E‑Rechnungs-Studio logomarkE‑Rechnungs-Studio
Sign inCreate account

Payments and contract declarations

The controller is Casserus UG (haftungsbeschränkt), Camerloherstr. 44, 80686 Munich, Germany. Contact: info@e-rechnungs-studio.de, +49 89 24 41 43 09.

We use Stripe Payments Europe, Limited (Ireland) for Checkout, subscriptions, invoices, refunds and the billing portal. Stripe processes contact and billing details, payment details, transaction information and technical data needed for its services. We receive customer/subscription identifiers and billing status. You enter card details on Stripe's hosted pages; we do not receive your full card number. Necessary billing processing is based on Article 6(1)(b) GDPR (performance of the contract) and Article 6(1)(c) GDPR (legal obligations).

Stripe acts as our processor for relevant services and also as an independent controller, including for fraud prevention and its own legal obligations. Processing may take place outside the EEA, including in the USA. The safeguards include standard contractual clauses and applicable adequacy decisions. Details and copies of the safeguards are available in the following Stripe documents.

Data processing agreement · Data transfers addendum · Stripe privacy policy

For cancellation and withdrawal declarations we process your name, email, contract identification, declaration, any reason or desired termination date, and the submission timestamp. We send the declaration to our support mailbox and a receipt to you using our email service. This fulfils our legal obligations under Article 6(1)(c) GDPR and supports handling contractual claims under Article 6(1)(f) GDPR. Our legitimate interest is documenting and resolving those claims. Hosting and email providers process the information needed to deliver and store these messages. The requested information is needed to identify your contract and process your declaration; reasons are not required for withdrawal.

We keep billing and declaration records for as long as needed to fulfil the contract and process your declaration, and afterwards only for applicable tax and accounting retention obligations or until relevant legal claims are resolved or time-barred. Stripe's retention for its independent processing is described in its privacy policy.

You may contact us to exercise your rights of access, rectification, erasure, restriction and data portability, subject to their legal conditions. You may object to processing based on legitimate interests on grounds relating to your particular situation. You also have the right to complain to a data protection authority, including the Bavarian State Office for Data Protection Supervision.

Privacy notice

Controller and contact

Casserus UG (haftungsbeschränkt), Camerloherstr. 44, 80686 Munich, Germany. Telephone: +49 89 24 41 43 09. Email: info@casserus.com.

We are the controller for visits to this website, registration and the provision of our own services. When business customers use our service to process invoices containing their customers’, suppliers’ or employees’ personal data, we act as their processor under Article 28 GDPR. A data processing agreement covering the parties’ duties and technical and organisational measures is available on request.

Data we process and why

We process information you provide through your account, enquiries, invoice uploads and invoice presets, as well as technical information collected when you visit the website. We use it to provide the requested services and keep them reliable and secure. Processing necessary for a contract or steps you request before entering a contract is based on Article 6(1)(b) GDPR. Legal obligations are covered by Article 6(1)(c), and our legitimate interests in operating and protecting the service by Article 6(1)(f). Where we ask for consent, the basis is Article 6(1)(a); you may withdraw it at any time.

Hosting and other recipients

Our hosting provider is Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany. Servers, databases, logs and backups are located at Hetzner’s nbg1 site in Nuremberg, Germany. Hetzner may store server snapshots in Helsinki, Finland, or Falkenstein, Germany. Hosting serves contract performance and our legitimate interest in a reliable, secure website. Hetzner processes data on our instructions under a data processing agreement. See Hetzner’s privacy policy.

We disclose personal data to external recipients where necessary to perform a contract, meet a legal obligation (for example, disclosure to tax authorities), pursue a legitimate interest or on another applicable legal basis. We use processors under data processing agreements and agreements on joint responsibility where applicable. The billing section above describes Stripe and the processing of contract declarations.

Invoices, conversion and saved presets

Uploaded invoices may contain names, addresses, contact information, IBANs, BICs, tax identifiers, invoice numbers and dates, amounts, and descriptions of goods or services. We process these documents to convert, validate and display electronic invoices and create the requested results. This processing is necessary to provide these functions under Article 6(1)(b) GDPR; without the document data we cannot convert or check it. Limited technical metadata also supports stability, error analysis and security under Article 6(1)(f).

Invoices converted while you are signed in are automatically saved in your invoice history, including batch imports. Invoice presets store their labels and processing instructions for reuse. If you select presets for conversion or validation, their relevant contents may be sent to OpenAI with the document. We process presets to provide this account function under Article 6(1)(b) GDPR.

OpenAI processing and international transfers

We use the OpenAI API to extract invoice information for conversion. Only the contents required for this purpose are transmitted, including relevant selected preset instructions. The providers are OpenAI Ireland Ltd, 1st Floor, The Liffey Trust Centre, 117–126 Sheriff Street Upper, Dublin 1, D01 YC43, Ireland, and OpenAI OpCo, LLC, 1960 Bryant Street, San Francisco, CA 94110, USA. Processing may take place in the USA. The basis is Article 6(1)(b) GDPR for the requested conversion and Article 6(1)(f) for the limited technical information needed to maintain a stable, secure service.

OpenAI does not use API data for training by default. Invoice data processed by this service is not used to train OpenAI models or our own models. OpenAI may retain transmitted content in security and abuse prevention logs for up to 30 days, unless longer legal retention is required. See OpenAI’s privacy policy and its data processing terms.

Transfers outside the EU/EEA take place on the basis of an adequacy decision under Article 45 GDPR, appropriate safeguards under Article 46, or an applicable exception under Article 49. For OpenAI, we rely in particular on the European Commission’s standard contractual clauses included in its data processing terms. Countries outside the EU/EEA may offer different protections, including access by public authorities and more limited remedies. Contact us for information about the applicable safeguards.

How long we keep data

  • Temporary uploads, conversion, validation and display results, and processing logs are deleted within 30 days unless longer storage is legally required. This covers PDFs, XML files and results that have not become part of a saved invoice, unless a different period is stated here.
  • Invoices saved in your account, including automatic saves after signed-in conversion and batch imports, remain in your invoice history until you delete the invoice or account.
  • Saved invoice presets remain until you delete them.
  • OpenAI’s separate retention period is described above.

Otherwise, we keep personal data until its purpose ends. We delete it following a justified erasure request or withdrawal of consent unless another lawful reason, such as a tax or commercial retention requirement, permits continued storage. In that case, we delete it when that reason no longer applies. Billing and declaration retention is described in the billing section above.

Cookies and server logs

Cookies may last for a session or remain until their expiry or deletion. Cookies needed for communication, requested functions or reliable operation are used under Section 25(2) TDDDG and Article 6(1)(f) GDPR. Where consent is requested for other cookies or access to your device, the basis is Section 25(1) TDDDG and Article 6(1)(a) GDPR; you may withdraw consent at any time. You can control or block cookies in your browser, although this may limit website functions.

After a successful guest conversion, a necessary cookie records use of the free guest allowance and expires at the start of the following month. It prevents repeated use of that allowance and is not used for advertising or analytics.

The hosting provider automatically records browser type and version, operating system, referring URL, requesting computer’s host name, request time and IP address in server logs. These logs are not combined with other data sources. The basis is Article 6(1)(f) GDPR: our legitimate interest in reliable operation and security.

Enquiries and security

When you contact us by email or telephone, we process your name, contact details and enquiry to respond. The basis is Article 6(1)(b) GDPR for contract-related enquiries, otherwise our legitimate interest in handling enquiries under Article 6(1)(f), or consent under Article 6(1)(a) where requested. We retain the information until the enquiry’s purpose ends, you request deletion, or you withdraw consent, subject to applicable legal retention requirements. We do not disclose enquiry contents without your consent unless another legal basis permits it.

This website uses TLS encryption for transmission. Internet communications can still have security gaps; complete protection against access by third parties cannot be guaranteed.

Your rights

Subject to the GDPR’s conditions, you may request access to your personal data, its correction or erasure, restriction of processing, and portability of data processed automatically on the basis of consent or a contract. You may withdraw consent at any time without affecting the lawfulness of earlier processing. Contact the controller above to exercise these rights.

You may object, on grounds relating to your particular situation, to processing based on Article 6(1)(e) or (f) GDPR, including related profiling. We will stop unless we demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing is needed for legal claims. You may object to direct marketing, including related profiling, at any time; we will stop that processing.

You may complain to a data protection supervisory authority, particularly in the EU country where you live or work or where an alleged infringement occurred. For our registered office, this is the Bavarian State Office for Data Protection Supervision: BayLDA.