Privacy Policy

Version: 1.0.0
Effective Date: 16 October 2026
Last Updated: 16 October 2026

1. Controller

For processing described in this Privacy Policy, the controller is:

Mahdi Ghorban Pour - Digitexia
Hauptstrasse 109, 79364 Malterdingen
Germany
Email: kontakt@rechnelia.de
Website: https://rechnelia.de

This policy applies to the Rechnelia public website and application. When a Customer uploads or creates invoice and customer data, the Customer is generally the controller and Digitexia processes that data on its behalf under the Data Processing Agreement.

2. Data We Process

Depending on how you use Rechnelia, we may process:

account data, including name, email address, password hash, language, roles, and tenant membership;
registration, email-confirmation, invitation, password-reset, and authentication records;
Customer contact, billing, plan, subscription, and transaction identifiers;
customer and invoice data, including names, addresses, contact details, tax and registration identifiers, payment details, line items, dates, amounts, source PDF or RTF files, generated XML and PDF files, logos, and invoice settings;
communications and support requests;
IP address, browser and device information, request metadata, audit records, application logs, security events, and cookie or session identifiers; and
Cloudflare Turnstile challenge data used to assess whether a request is legitimate.

Rechnelia does not store complete payment-card details; those are handled by Stripe.

3. Purposes and Legal Bases

We process data to provide and administer accounts and the service, perform contracts, convert and generate invoices, store Customer content, authenticate users, send transactional messages, manage billing, prevent abuse, maintain security, diagnose faults, comply with law, and establish or defend legal claims.

Depending on the context, the legal basis is Article 6(1)(b) GDPR (contract or pre-contract steps), Article 6(1)(c) (legal obligation), Article 6(1)(f) (legitimate interests in secure and reliable operation, fraud prevention, support, and business administration), or Article 6(1)(a) (consent, where requested). Customer Data processed on behalf of a Customer is handled according to that Customer’s documented instructions.

4. Cookies and Local Storage

Rechnelia uses cookies and browser storage that are necessary for authentication, session continuity, security, anti-forgery protection, language or interface preferences, and application operation. The commercial website also uses Google Analytics as described below. Analytics storage and measurement are activated only after consent where consent is legally required. Google Analytics is not used in the authenticated Rechnelia application.

5. Service Providers

IONOS

IONOS provides hosting infrastructure, databases, backups, and IONOS Object Storage through an S3-compatible interface. It may process Customer files, generated documents, logos, backup content, IP addresses, logs, and related technical metadata. Rechnelia does not use Amazon Web Services to operate this storage. See the IONOS privacy information.

Cloudflare Turnstile

Cloudflare Turnstile protects registration and other public forms from automated abuse. Cloudflare may receive IP address, browser and device signals, request metadata, and challenge results. Turnstile may use necessary browser technologies to perform the security check. See the Cloudflare Privacy Policy.

Stripe

Stripe Payments Europe, Ltd. and affiliated entities provide checkout, subscription management, metered billing, invoices, and payment-method management. Stripe receives identifiers and billing or transaction data necessary for those services. See the Stripe Privacy Policy.

Google Analytics - Commercial Website Only

The public commercial website uses Google Analytics 4, provided by Google Ireland Limited, to understand website traffic and how visitors interact with public marketing pages. Google Analytics is not used within the authenticated Rechnelia application and does not receive Customer invoice, customer, or workspace data from the application.

Depending on consent and configuration, Google Analytics may process a client identifier, pages viewed, session and interaction information, approximate location, browser and device information, operating system, language, referrer, and IP-derived technical information. We use this information to measure and improve the commercial website. The legal basis is consent under Article 6(1)(a) GDPR where consent is required. Consent may be withdrawn through the commercial website’s cookie settings.

Google may process data outside the European Economic Area using applicable transfer safeguards. See Google’s Privacy Policy and Google Analytics data-collection information.

Transactional Email

An SMTP email provider processes recipient addresses, message content, and delivery metadata to send account confirmation, invitation, password-reset, billing, and service messages. The current provider is identified in the Rechnelia Data Processing Agreement.

6. Recipients and International Transfers

We disclose personal data only to authorized personnel, the Customer responsible for the relevant workspace, service providers needed to operate Rechnelia, professional advisers subject to confidentiality, authorities where legally required, or parties involved in a corporate transaction subject to appropriate safeguards.

Where data is transferred outside the European Economic Area, we use an adequacy decision, approved standard contractual clauses, or another lawful transfer mechanism as required.

7. Retention

We retain personal data only as long as needed for the stated purposes. Account and Customer Data are generally retained for the account or contract term and a reasonable deletion period afterwards. Billing and business records may be retained for statutory periods. Security and operational logs are retained according to operational need. Backups expire through scheduled rotation. Data may be kept longer where required for legal claims or compliance.

8. Security

We use appropriate technical and organizational measures including access controls, tenant separation, authentication and authorization, encrypted transport, logging, backups, security updates, and restricted administrative access. No system can guarantee absolute security.

9. Your Rights

Subject to legal conditions, you may request access, rectification, erasure, restriction, portability, or objection, and may withdraw consent prospectively. You may also complain to a competent data-protection supervisory authority. For Customer-controlled invoice or customer data, first contact the Customer that provided the data; Rechnelia will assist that Customer where required.

Send privacy requests to kontakt@rechnelia.de. We may need to verify your identity.

10. Changes

We may update this policy for legal, operational, security, or product changes. The current version and effective date will be published with this document.