Privacy notice.

Valentin Döring
Kiefernring 6
14478 Potsdam
Germany

Email: freevallm@gmail.com

This notice covers the static marketing website rechnungstool.net, the app at app.rechnungstool.net and its remote MCP server. The data processed depends on whether you visit the site, create an anonymous invoice, or use an account and optional sending features.

Cloudflare, Inc. serves the static site through Cloudflare Workers Static Assets. Access may generate technically necessary data such as IP address, time, requested URL, data volume, referrer, browser and operating system, and HTTP status. This supports secure, stable delivery and detection of attacks or faults. The legal basis is Article 6(1)(f) GDPR: the legitimate interest in secure and reliable operation.

The site uses no web analytics, ad networks, external fonts, embedded videos, forms or analytics cookies. Fonts and product images are served locally.

Further information: Cloudflare privacy policy and Cloudflare Data Processing Addendum.

Vercel, Inc. hosts the application and MCP endpoint at app.rechnungstool.net. It processes necessary connection, server and delivery data for service operation, troubleshooting, security and abuse prevention. Article 6(1)(b) GDPR applies where processing is needed to provide the requested app; Article 6(1)(f) applies to secure and stable delivery.

Further information: Vercel privacy notice and Vercel DPA.

You can use Rechnungstool through a compatible assistant such as ChatGPT or Claude. Each provider processes chat, account and usage data under its own responsibility. When you enable Rechnungstool and confirm an invoice task, the assistant sends the details you approved to the MCP server. Rechnungstool does not control the provider's processing of chat histories and account data. Also review OpenAI's privacy policy or Anthropic's privacy policy and your settings there.

Rechnungstool processes details you or your assistant send for the invoice. These may include sender and recipient data, addresses, email addresses, tax and bank details, services, quantities, periods, amounts and invoice metadata. An invoice record and PDF are produced.

Anonymous invoices and PDFs are stored for 30 days and then deleted under the implemented retention rule. If you transfer the workspace into an account before then, the account rules apply. Article 6(1)(b) GDPR covers creating and providing the requested invoice; Article 6(1)(f) also applies to safe operation, troubleshooting and abuse prevention.

Depending on use, an account may involve email address, password hash or other authentication data, sender profiles, customers, items, drafts, final invoices, PDFs, status and sending data. Plain-text passwords are not stored. Article 6(1)(b) GDPR covers the account and selected features; Article 6(1)(f) covers security logs and prevention of unauthorised use.

Connection to an AI assistant uses OAuth 2.1 with PKCE and approved permission scopes. Access tokens are stored only as hashes, expire after one hour, and refresh tokens expire after 30 days. You can disconnect in the AI service or revoke permission. Expired or revoked tokens cannot be reused for account access.

Rechnungstool uses Convex for data models and file storage, including workspaces, account data, master data, drafts, final invoices and generated files. Convex processes these as a technical service provider for app operation. See the Convex privacy notice and Convex DPA.

For password resets and one-time codes, Rechnungstool uses Resend, a service of Plus Five Five, Inc. Recipient email, technical delivery data and email content are processed to secure sign-in or restore access. The legal basis is Article 6(1)(b) GDPR, plus Article 6(1)(f) for abuse prevention. See Resend's privacy notice and DPA.

You may configure your own SMTP credentials. Your chosen provider receives the recipient address, invoice and technical message and connection data needed for delivery; you choose and configure that provider. SMTP credentials are stored encrypted on the server. Sending logs may contain recipient, time, status and error messages. Article 6(1)(b) GDPR covers requested sending, and Article 6(1)(f) covers troubleshooting and abuse prevention.

Personal data goes only to providers needed for each feature: Cloudflare for the site, Vercel for app and MCP delivery, Convex for backend and files, Resend for account emails and your chosen SMTP provider for optional invoice delivery. Within Rechnungstool, access is limited to people who need it for operation, support or troubleshooting.

Cloudflare, Vercel, Convex and Resend are providers based in or processing data in the United States, so processing outside the European Economic Area may occur. Where necessary, transfers rely on mechanisms described in their linked contractual and privacy documents, particularly adequacy decisions or standard contractual clauses. The exact mechanism depends on provider, service and current contract.

Anonymous invoice data and PDFs are held for 30 days unless transferred to an account. Account data remains until deletion or as long as needed for selected functions. Data may be retained longer to meet legal duties or establish, exercise or defend claims. Rechnungstool does not guarantee automatic GoBD-compliant retention; users remain responsible for their applicable invoice retention duties.

Technical logs are deleted or anonymised once no longer needed for operation, security or troubleshooting, unless legal duties or a specific security incident require longer retention.

Besides the bases described above, Article 6(1)(c) GDPR may apply where processing is necessary to meet legal duties. Article 6(1)(a) applies where processing exceptionally depends on consent. Consent can be withdrawn for the future at any time; earlier lawful processing is unaffected.

Under the GDPR, you may have rights of access, correction, erasure, restriction and data portability. You may object to processing based on Article 6(1)(e) or (f). You may object to direct marketing at any time; Rechnungstool currently conducts no direct marketing through this website.

Send requests for access, correction, deletion, withdrawal or objection to freevallm@gmail.com. An appropriate identity check may be needed to prevent unauthorised disclosure. You may also complain to a data protection authority, in particular the Brandenburg Commissioner for Data Protection and Access to Information, Stahnsdorfer Damm 77, 14532 Kleinmachnow, Germany.

This site contains ordinary links to external sites and services. Their providers process access data under their own terms only when you open such a link. This notice will be updated when features, data flows or legal requirements change; the current version is available here.