup-time consent choices and completion time. We do not retain advertising click IDs, raw referrer URLs, landing query strings, or customer-provided tracking values in the canonical signup record.
• Communications data: emails, support messages, meeting notes, internal CRM notes, related email-send status and follow-up history.
• Technical and security data: IP address, user agent, device/browser information, logs, Cloudflare Turnstile verification result, basic request metadata and abuse-prevention signals.
• Optional analytics and campaign data: page and landing views, CTA clicks, form starts, lead and booked-consultation events, plus standard device, browser and campaign metadata sent by the direct Google tag after consent.
• Third-party personal data contained in customer materials, such as names, contact details, invoice references, employee/vendor/customer data, or transaction counterparties that customers upload or connect.
• Billing and payment data: selected plan, billing contact and address, Stripe Customer/subscription/invoice status, payment-method status, trial dates, payment events, credits, cancellations and provider identifiers. DeinHans does not store complete card details.

5. Sources of data

Most data comes directly from you or your organization. Some data is created by providers and integrations needed to operate the workflow.

• You provide data through forms, email, meetings, product input, uploads and support communication.
• Your organisation, authorised users or professional firm may provide information for the same bookkeeping workflow.
• The providers in section 9 generate operational status, identifiers, logs and webhook events for the functions used.
• UTM links and referral navigation provide limited first-party campaign context. Optional ad-platform measurement requires the relevant consent.

6. Purposes

We process personal data for the following operational purposes. When acting as processor for bookkeeping data, the agreed customer instructions and DPA define the purpose; the controller legal bases below do not replace them.

• Operate public pages, language selection, cookie choices, security checks and request forms.
• Check whether a requested bookkeeping month or accountant workflow fits the current beta package and decide whether to accept, defer, or reject access.
• Send request confirmations, booking links, beta onboarding information, service notices and follow-up messages.
• Schedule calls, update booking status and connect request IDs with meetings and CRM status.
• Provide, secure, support, debug and improve the DeinHans product after onboarding.
• Prepare bookkeeping work, separate open business questions, produce handover state and support accountant or customer review.
• Preserve sanitized first-party signup source and medium for operational funnel reporting and measure provider-side page or campaign behavior only when analytics or marketing consent has been given.
• Comply with legal, tax, commercial, accounting, security and dispute-resolution obligations.
• Confirm identity, activate the selected organization route, operate the direct trial and subscription, provide the billing portal, reconcile payments and prevent fraud or duplicate commercial objects.

7. Legal bases

For processing where DeinHans is controller, the applicable GDPR legal basis depends on the activity. Article 6(1)(b) applies where the individual is a contractual party or requests pre-contract steps; handling a corporate customer’s contact persons generally relies on the corresponding legitimate interest. Customer bookkeeping processed on instructions follows the controller’s lawful basis and the DPA.

• Art. 6(1)(b) GDPR for necessary pre-contract steps and contract performance where you are the contractual party, including service access, billing and support.
• Art. 6(1)(f) GDPR for necessary B2B contact handling, security, fraud prevention, reliability, internal administration, limited first-party attribution and proportionate enquiry follow-up, subject to balancing your interests and rights.
• Art. 6(1)(a) GDPR for optional analytics, marketing tags and consent-based communications where required. Withdrawal applies for the future. Device storage/access also follows the applicable consent rules under section 25 TDDDG.
• Art. 6(1)(c) GDPR for applicable legal obligations, such as retention of our own tax and commercial records.
• Art. 6(1)(f) GDPR for necessary establishment, exercise or defence of legal claims; legal obligations may also apply in a particular case.

8. Required and voluntary data

Some information is necessary to evaluate and provide the service. Optional information is marked by context or can be omitted unless needed for the requested workflow.

• Required information depends on the route: contact and business-fit details for an enquiry; identity, company, authority, service selection and applicable agreement acceptance for product activation.
• If information necessary for the requested service is missing, we may be unable to process the enquiry, schedule the call or activate the workspace.
• Optional analytics and marketing consent is not required to use the website or submit a request. Acknowledging a privacy notice is not consent to unrelated marketing.

9. Recipients and processors

The following services receive the data needed for their purpose when the relevant function is used. Product subprocessors, their serving providers and processing locations must be identified in the applicable DPA annex; this public overview does not prove that a particular contractual arrangement or regional configuration has been completed.

• Supabase: authentication, product database and file storage, including account and membership data, bookkeeping records, source documents and processing history.
• Vercel: public website, web application and server-route transport, including request metadata and application data passing through those routes.
• Cloudflare Turnstile: bot protection and abuse-prevention signals on public request forms.
• Cal.com: call scheduling, contact and appointment details, meeting links, booking status and webhook updates.
• Notion: CRM and enquiry tracking where configured, including contact details, business-fit information, submitted messages and internal notes. Notion is not the product bookkeeping store.
• Resend: recipients, message contents and delivery status for request confirmations, booking links, invitations, account emails and service notices.
• Google Analytics and Google Ads through the direct Google tag and Meta Pixel: optional public-site measurement only after the relevant consent and where configured. Bookkeeping documents and free-text form contents are not campaign payloads.
• Accountants, tax advisors or other authorised professional participants selected by the customer for review, acceptance, filing or onboarding. Their own professional mandates may make them independent controllers.
• Authorities, courts and professional advisers where disclosure is required by law or justified for legal claims or security.
• Stripe: billing contacts, payment-method collection, subscriptions, invoices, the Customer Portal and billing webhooks. DeinHans does not store full card details. Stripe’s role may differ between payment processing and its own legal or fraud-prevention duties.
• Google as identity provider only when Google sign-in is enabled and selected. This is separate from optional Google Analytics and Google Ads.
• Railway: backend API and background workers processing product requests, uploaded evidence, bookkeeping context, job state and operational logs.
• OpenAI: API-based document extraction and specialist analysis using relevant source text, PDFs, images and accounting context; see section 11.
• OpenRouter is not currently enabled for customer documents. Any later activation and serving model providers will be addressed before use under the agreed and statutory notice and authorisation requirements.
• Google Drive when document import is selected: folder and file identifiers, metadata and selected files from the customer-provided source. Source-sharing permissions and the customer’s own Google arrangement need a separate check; confidential folders must not be made publicly accessible for import.

10. Cookies, local storage and campaign tags

Essential storage is used for site operation, language, security, sign-in and consent records. Optional analytics and marketing tags run only after consent. Further details and controls are available in the Cookie Policy.

• Essential storage is necessary for the website and product to work and cannot be switched off through the cookie panel.
• Analytics storage helps us understand performance and page behavior after consent.
• Google Ads and Meta campaign and conversion tags load only after marketing consent.
• You can change or withdraw optional consent at any time in the Cookie Policy.

11. Automation, AI providers and human review

DeinHans uses automated extraction, matching, classification and AI-assisted analysis to prepare and process bookkeeping records. OpenAI receives task-specific document text, PDFs or images and accounting context. OpenRouter is not currently enabled to process customer documents. DeinHans does not use customer bookkeeping content to train general-purpose AI models or for unrelated advertising. OpenAI states that API data is not used for training by default. Provider retention is separate: response storage, abuse-monitoring logs and endpoint-specific exceptions depend on the service and account settings. Some extraction paths use provider defaults; we do not promise universal zero retention or EU-only AI processing. Relevant outputs and decision history are stored in DeinHans for the workflow. AI results can be wrong and remain subject to validation, configured review and correction. The service is intended for bookkeeping support, not solely automated decisions with legal or similarly significant effects on individuals under Article 22 GDPR. Such use requires a separate assessment and is not authorised by this notice.

12. Customer-provided data and roles

Customers must have a lawful basis for the personal data they provide and give the necessary information to affected people. The role follows the actual data flow. Article 28 GDPR governs processing on instructions; it is not itself an Article 6 lawful basis. Processing of special-category data, where applicable, additionally requires an Article 9 condition and appropriate safeguards. Do not upload data beyond the agreed purpose.

• DeinHans generally acts as controller for its own website, enquiries, scheduling, CRM, billing, account administration, platform security and campaign records.
• For bookkeeping documents processed on customer instructions, DeinHans generally acts as processor under the DPA. A firm’s independent professional work remains under its own responsibility.
• The DPA must cover instructions, confidentiality, technical and organisational measures, authorised subprocessors, rights-request assistance, incident handling, return or deletion and the information and audit rights required by Article 28 GDPR.
• Where professional secrecy applies, the service arrangement must also address section 203 StGB and section 62a StBerG, including necessary access, confidentiality, further providers and overseas processing.
• Before live client materials are processed, the customer agreement must include or be accompanied by the applicable DPA, TOMs and provider/transfer arrangements. This notice is not a substitute for those documents.
• Public request forms, CRM and booking fields are for business-fit and contact information. Do not submit invoices, bank exports, employee/customer records or confidential bookkeeping documents through them.

13. International transfers

The service does not make a blanket Germany-only or EEA-only processing commitment. Hosting, AI inference, logs, support and onward processing may involve countries outside the EEA. Before such processing, the responsible parties must establish the applicable Chapter V GDPR mechanism: an applicable adequacy decision, including a relevant entity’s verified EU-US Data Privacy Framework coverage where appropriate, or safeguards such as standard contractual clauses with the necessary transfer assessment and supplementary measures. A DPA or provider privacy policy alone is not a transfer mechanism. The product annex must identify the active provider chain, processing locations and applicable safeguards; contact hello@deinhans.de for the applicable information and copies. Professional-secrecy requirements need a separate assessment.

14. Retention

We retain enquiry, CRM and communication records while needed to answer the request, maintain the business relationship or meet a documented obligation or claim-related need; records without a continuing purpose are subject to deletion review. Account access is removed when no longer authorised. Bookkeeping retention follows record-specific duties and customer instructions: common periods are ten years for books and annual records, eight years for booking vouchers and six years for relevant correspondence under AO/HGB, generally from the end of the relevant calendar year, subject to special rules and holds. These periods do not make all uploads, AI attempts or marketing records retainable and are not a storage-plan guarantee. Rights requests separate erasure from justified restriction; one user’s removal does not erase a shared organisation’s books. A minimal one-way email hash may remain to honour a marketing objection. Exit terms must specify export, active-data deletion and the backup lifecycle. Provider follow-up is separate; we do not promise immediate removal from every backup or provider. Ask us for the criteria applicable to your record or service.

15. Security

The service uses authentication and company-scoped permissions, restricted service credentials, transport encryption, time-limited document preview links and recorded accounting actions. Authorised support or beta quality personnel may review customer materials where necessary under the confidentiality and need-to-know limits in the agreement. A suspected personal-data breach is assessed and handled under applicable GDPR duties and the DPA; when acting as processor we notify the controller without undue delay. Backup coverage, recovery commitments, subprocessor controls and incident contacts must be documented for the agreed service. No certification, recovery SLA or absence of all risk is implied by this notice.

16. Your rights

Where the GDPR applies, you may request access, rectification, erasure, restriction, portability, objection and withdrawal of consent. You may also object to processing based on legitimate interests. We respond to data-subject requests within the statutory period, usually one month, unless an extension or lawful refusal applies. You may lodge a complaint with a competent data protection authority, including the Berlin Commissioner for Data Protection and Freedom of Information where applicable.