Privacy policy

01Controller

MR²Consulting Ruediger & Rheinlaender Ltd, Evagora Pallikaridi 38, 8010 Paphos, Cyprus (HE 449045). Questions about data protection and the exercise of your rights: datenschutz@mr2consulting.com. There is no designated data protection officer — the conditions of Article 37 GDPR are not met.

02The two roles

For visiting this site, the contact form and your user account we are the controller within the meaning of Article 4(7) GDPR.

For the data you keep in Invobookz — your customers, suppliers, invoices, receipts and bank movements — YOU are the controller and we are your processor under Article 28 GDPR. What we may do with it is not set out here but in the data processing agreement you conclude with us. Data subjects turn to you in that case, not to us; if a request nevertheless reaches us, we forward it to you and do not answer it ourselves.

03Visiting this site

The site runs on Vercel Inc. in region `fra1` (Frankfurt am Main). Technical access data arises in the process — IP address, time, address requested, browser identification. It serves operation and defence against attacks and is not combined with other data. The legal basis is Article 6(1)(f) GDPR; our legitimate interest is a service that stays reachable.

There is NO audience measurement. We use no analytics tool, no tracking pixels, no advertising networks, and we load no third-party fonts at runtime — the fonts sit on the same server as the page. That is also why this site has no consent banner: there is nothing to consent to.

04Cookies

We set exactly one cookie, and only after you sign in: it holds your session. It is bound to the host name you signed in under — a session on scan.invobookz.com does not apply on app.invobookz.com and vice versa. It is technically necessary (Article 6(1)(b) GDPR) and expires with the session.

05Contact form

We process name, company, e-mail address and your message in order to answer the enquiry (Article 6(1)(b) or (f) GDPR). Dispatch runs through Resend Inc. We keep the enquiry for as long as the matter lasts, and beyond that only where commercial or tax law periods require it.

Before submission, Cloudflare Turnstile checks whether the request comes from a human. Your IP address is transmitted to Cloudflare Inc. in the process. Turnstile sets no advertising identifiers and builds no profile across sites. The legal basis is Article 6(1)(f) GDPR — without that check the form would be a bulk-mail tool within days.

06User account and sign-in

For your account we process e-mail address, name and a password check value. We do not store the password itself: it is turned into a bcrypt check value from which it cannot be computed back. The legal basis is Article 6(1)(b) GDPR.

We count failed sign-in attempts in order to slow down password guessing. Your IP address is NOT stored in the process, only a SHA-256 check value derived from it — enough to recognise two attempts of the same origin, too little to name that origin. These entries are deleted after 24 hours at the latest, by an hourly run rather than only on the next failed attempt.

We record successful sign-ins on your user account: the last 20, each with the time and the device in rough form (browser and operating system, such as “Chrome · macOS”) — without your IP address and without the full identifier of your browser. This serves the security of your account and support: it shows whether someone else is using your account. The legal basis is Article 6(1)(f) GDPR. Older entries drop out; everything is deleted with the account.

07Partner programme

If you become a partner, we process as controller your name, your email address, your partner code, how often your link was opened, which new companies came through you and which commissions arose; for payouts also your address, your VAT number where applicable and your bank details — the IBAN encrypted. The legal basis is Article 6(1)(b) GDPR (the partner terms), for the credit notes also point (c) (retention duties). Your link sets no cookie: only what arrives with the registration is attributed.

If a company registers through a partner link or with a partner code, we record this and pay the partner a commission on its payments. The partner sees only a short code for that company, the date and the commission — no name and nothing from its account. The legal basis is Article 6(1)(f) GDPR (settling with the partner).

08Receipt reading by a language model

Invobookz can read receipts instead of having them typed in. For that, the image or PDF is transmitted to Anthropic PBC in the USA. This happens ONLY if you have switched it on in the settings; the default is off, and you can withdraw it at any time with immediate effect (Article 6(1)(a) GDPR).

• Anthropic does NOT use the content to train models.
• Retention at the provider is limited to 30 days.
• The result is a PROPOSAL. It takes effect only once a human confirms it — there is no automated decision within the meaning of Article 22 GDPR.

09Recipients

We use five processors. There are no others — in particular no provider for error monitoring, audience measurement or advertising. Stripe is deliberately absent from this table: if you use the card payment link, it runs through YOUR Stripe account and your own contract with Stripe, just like your bank. What is transmitted is set out in the data processing agreement, § 5(4).

Your own cloud storage, your bank and your Stripe account are NOT recipients in this sense: they are your systems. Invobookz accesses them only because you stored the credentials — read-only in the case of the bank, and with the restricted key you created yourself in the case of Stripe.

10Transfers to third countries

Your receipts, invoices and bank data reside in Frankfurt. Three recipients go beyond this: Resend stores the data arising from mail dispatch (recipient, subject, delivery log) in the USA — and, if you use the receipt inbox, also the e-mails sent to your receipt address including attachments —, Cloudflare checks at whichever location is closest to you, and Anthropic processes in the USA.

The basis is the adequacy decision on the EU-US Data Privacy Framework and, in addition, the standard contractual clauses under Implementing Decision (EU) 2021/914.

11How long we store

12Your rights

You have the right of access (Article 15), rectification (16), erasure (17), restriction (18), data portability (20) and objection (21). Any consent given — for instance to receipt reading — can be withdrawn at any time; processing carried out until then remains lawful.

Access and data portability are available as self-service: in the settings under "Company" you can download a complete archive of your data at any time. It is tied to no plan and to no role.

For rectification, restriction and objection, write to datenschutz@mr2consulting.com. We answer within one month.

Erasure is yours too: the danger zone sits under Settings → Company. It first shows how many rows in which tables will disappear and which accounts go with them, and then asks for your password and the company name typed out. Nothing is recoverable afterwards.

You may also lodge a complaint with a supervisory authority. The authority responsible for us is the Office of the Commissioner for Personal Data Protection in Nicosia, Cyprus; you may equally turn to the authority of your place of residence or work (Article 77 GDPR).

13Changes

If who processes on our behalf changes, we announce it here before it takes effect. The date above says which version you are reading.