Privacy

Last updated: October 2026

1. Controller

The controller responsible for data processing on this website and in the application E-Rechnungsfreund is:

Nils Wehner
Wolfsgrube 11
97493 Bergrheinfeld

Email: privacy@e-rechnungsfreund.de

The controller is the natural or legal person who, alone or jointly with others, decides on the purposes and means of processing personal data (e.g. names, e-mail addresses).

2. Overview

This privacy policy explains which personal data we process when you visit this website and use E-Rechnungsfreund, for which purposes, on which legal basis and for how long. Personal data is any information that can be used to identify you personally.

3. Hosting at STRATO

This website and the application E-Rechnungsfreund are operated on servers of STRATO GmbH in Germany. The data processed in the application (in particular account data, invoice data and files, validation logs and server logs) is stored on these servers. The validation of e-invoices (KoSIT validator, Mustang, Saxon) also runs on these servers; uploaded files are not passed on to third parties for validation.

STRATO GmbH
Otto-Ostrowski-Straße 7
10249 Berlin

Hosting serves to fulfil our contracts with our users (Art. 6(1)(b) GDPR) and our legitimate interest in a secure and efficient provision of our service (Art. 6(1)(f) GDPR). STRATO processes the data on our behalf and only according to our instructions (Art. 28 GDPR). A data processing agreement pursuant to Art. 28 GDPR exists with STRATO.

To protect against data loss, the database and the stored files are backed up daily on the server. Backups are kept for 14 days and then deleted. Additional encrypted backups at an external storage location are planned.

4. Server log files and encryption

When you access this website, your browser automatically transmits information that our server processes in order to deliver the website:

• IP address
• date and time of the request
• requested page or file

This data is not merged with other data sources. The processing is based on Art. 6(1)(f) GDPR; our legitimate interest lies in the technically error-free and secure provision of the website. Server logs are kept for 7 days and then deleted.

Access log: Our web server writes an access log of the requests to this website. It contains the time of the request, the request method, the requested host and path without parameters (query string), the protocol, the status code, the size of the request and the response and the processing time, as well as your IP address shortened to the first three blocks (IPv4) or the first 48 bits (IPv6). Request and response headers (e.g. browser identification, cookies and login data) are not logged. The log files are renewed daily and deleted after 7 days. We use the access log to operate the website, to detect errors and attacks and to plan the capacity of the server; for this we only evaluate aggregated figures (e.g. number of requests, response times and status codes per area of the website). The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in the stable and secure operation of the website.

For security reasons and to protect the transmission of confidential content, this website uses TLS encryption. You can recognise an encrypted connection by the address line of the browser starting with "https://" and by the lock symbol in your browser bar.

5. Cookies and consent

Without your consent we only set cookies that are technically necessary for the operation of the website:

• cookiebanner: stores your cookie settings
• cookieconsent_id: random ID that links your cookie settings to our consent record (see below)
• csrftoken: protects forms against cross-site request forgery
• sessionid: keeps you logged in and stores session data, e.g. the number of free validations without an account
• messages: displays one-time notices

The storage of these cookies is based on Section 25(2) no. 2 TDDDG; the processing of the related data is based on Art. 6(1)(b) and (f) GDPR.

Other technologies that store information on your device or access it are only loaded after you have consented in the cookie banner. You decide separately for each purpose; nothing is preselected: "Improvements" (error monitoring in the browser with Sentry, see section 13), "Statistics" (web analysis with Matomo, see section 14) and "Marketing" (Google Ads conversion tracking, see section 15). The legal basis is Section 25(1) TDDDG and Art. 6(1)(a) GDPR. You can change or withdraw your consent for each group at any time with effect for the future via "Cookie Settings" at the bottom of each page.

Consent record: To be able to prove your consent (Art. 7(1) GDPR), we store every decision in the cookie banner on our server: the time, the version of the banner, your choice for each group and a random ID that is also stored in the cookie cookieconsent_id. We do not store your IP address or any reference to your user account. The legal basis is Art. 6(1)(c) GDPR in conjunction with Art. 7(1) GDPR. The entries are deleted after three full calendar years from the end of the year of the decision.

6. Registration and user account

To use the application you need a user account. For registration we process your e-mail address and your password (stored only as a hash value). We also store your language setting, the dates of registration and last login and any further details you enter in your account. We send you e-mails to confirm your e-mail address and to reset your password.

To protect against automated registrations, registration and password reset use a captcha. The captcha image is generated on our own server; no external captcha service is used.

The processing is based on Art. 6(1)(b) GDPR (user contract) and, for the captcha, on Art. 6(1)(f) GDPR (protection against abuse). The data is stored until you delete your account (see section 16).

Referral codes: If you enter a referral code when registering (the field is pre-filled if you open our website via a referral link, e.g. from your tax advisor), we store the code with your user account. Nothing is stored on your device for this. We only use the code to attribute the registration to the recommendation and to count registrations per referral source. If you have consented to "Statistics" in the cookie banner, the registration event in Matomo (see section 14) also contains this code. The legal basis for storing the code with your account is Art. 6(1)(f) GDPR; our legitimate interest is to measure which recommendations lead to registrations. The Matomo event is based on your consent (Art. 6(1)(a) GDPR). The code is stored until you delete your account.

7. Sending e-mails and contact

We send e-mails that are required for the use of the service (e.g. confirmation of the e-mail address, password reset, confirmation and cancellation of a subscription). The processing is based on Art. 6(1)(b) GDPR. The e-mails are sent via the mail server (SMTP) of STRATO GmbH in Germany; no data is transferred to a third country.

Sending invoices by e-mail: If you send an invoice from the invoice management by e-mail, we send it with the stored PDF or XML file to the recipient you specify, also via the mail server of STRATO. Replies go to the e-mail address of your account. For the invoice data of your business partners we act as a processor on your behalf (see section 9). To count the e-mails included in your plan, we store the recipient address, the time of sending and the invoice concerned in a sending log (Art. 6(1)(b) GDPR). Its entries are deleted automatically after 13 months and immediately when you delete your account. The sending also appears in the history of the invoice and is deleted together with the invoice.

Onboarding e-mails: After registration, once you have confirmed your e-mail address, we send you one e-mail explaining how to create your first e-invoice. This e-mail only concerns the use of the service and contains no advertising. The processing is based on Art. 6(1)(b) GDPR.

Only if you tick the box for tips by e-mail when registering (or switch them on in the user area) do we send you two further e-mails, 2 and 7 days after registration: tips on checking incoming invoices and information on the e-invoicing deadlines from 2027/2028. The legal basis is your consent (Art. 6(1)(a) GDPR, Section 7(2) UWG). As proof we store the time of your consent and the time each onboarding e-mail was sent until you delete your account.

You can unsubscribe from the onboarding e-mails at any time via the link in each e-mail (no login required) or in your user area. This also withdraws your consent with effect for the future. Apart from these onboarding e-mails, we do not send a newsletter.

If you contact us by e-mail, we process your details to handle your request (Art. 6(1)(b) GDPR if your request relates to a contract, otherwise Art. 6(1)(f) GDPR). We delete the data when it is no longer required, unless statutory retention obligations apply.

8. Invoice data, files and validations

When you create, import or manage invoices, we process the data they contain, e.g. names, addresses, contact details, tax numbers and VAT IDs, bank details (IBAN, BIC), invoice items and amounts. These may be your own data or data of your business partners. The invoices are stored in our database; generated files (XML, PDF) and attachments are stored on our server in a storage area that is not publicly accessible. Only your account has access to them.

When you validate an e-invoice, the uploaded file is only processed for the validation and is not stored unless you import it into the invoice management. Without an account we only count the number of validations in your session. With an account we store a validation log (time and file name of the validation) to calculate the validations included in your plan. The validation log is only used for the monthly quota. Its entries are deleted automatically after 90 days and immediately when you delete your account.

To display the result page, your browser passes the validation result, the uploaded invoice and its file name to the result page via the session storage (sessionStorage) of the browser. This data remains on your device, is bound to the browser tab and is deleted when you close the tab. This storage is technically necessary for the validation you requested (Section 25(2) no. 2 TDDDG).

Invoices you send by e-mail and the sending log (recipient address, time, invoice; stored for 13 months) are described in section 7.

E-Rechnungsfreund is not an archive within the meaning of the GoBD. You are responsible for retaining your invoices in accordance with the statutory retention obligations. Download all invoices and files you need to keep.

The processing is based on Art. 6(1)(b) GDPR. The data is stored until you delete the invoice or your account (see section 16).

9. Processing on behalf (Art. 28 GDPR)

Where invoice data contains personal data of your customers, suppliers or other third parties, you are the controller for this data. We process it on your behalf as a processor within the meaning of Art. 28 GDPR. The terms are laid down in our data processing agreement (DPA).

10. API keys

If you create API keys, we store the name, the prefix and a hash value of the key, the time of creation, any expiry date and the assignment to your account. The full key is only shown to you when it is created. The processing is based on Art. 6(1)(b) GDPR. API keys are deleted together with your account.

11. Payment processing with Stripe

For paid plans we use the payment service provider Stripe. For customers in the European Union the provider is Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland.

When you book a plan, we transmit your e-mail address to Stripe and forward you to the payment page of Stripe. There you enter your name, billing address and payment details directly with Stripe; we do not receive your complete payment details (e.g. card numbers). Stripe informs us about the subscription, payments and invoices; we store this billing data in our database. The processing is based on Art. 6(1)(b) GDPR and, for the retention of billing records, Art. 6(1)(c) GDPR.

Stripe may transfer data to Stripe, Inc. in the USA. Stripe is certified under the EU-U.S. Data Privacy Framework, for which the EU Commission has adopted an adequacy decision (Art. 45 GDPR). On the payment pages, the privacy policy of Stripe applies: https://stripe.com/privacy

If you delete your user account, your customer record at Stripe including the invoices for your plan remains stored, as are the billing data in our database. These are our invoices, which are subject to statutory retention obligations (Art. 17(3)(b) GDPR in conjunction with Section 147 AO and Section 257 HGB). The link to your user account is removed.

12. Cancellation and withdrawal declarations

If you declare the cancellation of a contract or a withdrawal via our website, we store your declaration with your name, your e-mail address, the contract concerned, the reason given and the time of receipt. We process this data to handle your declaration and to be able to prove its receipt. The legal basis is Art. 6(1)(c) GDPR (statutory obligations regarding cancellation and withdrawal) and Art. 6(1)(f) GDPR (our legitimate interest in proving the receipt). We store the declarations for three years from the end of the year in which they were received and then delete them.

13. Error monitoring with Sentry

To detect and fix errors, we use the error monitoring service Sentry of Functional Software, Inc. (USA). The data is stored in the EU data region of Sentry (Germany). If an error occurs in the application, technical information about the error (e.g. error message, affected function, requested address, browser type) is transmitted to Sentry. Invoice contents are not transferred to Sentry; recognisable identifiers (e-mail, IBAN) as well as tokens, passwords and cookies are masked before sending. By default, no IP addresses are transmitted. The processing on the server is based on our legitimate interest in an error-free service (Art. 6(1)(f) GDPR). Error monitoring in your browser is only loaded with your consent ("Improvements" in the cookie banner; Section 25(1) TDDDG, Art. 6(1)(a) GDPR).

As the provider is based in the USA, access to the data from the USA (a third country) cannot be ruled out, e.g. for support or maintenance. Functional Software, Inc. is certified under the EU-U.S. Data Privacy Framework; such transfers are based on the adequacy decision of the EU Commission for this framework (Art. 45 GDPR).

14. Web analysis with Matomo

With your consent ("Statistics" in the cookie banner) we use the open source web analysis service Matomo. Matomo sets cookies (_pk_*) and processes, among other things, your IP address, the pages you visit and the time of the visit, the referrer URL as well as browser, operating system and device type. We use this data to analyse and improve the use of our website. The legal basis is Section 25(1) TDDDG and Art. 6(1)(a) GDPR. You can withdraw your consent at any time via "Cookie Settings". We host Matomo ourselves on our server at STRATO in Germany; the analysis data is not passed on to third parties. IP addresses are anonymised (the last two bytes are removed). The raw data is deleted after 6 months.

Usage events: If you have consented to "Statistics", we also send events to Matomo when you complete certain steps: a validation without a user account, the completion of the registration, the creation or import of your first and of every further invoice, and a successful subscription checkout. An event only contains the step and, for invoices, whether the invoice was created or imported; the registration event additionally contains the referral code if you entered one (see section 6). Names, e-mail addresses and invoice contents are not part of the events. Like page views, the events are assigned to your visit in Matomo. We use them to measure how many visitors reach the individual steps. Until the next page is loaded, the event is noted in your session on our server; without your consent it is then discarded and not sent. The legal basis is Section 25(1) TDDDG and Art. 6(1)(a) GDPR.

15. Google Ads conversion tracking

With your consent ("Marketing" in the cookie banner) we load the Google tag (gtag.js) for Google Ads conversion tracking. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google sets cookies and processes, among other things, your IP address and information about your visit in order to measure whether visitors reach our website via an ad. The legal basis is Section 25(1) TDDDG and Art. 6(1)(a) GDPR. You can withdraw your consent at any time via "Cookie Settings". Further information: https://policies.google.com/privacy

Cookies and storage period: According to Google, the cookies _gcl_au and _gcl_aw are stored on our domain for 90 days, and the cookies IDE (13 months) and test_cookie (15 minutes) on the domain doubleclick.net. Source: https://business.safety.google/adscookies/

Google Consent Mode v2: We transmit your choice to Google via Google Consent Mode v2. Before the Google tag starts, all consent signals are set to "denied"; with your consent we set the advertising signals (ad_storage, ad_user_data, ad_personalization) to "granted". The signal for analytics (analytics_storage) remains "denied", as we do not use Google Analytics. Without your consent the Google tag is not loaded at all.

Role of Google and third-country transfer: According to Google, Google acts as an independent controller for Google Ads conversion tracking; the Google Ads Controller-Controller Data Protection Terms apply (https://business.safety.google/adscontrollerterms/). Data may be transferred to Google LLC in the USA. Google LLC is certified under the EU-U.S. Data Privacy Framework; the transfer is based on the adequacy decision of the EU Commission for this framework (Art. 45 GDPR).

16. Storage period and deletion

Unless a more specific storage period is stated in this privacy policy, your personal data remains with us until the purpose of the processing no longer applies. If you assert a justified request for deletion or withdraw your consent, your data will be deleted unless we have other legally permissible reasons for storing it (e.g. retention periods under tax or commercial law); in that case it is deleted once these reasons cease to apply.

You can delete individual invoices yourself; their files are deleted with them. You can delete your user account in the user area as long as no subscription is running. Deleting the account immediately and permanently deletes your account data and all your invoices including their files (XML, PDF, attachments), payments, templates, API keys, validation logs and sending logs. The billing data of your subscription (see section 11) and cancellation and withdrawal declarations (see section 12) are excepted.

Deleted data remains in the daily backups on the server until they are deleted in the course of the regular rotation after 14 days.

17. Legal bases

If you have consented to the data processing, we process your personal data on the basis of Art. 6(1)(a) GDPR. If you have consented to the storage of cookies or to access to information on your device, the processing is additionally based on Section 25(1) TDDDG. Consent can be withdrawn at any time. If your data is required to fulfil a contract or to carry out pre-contractual measures, we process it on the basis of Art. 6(1)(b) GDPR. If your data is required to fulfil a legal obligation, we process it on the basis of Art. 6(1)(c) GDPR. The processing may also be based on our legitimate interest pursuant to Art. 6(1)(f) GDPR. The legal basis applicable in each case is stated in the sections of this privacy policy.

Obligation to provide data: You are not obliged by law or by contract to provide personal data. However, the data required for registration (e-mail address and password) and for a paid plan (billing data at Stripe) is necessary for the conclusion and performance of the contract; if you do not provide it, we cannot set up a user account or a paid plan for you. You can visit the website without providing such data.

Automated decision-making: We do not use automated decision-making including profiling within the meaning of Art. 22 GDPR.

18. Your rights

Withdrawal of your consent

You can withdraw consent you have given at any time. The lawfulness of the processing carried out until the withdrawal remains unaffected.

Right to object (Art. 21 GDPR)

IF THE DATA PROCESSING IS BASED ON ART. 6(1)(E) OR (F) GDPR, YOU HAVE THE RIGHT TO OBJECT TO THE PROCESSING OF YOUR PERSONAL DATA AT ANY TIME ON GROUNDS RELATING TO YOUR PARTICULAR SITUATION; THIS ALSO APPLIES TO PROFILING BASED ON THESE PROVISIONS. THE LEGAL BASIS ON WHICH A PROCESSING IS BASED IS STATED IN THIS PRIVACY POLICY. IF YOU OBJECT, WE WILL NO LONGER PROCESS YOUR PERSONAL DATA CONCERNED UNLESS WE CAN DEMONSTRATE COMPELLING LEGITIMATE GROUNDS FOR THE PROCESSING WHICH OVERRIDE YOUR INTERESTS, RIGHTS AND FREEDOMS, OR THE PROCESSING SERVES THE ESTABLISHMENT, EXERCISE OR DEFENCE OF LEGAL CLAIMS (OBJECTION PURSUANT TO ART. 21(1) GDPR).

IF YOUR PERSONAL DATA IS PROCESSED FOR DIRECT MARKETING, YOU HAVE THE RIGHT TO OBJECT AT ANY TIME TO THE PROCESSING OF PERSONAL DATA CONCERNING YOU FOR SUCH MARKETING; THIS ALSO APPLIES TO PROFILING INSOFAR AS IT IS RELATED TO SUCH DIRECT MARKETING. IF YOU OBJECT, YOUR PERSONAL DATA WILL NO LONGER BE USED FOR DIRECT MARKETING (OBJECTION PURSUANT TO ART. 21(2) GDPR).

Right to lodge a complaint with a supervisory authority

In the event of violations of the GDPR, data subjects have the right to lodge a complaint with a supervisory authority, in particular in the member state of their habitual residence, their place of work or the place of the alleged violation. This right exists without prejudice to any other administrative or judicial remedy.

Right to data portability

You have the right to have data that we process automatically on the basis of your consent or in fulfilment of a contract handed over to you or to a third party in a common, machine-readable format. If you request the direct transfer of the data to another controller, this will only be done insofar as it is technically feasible.

Access, rectification and erasure

Within the scope of the applicable statutory provisions, you have the right at any time to free information about your stored personal data, its origin and recipients and the purpose of the data processing and, if applicable, a right to rectification or erasure of this data. For this and other questions about personal data, you can contact us at any time.

Right to restriction of processing

You have the right to request the restriction of the processing of your personal data. You can contact us about this at any time. The right to restriction of processing exists in the following cases:

• If you dispute the accuracy of your personal data stored by us, we usually need time to verify this. For the duration of the review, you have the right to request the restriction of the processing of your personal data.
• If the processing of your personal data was or is unlawful, you can request the restriction of the data processing instead of erasure.
• If we no longer need your personal data but you need it to exercise, defend or assert legal claims, you have the right to request the restriction of the processing of your personal data instead of erasure.
• If you have lodged an objection pursuant to Art. 21(1) GDPR, your interests and ours must be weighed. As long as it has not yet been determined whose interests prevail, you have the right to request the restriction of the processing of your personal data.

If you have restricted the processing of your personal data, this data may – apart from its storage – only be processed with your consent or for the establishment, exercise or defence of legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest of the European Union or of a member state.

Objection to advertising e-mails

We hereby object to the use of contact data published within the scope of the legal notice obligation for sending unsolicited advertising and information material. We expressly reserve the right to take legal action in the event of unsolicited advertising, such as spam e-mails.

Parts of this text are based on: https://www.e-recht24.de