Privacy Policy

1. Controller

The controller responsible for data processing on this website is:

Represented by Anton Volkhine, Director.

Email: info@volkaccountant.com

A data protection officer is not required by law. Please direct any enquiries regarding data protection to the email address above.

2. Basics of data processing

We process personal data only insofar as this is necessary to provide the website and our services, and only on the legal bases of the General Data Protection Regulation (GDPR) (Art. 6(1)(a), (b), (f) GDPR).

3. Hosting

The website is hosted by Vercel Inc. Delivery takes place via servers in Frankfurt am Main (region eu-central-1), i.e. within the EU. When the site is accessed, technically necessary data are processed (server log files: IP address, date and time, page accessed, referrer, browser type and version, operating system). The legal basis is Art. 6(1)(f) GDPR (legitimate interest in the secure and stable operation of the website). As Vercel Inc. is based in the USA, access from a third country cannot be entirely excluded; the transfer is safeguarded by standard contractual clauses and a data processing agreement.

4. Email communication and contact form

If you contact us via the contact form or by email, we process the data you provide (name, email address, "Business/Accountant" selection, your message) in order to handle your enquiry. The legal basis is Art. 6(1)(b) GDPR (pre-contractual measures) or Art. 6(1)(f) GDPR (legitimate interest in responding). Sending is handled via our own mail server (Hetzner Online GmbH, server location Germany). You automatically receive a confirmation of receipt. The data are deleted once the enquiry has been conclusively dealt with and no statutory retention periods apply.

For transactional emails sent from the application (for example verification emails, delivery of invoices and quotes, and system notifications) we additionally use the service provider Resend (Plus Five Five, Inc., USA). This processes the recipient's email address and the content of the respective message. The legal basis is Art. 6(1)(b) GDPR. The transfer to the USA is safeguarded by Standard Contractual Clauses and the EU-US Data Privacy Framework.

5. User account and use of the application

A user account is required to use Volk Accountant. In doing so, we process master data (name, email address, company data, login credentials) and the content you enter (invoices, quotes, receipts, payment and bank data, client data). The legal basis is Art. 6(1)(b) GDPR (performance of a contract). Insofar as you enter personal data of third parties (e.g. your clients), you are the controller under data protection law and we are the processor; for this we conclude a data processing agreement (DPA) under Art. 28 GDPR on request.

AI-assisted processing (receipt recognition, translation, support)

Within the application we use language models provided by Anthropic — for automatic receipt recognition (OCR) of uploaded documents, for translating line-item and receipt texts between German and English, and for the support chat. This may involve personal data contained in the respective content (for example the name, address, invoice amount or IBAN shown on a receipt). The legal basis is Art. 6(1)(b) GDPR (performance of a contract) or Art. 6(1)(f) GDPR (legitimate interest in efficient receipt processing and customer support).

The provider is Anthropic PBC, USA; for services in the EU, Anthropic Ireland Ltd. is the contracting party. Processing takes place solely to deliver the feature; the transmitted content is contractually not used to train AI models. The transfer to the USA is safeguarded by Standard Contractual Clauses (Art. 46 GDPR). Processing is transient — the result is written back into the data stored in your account.

6. Payment processing via Stripe

For processing payments we use Stripe Payments Europe, Ltd. (1 Grand Canal Street Lower, Dublin, Ireland). When a payment is made, the necessary data (including name, email address, payment method details, invoice amount) are transmitted to Stripe and processed there. Full card details are processed exclusively by Stripe and are not accessible to us. The legal basis is Art. 6(1)(b) GDPR. Further information can be found in Stripe's privacy policy athttps://stripe.com/privacy.

7. Google Drive integration (optional, only at your instigation)

If you activate the Google Drive integration, you establish a connection between your Google account and Volk Accountant via Google's authorisation procedure (OAuth). The integration works in both directions:

• Import — you can import files (in particular receipts) from your Google Drive into Volk Accountant. These files are transferred into our database and stored there permanently until you delete them or the contract ends.
• Export — you can export files stored in Volk Accountant to your Google Drive. The files additionally remain in your Volk Accountant account; this is a copy, not a move.

We access only the folders and files required for these operations. You can revoke the connection at any time in your account or in the security settings of your Google account; files already imported remain unaffected. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. The legal basis is Art. 6(1)(a) GDPR (consent through activation) in conjunction with Art. 6(1)(b) GDPR (performance of a contract).

8. Database and file storage

We store the content of your account — including invoices, quotes, receipts and imported files — in a database at Supabase Inc. The storage location is within the European Union. Supabase processes the data exclusively on our behalf and on our instructions; a data processing agreement under Art. 28 GDPR is in place. The legal basis is Art. 6(1)(b) GDPR (performance of a contract).

9. Reach measurement

To analyse website use, we employ our own cookieless analytics tool "Volk Analytics". It stores no cookies and creates no cross-device identifiers. Only aggregated usage data are collected, such as pages accessed, referrer, approximate region of origin, device type and time of access. IP addresses are not stored permanently. The data are processed on our own infrastructure and not passed on to third parties; identification of individuals is not possible. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in data-minimising reach measurement).

Google Analytics 4 (only with your consent)

In addition we use Google Analytics 4, a web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google Analytics uses cookies and similar identifiers that allow an analysis of your use of the website. Among the data recorded are the pages you visit, time spent, the source of your visit, your approximate location at city level and details about your browser and device. Your IP address is truncated before it is stored; it is not combined with other data held by Google.

We set cookies only after your express consent. The legal basis for storing and reading information on your device is § 25(1) TDDDG; for the subsequent processing of your data it is Art. 6(1)(a) GDPR (consent).

If you decline: We operate Google Analytics in what is known as consent mode. This means Google's script is loaded for all visitors. If you decline, no cookies are set and no persistent identifier is created. However, cookieless signals continue to be transmitted to Google containing your IP address, details about your browser and device, and the page you are viewing. Google uses these signals solely for statistical extrapolation and cannot identify an individual person from them. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in statistically reliable reach measurement).

Your right to object under Art. 21 GDPR: You may object at any time to this processing based on Art. 6(1)(f) GDPR — informally toinfo@volkaccountant.com. You can also prevent the transmission entirely yourself by installing theGoogle Analytics opt-out browser add-on or by blocking requests togoogletagmanager.com in your browser.

We have disabled the "Google signals" feature and cross-device advertising reports; your data are not used for advertising purposes. Retention of usage data in Google Analytics is limited to 14 months.

A transfer to Google LLC in the USA cannot be ruled out. Google LLC is certified under the EU-US Data Privacy Framework and Standard Contractual Clauses under Art. 46 GDPR are additionally in place. Despite these safeguards, a transfer to the USA carries the residual risk that US authorities may access the data and that you have no legal remedies comparable to those available in the EU.

Withdrawal: You may withdraw your consent at any time with effect for the future using the "Cookie settings" link in the footer of every page. After withdrawal, Google Analytics will no longer be loaded on future visits. The lawfulness of processing carried out up to the point of withdrawal remains unaffected.

Further information on how Google handles user data can be found inGoogle's privacy policy.

10. Cookies

On this website we use exclusively technically necessary cookies that are required for operation and security (e.g. session management in the user account, security functions). These are exempt from consent under Art. 6(1)(f) GDPR or § 25(2) TDDDG.

Beyond these, Google Analytics (see section 9) sets consent-requiring cookies for analytics purposes. They are set only after your express consent via our cookie notice and can be withdrawn at any time with effect for the future using the "Cookie settings" link in the footer of every page. We do not use any cookies for marketing or advertising purposes.

We store your choice from the cookie notice in your browser's local storage (localStorage) so that we do not have to ask you again on every visit. This storage is technically necessary to implement your choice and is therefore exempt from consent under § 25(2) TDDDG.

11. Recipients and processors

In providing our services we work with the following recipients and processors:

• Vercel Inc. (hosting, function region Frankfurt; USA, SCC/DPF)
• Supabase Inc. (database and file storage, data region EU/Frankfurt; USA, SCC/DPF)
• Hetzner Online GmbH (contact-form email, Germany)
• Resend (Plus Five Five, Inc.) — transactional emails from the application (USA, SCC/DPF)
• Anthropic PBC / Anthropic Ireland Ltd. — AI receipt recognition, translation and support chat (USA; Standard Contractual Clauses, no training on transmitted data)
• Stripe Payments Europe Ltd. (payments, Ireland)
• Google Ireland Limited (Google Drive integration, optional and only at your instigation; and Google Analytics 4 for reach measurement, only with your consent)

Data processing agreements under Art. 28 GDPR are in place with all providers. No data are passed on to other third parties unless we are legally obliged to do so.

12. Retention period

We store personal data only for as long as necessary for the stated purposes. Contract and billing data are subject to statutory retention periods (in Cyprus generally six years after the end of the tax year). After expiry, the data are deleted or anonymised. The content of your user account is deleted after the contract ends, unless retention obligations apply.

13. Your rights

As a data subject, you have the following rights with regard to your personal data:

• the right of access (Art. 15 GDPR)
• the right to rectification (Art. 16 GDPR)
• the right to erasure (Art. 17 GDPR)
• the right to restriction of processing (Art. 18 GDPR)
• the right to data portability (Art. 20 GDPR)
• the right to object to processing based on legitimate interests (Art. 21 GDPR)
• the right to withdraw consent given, with effect for the future (Art. 7(3) GDPR)

To exercise these rights, please contact us atinfo@volkaccountant.com.

14. Right to lodge a complaint

You have the right to lodge a complaint with a data protection supervisory authority. The authority responsible for us is the Office of the Commissioner for Personal Data Protection, Iasonos 1, 1082 Nicosia, Cyprus (www.dataprotection.gov.cy). You may also contact the authority in your place of residence.

15. Data security

We use appropriate technical and organisational measures to protect your data against loss, manipulation and unauthorised access. The website uses TLS encryption to protect the transmission of your data. Data are stored in encrypted form, access is restricted to authorised persons, and regular backups are created. Our security measures are continuously reviewed and adapted in line with technological developments.

16. Changes to this privacy policy

We adapt this privacy policy when the legal situation or our services change, so that it always complies with the current legal requirements. The current version is available at any time on this page.