Privacy Policy

The Data Controller as defined by the General Data Protection Regulation (GDPR) is:

This Privacy Policy applies to the website and web application HandwerkerBonus (https://handwerkerbonus.de).

We process personal data of our users only insofar as this is necessary to provide a functional platform and our content and services.

• Consent - Art. 6(1)(a) GDPR
• Performance of Contract - Art. 6(1)(b) GDPR
• Legal Obligation - Art. 6(1)(c) GDPR
• Legitimate Interest - Art. 6(1)(f) GDPR

Vercel Inc.

The website and web application are hosted via Vercel. Vercel processes technically necessary connection data (IP address, timestamp, browser information). Legal basis: Art. 6(1)(f) GDPR.

Supabase Inc.

We use Supabase for database, authentication, file storage, and parts of the backend infrastructure. Authentication data, session information, uploaded invoice PDFs, and the fields extracted from them (provider, date, amounts, service description) are processed. Legal basis: Art. 6(1)(b) GDPR.

Mistral AI SAS

We use Mistral AI's OCR service (hosted in France/EU) to extract text from uploaded invoices. The invoice PDF is transmitted; Mistral AI processes this data strictly on our instructions as a processor (Art. 28 GDPR) and does not retain it after processing. Legal basis: Art. 6(1)(b) GDPR.

Stripe Payments Europe Ltd.

We use Stripe to process paid subscriptions. Data transmitted to Stripe includes the information necessary for payment processing (name, email, payment-method token). Legal basis: Art. 6(1)(b) GDPR.

Registration and User Account

During registration we collect: name, email address, and password. This data is necessary for the performance of the contract (Art. 6(1)(b) GDPR).

Server Log Files

Each access to our platform automatically records: IP address, date and time, page accessed, referrer URL, browser type and version. Legal basis: Art. 6(1)(f) GDPR.

Invoice Data

In the course of platform use, we process the invoice PDFs you upload and the fields extracted from them (invoice number, date, provider, service description, net amount, labour/material/travel cost shares). This data is used exclusively to calculate your § 35a EStG tax credit. Legal basis: Art. 6(1)(b) GDPR. Retention period: until deletion of your user account or until the statutory retention periods under § 147 AO (German Tax Code) expire.

The platform uses technically necessary cookies for session management and authentication. Legal basis: Art. 6(1)(f) GDPR.

You have the right to:

• Access (Art. 15 GDPR)
• Rectification (Art. 16 GDPR)
• Erasure (Art. 17 GDPR)
• Restriction of processing (Art. 18 GDPR)
• Data portability (Art. 20 GDPR)
• Object (Art. 21 GDPR)
• Withdraw consent (Art. 7(3) GDPR)
• Lodge a complaint with a supervisory authority (Art. 77 GDPR)

We employ state-of-the-art technical and organisational security measures to protect your data against accidental or intentional manipulation, loss, destruction, or access by unauthorised persons.

We reserve the right to amend this Privacy Policy to reflect changes in the law or changes to the platform.

We have entered into data processing agreements pursuant to Art. 28 GDPR with all of the above-listed processors (Vercel, Supabase, Mistral AI, Stripe). These ensure that the processing of your data takes place exclusively in accordance with our instructions and in compliance with data protection law.

For all matters relating to data protection, please contact: privacy@handwerkerbonus.de