Privacy policy

1. Controller

KRUPKA Concept GmbH, Grabenstraße 18, 40789 Monheim am Rhein, Germany. E-mail for data protection enquiries: office@krupkagmbh.com.

2. Purposes and legal bases

We process personal data to provide BOB and to perform our contracts with you — account, projects, documents, purchases, reminders and the related confirmations (Art. 6(1)(b) GDPR). Where a law obliges us to process data, Art. 6(1)(c) GDPR is the legal basis: for the contract confirmation after a purchase (Section 312f BGB), for confirming a cancellation (Section 312k BGB) or a withdrawal (Section 356a BGB) and for retaining invoice records (Section 147 AO, Section 257 HGB). We rely on our legitimate interests (Art. 6(1)(f) GDPR) for the security of the service, preventing misuse, troubleshooting, proving declarations that have been made (section 8) and the notices about the end of your trial (section 6). What we only do with your consent (Art. 6(1)(a) GDPR) is described in section 9.

We do not sell data; documents are not analysed for advertising purposes.

Do you have to provide data? For an account, we need your email address; for a purchase, we also need the payment details requested by our payment service provider (section 5). Without them, we cannot conclude a contract with you. For a cancellation or withdrawal via our website, we need the details that allow us to identify you and the contract (section 8). Everything else — such as project content and documents — you provide voluntarily; if it is missing, BOB cannot carry out the function in question. You are not legally obliged to provide us with data.

3. Hosting and storage

Project and document data are stored with Supabase (Supabase Inc.) in the Frankfurt am Main region (AWS eu-central-1), encrypted in transit (TLS) and at rest.

The website and the application are operated on our behalf by Vercel Inc., 440 N Barranca Avenue #4133, Covina, CA 91723, USA. The application's server functions — such as sign-in, document processing, export, purchase, cancellation and withdrawal — run in Vercel's Frankfurt am Main data centre region (fra1). Content that is the same for everyone and the upstream check whether you are signed in, on the other hand, run on Vercel's worldwide network of data centres — depending on your location, also outside the EU. In doing so, Vercel processes in particular your IP address, the addresses you request and your session data.

Transfers to third countries: Because Vercel is based in the USA, data may also be processed there or accessed from there. According to Vercel, it is certified under the EU-U.S. Data Privacy Framework; for companies certified in this way, there is an adequacy decision of the European Commission (Implementing Decision (EU) 2023/1795, Art. 45 GDPR). In addition, Vercel's data processing agreement (Data Processing Addendum) provides for the European Commission's standard contractual clauses (Art. 46(2)(c) GDPR). Vercel publishes it at https://vercel.com/legal/dpa; we will send you a copy on request to office@krupkagmbh.com.

Data processing agreements pursuant to Art. 28 GDPR are in place with Supabase and Vercel.

4. Document recognition

If you use automatic document recognition, the uploaded document is transmitted for analysis (amount, vendor, line items) to our processor Anthropic Ireland, Limited, 6th Floor, South Bank House, Barrow Street, Dublin 4, D04 TR29, Ireland, which uses the AI model Claude for this purpose; the document is not used for training. Recognition is optional — every document can also be entered entirely by hand, and if you do not use it, no document leaves the storage infrastructure named above.

Transfers to third countries: Anthropic stores the data in the USA. According to Anthropic, it may also be processed in selected countries in Europe, Asia and Australia and — for safety reviews, support and incident response — in other countries where Anthropic or its affiliates operate. For transfers to countries without an adequacy decision of the European Commission, our data processing agreement with Anthropic (Data Processing Addendum) provides for the European Commission's standard contractual clauses (Implementing Decision (EU) 2021/914) — appropriate safeguards under Art. 46(2)(c) GDPR. Anthropic contractually binds its sub-processors to data protection obligations that are substantially as protective. Anthropic publishes the agreement that incorporates the clauses at https://www.anthropic.com/legal/data-processing-addendum; we will send you a copy on request to office@krupkagmbh.com.

5. Payment processing

If you buy a plan or a pack, Stripe Payments Europe, Limited (Ireland) processes the payment. For this purpose, we transmit your email address, the identifier of your BOB account, the product purchased and, where applicable, the identifier of the project you are buying for, as well as the language, the version of the terms and the time of your declaration on the immediate start of performance. You enter your payment details and the billing address that Stripe requests to calculate VAT directly with Stripe; we do not receive full card details. Depending on the payment method, the payment services involved also receive the necessary data, such as the bank that issued your card.

The legal basis is the performance of the purchase contract (Art. 6(1)(b) GDPR); we retain the invoice records because the law requires it (Art. 6(1)(c) GDPR in conjunction with Section 147 AO, Section 257 HGB). Stripe acts on our behalf in processing the payment. For its own purposes — in particular fraud prevention and its own legal obligations — Stripe is itself responsible and provides information on this at https://stripe.com/de/privacy.

Transfers to third countries: Stripe may transfer data to affiliated companies in the USA. According to Stripe, it complies with the EU-U.S. Data Privacy Framework (adequacy decision of the European Commission, Implementing Decision (EU) 2023/1795, Art. 45 GDPR) and also uses the European Commission's standard contractual clauses (Art. 46(2)(c) GDPR). They are set out in Stripe's Data Transfer Addendum at https://stripe.com/de/legal/dta.

6. Sending emails

We send emails to you via the mail server of IONOS SE, Elgendorfer Str. 57, 56410 Montabaur, Germany, which acts on our behalf (Art. 28 GDPR). Our own mailbox is hosted there as well. This covers:

• sign-in links and sign-in codes,
• the contract confirmation after a purchase (Section 312f BGB),
• acknowledgements of receipt for cancellations and withdrawals (Sections 312k, 356a BGB),
• daily reminders about your projects, for example about invoices falling due or warranty periods ending, and
• notices about the end of your trial — three days before and on the day after — with a link to our prices.

We process your email address and the content of the respective email: for example product, price and reference number, for cancellations and withdrawals the details you entered in the form, for reminders the project name and the type of reminder. A copy of contract confirmations, cancellations and withdrawals goes to our mailbox.

The legal basis is the performance of the contract (Art. 6(1)(b) GDPR) and, for the confirmations required by law, additionally our obligation under Art. 6(1)(c) GDPR. We send the notices about the end of the trial on the basis of our legitimate interest in informing you about our paid plans (Art. 6(1)(f) GDPR); you can object to this at any time (section 11).

7. Push notifications of the app

If you allow notifications for the BOB app on your smartphone, the app registers your device with the push service Expo of 650 Industries, Inc., 624 University Ave FL1, Palo Alto, CA 94301, USA, and receives a push address (Expo push token) in return. We store it together with your account and the platform (iOS or Android). We use this address to send you reminders about your projects. Expo forwards them to the notification service of Apple (Apple Push Notification Service) or Google (Firebase Cloud Messaging), which delivers them to your device. The message only contains the sender “BOB” and the number of new reminders — no project names, no amounts.

The legal basis is the performance of the contract (Art. 6(1)(b) GDPR), as the reminders are part of BOB. You can switch notifications off at any time in your device settings. We delete the push address together with your account.

Transfers to third countries: Expo is based in the USA. According to Expo, it is certified under the EU-U.S. Data Privacy Framework (adequacy decision of the European Commission, Implementing Decision (EU) 2023/1795, Art. 45 GDPR); in addition, Expo's terms of service refer to the European Commission's standard contractual clauses (Art. 46(2)(c) GDPR). We will send you a copy on request to office@krupkagmbh.com.

8. Cancellation and withdrawal via our website

If you cancel via “Cancel contracts here” or withdraw via “Withdraw from contract here”, we store the details from the form — for a cancellation, the type of cancellation and, where applicable, the reason, the contract, first and last name, email address, your customer number if given and the requested date; for a withdrawal, name, contract, the reference number if given and email address. In addition, we store the date and time of receipt and the wording of the confirmation we send you. If the email address belongs to a BOB account, we assign the declaration to that account.

The legal basis is our legal obligation to accept the declaration and to confirm its receipt (Art. 6(1)(c) GDPR in conjunction with Section 312k or Section 356a BGB) and our legitimate interest in being able to prove its receipt and content later (Art. 6(1)(f) GDPR). Because the details serve as this proof, they are retained even if you delete your account. We delete them once claims under the contract concerned are time-barred and no statutory retention obligation applies any longer.

9. Consent, cookies and audience measurement

We use technically necessary functions — in particular sign-in and session security — without consent on the basis of Section 25(2) TDDDG (German Telecommunications Digital Services Data Protection Act); the service cannot be used without them.

Anything beyond that (statistics, marketing) is only loaded once you consent in the consent banner (Section 25(1) TDDDG, Art. 6(1)(a) GDPR). No such service is loaded before you decide. We store your choice locally in your browser; you can change or withdraw it at any time via the “Cookie settings” link in the footer. Withdrawal takes effect for the future.

If we use audience measurement, it works without cookies and without cross-device recognition. At present, no statistics or marketing service is active; should that change, we will name the provider, purpose and storage period here before the service is used.

10. Email inbox

The email inbox for documents is not active at present. Once it is available, an email service provider will process the messages sent to your project address in order to deliver them to your inbox; this policy will then be supplemented with the provider and the legal basis.

11. Your right to object

12. Your other rights

• Access, rectification, erasure, restriction of processing (Art. 15–18 GDPR)
• Data portability (Art. 20) — available directly in BOB as an export
• Withdrawal of consent with effect for the future (Art. 7(3))
• Complaint to a supervisory authority (Art. 77). The authority responsible for us is the North Rhine-Westphalia Commissioner for Data Protection and Freedom of Information (Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen), Kavalleriestraße 2–4, 40213 Düsseldorf, Germany.

13. Storage period and deletion

You can delete your account, projects and individual documents yourself at any time. Deletion takes effect immediately: projects, documents and the associated files are removed at once, and the user account is deleted. If a deletion is interrupted for technical reasons, a daily job completes it. Projects with other owners remain available to them — only your membership ends there. Excepted are data subject to statutory retention obligations (in particular invoice documents under Section 147 of the German Fiscal Code (AO) and Section 257 of the German Commercial Code (HGB)); these are blocked and deleted once the retention periods have expired. Cancellation and withdrawal declarations are also excepted (section 8).