Datenschutzerklärung

1. Verantwortlicher (controller)

The Verantwortlicher (controller) within the meaning of Art. 4 Z 7 DSGVO for the processing of personal data on zvitly.io and in the Zvitly application is:

For any data protection question, for access requests and for exercising your rights, a message to the e-mail address above with the subject “Datenschutz” is enough. No particular form is required.

2. Datenschutzbeauftragter (data protection officer)

Zvitly has not appointed a Datenschutzbeauftragter (data protection officer). We think it is right to explain why rather than leave the question unanswered.

Art. 37 Abs 1 DSGVO ties the duty to appoint not to company size but to the nature of the processing. None of the three grounds applies:

• lit a — we are not a public authority or public body.
• lit b — our core activity is not “umfangreiche regelmäßige und systematische Überwachung” (large-scale regular and systematic monitoring) of data subjects. Zvitly processes bookkeeping data that the customer enters; we do not observe behaviour, build no profiles and track nobody across websites.
• lit c — we process neither special categories of personal data under Art. 9 DSGVO nor data on criminal convictions under Art. 10 DSGVO on a large scale. Bookkeeping, invoicing and banking data belong to none of those categories.

If the nature of our processing changes — for example through a feature that systematically evaluates behaviour — we will appoint an officer and name them here.

3. Grundrecht auf Datenschutz — § 1 DSG

In Austria, data protection is not only European secondary law. Art. 1 § 1 of the Datenschutzgesetz (DSG) is a Verfassungsbestimmung (constitutional provision) and grants everyone a claim to secrecy of personal data concerning them, in so far as an interest deserving protection exists.

In practice this means two things. First: restrictions of that claim are permissible only to safeguard overriding legitimate interests, and any interference may be carried out only in the least intrusive manner that achieves the aim (§ 1 Abs 2 DSG) — that standard underlies every balancing of interests in this document. Second: access, rectification and erasure are due to you in Austria additionally at constitutional level (§ 1 Abs 3 DSG), not only under Art. 15 et seq DSGVO.

Text of the provision in the Rechtsinformationssystem des Bundes (RIS): § 1 DSG

4. Categories of data processed

We process data that you enter or upload yourself, technical data that inevitably arises during operation and, in two cases, information we receive from a service you yourself choose for that purpose: when you sign in with Google, the information Google transmits for it (point 6), and when you pay for a subscription, Stripe’s notifications about plan and payment (point 8). We buy no data, enrich nothing from external sources and take over no data sets from third parties.

• Account data — E-mail address, password (only as a hash in Supabase Auth, never in plain text), name, telephone number, language choice, time zone, profile picture, active sessions and — if enabled — the factors of two-factor authentication.
• Company data — Company name, legal form, address, UID number, tax number, competent Finanzamt, bank details (IBAN, BIC), logo, invoice settings, chosen financial year and tariff.
• Bookkeeping data — Receipts and documents including uploaded files, outgoing and incoming invoices with line items, contacts and clients, bank accounts and account movements, cash entries, travel and expense claims, time tracking, fixed assets, payroll data as well as tax returns and filings. We process this data on your instructions — see point 7.
• Technical data — IP address, browser identifier (User-Agent), timestamps of accesses and actions, and server logs of the hosting.
• Communication data — Support requests including history and attachments, notifications inside the account, and the dispatch data of system e-mails.

Special categories of personal data under Art. 9 DSGVO — health data, biometric data, data on beliefs, trade union membership or sexual orientation — we do not process and do not ask for anywhere.

5. Purpose, legal basis and retention period

This table is the core of this statement: it answers Art. 13 Abs 1 lit c and Abs 2 lit a DSGVO for every single purpose of processing.

Where processing is based on Art. 6 Abs 1 lit f DSGVO, the balancing of interests is set out in point 9.

6. Registration and running the account

An e-mail address and a password are enough to register. Both are required because without an account there is no access to the data, and without a confirmed address nobody could reset their password.

Supabase Auth stores the password only as a cryptographic hash. At no point do we have access to the plain-text password — not even as the operator.

If you enable two-factor authentication, we additionally process the factor itself (TOTP secret) and the confirmations. The legal basis is Art. 6 Abs 1 lit b and lit f DSGVO — securing an account that holds your bookkeeping.

Instead of a password, you can also register and sign in with your Google account. If you choose this route, the sign-in itself takes place at Google; Google then transmits to Supabase Auth your e-mail address and the profile information Google releases for this purpose — name, profile picture and an identifier of your Google account. No Zvitly password is created in the process. We transmit no data about you to Google in this process; Google learns that you are signing in to Zvitly from the sign-in itself and processes this under its own terms. The legal basis on our side is Art. 6 Abs 1 lit b DSGVO. Signing in with Google is voluntary; the route via e-mail address and password is always available.

7. Bookkeeping data — Zvitly as Auftragsverarbeiter (processor)

Everything you enter into Zvitly as receipts, invoices, contacts and account movements regularly contains personal data of third parties: your customers, suppliers and employees. You decide on the purpose and means of that processing, not us.

In that constellation you are the Verantwortlicher (controller) and Zvitly is the Auftragsverarbeiter (processor) within the meaning of Art. 28 DSGVO. We process this data solely on your instructions and not for our own purposes — in particular we do not analyse it, do not pass it on and do not use it for advertising.

The data processing agreement (AVV), sub-processors, technical measures and the deletion concept are described on a separate page: GDPR & data processing

8. Features with their own processing and their status

Four Zvitly features involve processing of their own, and not all of them are in operation yet. A privacy statement describing processing that does not yet exist violates the principle of accuracy (Art. 5 Abs 1 lit a DSGVO) just as one that conceals existing processing does. We therefore record for each of these features what is actually processed as of the date of this statement: receipt recognition and payment processing are in operation, transmission to FinanzOnline and the bank connection are not yet.

• Automatic receipt recognition — In operation. If you upload a receipt as an image and your plan includes automatic recognition, Zvitly reads the receipt’s details via Amazon Bedrock, the AI service of Amazon Web Services. Only the receipt image in JPEG, PNG, GIF or WebP format is transmitted — PDF files are not sent to the service — without your name, your e-mail address or any other information from your account. The request runs through an inference profile that restricts processing to data centres in the EU; the source region is eu-central-1 (Frankfurt am Main). What comes back is the extracted information — issuer, date, amounts, tax rate — and a category suggestion; both are stored with the receipt in your account, and you can change them at any time. The category suggestion remains a suggestion until you accept it (point 18). Because the receipt belongs to your bookkeeping, this is processing on your behalf (point 7); Amazon Web Services is our sub-processor for it (point 13 and the table on the DSGVO and Auftragsverarbeitung page). Zvitly does not use your receipts to train AI models.
• Payment processing — In operation. Payments to Zvitly — in particular for your subscription — are processed by Stripe. When you proceed to payment, we pass Stripe your e-mail address and an internal identifier of your business account so that the payment is assigned to the right account. You enter your name, billing address, your VAT number where applicable and your payment method yourself in Stripe’s payment form; this information goes directly to Stripe, not to us — we never see or store card numbers. From Stripe we receive back what we need to perform the contract: the identifiers of customer and subscription, plan and billing period, the status of the subscription, amounts and dates of payments, and failed payments. The purpose is billing under your contract with us; the legal basis is Art. 6 Abs 1 lit b DSGVO. This data does not belong to your bookkeeping but to your contract with us — for it we are the controller (Verantwortlicher), not a processor. We retain payment and invoice records under § 132 Abs 1 BAO for seven years from the end of the calendar year to which they relate (table in point 5). How Stripe processes the information you enter in the payment form is described by Stripe in its own privacy statement.
• Transmission to FinanzOnline — Transmission to FinanzOnline is planned but not yet in operation. No filings are transmitted to the tax administration, and FinanzOnline credentials are currently not stored. Once the interface goes live, we will describe here which data is transmitted and how the credentials are protected.
• Bank connection — The automatic bank connection is planned but not yet in operation. Account movements currently enter the application only through files that you upload yourself. When the connection goes live, we will name the account information service provider and the basis for access.

9. Server logs, rate limiting and security

When you open the site, your browser transmits technically necessary data to the server, including your IP address. Without it no response can be delivered.

For registration and password reset we limit the number of attempts. To do so we store the IP address and the e-mail address not in plain text but only as HMAC-SHA256 with a server-side secret. The entries are deleted automatically after two hours at the latest.

We log administrative access to customer accounts with identifier, action, time, IP address and User-Agent. That log protects you: it makes it traceable who did what and when.

Until 21 August 2026 this section stated that we use no analytics tool. Since 22 August 2026 that is no longer true, and we say so explicitly rather than quietly rewriting the sentence. Google Analytics 4 now runs on the public part of the website — but only after your explicit consent: until you give it, the Google script is not loaded at all, so not a single request goes there. The legal bases are Art. 6 Abs 1 lit a DSGVO and § 165 Abs 3 TKG 2021. Details, the full list of entries and how to withdraw consent are in section 10. No measurement takes place inside the application behind sign-in. No error reporting or session recording service is embedded.

10. Cookies and local storage

Zvitly sets no advertising cookies and builds no profiles. The entries fall into two groups, and the difference matters: the first four are strictly necessary for the service you requested and are always set; the last three concern measurement of visits and appear ONLY after your consent. The list is complete:

§ 165 Abs 3 TKG 2021 requires active consent for access to your terminal equipment as a rule. The same paragraph expressly exempts what is strictly necessary in order for the provider of an information society service explicitly requested by the user to be able to provide that service.

That is exactly what we rely on for the first four entries — and it is a statement about the product, not an excuse. Without the session cookie there is no sign-in; without the language cookie and the two local entries the interface would fall back on every page change to a different language, a lost timer and a forgotten tariff. None of these four says anything about who you are or what else you do online, so the exemption is met and no consent is required. The three measurement entries do NOT fall under the exemption — that is what the consent notice is for, and it appears before anything is stored, not after. Declining switches nothing off: the site and the app work exactly the same.

You can delete cookies and local storage at any time in your browser settings. Deleting the session cookie signs you out; nothing else is lost.

You can withdraw consent at any time and without consequence: delete the zv-analytics-consent entry in your browser settings — the notice will appear again and you can decide differently. Deleting the two Google entries ends recognition of your browser immediately.

Text of the provision in the RIS: § 165 TKG 2021

11. E-mail dispatch (Resend)

System e-mails — address confirmation, password reset, invitation to a company, support replies, deadline reminders — are sent via Resend. The legal basis is Art. 6 Abs 1 lit b DSGVO.

The same route carries the two e-mails of the public contact form (the last row of the table in point 5). The first is a notification to our internal mailbox wenexus.at@gmail.com; it contains your name, your e-mail address, the subject you chose and the text of your message — without those details the enquiry could neither be attributed nor answered. The second is an acknowledgement of receipt sent to you; it states your name and the fact that the message arrived, and deliberately does not repeat the text of your enquiry — this protects you should someone enter your address without your knowledge, because the acknowledgement then discloses no one else's content. Here too the processor is Resend; the legal basis under Art. 28 DSGVO is not changed by this. Two consequences are material for you, however. The first: your e-mail address thereby enters Resend's delivery logs, which under its data processing agreement remain in the United States. The second: the notification, together with the full text of your message, stays in that mailbox, and that mailbox is operated by Google — which is why point 13 names Google as a recipient. A transfer to a third country therefore takes place even if you write to us only once and without an account; the legal basis for that transfer is set out in point 14.

Transmitted in the process are your e-mail address, your name where it appears in the text, the language and the text of the respective message — that is, the FACT of a notification, not the content of your bookkeeping. A deadline reminder carries the date of the deadline, not the document; a support reply carries the text written, not your account balance. Receipts, invoices, account movements and your customers' contact details do not enter the e-mail dispatch.

Resend is operated by Plus Five Five, Inc., based in San Francisco, United States. Our domain zvitly.io is set there to the Ireland region (eu-west-1) and verified: your e-mails are sent from Ireland, not from the United States. The choice of region governs only the sending path, however — the Resend account credentials, the delivery logs and the API records remain in the United States under Resend's data processing agreement. To that extent a third-country transfer occurs; its legal basis is set out in point 14. We have no influence on how long the delivery logs are kept; that follows Resend's own periods.

The transmission is encrypted. Since 19 August 2026 dispatch is set to “Enforced TLS”: a message is delivered only if the receiving mail server establishes a TLS-encrypted connection. Previously the usual opportunistic encryption applied, under which a server without TLS support could force unencrypted delivery; that case is ruled out. This is a technical measure under Art. 32 Abs 1 lit a DSGVO.

12. Hosting

The application runs on a virtual server of Hostinger International Ltd. located in Frankfurt am Main, Germany. Database, authentication and file storage are with Supabase in the eu-central-1 region (Frankfurt am Main).

Both locations are in the European Union. Server-side logs arise during operation — time of access, requested address, IP address, User-Agent. The legal basis is Art. 6 Abs 1 lit f DSGVO; the legitimate interest lies in stable and secure operation.

13. Recipients of the data

We do not pass personal data on to third parties. We list the exceptions here in full, and they are of two kinds: first, the processors without which the service cannot be operated; second, further recipients that we name separately — the operator of the mailbox in which messages addressed to us arrive, and the payment service Stripe. First the processors:

• Supabase — database, authentication and file storage (region eu-central-1, Frankfurt am Main)
• Hostinger International Ltd. — server infrastructure (location Frankfurt am Main)
• Plus Five Five, Inc. (Resend) — dispatch of system e-mails (sending region Ireland; delivery data in the United States)
• Amazon Web Services (Amazon Bedrock) — automatic receipt recognition (data centres in the EU; EU inference profile, source region eu-central-1, Frankfurt am Main)

A data processing agreement under Art. 28 Abs 3 DSGVO is in place with each of these providers. At the end of the e-mail path one further recipient within the meaning of Art. 4 Z 9 DSGVO is added, and we name it separately: the notifications our system sends to us — an enquiry from the public contact form, a new support request, a report of a technical fault — have since August 2026 gone to the mailbox wenexus.at@gmail.com, and that mailbox is operated by Google. The details from the contact form — name, e-mail address, chosen subject and text of the message — therefore no longer sit only in our database in Frankfurt am Main, but additionally in a mailbox whose storage locations we do not determine; Google belongs to a US corporate group, so processing in the United States cannot be ruled out. The legal basis for that transfer is set out in point 14. That Google does not appear in the list above is not an oversight but the distinction itself: for this mailbox there is no data processing agreement under Art. 28 DSGVO. Google processes the messages received there under its own terms and is, in that respect, a recipient and not a processor acting on our instructions. This changes nothing about the purpose, legal basis and storage period of your enquiry itself (point 5); we delete the notification in the mailbox within the same period. Finally, none of this affects the address zvitly@wenexus.at: it is our public contact address named in the Impressum — all that has changed is where our system delivers its own notifications.

A further recipient is Stripe. Payments to Zvitly run through Stripe (point 8); for this, Stripe receives from us your e-mail address and an internal identifier of your business account, and you enter all other payment details at Stripe yourself. We name Stripe separately from the list above because it receives no data from your bookkeeping — it concerns only your own contract with us. How Stripe processes the information you enter in the payment form is described by Stripe in its own privacy statement. When you sign in with Google (point 6), by contrast, we pass no data to Google: there the data flows in the opposite direction, from Google to us.

Beyond that we pass data on only where a legal obligation exists or a court or authority obliges us to. We sell no data and make it available to nobody for advertising purposes.

The full list of sub-processors with role, location and legal basis is on the page: GDPR & data processing

14. Transfers to third countries

Database, file storage, application server and automatic receipt recognition are located in the European Union. Everything you enter or upload into Zvitly is processed and stored there. The only exceptions are the e-mail dispatch and the passing of your e-mail address to Stripe when you pay, and even there only to the extent described below.

We name the points of contact with a third country explicitly instead of claiming in general terms that no transfer occurs at all:

• E-mail dispatch and incoming mail: the sending itself happens from Ireland. The US-based operator of Resend nevertheless retains the access and delivery data — recipient address, subject, time and delivery status. If you write to us through the contact form or support, the incoming mailbox is added: the notification about it sits, text included, in our mailbox at Google (point 13).
• Supabase: the data is held in Frankfurt am Main, but Supabase, Inc. is based in the United States, so administrative access from a third country cannot be ruled out.
• Google Analytics: if you have consented under section 10, your IP address, browser data and the pages you viewed are transferred to Google LLC, USA. Without consent this transfer does not take place at all — the script is not loaded. The operator is Google LLC, 1600 Amphitheatre Parkway, Mountain View, USA.
• Amazon Web Services: receipt recognition runs in data centres in the EU, but Amazon Web Services belongs to a US group, so — as with Supabase — administrative access from a third country cannot be ruled out.
• Stripe: Stripe belongs to a US group, so processing of your contract and payment data in the United States cannot be ruled out. This concerns the e-mail address we pass on and the information you enter in Stripe’s payment form — not your bookkeeping.
• Sign-in with Google: if you choose it, you sign in at Google, that is, with a US group. We transmit no data to Google in doing so; Google processes the sign-in within your own Google account and under its terms.

These transfers do not happen on a wing and a prayer. Resend is certified with the US Department of Commerce under the EU-U.S. Data Privacy Framework, and for that framework the European Commission established an adequate level of protection by implementing decision of 10 July 2023. The transfer is therefore based on Art. 45 Abs 1 DSGVO and requires no separate authorisation. As a second layer, Resend's data processing agreement additionally contains the EU standard contractual clauses (Art. 46 Abs 2 lit c DSGVO); governing law and jurisdiction are Ireland. Google LLC is likewise certified with the US Department of Commerce under the EU-U.S. Data Privacy Framework, so the transfer into our mailbox rests on the same adequacy decision and hence also on Art. 45 Abs 1 DSGVO. The second layer is missing there, however: for that mailbox we hold no standard contractual clauses from a data processing agreement of our own. That is why nothing reaches it except what is addressed to us anyway — and nothing from your bookkeeping.

The specific contractual bases per processor — including Amazon Web Services — are set out in the sub-processor table on the DSGVO and Auftragsverarbeitung page. Stripe is not listed there (point 13); the basis on which Stripe relies for transfers to third countries is disclosed by Stripe in its own privacy statement.

15. Retention periods and the clash with the right to erasure

We store account data and company data for as long as the account exists. If you delete it, they are removed.

For bookkeeping data that does not apply without limitation — and this is exactly where Zvitly differs from an ordinary SaaS.

§ 132 Abs 1 BAO requires books, records and the Belege (source documents) belonging to them to be kept for seven years. The period runs not from the date of the document but from the end of the calendar year to which it relates: an invoice from January 2026 must therefore be kept until the end of 2033. § 212 UGB requires the same for books, annual accounts, business correspondence and accounting vouchers, likewise seven years from the end of the calendar year. Beyond the seven years the obligation continues for as long as the documents matter for pending proceedings in which the entrepreneur is a party.

Server and security logs follow their own, considerably shorter periods — see the table in point 5.

Texts of the provisions in the RIS: § 132 BAO · § 212 UGB

16. Your rights

You have the following rights. They are not a paperwork ritual: every one of these requests is handled by a person.

• Auskunft — access (Art. 15 DSGVO) — You receive confirmation of whether and which data we process, together with purposes, recipients and retention periods, plus a copy of the data.
• Berichtigung — rectification (Art. 16 DSGVO) — In most cases you correct inaccurate data yourself in the settings; where that is not possible, we correct it on your notice.
• Löschung — erasure (Art. 17 DSGVO) — You can request deletion of your account. Point 15 draws the line: whatever falls under a statutory retention period is restricted instead of deleted.
• Einschränkung — restriction of processing (Art. 18 DSGVO) — If you contest the accuracy of data or the processing is unlawful, processing is suspended until the matter is clarified.
• Datenübertragbarkeit — portability (Art. 20 DSGVO) — You receive your data in a common, machine-readable format. For bookkeeping data, export is part of the product and does not depend on a request.
• Widerspruch — objection (Art. 21 DSGVO) — Against processing that we base on Art. 6 Abs 1 lit f DSGVO — those listed in point 9 — you may object at any time on grounds relating to your particular situation.
• Widerruf — withdrawal of consent (Art. 7 Abs 3 DSGVO) — Where we rely on consent, you may withdraw it at any time with effect for the future. The lawfulness of processing carried out until then remains unaffected.

How to exercise them: an informal message to the address given in point 1 is enough.

We reply without undue delay, at the latest within one month (Art. 12 Abs 3 DSGVO). If a request is complex, the period may be extended by two months; we will tell you within the first month.

Where there are reasonable doubts about your identity, we ask for additional information to confirm it (Art. 12 Abs 6 DSGVO). That is not an obstacle but a safeguard: disclosure to the wrong person would itself be a data breach.

17. Complaint to the Datenschutzbehörde

If you consider that the processing of your data infringes the DSGVO, you have the right — without prejudice to any other remedy — to lodge a complaint with a supervisory authority (Art. 77 DSGVO). In Austria that is:

Österreichische Datenschutzbehörde
Barichgasse 40-42
1030 Wien, Österreich
+43 1 52 152-0
dsb@dsb.gv.at
www.dsb.gv.at

A complaint is free of charge. We would still rather you came to us first — it is faster, and then we can actually fix the mistake.

18. Automated decisions and profiling

Automated decision-making, including profiling, which produces legal effects concerning you or similarly significantly affects you does not take place (Art. 22 Abs 1 DSGVO).

Zvitly does not score you, builds no creditworthiness or behaviour profiles and takes no decision about you without human involvement.

Where the application suggests something — a category for a receipt, say, or the matching of an account movement — that is a suggestion which you confirm or discard. Without your confirmation nothing changes.

19. Whether providing data is required

Providing your e-mail address and choosing a password — or signing in with Google instead — are necessary to conclude the contract: without them no account can come into being and no access can be granted.

Company data such as the UID number or the address is not required for use, but it is required for individual features — an invoice without the particulars required by § 11 UStG is not a proper invoice. You decide which features you use.

There is no statutory duty to provide us with data. The only consequence of not providing it is that the feature or the contract in question does not come about.

20. Changes to this statement

This statement applies in the version of the date shown above. We adapt it when the processing changes — in particular before any of the features described in point 8 as not yet in operation goes into operation, not afterwards.

Material changes affecting your rights are additionally communicated to signed-in users by e-mail or in the account. Earlier versions are made available on request.