Privacy Policy

1. Controller

The controller responsible for data processing on this website is:

Represented by Anton Volkhine, Director.

Email: info@volkaccountant.com

A data protection officer is not required by law. Please direct any enquiries regarding data protection to the email address above.

2. Basics of data processing

We process personal data only insofar as this is necessary to provide the website and our services, and only on the legal bases of the General Data Protection Regulation (GDPR) (Art. 6(1)(a), (b), (f) GDPR).

3. Hosting

The website is hosted by Vercel Inc. Delivery takes place via servers in Frankfurt am Main (region eu-central-1), i.e. within the EU. When the site is accessed, technically necessary data are processed (server log files: IP address, date and time, page accessed, referrer, browser type and version, operating system). The legal basis is Art. 6(1)(f) GDPR (legitimate interest in the secure and stable operation of the website). As Vercel Inc. is based in the USA, access from a third country cannot be entirely excluded; the transfer is safeguarded by standard contractual clauses and a data processing agreement.

4. Email communication and contact form

If you contact us via the contact form or by email, we process the data you provide (name, email address, "Business/Accountant" selection, your message) in order to handle your enquiry. The legal basis is Art. 6(1)(b) GDPR (pre-contractual measures) or Art. 6(1)(f) GDPR (legitimate interest in responding). Sending is handled via our own mail server (Hetzner Online GmbH, server location Germany). You automatically receive a confirmation of receipt. The data are deleted once the enquiry has been conclusively dealt with and no statutory retention periods apply.

For transactional emails sent from the application (for example verification emails, delivery of invoices and quotes, and system notifications) we additionally use the service provider Resend (Plus Five Five, Inc., USA). This processes the recipient's email address and the content of the respective message. The legal basis is Art. 6(1)(b) GDPR. The transfer to the USA is safeguarded by Standard Contractual Clauses and the EU-US Data Privacy Framework.

5. User account and use of the application

A user account is required to use Volk Accountant. In doing so, we process master data (name, email address, company data, login credentials) and the content you enter (invoices, quotes, receipts, payment and bank data, client data). The legal basis is Art. 6(1)(b) GDPR (performance of a contract). Insofar as you enter personal data of third parties (e.g. your clients), you are the controller under data protection law and we are the processor; for this we conclude a data processing agreement (DPA) under Art. 28 GDPR on request.

AI-assisted processing (receipt recognition, translation, support)

Within the application we use language models provided by Anthropic — for automatic receipt recognition (OCR) of uploaded documents, for translating line-item and receipt texts between German and English, and for the support chat. This may involve personal data contained in the respective content (for example the name, address, invoice amount or IBAN shown on a receipt). The legal basis is Art. 6(1)(b) GDPR (performance of a contract) or Art. 6(1)(f) GDPR (legitimate interest in efficient receipt processing and customer support).

The provider is Anthropic PBC, USA; for services in the EU, Anthropic Ireland Ltd. is the contracting party. Processing takes place solely to deliver the feature; the transmitted content is contractually not used to train AI models. The transfer to the USA is safeguarded by Standard Contractual Clauses (Art. 46 GDPR). Processing is transient — the result is written back into the data stored in your account.

6. Payment processing via Stripe

For processing payments we use Stripe Payments Europe, Ltd. (1 Grand Canal Street Lower, Dublin, Ireland). When a payment is made, the necessary data (including name, email address, payment method details, invoice amount) are transmitted to Stripe and processed there. Full card details are processed exclusively by Stripe and are not accessible to us. The legal basis is Art. 6(1)(b) GDPR. Further information can be found in Stripe's privacy policy athttps://stripe.com/privacy.

7. Google Drive integration (optional, only at your instigation)

If you activate the Google Drive integration, you establish a connection between your Google account and Volk Accountant via Google's authorisation procedure (OAuth). The integration works in both directions:

• Import — you can import files (in particular receipts) from your Google Drive into Volk Accountant. These files are transferred into our database and stored there permanently until you delete them or the contract ends.
• Export — you can export files stored in Volk Accountant to your Google Drive. The files additionally remain in your Volk Accountant account; this is a copy, not a move.

We access only the folders and files required for these operations. You can revoke the connection at any time in your account or in the security settings of your Google account; files already imported remain unaffected. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. The legal basis is Art. 6(1)(a) GDPR (consent through activation) in conjunction with Art. 6(1)(b) GDPR (performance of a contract).

8. Database and file storage

We store the content of your account — including invoices, quotes, receipts and imported files — in a database at Supabase Inc. The storage location is within the European Union. Supabase processes the data exclusively on our behalf and on our instructions; a data processing agreement under Art. 28 GDPR is in place. The legal basis is Art. 6(1)(b) GDPR (performance of a contract).

9. Reach measurement

To analyse website use, we employ our own cookieless analytics tool "Volk Analytics". It stores no cookies and creates no cross-device identifiers. Only aggregated usage data are collected, such as pages accessed, referrer, approximate region of origin, device type and time of access. IP addresses are not stored permanently. The data are processed on our own infrastructure and not passed on to third parties; identification of individuals is not possible. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in data-minimising reach measurement).

We do not currently use any third-party reach-measurement or marketing services such as Google Analytics. Should this change, we will inform you here in advance and, where required, obtain your consent via a cookie notice.

10. Cookies

On this website we use exclusively technically necessary cookies that are required for operation and security (e.g. session management in the user account, security functions). These are exempt from consent under Art. 6(1)(f) GDPR or § 25(2) TDDDG. We do not currently use any cookies requiring consent for analytics or marketing purposes. Should we do so in future, this will happen only after your express consent via a cookie notice, which you can revoke at any time with effect for the future.

11. Recipients and processors

In providing our services we work with the following recipients and processors:

• Vercel Inc. (hosting, function region Frankfurt; USA, SCC/DPF)
• Supabase Inc. (database and file storage, data region EU/Frankfurt; USA, SCC/DPF)
• Hetzner Online GmbH (contact-form email, Germany)
• Resend (Plus Five Five, Inc.) — transactional emails from the application (USA, SCC/DPF)
• Anthropic PBC / Anthropic Ireland Ltd. — AI receipt recognition, translation and support chat (USA; Standard Contractual Clauses, no training on transmitted data)
• Stripe Payments Europe Ltd. (payments, Ireland)
• Google Ireland Limited (Google Drive integration, optional and only at your instigation)

Data processing agreements under Art. 28 GDPR are in place with all providers. No data are passed on to other third parties unless we are legally obliged to do so.

12. Retention period

We store personal data only for as long as necessary for the stated purposes. Contract and billing data are subject to statutory retention periods (in Cyprus generally six years after the end of the tax year). After expiry, the data are deleted or anonymised. The content of your user account is deleted after the contract ends, unless retention obligations apply.

13. Your rights

As a data subject, you have the following rights with regard to your personal data:

• the right of access (Art. 15 GDPR)
• the right to rectification (Art. 16 GDPR)
• the right to erasure (Art. 17 GDPR)
• the right to restriction of processing (Art. 18 GDPR)
• the right to data portability (Art. 20 GDPR)
• the right to object to processing based on legitimate interests (Art. 21 GDPR)
• the right to withdraw consent given, with effect for the future (Art. 7(3) GDPR)

To exercise these rights, please contact us atinfo@volkaccountant.com.

14. Right to lodge a complaint

You have the right to lodge a complaint with a data protection supervisory authority. The authority responsible for us is the Office of the Commissioner for Personal Data Protection, Iasonos 1, 1082 Nicosia, Cyprus (www.dataprotection.gov.cy). You may also contact the authority in your place of residence.

15. Data security

We use appropriate technical and organisational measures to protect your data against loss, manipulation and unauthorised access. The website uses TLS encryption to protect the transmission of your data. Data are stored in encrypted form, access is restricted to authorised persons, and regular backups are created. Our security measures are continuously reviewed and adapted in line with technological developments.

16. Changes to this privacy policy

We adapt this privacy policy when the legal situation or our services change, so that it always complies with the current legal requirements. The current version is available at any time on this page.