Privacy Policy

The controller under Art. 4(7) GDPR is:

The operator is controller for its own account and business data and for running the portal. The operator processes the business content of a client inside a project to perform the contract between the freelancer and that client.

This portal is for the operator (a freelancer) and the operator's business clients. It is not intended for consumers. This policy covers the portal and its sign-in, sign-up and invitation pages.

• Account data: name, email address, time zone.
• Freelancer business data: address, tax number, VAT ID, bank details (IBAN, BIC).
• Client data: company, contact name, email, phone, address, VAT ID, Leitweg-ID, e-invoice email.
• Project data: projects, tasks, milestones, meetings, messages, uploaded files, time entries.
• Billing data: invoices and payments.
• Activity logs and notifications.
• Technical server logs (IP address, user agent, timestamps), processed by the hosting provider.

Providing this data is necessary to use the portal. Without it, we cannot create an account or perform the contract.

• Art. 6(1)(b) GDPR: accounts, access, project work, messages, files, time tracking, invoicing, and pre-contract steps.
• Art. 6(1)(c) GDPR: statutory retention and accounting duties (§ 147 AO, § 257 HGB).
• Art. 6(1)(f) GDPR: security, server logs, abuse prevention, and keeping the portal running. Our interest is a secure and stable service.

There is no automated decision-making or profiling under Art. 22 GDPR.

We use these processors under data processing agreements:

• Clerk, Inc. (USA): authentication, sessions, and Google sign-in through Clerk.
• Cloudflare, Inc.: hosting on Cloudflare Workers (global edge network), file storage in Cloudflare R2 (EU jurisdiction bucket), and Cloudflare Turnstile (bot and abuse protection on sign-in, see section 8).
• Neon, Inc.: PostgreSQL database in region AWS eu-central-1 (Frankfurt).
• Resend: transactional email (invitations, invoice delivery, notifications). Resend may process data in the USA.

Other recipients are the freelancer and the client of a project, each limited to the data of that project. We do not sell data. There is no analytics, tracking, advertising, or error-tracking service.

The hosted portal currently sends no data to AI services. If an AI assistant is enabled in future, we will update this policy before it is used.

Clerk, Cloudflare, Neon and Resend may process data in the USA or other third countries. Transfers rely on the EU-US Data Privacy Framework where the provider is certified, and otherwise on Standard Contractual Clauses (Art. 46 GDPR).

We set only strictly necessary Clerk session cookies. Cloudflare Turnstile protects the sign-in step against bots and abuse. It processes your IP address and browser and device signals. This is based on Art. 6(1)(f) GDPR (security) and is strictly necessary under § 25(2) No. 2 TDDDG. Your browser's localStorage and sessionStorage hold interface settings and unsaved drafts. The legal basis is § 25(2) No. 2 TDDDG. Because nothing non-essential is set, there is no consent banner.

• Account data: kept while access exists.
• Revoked portal access ends the login. Project records stay with the freelancer.
• Invoices are immutable and kept for up to 10 years as statutory retention periods require.
• Database backups are kept for 30 days on a rolling basis.

We use TLS for all connections, role-based access, and client isolation: clients see only their own data. Files are stored privately and served through short-lived signed URLs. No system is perfectly secure.

• Access, rectification, erasure, restriction, portability (Art. 15-20 GDPR).
• Objection to processing based on Art. 6(1)(f) (Art. 21 GDPR).
• Withdrawal of consent at any time, with effect for the future.
• Complaint to a supervisory authority, for example the authority of your place of residence or the authority competent for the operator in its German state.

To exercise your rights, write to the email address in section 1.

We update this policy when the portal or the law changes. The date at the top shows the current version.