Privacy Policy
The current version reflects the product direction, but not a final legal release state.
Data Controller
OzyCore GmbH Kreuzberger Ring 24 65205 Wiesbaden Email: info@ozycore.de
Purpose of processing
Processing inbound invoice documents, user accounts, export data, audit trails and product-related communication.
Data location
Invoice data and documents are stored in Frankfurt (AWS eu-central-1, an ISO 27001/SOC 2 certified data center). The application runs in the EU region Frankfurt. Vercel Inc. (USA, DPF-certified) is a data processor under EU Standard Contractual Clauses.
Cookies and consent management
We use three cookie categories that you can manage at any time via the consent banner or the “Cookie settings” footer link: Essential: Login sessions, security tokens (CSRF, Turnstile) and language preference. Without these cookies the service cannot function. Analytics: Google Analytics 4 (conversion and usage measurement). These cookies are only set after your explicit consent; without consent no script is loaded and no request is sent to googletagmanager.com or google-analytics.com. Marketing: Google Ads conversion measurement, only after consent. Without your consent no Google Ads tag is loaded and no conversion data is transmitted. Your consent decision is stored locally in your browser under the key “cookie-consent-v1” and can be withdrawn at any time via the footer link. A final legal review of this section (data processing agreement with Google, third-country data transfers, retention periods) is part of the GA preparation.
Data Processors / Sub-Processors
The following external service providers process personal data on our behalf in accordance with Art. 28 GDPR:
Microsoft Ireland Operations Limited
Service: Azure Document Intelligence (OCR processing of PDF receipts). Processing region: Germany West Central (Frankfurt). Retention: maximum 24 hours during processing; the analyse result is also actively deleted via the Delete-Analyze-Result API immediately after our server has retrieved it. Contractual basis: Microsoft Products and Services Data Protection Addendum (DPA), including EU Standard Contractual Clauses. Data categories: PDF content of uploaded receipts (may contain personal data — e.g. names, addresses, contact details of suppliers and employees). Purpose: Structured extraction of invoice data from PDF receipts that are not in EN-16931 XML format. Legal basis: Art. 6 (1) (b) GDPR (performance of contract) in conjunction with Art. 28 GDPR (data processing on behalf).
European Commission (VIES — VAT Information Exchange System)
Service: VAT identification number validation via the public VIES REST API (https://ec.europa.eu/taxation_customs/vies/). Processing region: European Union. Retention: in accordance with the retention rules of the public VIES register; the validation result is cached in our database for a maximum of 30 days. Data categories: VAT-ID (public business identifier); for validated numbers VIES returns company name and address from the public register. Purpose: Validating the validity of a VAT-ID, in particular for cross-border transactions within the EU. Legal basis: Art. 6 (1) (c) GDPR (legal obligation; § 18e UStG requires the plausibility check of business partners' VAT-IDs).
Federal Central Tax Office (BZSt — confirmation of foreign VAT-IDs)
Service: simple confirmation request for a foreign EU VAT-ID via the BZSt's public eVatR REST interface (https://api.evatr.vies.bzst.de). Processing region: Germany. Data transmitted: your company's German VAT-ID (as the requesting party) and the supplier's VAT-ID. Company name and address are not transmitted. Retention: at the BZSt according to its rules; on our side the result (valid/invalid, time, source) is stored on the supplier record and re-checked after 30 days at the latest. If the BZSt does not respond, we query VIES instead (see above). Purpose: Confirming the validity of VAT-IDs of suppliers from other EU member states. Legal basis: Art. 6 (1) (c) GDPR (legal obligation; confirmation procedure under § 18e UStG).
Subprocessors (full list)
• Supabase, Inc. (USA) – database, object storage, authentication; processed in the EU region Frankfurt (AWS eu-central-1); EU Standard Contractual Clauses • Vercel, Inc. (USA, EU-US Data Privacy Framework) – hosting of the web and API layer in the EU region Frankfurt (fra1); account and log data may be processed in the USA; EU Standard Contractual Clauses • Mailgun Technologies, Inc. (USA) – receiving and sending email via the EU region; EU Standard Contractual Clauses • Stripe Payments Europe, Ltd. (Ireland) – payment processing and invoicing • Functional Software, Inc. (Sentry, USA) – error and security monitoring in the EU/DE region; EU Standard Contractual Clauses • Inngest, Inc. (USA) – execution of background jobs (job metadata, no invoice content); location per vendor, EU Standard Contractual Clauses • Upstash, Inc. (USA) – rate limiting (hashed keys, no content); location per vendor, EU Standard Contractual Clauses • Cloudflare, Inc. (USA, EU-US Data Privacy Framework) – bot protection (Turnstile) on public forms • Fly.io, Inc. (USA) – operation of the KoSIT validator and the PDF review sandbox in the Frankfurt region; EU Standard Contractual Clauses • Microsoft Ireland Operations Limited – Azure Document Intelligence (OCR) in the Germany West Central region • Google Ireland Limited – Google Analytics 4 and Google Ads only after consent via the cookie banner; no processing of invoice data (website usage only, not a subprocessor under Art. 28 GDPR for customer data)
Google Ads / Remarketing
Only after your consent to the “Marketing” category do we transmit conversion events (e.g. registration) to Google Ireland Limited. Without consent, no Google Ads tag is loaded. Legal basis: Art. 6 (1) (a) GDPR; you can withdraw consent at any time via “Cookie settings” in the footer.
Supervisory Authority
Der Hessische Beauftragte für Datenschutz und Informationsfreiheit Gustav-Stresemann-Ring 1 65189 Wiesbaden Phone: +49 611 1408-0 Email: poststelle@datenschutz.hessen.de