1. Controller
[Zenpra GmbH / UG (haftungsbeschränkt) / Einzelunternehmen – Rechtsform eintragen], [Straße und Hausnummer], [PLZ] [Ort], Deutschland
Email: [kontakt@zenpra.de]
Data protection contact: [datenschutz@zenpra.de]
2. This website
When you visit this website, our hosting provider ([Hosting-Anbieter und Serverstandort]) processes technically necessary data (IP address, time of access, page requested, browser and operating system information) in server log files. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is the secure and stable operation of the site. Log data is deleted after 14 days at the latest.
This website sets no cookies, uses no analytics or tracking services and loads no third-party content. Fonts are served from our own server.
3. The Zenpra app: account and sign-in
Using the app requires an account. We process your email address, name, chosen language and, optionally, your place of residence and nationality, which tailor the AI replies to your situation. Authentication is handled by Firebase Authentication (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland); when you sign in with Google or Apple we receive the profile data you approve. Legal basis: Art. 6(1)(b) GDPR (performance of a contract).
4. Documents and AI processing
The core of the app is processing the letters you scan, upload or import. These documents regularly contain personal data, sometimes special categories (for example health data in letters from your health insurer). We store documents encrypted on servers at [Hosting-Anbieter und Serverstandort] and send their text to our AI processor ([KI-Anbieter und Serverstandort, z. B. OpenAI, L.L.C. (USA) / EU-Region]) for summarisation, translation, deadline extraction and reply drafting. Data processing agreements under Art. 28 GDPR are in place with all processors; where processing takes place outside the EU we rely on the EU Standard Contractual Clauses.
The legal basis is Art. 6(1)(b) GDPR and, where special categories are involved, your explicit consent under Art. 9(2)(a) GDPR, which you give at your first upload and can withdraw at any time. Your documents are not used to train AI models.
5. Email import (Gmail, Outlook)
If you enable inbox import, we access your mailbox read-only through Google's or Microsoft's APIs, with your consent (Art. 6(1)(a) GDPR), to detect and import letters from authorities, insurers and companies. We store only the detected documents, never your whole mailbox. You can disconnect at any time in the app. Use of Google data is subject to the Google API Services User Data Policy, including the Limited Use requirements.
6. Payments
Subscriptions are processed by Stripe (Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Dublin 2, Ireland). Payment details such as card numbers are handled directly by Stripe and never reach our servers. We receive invoice and status data about your subscription. Legal basis: Art. 6(1)(b) GDPR; invoice data is retained for ten years under §§ 147 AO and 257 HGB.
7. Push notifications
Deadline reminders are delivered with your consent through Firebase Cloud Messaging (Google), which requires a device token. You can disable notifications at any time in your device's system settings.
8. Family and team sharing
If you share documents with family members or your organisation, the invited people see the documents and deadlines you have shared. Invitations use the invitee's email address (Art. 6(1)(b) GDPR).
9. Retention and deletion
Your data is kept for as long as your account exists. You can delete your account and every document at any time in the app (Art. 17 GDPR); deletion is propagated to backups within 30 days. Statutory retention obligations (for example for invoices) remain unaffected.
10. Your rights
You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection (Art. 21). You can withdraw any consent at any time with effect for the future. You also have the right to lodge a complaint with a data protection supervisory authority, for example the state data protection commissioner responsible for your place of residence.
For all requests, contact us at [datenschutz@zenpra.de].
11. Changes
We update this policy when our processing or the legal situation changes. The current version is always available on this page and in the app.