Privacy Policy

This privacy policy explains which personal data we (the "controller") process, for what purposes and to what extent, when you use our online offering at lavesy.de and the Lavesy application.

Controller

Overview of processing

We process inventory data (e.g. names, addresses), contact data (e.g. email addresses), content data (e.g. entries in the application), usage data (e.g. pages visited, interest in content) and meta/communication data (e.g. device information, IP addresses) of customers, prospects, visitors and users of the online offering. Purposes are the provision of our contractual services, security measures, reach measurement and the administration of the service.

Relevant legal bases

• Performance of a contract (Art. 6(1)(b) GDPR): providing the Lavesy service, account management, billing.
• Legal obligation (Art. 6(1)(c) GDPR): commercial and tax retention duties.
• Legitimate interests (Art. 6(1)(f) GDPR): security, cookieless reach measurement, usability improvement (masked session recordings on the public pages), defence of legal claims.
• Consent (Art. 6(1)(a) GDPR): only where we ask for it explicitly (e.g. optional communications).

In addition to the GDPR, the German Federal Data Protection Act (BDSG) and the German Telecommunications Digital Services Data Protection Act (TDDDG) apply.

Security measures

We take appropriate technical and organisational measures in accordance with Art. 32 GDPR, including transport encryption (TLS), access controls, role-based permissions inside the application, audit logging and hosting on servers in the EU.

Transfers of personal data and international transfers

Data is transferred to service providers only where necessary for providing the service (see the list of subprocessors). Processing takes place in the EU; where a provider may transfer data to third countries (e.g. Stripe to the USA), this is based on the EU standard contractual clauses and/or an adequacy decision (EU–US Data Privacy Framework).

Storage and deletion

We delete personal data as soon as the purpose of processing no longer applies and no statutory retention periods require storage. Customers can export their data at any time and permanently delete their account, including all data, in the account settings (Art. 17 GDPR).

Rights of data subjects

You have the rights of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection (Art. 21 GDPR), as well as the right to lodge a complaint with a supervisory authority (Art. 77 GDPR). To exercise your rights, contact us at mail@lavesy.de.

Business services (accounts, billing)

We process the data of our customers to provide the contractual services: account data (email address, password hash, company name where provided), plan and billing data, and the content customers store in the application (items, stock, suppliers, documents). Payment processing for paid plans is handled by Stripe; we do not store full payment card details ourselves. Legal bases: performance of a contract, legal obligations, legitimate interests.

Cancellation and withdrawal via our form: you can declare a cancellation or withdrawal without signing in. We process the data you enter (name, email address, optionally account/company name, contract reference and reason) and the date and time of the declaration in order to assign it to your contract (via the email address of your account), execute it automatically and confirm receipt in text form; that email also contains a personal link to execute or stop the declaration. We keep the declaration as evidence until the regular limitation period expires (three years from the end of the year). Legal bases: performance of a contract, legal obligation (Sections 312k, 356a BGB), legitimate interests in preserving evidence.

Automated document processing (OCR and optional AI extraction)

A core part of the service is processing documents that users upload into the application (e.g. supplier invoices, delivery notes). We run optical character recognition (OCR) on our own infrastructure and extract structured fields (e.g. invoice number, amounts, line items); the results are reviewed and confirmed by authorised users before they are applied (human review). Optionally, extraction can be assisted by AI services. This AI-assisted extraction is disabled by default and only takes effect once a tenant enables it and provides their own API key. When enabled, the document content required for the analysis is transmitted to the respective AI provider (OpenAI or Anthropic), which may involve a transfer to a third country (USA) on the basis of the EU standard contractual clauses. Legal bases: performance of a contract (Art. 6(1)(b) GDPR) and legitimate interests (Art. 6(1)(f) GDPR).

Provision of the online offering and web hosting

The application is hosted on servers in the EU. When you access our services, the web server processes connection data (IP address, timestamp, requested resource, user agent) in server log files for the purposes of stability, security and abuse prevention; log files are deleted on a short rotation. Legal basis: legitimate interests.

Use of cookies

We only use technically necessary cookies (sign-in session, security, settings such as language and theme). These require no consent (§ 25(2) TDDDG). We do not use marketing or third-party tracking cookies. The only processing that requires consent is the optional session recording described below; we ask for it in a banner and you can change your choice at any time via "Privacy settings" in the footer.

Contact and enquiry management

When you contact us (e.g. by email), we process the information you provide to handle the enquiry. Legal bases: performance of a contract / pre-contractual measures and legitimate interests.

Emails about getting started, tips and feedback

If you want them, we email you tips for getting started with Lavesy (e.g. how to set up your first stock with the start assistant or install the warehouse app on your phone) and occasionally ask how it is going, what got in your way or whether you still need Lavesy — at most about two such emails a month (technically capped at two within 30 days and one per week). Our emails contain no tracking pixels (web beacons) and we do not track opens or clicks.

• Consent and double opt-in: we send these emails only with your consent. At sign-up you can tick an optional box that is not pre-ticked; registration does not depend on it. If you ticked it, the email asking you to confirm your address mentions it; that email itself contains no advertising. After you click the confirmation link, the next page asks you explicitly whether you want these emails ("Yes, send me tips & feedback questions" or "No thanks"). Only once you confirm there do you receive them — merely opening the link (e.g. by a mailbox virus scanner) is not enough. When signed in with a confirmed address, you can also switch them on in your profile under "Notifications" ("Start tips & feedback by email"); this is recorded as consent too. Legal bases: consent (Art. 6(1)(a) GDPR; § 7(2) no. 2 UWG).
• Notice under § 7(3) UWG: at sign-up we additionally inform you that, as a Lavesy customer, we would be allowed to email you occasional information about similar Lavesy features and plans even without your consent, that we currently don't, and that you can object at any time — via the unsubscribe link or by email — at no cost other than basic transmission charges. We currently send these emails only with consent. Should we rely on § 7(3) UWG for existing customers, every such email contains this notice and the objection works the same way.
• What triggers them: to send only relevant emails and no unnecessary ones, we choose the email and its timing solely based on the following data that we keep as the provider anyway (this list is exhaustive): when you registered and confirmed your email address; the timestamp of your last sign-in or session renewal (only the time, no usage content); whether your company's start assistant was completed or skipped; your role as an administrator of the company; the status of your contract, plan and trial; your consent and any unsubscribes; your company's setting for these emails; and, in aggregated form, when any member of your company last signed in (see the next item). Emails asking about your use and contract ("what got in the way?", "shall we help you get back into Lavesy?") go to company administrators only. We do not use the contents of your warehouse — items, stock, postings, documents, orders or the business entries in the audit log — for this; we process that data only on behalf of our customers. Nor do we use the server-side usage statistics; they remain without any link to individual users. Legal bases: consent and legitimate interests (Art. 6(1)(a) and (f) GDPR).
• Notice to all members of a company — also without their own consent: while people work in a company, we don't ask its administrators what got in the way. To tell, for companies in which at least one person wants these emails, we evaluate in aggregated form when any active member of the company last signed in or renewed their session. This includes the timestamps of all active members, including members who have not consented themselves. The result is a single point in time per company ("last sign-in of any member"), not a value per person: who signed in when is neither stored separately nor logged for this purpose, nor disclosed to the recipient of the email. We keep the timestamps themselves anyway to run and secure the user accounts. Legal basis: our legitimate interest in not sending unsuitable and unnecessary questions to the administrators of a company in which people work (Art. 6(1)(f) GDPR). Right to object: as the evaluation serves the selection of promotional emails, you can object to it at any time without giving reasons (Art. 21(2) GDPR): most easily in your profile under "Notifications" with the switch "Leave my sign-in times out of the company evaluation for Lavesy emails" — also without having consented to the emails yourself — or by emailing the controller. We then leave your timestamps out of this evaluation (Art. 21(3) GDPR); as a result, administrators of your company may receive such a question even though you use Lavesy. As proof we record your objection (time, channel, your email address; with the profile switch also IP address and user agent as supporting evidence) while it stands and, after you withdraw it, until the end of the third calendar year thereafter.
• Your company's setting: company administrators can switch these emails off for all members of the company — in the profile under "Emails from Lavesy to this company" with the switch "Allow tips and feedback emails from Lavesy to members of this company"; it applies to the company they are currently signed in to. If the switch is off in any of your companies, you do not receive these emails even if you consented; your profile shows which company it is under "Notifications". Your consent itself stays unaffected. When it is on, only members who consented themselves receive them. Contract-related emails are not affected. Every change is recorded with time and person in the company's audit log.
• Your feedback: in the "Quick question: what got in the way?" email you can click an answer (including "All good – I just don't need Lavesy often"). The following page shows it preselected; you can change it there and optionally add a sentence. Nothing is saved until you press "Send" — merely opening the link (e.g. by a virus scanner) saves nothing. No sign-in needed. We store the chosen reason, your text, the time and the link to your account and company to improve Lavesy (Art. 6(1)(f) GDPR). We delete the free text after 12 months; the reason stays linked to your account while it exists and afterwards only as a statistic without any link to you.
• No tracking: no tracking pixels, no open or click tracking, no redirect links that track individual recipients. Only links that perform an action for you (such as the unsubscribe link or the answer links of a feedback question) are personal. Links to our website may carry a campaign parameter (utm_campaign) that names the email, not you; it only feeds into the aggregated page statistics of our self-hosted Umami.
• Sender: we send these emails ourselves, as Lavesy, through the same mail transport we use for our system emails — never through a mailbox a customer has connected to Lavesy. Replies reach a Lavesy mailbox.
• Proof of consent (Art. 7(1) GDPR): we store your email address, the time of consent, the exact consent text and its version, the source (sign-up form or profile), IP address and user agent (only as supporting evidence) at consent and at the confirmation click, the time of confirmation, the version of the confirmation email, and the time and channel of any withdrawal. We keep this proof for the duration of the consent and afterwards until the end of the third calendar year after withdrawal (limitation period, Sections 195, 199 BGB); legal bases: Art. 6(1)(c) and (f) GDPR. Consents never confirmed via the link are deleted after 30 days.
• Unsubscribe, withdrawal and objection: you can withdraw your consent (Art. 7(3) GDPR) and object (Art. 21(2) and (3) GDPR) at any time. Every such email contains a visible unsubscribe link that opens a small page where you confirm with one click — no sign-in, no reason required — and a one-click "List-Unsubscribe" header (RFC 8058) that mail programs show as "Unsubscribe". You can also use the switch in your profile or email us (we act on emails within 48 hours). Link, mail program and profile take effect immediately. Every such email states why you receive it, links to our imprint and privacy policy and contains a separate notice of your right to object under Art. 21 GDPR.
• Suppression list: after you unsubscribe we store only a SHA-256 hash of your normalised email address together with the date and scope, so that we do not email that address again — also after re-registration or deletion of your account or company. We keep it as long as the address could otherwise be contacted again and review it about every three years. Legal bases: Art. 6(1)(c) and (f) in conjunction with Art. 21(3) and Art. 17(3)(b) GDPR.
• Contract-related emails (e.g. address confirmation, password reset, invoices and payment issues, end of trial, deletion warnings, offers to adjust the contract after a price change, confirmations of cancellation or withdrawal) are not advertising. We send them to perform the contract (Art. 6(1)(b) GDPR); they cannot be unsubscribed and are unaffected by this setting.

Registration: when you sign up, we store when you confirmed our terms and privacy policy, together with the version of each document, as proof of the conclusion of the contract (Art. 6(1)(b) and (f) GDPR).

Web analytics, monitoring and optimisation

For reach measurement we exclusively use the open-source software Umami, which we operate on our own infrastructure. No analytics data is shared with third parties and no third-party services (such as Google Analytics) are used. Umami works without cookies and without comparable access to information on your device; no cross-device profiles are created. IP addresses are not stored — they are only processed transiently to derive a daily-rotating, non-reversible pseudonym and a coarse geographic region. Browsers with the "Do Not Track" setting enabled are excluded from measurement. You can also switch reach measurement off at any time with "Necessary only" in the notice banner or via "Privacy settings" in the footer; we store this choice in your browser's local storage. As no cookies are set and no information is stored on or read from the device, no consent is required (§ 25(2) TDDDG); processing is based on our legitimate interests (Art. 6(1)(f) GDPR).

Feature usage in the application: inside the logged-in application we additionally record which features are used (e.g. "goods receipt posted") and the subscribed plan, to improve the product — never content, record IDs, search terms, names or identifiers of users or companies; addresses of detail pages are reduced to their generic form before transmission. Legal basis: legitimate interests (Art. 6(1)(f) GDPR).

Server-side usage statistics: to see which features of our software are actually used and to support our customers, our server counts per customer account and day how often each feature area was opened or executed (e.g. "goods receipt · posted") and through which interface (web application, warehouse app, assistant, MCP interface). Only these counters are stored — no content, no record IDs, no IP addresses and no link to individual users. Counters are deleted after 13 months. We only count for customer accounts whose data processing agreement provides for this counting (clause 1(7), first sentence, no. 5); for existing customers only after they have accepted that version. Legal basis: legitimate interests (Art. 6(1)(f) GDPR).

Session recordings and heatmaps (Umami Replays): only if you consent, we record on the information pages of our website (never in the logged-in application and never on sign-in, sign-up, password, cancellation or withdrawal pages) usage interactions such as mouse movements, clicks and scrolling to improve usability and to generate aggregated heatmaps. Form inputs and text content are masked in your browser before transmission (strict masking); the recordings contain no clear-text data. Recordings are stored on our own infrastructure, are not shared with third parties and are automatically deleted after 30 days. Browsers with "Do Not Track" enabled are never recorded. Without your consent nothing is recorded; you can withdraw it at any time with effect for the future via "Privacy settings" in the footer. Your choice is stored in your browser's local storage. Legal bases: consent (Art. 6(1)(a) GDPR; § 25(1) TDDDG).

Error monitoring

To detect and fix technical errors we use self-hosted error tracking (GlitchTip) on our own EU infrastructure. Error reports may contain technical metadata (browser, operating system, stack traces); they are not shared with third parties. Legal basis: legitimate interests.

Presence on social networks

We maintain profiles on social networks (e.g. LinkedIn, Instagram, TikTok) to communicate with users there. When you visit those profiles, the terms and privacy policies of the respective operators apply; data may be processed outside the EU. We receive at most aggregated statistics from these platforms.

Plug-ins and embedded content

Our online offering does not embed third-party content that transmits personal data to external providers (fonts, scripts and media are served from our own infrastructure).

For the complete, authoritative wording — including further sections that may apply — please refer to the German Datenschutzerklärung.