1. Information We Collect

1.1 Personal Information

We may collect personal information that you voluntarily provide to us when registering for an account, including:

• Name and contact information
• Company information
• Email address
• Payment information (processed securely by our payment processor)
• Professional credentials

1.2 Financial Documents

As part of our service, we process financial documents that you upload. These may include:

• Financial statements (PDF, Excel, Word formats)
• Balance sheets and income statements
• Tax documents (in supported formats)
• Other financial records relevant to materiality calculations

1.3 Usage Data

We automatically collect certain information when you use our services:

• Log data (IP address, browser type, pages visited)
• Device information
• Usage patterns and analytics
• Performance data

2. How We Use Your Information

• To provide and maintain our services
• To process materiality calculations
• To improve and optimize our application
• To communicate with you about updates and support
• To comply with legal obligations
• To prevent fraud and ensure security

3. Data Security

We implement appropriate technical and organizational measures to protect your data:

• All data processed within EU servers (Germany)
• End-to-end encryption for data in transit
• Regular security audits and vulnerability assessments
• Access controls and authentication mechanisms
• Automatic document deletion according to retention policies

4. Data Retention

Data Type	Retention Period	Notes
Uploaded Documents	30-365 days	Based on your plan settings, automatically deleted after processing
Account Information	While account is active	Deleted upon account closure
Usage Data	24 months	Anonymized after 12 months
Payment Information	As required by law	Handled by payment processor, not stored by us

5. Your Rights (GDPR)

Under GDPR, you have the following rights regarding your personal data:

• Right to Access: Request copies of your personal data
• Right to Rectification: Request correction of inaccurate data
• Right to Erasure: Request deletion of your personal data
• Right to Restrict Processing: Limit how we use your data
• Right to Data Portability: Receive your data in a structured format
• Right to Object: Object to certain types of processing

6. Third-Party Services

We use the following third-party services that may process your data:

• Microsoft Azure: Cloud infrastructure and OCR processing
• Stripe: Payment processing
• Google Analytics: Usage analytics (anonymized data)
• Customer.io: Email communication

All third-party processors are GDPR-compliant and have Data Processing Agreements in place.