We take the protection of your personal data very seriously. Below we inform you in detail about how your data is handled when using the Solobuch platform in accordance with the General Data Protection Regulation (GDPR/DSGVO). Last updated: 27 September 2026
1. Controller
The controller responsible for processing personal data on this website within the meaning of Art. 4 No. 7 GDPR is: mcarrow software UG (haftungsbeschränkt) Bornstraße 19, 58762 Altena, Germany Email: [email protected] Phone: +49 160 91470380
2. Hosting and Infrastructure (Hetzner)
Our platform is hosted on servers of Hetzner Online GmbH (Industriestr. 25, 91710 Gunzenhausen, Germany). The server location is Germany (EU). The use of Hetzner is based on Art. 6 Abs. 1 lit. f GDPR (legitimate interest in the secure, fast and efficient delivery of our online services). We have concluded a Data Processing Agreement (DPA) with Hetzner in accordance with Art. 28 GDPR, which ensures that Hetzner processes our users' data solely according to our instructions and in compliance with the GDPR.
3. Server Log Files, Security and Abuse Prevention
Each time you access our website, our web server automatically processes technical data: IP address, date and time, requested address (URL), HTTP status code, amount of data transferred, referrer and browser identifier (user agent). Our application also automatically checks requests for attacks and bots (web application firewall) and limits the number of requests per IP address or user account (rate limiting). For this purpose we store counters with the IP address or user ID in a Redis store on our servers in Germany; they expire automatically at the end of the time window (1 to 10 minutes depending on the function). Server log files are deleted after 14 days unless they are needed longer to investigate a specific security incident. The legal basis is our legitimate interest in secure and stable operation and in defending against attacks (Art. 6 (1) (f) GDPR).
4. Registration and Sign-in (Google)
You sign in to Solobuch with your Google account (Google OAuth; Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). Google transmits your email address, name and profile picture to us, which we store in our database. While you are signed in, we set a session cookie (section 10); sessions expire after 30 days. The legal basis is Art. 6 (1) (b) GDPR (performance of the user agreement). Google also processes data in the USA; Google LLC is certified under the EU-US Data Privacy Framework (DPF) (adequacy decision, Art. 45 GDPR). We store your account data for as long as your account exists. You can delete your account yourself at any time in the profile settings under “Delete account”. Your account and all associated data (invoices, clients, expenses, receipts, settings) are then deleted immediately and any active subscription is cancelled. Invoices we issued to you for your subscription are retained for 8 or 10 years due to statutory obligations (§ 147 AO, § 257 HGB; Art. 6 (1) (c) GDPR).
5. Data Processing for Invoicing
When you create invoices on our platform, we process the data you enter (sender data, customer data, invoice amounts, tax numbers, descriptions, banking details). This data is necessary for the performance of our contractual obligations (Art. 6 Abs. 1 lit. b GDPR) as well as for compliance with legal obligations such as German GoBD and tax retention requirements (Art. 6 Abs. 1 lit. c GDPR). Invoices and their embedded XML metadata (ZUGFeRD/XRechnung) are stored securely in our database and object storage (MinIO) on servers in the EU.
6. Tax Advisor Access and Public Links
You can give your tax advisor read access to your invoices, expenses, receipts and DATEV exports via a personal access link, and create public links to invoices or payment reminders. The links contain a random, unguessable token and are not indexed by search engines. Anyone who knows the link can view the shared data. For each access we store the token, the name you assigned, an optional expiry date and the status. You can revoke access links at any time in the settings; they are deleted with your account at the latest. The legal basis is Art. 6 (1) (b) GDPR.
7. Payment Processing via Stripe
To process payments and subscriptions, we use the payment service provider Stripe Payments Europe, Ltd. (1 Grand Canal Street Lower, Canal Dock, Dublin, Ireland). When you subscribe, your payment data (e.g. credit card details, billing address) is transmitted directly to Stripe. We do not store complete credit card information on our servers. The transfer of your data to Stripe is based on Art. 6 Abs. 1 lit. b GDPR (contract performance). Since Stripe Inc. processes data in the USA, it is certified under the EU-US Data Privacy Framework (DPF) to ensure an adequate level of data protection. For further details, please refer to Stripe's Privacy Policy (https://stripe.com/privacy).
8. Email Delivery via Resend
For sending system-relevant emails (e.g. notifications about your account, your subscription and tax deadlines) and for the optional direct delivery of invoices to your clients, we use Resend (Resend Labs Inc., 315 Montgomery St, San Francisco, CA 94104, USA). In doing so, email addresses and invoice details are transferred to Resend. This service is used to perform our contract (Art. 6 Abs. 1 lit. b GDPR) and based on our legitimate interest in reliable email delivery (Art. 6 Abs. 1 lit. f GDPR). Resend Labs Inc. is certified under the EU-US Data Privacy Framework (DPF), and we have concluded Standard Contractual Clauses (SCC) to secure an adequate level of data protection.
9. Error Tracking via Sentry
To improve stability and troubleshoot our application, we use Sentry, a service provided by Functional Software Inc. (Sentry, 45 Fremont Street, San Francisco, CA 94105, USA). When an error occurs, Sentry transmits technical data such as browser type, operating system, time of error, error message, the URL accessed and, where applicable, your internal user ID. In addition, performance data (e.g. loading times) is collected for about 10% of page views. IP addresses, cookies, names and email addresses are removed before transmission; the data is therefore pseudonymized, not anonymized. Sentry (Functional Software Inc.) is certified under the EU-US Data Privacy Framework (DPF). The legal basis is our legitimate interest in the stable and error-free operation of our service (Art. 6 (1) (f) GDPR).
10. Cookies, Local Storage and Consent Management
We use cookies and similar technologies (the browser’s local storage). Technically necessary storage takes place without consent (§ 25 (2) No. 2 TDDDG); everything else only with your consent (§ 25 (1) TDDDG). Technically necessary: - authjs.session-token and other authjs.* cookies: sign-in and protection against misuse (CSRF), up to 30 days - cookie-consent (local storage): your cookie choice, 12 months - referred_by_code: only when you open a partner link, to assign your registration to the partner (the most recently opened partner link applies), 60 days - affiliate_invite_token, promo_invite_token: only when you open an invitation or promo link, to assign your registration to the invitation or offer, 30 days - The browser’s local database (IndexedDB): drafts and offline data of the app on your device Only with consent: - Statistics: Google Analytics 4 and Google Tag Manager (section 11) - Marketing: Meta Pixel and Google advertising signals (section 12) After registration we set the cookie just_registered for 2 minutes. It is only evaluated if you have consented to “Statistics”, to measure the completed registration. We also store your choice in a consent log so that we can prove consent (Art. 7 (1), Art. 6 (1) (c) GDPR). The log contains only a random ID, the banner version, your choice and the time, no IP address and no user ID. Entries are deleted after 3 years. You can change or withdraw your choice at any time via “Cookie settings” in the footer.
11. Web Analytics with Google Analytics 4 and Google Tag Manager
With your consent to “Statistics”, we use Google Analytics 4 (GA4) and Google Tag Manager (GTM) provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Before you consent, these services are not loaded and no data is transferred to Google. GA4 collects pseudonymous usage data such as pages viewed, time spent, approximate region, device and browser information and events (e.g. completed registration) and sets cookies for this purpose (_ga, _ga_*, up to 2 years). GA4 does not store IP addresses. Google also processes the data in the USA; Google LLC is certified under the EU-US Data Privacy Framework (Art. 45 GDPR). Analytics data is deleted after 14 months at the latest. The legal basis is your consent (Art. 6 (1) (a) GDPR, § 25 (1) TDDDG). You can withdraw it at any time with effect for the future via “Cookie settings” in the footer. Google privacy policy: https://policies.google.com/privacy
12. Meta Pixel and Google Advertising Signals (Marketing)
With your consent to “Marketing”, we use the Meta Pixel provided by Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland. The pixel records which pages you visit and which actions you take (e.g. registration) and sets cookies for this purpose (_fbp, up to 90 days). Meta may link this information to your Facebook or Instagram account and use it for its own purposes. We are jointly responsible with Meta for collecting this data on our website and transmitting it to Meta (Art. 26 GDPR). The agreement is available at https://www.facebook.com/legal/controller_addendum. Under it, Meta is responsible for fulfilling data subject rights regarding the data stored by Meta; you can also contact us. Further processing by Meta is Meta’s sole responsibility. Meta also processes data in the USA; Meta Platforms Inc. is certified under the EU-US Data Privacy Framework. With the same consent we enable advertising signals to Google via Google Consent Mode (ad_storage, ad_user_data, ad_personalization) so that Google can measure the success of ads and personalise ads. The legal basis is your consent (Art. 6 (1) (a) GDPR, § 25 (1) TDDDG), which you can withdraw at any time via “Cookie settings”. Meta privacy policy: https://www.facebook.com/privacy/policy
13. Push Notifications
If you enable push notifications in the app (e.g. for tax deadlines), your browser creates a push address (endpoint) with keys, which we store together with your user ID. Notifications are delivered encrypted via your browser vendor’s push service (e.g. Google Firebase Cloud Messaging, Apple Push Notification Service, Mozilla Push Service). These providers process your IP address and the time of delivery, including in the USA. The legal basis is your consent (Art. 6 (1) (a) GDPR, § 25 (1) TDDDG). You can withdraw it by disabling notifications in the app or in your browser settings; the push address is then deleted, at the latest with your account.
14. Partner Program, Invitation and Promo Links
If you apply for our partner program, we process your details (name, phone number, email address, company name, business status, tax number or VAT ID (stored encrypted), country, information on promotion channels) to review the application and contact you (Art. 6 (1) (b) and (f) GDPR). The application is stored linked to your account and additionally sent to us by email via Resend (section 8). As a partner, we store your partner code, commission balance, commission entries and payout details (IBAN or PayPal address, stored encrypted) for settlement (Art. 6 (1) (b) GDPR). We retain accounting and payout records in accordance with § 147 AO and § 257 HGB (Art. 6 (1) (c) GDPR). If someone registers via a partner link, we store the link to the partner code and calculate the commission from the subscription payments. In the dashboard, the partner only sees a partially masked email address (e.g. a***[email protected]) and the registration date, no invoice or account data. If you open an invitation or promo link, we store the code in a cookie (section 10) and assign it to your account after registration in order to provide the offer (Art. 6 (1) (b) GDPR).
15. Feedback and Contact Form
If you write to us via the feedback form, we process your name, email address, selected category, rating and message in order to answer your request (Art. 6 (1) (b) or (f) GDPR). The message is delivered to us by email via Resend (section 8) and is not stored in our database. To prevent spam, we check requests automatically and limit the number per IP address (section 3). We delete the message once the request has been fully handled and no statutory retention obligations apply.
16. Professional Liability Seal of exali AG
In our legal notice (Impressum) we display the liability seal of exali AG as proof of our professional liability insurance (§ 2 (1) No. 11 DL-InfoV). The graphic is served from our own server; no data is transferred to exali AG when the page is loaded. Only when you click on the seal do you leave our website and are redirected to the website of exali AG, where the privacy policy of exali AG applies (https://www.exali.de/Ueber-exali/Rechtliches/Datenschutzerklaerung,100401.php).
17. Right to Object under Art. 21 GDPR
Where we process personal data on the basis of legitimate interests (Art. 6 (1) (f) GDPR), you have the right to object to this processing at any time on grounds relating to your particular situation. We will then no longer process the data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims. You can object informally, e.g. by email to [email protected].
18. Your Rights as a Data Subject
Under the GDPR, you have the following rights: - Right of access (Art. 15) - Right to rectification (Art. 16) - Right to erasure ('right to be forgotten', Art. 17) - Right to restriction of processing (Art. 18) - Right to data portability (Art. 20) - Right to object (Art. 21) - Right to withdraw consent (Art. 7 Abs. 3) - Right to lodge a complaint with a supervisory authority (Art. 77) Competent Supervisory Authority: Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW), Kavalleriestr. 2-4, 40213 Düsseldorf, Germany. To exercise these rights, you can contact us at any time via email at [email protected]. Providing your data is neither required by law nor by contract. However, without an email address and name (via your Google account) we cannot provide you with an account. No automated decision-making including profiling within the meaning of Art. 22 GDPR takes place. We have not appointed a data protection officer, as the requirements of § 38 BDSG are not met.
19. Telegram notifications
If you enable tax deadline reminders via Telegram, you connect your Telegram chat to Solobuch. For this we store the chat ID (encrypted) and the time of the connection; we do not store your Telegram username or name. Through our Telegram bot we send you messages containing the name of your profile, the kind of tax deadline, the period, the due date and a link to the application; tax numbers, VAT IDs, amounts and invoice or client data are not transmitted. The recipient is Telegram (Telegram Messenger Inc. or Telegram FZ-LLC, Dubai, United Arab Emirates). Processing also takes place outside the EU/EEA; there is no adequacy decision for this transfer, and messages in chats with bots are not end-to-end encrypted. The legal basis is your explicit consent (Art. 6(1)(a), Art. 49(1)(a) GDPR). You can withdraw your consent at any time with effect for the future by disconnecting in the settings or in the chat with /stop; the chat ID is then deleted. We keep delivery logs (time, channel, status – without message content) for three years to prove how the function works (Art. 6(1)(f) GDPR, limitation periods) or until your account is deleted.