This privacy policy explains how voicelayer GmbH processes your personal data when you use kein (kein.tax).
1. Controller
The controller within the meaning of the General Data Protection Regulation (GDPR) is:
voicelayer GmbH
Sebastianstraße 88
10967 Berlin, Germany
Email: hallo@kein.tax
2. Data Protection Officer
We have not appointed a Data Protection Officer, as we are not legally required to do so. For any data protection questions, please contact us at hallo@kein.tax.
3. Categories of data we process
- Master and account data (name, email address, authentication data)
- App content and usage data
- Invoices, receipts and related email metadata retrieved from your Google/Gmail account
- Bank account and transaction data (account movements, balances, IBAN, payment references)
- Tax and accounting data you create or import in the app
- Payment and billing data
- Usage, log and metadata (IP address, timestamps, device and browser data)
4. Purposes and legal bases (Art. 6 GDPR)
- Providing, operating and improving the service and performing our contract with you: Art. 6(1)(b) GDPR.
- Authentication and account security: Art. 6(1)(b) and (f) GDPR.
- Retrieving and processing invoices and receipts from your Google/Gmail account: Art. 6(1)(b) GDPR and your consent under Art. 6(1)(a) GDPR, granted in the Google OAuth dialog and revocable at any time.
- Retrieving and processing bank and transaction data (account information service): Art. 6(1)(b) GDPR and your consent under Art. 6(1)(a) GDPR.
- Compliance with legal obligations, e.g. commercial and tax retention: Art. 6(1)(c) GDPR.
- Analytics, error analysis, IT security and fraud prevention: Art. 6(1)(f) GDPR (our legitimate interest in a secure, stable service).
Where special categories of personal data may be involved, we process them only on the basis of your explicit consent (Art. 9(2)(a) GDPR).
5. Authentication via Clerk
We use the authentication service Clerk (Clerk, Inc., USA) for registration and sign-in. Your sign-in data (e.g. email address, authentication tokens) is processed and Clerk sets strictly necessary cookies for session management. The legal basis is Art. 6(1)(b) GDPR. A transfer to the USA may occur; see section 9.
6. Access to Google/Gmail data
With your consent, kein accesses your Google/Gmail account via the Google API to identify and import invoices and receipts for your bookkeeping. Access is limited to the permissions (scopes) you grant in the Google OAuth dialog. You can revoke access at any time in your Google account (https://myaccount.google.com/permissions) or in the app.
kein's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. In particular, we do not use or transfer Google user data for advertising, we do not sell it, and we do not allow humans to read this data except (a) with your explicit consent, (b) for security purposes, (c) to comply with applicable law, or (d) as necessary for internal operations after the data has been aggregated and anonymized.
7. Bank account connection
At your instruction, we connect to your bank accounts to import turnover and transactions. Account master, balance and transaction data are processed. The legal basis is Art. 6(1)(b) GDPR and your consent under Art. 6(1)(a) GDPR. You may revoke granted access at any time.
8. Hosting and processors
We use carefully selected service providers with whom we have concluded data processing agreements pursuant to Art. 28 GDPR:
- Render (Render Services, Inc., USA) — cloud hosting and infrastructure
- Clerk (Clerk, Inc., USA) — authentication
- Logfire / Pydantic (Pydantic Services Inc., USA) — observability, logging and error analysis
- Hatchet — execution of background jobs
- Infisical — management of access secrets
- A PostgreSQL database operated within our hosting infrastructure
9. Transfers to third countries (USA)
Some of the providers named above (including Clerk, Render and Logfire) are based in the USA or process data there. A transfer takes place only where an adequate level of data protection under Art. 44 et seq. GDPR is ensured, in particular through (a) the recipient's certification under the EU-U.S. Data Privacy Framework, where applicable, and/or (b) the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR) together with supplementary safeguards. On request, we will provide information about the specific safeguards in place.
10. Cookies and local storage
We use strictly necessary cookies, in particular Clerk session cookies for sign-in and a cookie to store your language setting. These are required for operation; the legal basis is Section 25(2) TDDDG and Art. 6(1)(f) GDPR. We do not use tracking or advertising cookies.
11. Retention
We store personal data only as long as necessary for the respective purposes. Statutory retention periods apply to documents subject to tax and commercial law (generally 6 or 10 years under Sec. 147 AO and Sec. 257 HGB). Once the purpose ceases or the periods expire, the data is deleted or anonymized. If you delete your account, we delete your data unless a statutory retention obligation applies.
12. Your rights
Under the GDPR you have the right to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20), objection to processing based on Art. 6(1)(f) (Art. 21), and withdrawal of consent with effect for the future (Art. 7(3)). You also have the right not to be subject to a solely automated decision producing legal effects (Art. 22); no such decision-making takes place. To exercise these rights, send a message to hallo@kein.tax.
13. Right to lodge a complaint
You have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is:
Berliner Beauftragte für Datenschutz und Informationsfreiheit
Alt-Moabit 59–61, 10555 Berlin, Germany
Phone: +49 30 138890
Email: mailbox@datenschutz-berlin.de
14. Changes to this policy
We update this privacy policy whenever changes to our processing require it. The current version published here applies.