Privacy Policy

The controller within the meaning of the General Data Protection Regulation (GDPR) is:

For all questions relating to data protection, you can reach us at info@myrobotax.de.

MyRobotax is a platform for businesses and tax advisory firms for capturing, extracting and posting accounting documents. In doing so, we act in two different roles:

• As controller, we process the data of visitors to our website as well as the account, contract and billing data of our customers and their users.
• As processor (Art. 28 GDPR), we process the content that our customers upload to or generate on the platform – in particular invoices, receipts, bank statements, Z reports (cash register end-of-day reports) and the accounting data derived from them. These documents regularly contain personal data of third parties (e.g. suppliers, customers or employees of our customers). The controller for this data is the respective customer; we process it solely on the customer's instructions and on the basis of a data processing agreement.

Our website and application are delivered via the network of Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA (“Cloudflare”) (Cloudflare Workers). When you access them, Cloudflare processes technically necessary connection data:

• IP address of the requesting device
• date and time of access
• URL accessed, HTTP method and status code
• browser type and version as well as operating system (user agent)

For error analysis and secure operation, we additionally log structured application events (request ID, route, status code and – for logged-in users – internal user and company identifiers). Request headers and request content are not logged.

The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest lies in the stable, secure and high-performance provision of our services and in defending against attacks. Log data is deleted after 7 Tage. Cloudflare is certified under the EU-US Data Privacy Framework; in addition, we have concluded a data processing agreement with Cloudflare that includes Standard Contractual Clauses.

We operate the database, user authentication and storage of uploaded files with Supabase, Inc. (“Supabase”). The data is stored exclusively in a data centre in Frankfurt am Main (Amazon Web Services, region eu-central-1).

The legal basis is Art. 6(1)(b) GDPR (performance of a contract) or – for customer content – the data processing agreement with our customer. A data processing agreement including Standard Contractual Clauses is in place with Supabase, as access from the USA for support and maintenance purposes cannot be entirely ruled out.

A user account is required to use the platform. In this context, we process:

• name, email address and password (stored exclusively as a cryptographic hash)
• optionally, phone number and profile picture
• company affiliation and role (e.g. administrator, employee, tax adviser, client portal)
• for tax advisory firms: DATEV adviser number
• time of last login as well as language settings and other preferences

If you are invited by a customer – for example by your employer or your tax advisory firm – or granted access to the client portal, we receive your name and email address from that customer. Access credentials for the client portal are stored in encrypted form (AES-256-GCM).

Sign-in with Google: If you choose “Sign in with Google”, you are redirected to Google (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). After you confirm, Google transmits your name and email address to us via our authentication service Supabase; we do not receive your Google password. Google's own privacy policy applies to the processing at Google. Use is voluntary; sign-in with email address and password is always available.

Signed-in devices: With each sign-in we store, for the session, the browser and device type (user agent) as well as the city and country derived by Cloudflare from the connection; no separate IP geolocation takes place. You can see these sessions in your account settings and end them there. If someone signs in from a previously unknown device, we notify you by email. The entries are deleted together with your account. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in protecting your account against unauthorised access.

The legal basis is Art. 6(1)(b) GDPR. This information is required for the conclusion and performance of the contract; without it, the platform cannot be used.

We send emails via the email API of Hostinger International Ltd. (Larnaca, Cyprus). If this service fails, emails may be sent instead via the Gmail API provided by Google (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; processing by Google LLC in the USA is possible). We send:

• confirmation of your email address and password resets
• security notices, e.g. when someone signs in from a new device (with device type, location and time)
• notifications from the platform, e.g. about new documents or documents requiring review, periodic summaries and low-credit alerts – depending on your notification settings
• on request, additionally to further recipient addresses that you have added and verified

In this context, the name and email address of the recipients and the content of the message are processed.

The legal basis is Art. 6(1)(b) GDPR. Hostinger processes the data in the European Union; Google LLC is certified under the EU-US Data Privacy Framework. We do not send promotional emails.

Push notifications of the mobile app: If you allow notifications in our mobile app, we store a device identifier (push token), the platform (iOS or Android), the device name and the app version. Notifications are delivered to your device via the Expo service of 650 Industries, Inc. (USA) and from there via the Apple Push Notification Service (Apple Inc.) or Firebase Cloud Messaging (Google). The title and text of the notification are transmitted, e.g. the company name and the number of new documents, low-credit alerts or security notices; push notifications do not contain file names or document descriptions. Depending on your device settings, they may be shown on the lock screen.

The legal basis is Art. 6(1)(b) GDPR. You can switch off push notifications at any time in your device settings. The device identifier is deleted when you sign out of the app, remove the device in your account settings, delivery fails permanently or your account is deleted.

The core of our service is the processing of the documents and data that our customers upload or enter, in particular:

• invoices, credit notes, receipts, bank statements and Z reports as files
• content extracted from them (text recognition) and structured document data
• master data of the companies and their business partners (e.g. name, address, tax number, VAT ID, IBAN)
• bookings, payments, account assignments and comments
• usage and billing events for credits consumed

This processing is carried out on behalf of and on the instructions of our customer (Art. 28 GDPR). The legal basis for the processing derives from the relationship between our customer and the data subjects, generally Art. 6(1)(b), (c) or (f) GDPR.

To extract documents automatically and generate booking suggestions, we use specialised sub-processors:

• Datalab (datalab.to, USA): text recognition (OCR). For this purpose, the uploaded file is transmitted and the recognised result is returned.
• Google Gemini API (Google Ireland Limited or Google LLC, USA): structuring of recognised text, classification of documents and generation of account assignment suggestions. For this purpose, the recognised text of the document and the company and business partner data required for this are transmitted, but not the original file. If the issuer of a document cannot be determined from the text or the tax number, a small image section from the header of the document (usually the logo, at most 50 KB) is additionally transmitted.

The providers process the data solely to provide the respective service to us and not to train their own models. This is based on data processing agreements; for the safeguards governing transfers to the USA, see section 14.

No automated individual decision-making: The results of the AI are suggestions. No decision producing legal effects concerning data subjects within the meaning of Art. 22 GDPR is made; bookings are reviewed by our customers or approved in accordance with rules they have defined.

At the express instigation of a customer, we transmit booking batches, documents and client master data to DATEV eG, Paumgartnerstraße 6–14, 90429 Nürnberg, Germany, or to Lexware Office of Haufe-Lexware GmbH & Co. KG, Munzinger Straße 9, 79111 Freiburg, Germany. Such transmission takes place solely on the customer's instructions; the respective recipient is responsible for further processing in accordance with its own data protection provisions.

We store the access tokens required for this in encrypted form (AES-256-GCM). When you log in to DATEV, we briefly set a strictly necessary cookie (see Cookie Policy).

To ensure traceability of changes to documents, bookings and permissions and to investigate misuse, we log security-relevant actions within the platform. We store the person acting, the time, the type of action, the company concerned, the values changed as well as the IP address and user agent.

The legal basis is Art. 6(1)(f) GDPR and – insofar as changes to documents and bookings must remain traceable – Art. 6(1)(c) GDPR in conjunction with Sections 146(4) and 147 of the German Fiscal Code (AO). Our legitimate interest and that of our customers lies in the audit-proof integrity of the accounting records and the security of the platform. The IP address and user agent are removed after 12 Monate. The remaining details are kept for as long as the related records must be retained by law (no more than ten years).

To protect against automated attacks (e.g. password guessing), we limit the number of login and comparable requests. For this purpose, we store only a cryptographic hash of the IP address and request type, never the IP address in plain text. These entries are deleted after two hours at the latest. The legal basis is Art. 6(1)(f) GDPR.

We use only strictly necessary cookies and entries in your browser's local storage, e.g. for login, the selected language and the colour scheme. We do not use analytics, marketing or tracking technologies. The legal basis is § 25(2) no. 2 TDDDG (German Telecommunications Digital Services Data Protection Act) in conjunction with Art. 6(1)(b) or (f) GDPR.

A complete overview can be found in our Cookie Policy.

If you contact us by email (e.g. at info@myrobotax.de), we process the information you provide in order to handle your enquiry. The legal basis is Art. 6(1)(b) GDPR where your enquiry relates to a contract, and otherwise Art. 6(1)(f) GDPR. We delete the data once the enquiry has been conclusively dealt with and no statutory retention obligations preclude deletion.

We use the following service providers as processors:

For transfers to the USA, we rely on the European Commission's adequacy decision on the EU-US Data Privacy Framework (Art. 45 GDPR) where the recipient is certified, and otherwise on the Standard Contractual Clauses adopted by the European Commission (Art. 46(2)(c) GDPR). You can request a copy of the safeguards using the contact details provided above.

Beyond this, we only disclose data if you or our customer instigate this (e.g. export to DATEV), if we are legally obliged to do so or if this is necessary to enforce our rights. We obtain exchange rates from the European Central Bank; no personal data is transmitted in this process.

We store personal data only for as long as is necessary for the respective purpose:

• Account data: for the duration of the contractual relationship; after the contract ends, it is deleted unless retention obligations apply.
• Documents archived (sorted out) or deleted by customers: permanent deletion of the file and record 30 days after archiving. Excepted are approved documents and documents exported to DATEV or Lexware Office (accounting vouchers): they are removed from view but kept for the statutory retention period (Section 147 AO, Section 257 HGB). Changes to documents that have already been exported are recorded together with their previous state and kept for the same period.
• Intermediate files from bulk uploads: deletion after 30 days.
• Other customer content: for the duration of the contract or until deleted by the customer; after the contract ends, in accordance with the data processing agreement.
• Audit log: IP address and user agent 12 Monate, remaining details for the statutory retention periods (no more than ten years). Request logs: 7 Tage. Misuse protection: no more than two hours.
• Records relating to our own services: invoices and other accounting vouchers eight years, books of account and annual financial statements ten years, commercial and business letters six years (§ 147 AO – German Fiscal Code, § 257 HGB – German Commercial Code); the period starts at the end of the calendar year in which the last entry was made in the book, the annual financial statements were prepared, the letter was received or sent, or the accounting voucher was created (§ 147(4) AO, § 257(5) HGB).

You have the following rights vis-à-vis us:

• access to the data stored about you (Art. 15 GDPR)
• rectification of inaccurate data (Art. 16 GDPR)
• erasure (Art. 17 GDPR) and restriction of processing (Art. 18 GDPR)
• data portability (Art. 20 GDPR)
• withdrawal of consent given, with effect for the future (Art. 7(3) GDPR)
• lodging a complaint with a data protection supervisory authority (Art. 77 GDPR), e.g. with the authority competent for us: Berliner Beauftragte für Datenschutz und Informationsfreiheit, Alt-Moabit 59–61, 10555 Berlin

To exercise your rights, an informal message to info@myrobotax.de is sufficient. We process requests for the deletion of your account or for the release of your data within the statutory period of one month. How to request the deletion of your data is described on our Data Deletion page.

Providing the data marked as mandatory is necessary for concluding the contract and using the platform. Without this data, we cannot set up a user account for you. Our services are directed at businesses and not at children.

We take technical and organisational measures to protect your data, in particular:

• transport encryption (TLS) throughout
• strict separation of different customers' data at database level (Row Level Security)
• non-public file storage with time-limited, signed access links
• encryption of particularly sensitive access credentials (AES-256-GCM)
• role-based permissions, limitation of login attempts and logging of security-relevant operations

We will amend this Privacy Policy if our services or the legal situation change. The version published on this page at any given time applies; the date of the last update is shown above.