Privacy Policy – Bobits Flow (flow.bobits.at)

Last updated: [[STAND-DATUM]]

1. Controller

[[FIRMENNAME]], [[ANSCHRIFT]], email: [[E-MAIL]]
Privacy contact: [[DATENSCHUTZ-KONTAKT]]
Data protection officer: [[not appointed / appointed: NAME, CONTACT]] ⚠ to be checked (Art. 37 GDPR).

2. Scope and roles

This policy covers the web application "Bobits Flow" at flow.bobits.at, including its installable app version (PWA). Other websites of the provider (e.g. bobits.at) have their own notices.

Bobits Flow is accounting and administration software for businesses ("customers"). We process personal data in two roles:

• As controller (Art. 4(7) GDPR) for data we need for sign-up, the customer account, login, billing, operation, security and support. This policy describes that processing.
• As processor (Art. 28 GDPR) for all content customers store in Bobits Flow: invoices, receipts, customer and supplier data, bank transactions, employee and scheduling data, emails and documents in the inbox. The customer is the controller for that data. The data processing agreement (DPA), part of our terms, governs it. If you are a business partner or employee of a customer, please contact that customer.

⚠ to be checked: whether user accounts a customer creates for its own staff fall under our responsibility or are processed on the customer's behalf. This draft treats login data of all users as our own processing (security, login) and the remaining user data within a customer account as processing on behalf of the customer.

3. Processing in detail

3.1 Accessing the application (server and security logs)

When you access flow.bobits.at, our web server necessarily processes your IP address, date and time, requested address, HTTP status code, browser identifier (user agent) and referrer.

• The application logs each request in structured form (time, path, status code, duration, request ID and, for signed-in users, customer and user ID). These log lines do not contain the IP address.
• For requests within a customer account, the application also stores a request log with the request headers (including IP address and user agent) and the request and response content. Passwords, credentials and tokens are excluded or redacted. The latest 1,000 entries per customer account are kept; older ones are deleted automatically.
• To prevent abuse we count login, sign-up and other requests per IP address (rate limiting). These counters exist only in memory and expire after a short time (a few hours at most).

Purpose: provision, stability and security of the application; troubleshooting.
Legal basis: Art. 6(1)(f) GDPR (legitimate interest in secure and functioning operation); where needed to perform the contract, Art. 6(1)(b) GDPR.

Retention: operational logs 30 days (central log store) or until container log rotation (capped at 250 MB). Web server access logs: [[NGINX-LOG-DAUER]]. Request log in the customer account: see above (capped by count, no fixed period). ⚠ to be checked: count-based instead of time-based retention may not satisfy Art. 5(1)(e) GDPR.

3.2 Sign-up and customer account

At sign-up we process: company name, desired account identifier (slug), name of the administering person, email address and password. We store the password only as a bcrypt hash. We send a confirmation link to the email address; it is valid for 24 hours and we store only a hash of it. Login is not possible without confirmation. We are notified internally by email of new sign-ups (company name, identifier, email address).

During operation we store for user accounts: username, display name, email address, role, active status, time of last login and email confirmation, and an activity log of important actions. For the customer account we store plan, status and administrative events (e.g. a block with its reason, upgrade requests).

Purpose: entering into and performing the contract, account administration, abuse prevention.
Legal basis: Art. 6(1)(b) GDPR; for the internal notification and activity logs Art. 6(1)(f) GDPR.

This data is required to conclude the contract; without it we cannot set up an account.

3.3 Login and session

After login we set two strictly necessary cookies (see section 6). The session is linked to a refresh token we store server-side with an expiry date. Failed login attempts are logged with the user ID (if known) and a reason code, never with username or password.

Legal basis: Art. 6(1)(b) GDPR (providing the account) and (f) (security).

3.4 Billing for paid plans (Stripe)

Paid plans are billed through the payment provider Stripe. For billing we send Stripe the company name, the account's email address and internal identifiers (customer ID, account identifier, chosen plan). You enter payment details (e.g. card data) directly on Stripe's checkout page; we neither receive nor store them. We store the Stripe customer and subscription ID and the subscription status. Invoices and payment methods are managed in Stripe's customer portal.

Legal basis: Art. 6(1)(b) GDPR; retention of accounting records: Art. 6(1)(c) GDPR in conjunction with § 132 BAO and § 212 UGB.

⚠ to be checked: Stripe's role (independent controller for payment processing and fraud prevention, or processor) and transfers to Stripe, Inc. (USA).

3.5 System emails

We send email confirmation messages and internal sign-up notifications through [[E-MAIL-DIENSTLEISTER]]. Legal basis: Art. 6(1)(b) GDPR.

Emails customers send from Bobits Flow to their own customers (e.g. invoices) go through the mail server the customer configured and are part of the processing on the customer's behalf.

3.6 Error reports from the browser

When an error occurs in the application, your browser sends us an error report: error type and message, technical stack trace, component name, the page and address, and for failed server requests the method, path, status and request ID. Reports go to our central log store (30 days). Legal basis: Art. 6(1)(f) GDPR (fixing errors).

3.7 AI-assisted document reading (OpenAI)

On certain plans a customer can have documents read automatically: incoming and outgoing invoices, quotes and bank statements. We send the document (image, PDF or extracted text), the customer's company details (to tell "own company" from business partner) and up to five of the customer's earlier corrections as examples to the OpenAI API. The result is a proposal the user must check and confirm. No automated decision within the meaning of Art. 22 GDPR takes place.

This concerns customer content and is done on the customer's behalf (DPA). The customer can switch the feature off in the settings.

Recipient: OpenAI (see section 4). Processing takes place in the USA. ⚠ to be checked: transfer mechanism, contracting entity (OpenAI Ireland Ltd. or OpenAI, L.L.C.) and retention at OpenAI (to our knowledge up to 30 days for abuse monitoring unless a zero-data-retention agreement is in place).

3.8 Telegram (optional)

Customers can link a Telegram chat with our bot and send receipts, photos, PDFs and voice messages to it. Telegram processes these messages first; we download the files through the Telegram Bot API and store them in the customer's inbox. We store the Telegram chat ID and its link to the user. Legal basis: Art. 6(1)(b) GDPR (feature chosen by the user).
⚠ to be checked: Telegram is based outside the EU; there is no adequacy decision. Use is voluntary.

3.9 Other integrations (optional, enabled by the customer)

• Tesla: a customer can connect a Tesla account (OAuth). We then retrieve the charging history (sessions with time, location, vehicle identification number, energy, cost, invoices). We store the access tokens issued by Tesla.
• Own mail server (IMAP/SMTP): if a customer configures a mailbox, we fetch emails from it regularly and take attachments into the inbox; outgoing emails are sent through the configured SMTP server.
• Invoice export via FTP/SFTP: a customer can specify its own server to which invoice documents are transferred.

These integrations process customer content on the customer's behalf; the services named are endpoints chosen by the customer.

3.10 Exchange rates

To convert foreign currencies our server retrieves reference rates from the European Central Bank. No personal data of yours is transmitted.

3.11 Support and other enquiries

If you contact us by email, we process your details to handle the enquiry. Legal basis: Art. 6(1)(b) GDPR (contract-related) or (f) (other enquiries).

4. Recipients and processors

We run the central log store (Grafana/Loki) and the web server ourselves on the same Hetzner server; no further providers are used for this. The application embeds no analytics or tracking services, ad networks, social media plugins or external fonts.

One exception is the API documentation page (signed-in users on certain plans only): it loads program files from unpkg.com, which sends your IP address to the operator of unpkg.com. ⚠ to be checked / better fixed technically.

Beyond this we disclose data only where legally required (e.g. to authorities or courts).

5. Transfers to third countries

With OpenAI (USA), possibly Stripe (USA), Telegram and Tesla, data may leave the EEA. Where available we base such transfers on an adequacy decision (for the USA: the EU-US Data Privacy Framework, if the recipient is certified) or on the European Commission's standard contractual clauses (Art. 46(2)(c) GDPR). ⚠ to be checked per recipient. You can request a copy of the safeguards at [[DATENSCHUTZ-KONTAKT]].

6. Cookies and local browser storage

We use only cookies and storage that are required for the function you requested or that store a setting you chose (§ 165(3) Austrian Telecommunications Act 2021). We use no analytics, marketing or third-party cookies, so in our assessment no consent is required. ⚠ to be checked (in particular for language and table settings).

7. Retention

• Account data: for the term of the contract; then deleted within [[LÖSCHFRIST]] unless a legal retention duty applies.
• Billing records: 7 years from the end of the calendar year (§ 132 BAO, § 212 UGB), longer if relevant to pending tax or court proceedings.
• Operational logs: 30 days; request logs in the customer account: see 3.1.
• Backups: 30 days rolling ([[BESTÄTIGEN: backup cron active in production]]).
• Email confirmation links: valid for 24 hours.
• Customer content (processing on behalf): as instructed by the customer and per the DPA.

8. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20) and to object to processing based on Art. 6(1)(f) GDPR (Art. 21). Contact [[DATENSCHUTZ-KONTAKT]].

If your data is part of content a customer stored in Bobits Flow, please contact that customer. We forward requests that reach us to them.

9. Right to lodge a complaint

You may lodge a complaint with the Austrian Data Protection Authority (Österreichische Datenschutzbehörde), Barichgasse 40–42, 1030 Vienna, dsb@dsb.gv.at, www.dsb.gv.at.

10. Changes

We update this policy when the application or the law changes. The version published at [[DATENSCHUTZ-URL]] applies.