Privacy Policy (Datenschutz­erklärung)

The short version

This website sets no cookies, runs no analytics, embeds no trackers, and loads nothing from third-party servers. The Valutorio apps contain no analytics, advertising or tracking code. Without a subscription they do not contact our servers.

Personal data is processed only where you hand it to us or where a feature you use needs it: the support form (your email address and the text you write), the launch notification form (your email address), mail you send to us, and, if you subscribe, what Valutorio Sync, the personal MCP endpoint and the Assistant need. That is the signed purchase record from Apple, a device ID and a device label, the files of the vaults you sync (notes, images and other attachments), and, for the Assistant, your messages and the notes it looks up, which go to OpenAI. Our web host processes the technical data it needs to deliver a page. We keep no log of page visits; the only access log we keep is for the support and notification forms (section 2).

We keep account records, synced vaults and file names until you ask us to delete them. Support threads are kept until you ask us to delete them, or are deleted automatically 12 months after we close the ticket. We delete mail you send us from our mailbox by hand 12 months after the last message. Erasure is done by hand: email the address in section 1. Files you delete in the app stay as earlier versions for about 90 days; when we erase your data on request, we delete all versions as part of that. Database backups hold deleted data for up to 35 days (sections 2 and 7).

1. Controller (Verantwortlicher)

Lovre Crncevic
Sudermannstr. 2A
60431 Frankfurt am Main, Germany
Email: lovre@crncevic.org

See the imprint for full legal notice information.

We have not appointed a data protection officer. Use the address above for every question and request about your data.

2. Hosting, server log files and backups

When you visit this website, Amazon CloudFront delivers the pages. To do that, it processes technical connection data: the IP address of the requesting device, date and time of the request, the requested URL, the referrer URL, the browser identification (user agent), and the HTTP status code. This processing is technically necessary to deliver the website and to ensure its stability and security. We have not switched on CloudFront access logs, so we keep no log of page visits ourselves.

The forms on /support/ and the launch notification form talk to our API under /api/. For these requests only, the API gateway writes an access log entry: the time, the source IP address the gateway sees (behind CloudFront this can be an address of the delivery network rather than yours), the HTTP method, the request path (for ticket pages this includes the ticket number), the status code, an error message if one occurred, and a request ID. These entries are kept for 90 days and then deleted automatically. The support function also keeps its own error log, likewise for 90 days. When something fails, an entry in that log can contain the email address or the ticket number involved in the failed request.

Legal basis: Art. 6 (1) (f) GDPR (our legitimate interest in providing and securing this website and in finding and fixing errors). Log data is not merged with other data sources and is not used to identify individual visitors.

This website is hosted on Amazon Web Services (Amazon Web Services EMEA SARL, Luxembourg): content is delivered via Amazon CloudFront and the support system runs in the AWS Frankfurt region (eu-central-1). CloudFront serves pages from edge locations in Europe, North America and other regions that AWS includes in its price class 100. The data that we store on AWS and that sections 3, 4, 5 and 7 below describe is stored in the EU (Frankfurt). There are three exceptions. The Assistant (section 7): OpenAI processes its requests in the United States and possibly in other countries outside the EU. Notes that an AI tool you connect to the MCP endpoint reads (section 7): they go to that tool, wherever it runs. And mail that reaches our own mailbox (sections 3 and 5), which is held by our email provider, Apple (section 8). AWS, through its parent Amazon.com, Inc., is certified under the EU-U.S. Data Privacy Framework, and we have a data processing agreement with AWS incorporating the EU Standard Contractual Clauses.

Our databases keep point-in-time backups for up to 35 days. When we delete data, copies stay in those backups until they age out. We do not restore from a backup except after a failure, and if we do, we delete the data again. Where this policy says that a record is deleted automatically after a period, the database or storage service removes it some time after that period ends, normally within a few days.

3. Support ticket form

If you open a support ticket at /support/, we process: your email address, the subject and message text you write, and, for abuse prevention only, short-lived counters that rate-limit the form. The counters are keyed to your IP address (hourly) and to a one-way hash of your email address (hourly and daily). They also count requests to load the form's captcha, to confirm an address, and to read or answer a ticket. They store no message content and are set to expire after two hours (hourly counters) or two days (daily counters), after which they are removed automatically. The captcha is a proof-of-work puzzle that runs in your browser; no third-party captcha service is involved.

Your ticket becomes active only after you confirm your email address via the verification link we send (double opt-in). Until then it is stored as pending, with your address, subject and message; an unconfirmed ticket and its content are set to expire after 24 hours and are then deleted automatically. A confirmed ticket and its conversation are kept until the issue is resolved. When we close a ticket, it is set to be deleted automatically 12 months later, so recurring problems stay diagnosable; if you write again, the ticket reopens and that period stops running. A ticket we have not closed stays until you ask us to delete it, which you can do at any time. We send email strictly about your ticket: the verification link, a confirmation, and reply notifications. Nothing else, no lists.

Legal basis: Art. 6 (1) (b) GDPR (processing necessary to handle your request) and, for the rate-limiting records, Art. 6 (1) (f) GDPR (our legitimate interest in preventing abuse of the form). Ticket data is stored in the AWS Frankfurt region; verification and notification emails and our replies are sent through our Gmail mailbox (Google, section 8), and only if Gmail is unavailable via Amazon SES from the same AWS region. Backups: see section 2.

To track our work on a ticket, we keep a working copy of each confirmed ticket in an internal ticket system on a server we operate ourselves in Germany, reachable only from our private network: the subject, the messages, and your email address with most of its characters hidden. The copy is deleted when the ticket is deleted from the support system (on your request, or 12 months after we close it). Legal basis: Art. 6 (1) (b) GDPR.

You can also write to the address in section 1. We then process your email address and your message to answer you: Art. 6 (1) (b) GDPR where you ask about a contract with us, otherwise Art. 6 (1) (f) GDPR (our legitimate interest in answering enquiries). The mail arrives in our own mailbox, which is held by our email provider (section 8). We delete the correspondence from the mailbox by hand 12 months after the last message in it, or earlier on your request, unless a legal duty to keep it applies. That applies, for example, to business correspondence that falls under section 147 of the German Fiscal Code (AO) or section 257 of the German Commercial Code (HGB); we then keep it for the period that law sets, currently six years.

We read and answer tickets, and read the list of confirmed launch notification addresses (section 4), through a private administration interface of the support system that opens only with a secret token held by us. We use software tools for this work, including Claude, an AI assistant provided by Anthropic, PBC (USA). Such a tool sees the ticket or the address it is working on and may process it outside the EU (section 8). Legal basis: Art. 6 (1) (b) GDPR for tickets and Art. 6 (1) (a) GDPR for the launch notification list.

4. Launch notification email form

If you submit your email address through the "notify me at launch" form, it is used for exactly one purpose: to send you a single email when Valutorio launches. The flow is double opt-in: we first send a confirmation link, and an unconfirmed request, including the address, is set to expire after 48 hours and is then deleted automatically. As with the support form, short-lived rate-limit counters keyed to your IP address and to a one-way hash of your email address protect the form from abuse; they store no content and expire automatically. Data is stored in the AWS Frankfurt region (eu-central-1). Legal basis: Art. 6 (1) (a) GDPR, your consent, from the moment you confirm your address; we store the time of your confirmation as proof of it. Before that, the pending request, the confirmation email and the rate-limit counters rest on Art. 6 (1) (f) GDPR (our legitimate interest in being able to show that a consent is valid and in protecting the form from abuse). A confirmed address is stored until the launch email is sent. We then delete the remaining addresses by hand, no later than 30 days after that email. You can withdraw your consent at any time via the unsubscribe link in the launch email (which deletes your address immediately), or by writing to the address above. Withdrawal does not affect the lawfulness of processing before the withdrawal. Backups: see section 2.

Right to object to this email: you can object at any time to your address being used for the launch email (Art. 21 (2) GDPR). We then stop at once and delete your address. Use the unsubscribe link in the launch email or write to the address in section 1.

5. Inbound mail forwarding

The domain valutorio.com receives email at a single address, used to operate the app's App Store test account. Mail to any other address on the domain is refused by the mail server and is never stored. If you send mail to that one address, the message (sender, subject, content and any attachments) is stored briefly in the AWS Frankfurt region (eu-central-1), scanned for spam and malware, and forwarded to our own mailbox, which is held by our email provider (section 8). The stored copy is deleted automatically after about 30 days. We delete the forwarded copy from our mailbox by hand 12 months after it arrives. Mail that fails authentication checks in a way its own sending domain asks recipients to reject or quarantine, or that is identified as spam or malware, is not forwarded. The forwarding service also keeps a log of each message's ID, its spam, virus and sender-authentication verdicts, our own destination address and its size for 90 days. The log holds no sender, subject or content.

Mail we send through Gmail that cannot be delivered comes back to that Gmail mailbox as a delivery notice; we delete such notices by hand 90 days after they arrive. Separately, when email we send through Amazon SES cannot be delivered, Amazon SES reports the failure (a "bounce", or a spam complaint) and we process the affected email address to diagnose it. That happens in three places:

• A server log in the AWS Frankfurt region records the event. It is kept for no longer than 30 days and is then deleted automatically. In that log the local part of any address that is not ours is masked (the domain is kept). It contains no message subjects or content.
• For each bounce or complaint, a notification email with the full address of the affected recipient, the kind of failure, the time and the message ID goes to our own mailbox. We delete these notifications from the mailbox by hand 90 days after they arrive.
• Amazon SES keeps a list of addresses that bounced or complained, so that we do not send to them again. An address stays on that list until we remove it. The list has no expiry and we do not clear it on a schedule; we remove an address when you ask us to. AWS also keeps a list of its own, across its customers, for addresses that hard-bounced. AWS manages that list and sets how long it keeps an address on it.

Legal basis: Art. 6 (1) (f) GDPR, our legitimate interest in operating a working email address for the service, in protecting our systems from spam, malware and spoofed mail, in diagnosing delivery failures, and in not sending again to an address that rejected our mail or complained. Where you send us mail yourself, the processing necessary to receive and answer it also rests on Art. 6 (1) (b) GDPR. You can object to processing based on legitimate interest at any time (see section 9).

6. No cookies, no analytics, no third-party content

This site sets no cookies of any kind and uses no analytics or tracking services. It stores no information on your device and reads none from it (no cookies, local storage or similar), so no consent under section 25 TDDDG is needed and there is no cookie banner. No content is loaded from third-party servers: fonts, images, and videos are all hosted on this domain. There are outbound links to other websites (for example to sources cited on the comparison pages); this privacy policy does not apply to those external sites, and no data is transmitted to them unless you click such a link. What the apps keep on your device is described in section 7.

7. The Valutorio apps

The Valutorio apps for Mac, iPhone and iPad are distributed through the App Store. Your notes are files in vault folders on your own devices. Without a Valutorio Sync or Valutorio Pro subscription, the apps do not contact our servers, and we receive none of your data. The apps contain no analytics, advertising, tracking or crash-reporting code and no third-party SDK that collects data. We do not sell personal data, and we do not share it with anyone for their advertising or analytics.

Apple may give us aggregate statistics about sales and, if you chose to share app analytics with developers in your device settings, about usage and crashes. These statistics do not identify you.

When the apps contact us

A subscriber's app contacts our servers only when you use Valutorio Sync, the personal MCP endpoint or the Assistant. Everything else in the apps works without a connection to us.

Purchases and the purchase record

Apple processes the purchase of the apps and of subscriptions, and manages subscriptions and refunds, under Apple's own terms and privacy policy. We receive no payment details, name, email address or Apple ID from Apple.

When you use Valutorio Sync, the MCP endpoint or the Assistant, the app registers with our backend. It sends the signed transaction record that Apple issued for your subscription, a random device ID that the app created on your device, and a device label. Our backend checks Apple's signature on the record and reads only the bundle ID, the product, the environment (production or test), the original transaction ID, the expiry date and whether Apple revoked the transaction. We do not keep the signed record itself. The app registers again whenever its access token, which is valid for 24 hours, has expired and you use one of these features.

We store the following in an account record:

• The original transaction ID of your subscription, and an account ID that is a SHA-256 hash of it. We keep the original next to its hash, so the account ID is not anonymous to us, and Apple can link the original transaction ID to you.
• The product (Sync or Pro), the expiry date and the environment, with the dates when the record was created and last updated.
• The device ID and the device label of the device that registered last. Each registration replaces the previous values.
• The names of your cloud vaults and when you created them, how much storage and how many files you use, a one-way hash of your MCP token, and the date it was issued.

The device label is the name the device gives itself. On a Mac the app sends the computer name, which often contains a first name (for example "Anna's MacBook Pro"). On iPhone and iPad, iOS gives apps only a generic name ("iPhone" or "iPad"), not the name you gave the device, and the app sends that. The label is stored when the device registers, and each registration replaces the one stored before. A label that is already stored stays until the next registration from any of your devices replaces it. No screen in the apps shows the label, and we do not use it for any purpose; it is stored because the registration request carries it.

Purpose: checking that your subscription is current before we provide Sync, the MCP endpoint or the Assistant, and running your account (storage limits, vault list). Legal basis: Art. 6 (1) (b) GDPR, performance of the subscription contract. Providing the signed record is necessary for these features. Without it we cannot check your subscription and they do not work.

Valutorio Sync

If you subscribe to Valutorio Sync and switch it on for a vault, the app uploads the files of that vault to our infrastructure in the AWS Frankfurt region (eu-central-1) and keeps your devices in step. This covers notes, images, PDFs and every other file in the vault folder that is 25 MB or smaller. The app skips larger files, hidden files and folders (names that start with a dot, for example .git and .obsidian), files inside package folders (for example an .app bundle), and symbolic links. Your device sends the contents of each file directly to Amazon S3 through short-lived links, so S3 receives your device's IP address. We have not switched on S3 access logs. While sync is on, the app uploads changes after you save, checks for changes when it opens and about every 30 seconds while you use it, and on iPhone and iPad may also check in the background when iOS allows it. On the Mac the app also checks about every 5 minutes for as long as it is running, in the background too.

For each file we also receive and store its path inside the vault (the folder and file names), its size, a SHA-256 checksum, a revision number, the time of the last change, and the ID of the device that made the change (or "mcp" when the change came through the MCP endpoint or the Assistant). We store the name of each vault too; on the Mac it is by default the name of the vault's folder.

On iPhone and iPad, an image you add through the system photo picker or the Files picker is converted on the device, which removes embedded metadata including location, and is saved in the vault's attachments folder (up to 5 MB each). Once synced, it is stored like any other file. Text recognition (OCR) on images runs on your device. The recognised text is saved as a note and syncs like any note. Files you copy into a vault yourself are uploaded unchanged.

Earlier versions of a file stay on our servers for about 90 days after you change or delete the file. Deleting a note in the app deletes it on your synced devices and marks it deleted on our server; its stored content is normally removed about 90 days later. The entry for the file, including its name, stays in our file list until we erase your data on request. Turning sync off for a vault stops the uploads. It does not delete the copy on our servers.

We process the contents of your files only to provide Sync, the personal MCP endpoint and the Assistant, at your instruction, and our access to them is limited to what operating the service needs. The files are encrypted in transit (TLS) and at rest in Amazon S3 and DynamoDB, but not with a key that only you hold. Legal basis: Art. 6 (1) (b) GDPR, performance of the subscription contract.

The personal MCP endpoint

Valutorio Sync includes a personal MCP endpoint at sync.valutorio.com/mcp. An AI tool that you connect to it can search, list, read, write and delete notes in your first cloud vault, and only with your personal token. The token is a random value. The server shows it once, when you first register or when you rotate it, and stores only a one-way hash of it. The app keeps a copy in the Keychain of your device so that it can show the token again. Rotating the token in the app makes the old token stop working immediately. Removing the token from a device deletes only the copy on that device, so to cut off a tool, rotate the token. We check your subscription on every call, and the endpoint stops working once the subscription has lapsed.

Anything that holds the token can change and delete notes in that vault. The tool you connect, and the company behind it, receive the notes it reads. They receive them only because you connect the tool and it reads them with your token; Valutorio does not send notes to it. They are not our processors, we do not control what they do with the notes, and their own terms and privacy policies apply. Each tool call also makes the backend write a short-lived technical record (see "Logs and security"). Legal basis for our part: Art. 6 (1) (b) GDPR, performance of the subscription contract.

The Assistant

The Assistant is an optional feature of the Mac, iPhone and iPad apps, available with a Valutorio Pro subscription. It answers from the notes in your Valutorio Cloud vault: it reads the cloud copy of your first cloud vault, whichever vault is open on your device. If you have no cloud vault, it has no notes to read. Its answers come from an AI model and can be wrong.

Before your first message, the app asks for your consent. It tells you that your messages, the conversation so far and the notes the Assistant looks up go to OpenAI in the United States, and that Valutorio does not include your name, email address or Apple ID. No Assistant message is sent until you accept. You can withdraw your consent at any time: on the Mac in Preferences, under General, in the Privacy section; on iPhone and iPad in the app's Settings, in the Privacy section. Withdrawal does not affect the processing before it, and the app asks again if you want to use the Assistant afterwards. The record of your consent is stored on your device.

When you send the Assistant a message, the app sends the conversation (your messages and the Assistant's earlier answers) to our backend in the AWS Frankfurt region (eu-central-1). The backend sends requests to our AI provider, OpenAI Ireland Limited, which processes them on our behalf as a processor under Art. 28 GDPR. The requests contain your message, the earlier messages and answers of the same conversation, the instructions that tell the model how to work with your notes, and the note content the Assistant looks up in your cloud vault to answer: search excerpts, the text of the notes it reads, and the paths (folder and file names) of the notes it finds or, when it lists notes, of the notes in the vault. The note content looked up for one message is limited to 48,000 characters. Apart from what you write in your messages and notes, the requests contain no name, email address, Apple ID or account identifier, and OpenAI receives them from our server, not from your device. Nothing is sent to OpenAI unless you send a message to the Assistant; Valutorio Sync on its own sends nothing to OpenAI.

The Assistant can create a new note in your cloud vault, which then syncs to your devices. It cannot delete notes. When it proposes a change to an existing note, our backend holds the path and the full proposed text until you tap Apply. A proposal not applied within 10 minutes expires. A held proposal is deleted when you apply it or clear the chat; otherwise it is deleted automatically, normally within a few days after it expires.

OpenAI processes the requests in the United States and possibly in other countries outside the EU. Transfers out of the EU rely on the EU Standard Contractual Clauses (Art. 46 (2) (c) GDPR) or another transfer mechanism in OpenAI's data processing addendum. Our requests ask OpenAI not to store the answers for later retrieval (the API's "store" setting is off). OpenAI keeps requests and answers in abuse-monitoring logs for up to 30 days, unless a longer period is required by law or needed to protect its services or others from harm; prompt caching can hold an encrypted intermediate form of a request for up to 24 hours. Under OpenAI's API data-usage policy, data sent to its API is not used to train OpenAI's models unless the customer opts in, and we have not opted in.

Our backend does not store your conversations. The conversation is saved only on your device, in a file that is not part of your vault and is never synced; Clear Chat deletes it. Our backend keeps a spend counter per account: for each day and month in which you used the Assistant, an amount (no content), linked to your account ID. It enforces the daily and monthly limits, and it shows on which days the Assistant was used. The counters are deleted automatically about a week after the day or month they cover ends. The backend also keeps short-lived technical records that limit how many requests run at once (see "Logs and security").

To stop the processing, withdraw your consent, stop using the Assistant, or end the Valutorio Pro subscription. Legal basis: Art. 6 (1) (b) GDPR, to provide the Assistant you asked for, and Art. 6 (1) (a) GDPR, the consent you give in the app before the first message, for passing your messages and notes to OpenAI. For the spend counter and the technical records the legal basis is Art. 6 (1) (f) GDPR (our legitimate interest in keeping use within its limits and in preventing abuse).

What you put in your notes

The apps are made for personal use. Your notes can hold information about other people, or sensitive information about you, such as your health. You decide what you write and what you put into a vault that you sync. Everything this section says about Sync, the MCP endpoint and the Assistant applies to that content too: Sync stores it at your instruction, an AI tool you connect to the MCP endpoint receives what it reads, and the Assistant sends what it looks up to OpenAI once you have given your consent in the app. Use these features only for content that you accept this for. If you use them for professional or client data, you remain responsible for that data, and if you need a data processing agreement for it, email the address in section 1 before you start.

Data that stays on your device

The apps keep the following on your device and send none of it to us except as described above: your vaults and the notes in them; the search index, tags, backlinks and graph, which the app builds on the device; the note history, which is a hidden .git folder inside the vault that is never uploaded; settings, recent vaults and notes, tabs and window layout; unsaved drafts; the Assistant conversation and your Assistant consent record; and, in the Keychain of that device only (not in iCloud Keychain), the access token, the device ID and the MCP token. This storage, and the reading of the device ID and the tokens to send them to our servers when you use Sync, the MCP endpoint or the Assistant, is strictly necessary for the service you asked for (section 25 (2) no. 2 TDDDG).

The apps do not ask for access to your photo library, camera, microphone, location or contacts. On iPhone and iPad you add an image through the system picker, and the app receives only the image you pick. The apps never load remote images that a note links to, and they open links in your browser only when you click or tap them. A vault that you keep in iCloud Drive, Dropbox or a similar service is handled by that service. On iPhone and iPad, the vault is part of your own device backup with Apple unless you exclude it; drafts and the Assistant conversation are excluded from it. Apple handles that backup under its own terms, not as our processor.

Logs and security

Our backend writes operational logs: a request ID, the route, counters and error details. They do not contain the contents of your notes. When a step fails, the error details can include the path (folder and file names) of the file involved. They are kept for 30 days and then deleted automatically. We have not set up access logs for the sync, MCP or Assistant endpoints, so we keep no log of the IP addresses that call them. For the Assistant and the MCP endpoint, the backend also keeps short-lived technical records, linked to your account ID, that limit how many requests run at once. They are deleted automatically after about an hour. Legal basis: Art. 6 (1) (f) GDPR, our legitimate interest in running the service securely, in finding and fixing errors and in keeping use within its limits. All traffic between the apps and our servers uses HTTPS.

How long we keep app data

• The account record is kept until you ask us to delete it. It does not expire when a subscription ends, and we delete nothing automatically at that point.
• Synced files are kept until you ask us to delete them. Earlier versions of a file stay in storage for about 90 days after the file is replaced or deleted, and the last version of a deleted file normally does too.
• The file list keeps the path and name of every file, deleted files included, until you ask us to delete them.
• Held Assistant changes are deleted when you apply them or clear the chat, and otherwise automatically, normally within a few days after they expire.
• Spend counters are deleted automatically about a week after the day or month they cover ends.
• Backend logs are kept for 30 days. The short-lived technical records for the Assistant and the MCP endpoint are deleted after about an hour.
• At OpenAI, requests are not stored for later retrieval. Abuse-monitoring logs are kept for up to 30 days and the prompt cache for up to 24 hours.
• Database backups hold deleted data for up to 35 days (section 2).
• Support threads and mail are covered in sections 3 to 5.

Deleting your data

To have your data deleted, email the address in section 1. We erase the account record, the vault entries, the stored files with all their earlier versions, the MCP token entries and the Assistant records, and we confirm when this is done, within one month (Art. 12 (3) GDPR). We do this by hand.

Our account records have no field for your name or email address, so we cannot find them by who you are. A device label, a vault name or a file name that you chose can contain a name or an email address, though. Tell us details that identify your account, for example the names of your cloud vaults and when you subscribed. We may ask for more to be sure the records are yours. Once we have erased the live data, backups age out within 35 days and are not restored except after a failure, in which case we delete the data again. Erasure on our servers does not touch the notes on your devices. Turn sync off first, or the app may upload your files again. A subscription is cancelled with Apple in your account settings, not with us.

8. Who receives your data, and transfers outside the EU

We pass personal data on to these recipients:

• Amazon Web Services EMEA SARL (Luxembourg) hosts the website, the support system, the mail handling and the backend for sync, the MCP endpoint and the Assistant. It is our processor, and the data we store on it is stored in Frankfurt.
• OpenAI Ireland Limited receives Assistant requests (section 7). It is our processor and processes them in the United States and possibly in other countries outside the EU.
• Apple handles payment, subscriptions and the App Store under its own privacy policy and is a separate controller for that data. Apple's signed transaction record reaches us from your device. Our backend sends Apple nothing.
• Apple also provides the email service (iCloud Mail) that holds our mailbox. It receives the email you send to us, the mail forwarded from valutorio.com and the notifications about undeliverable mail (sections 3 and 5), under Apple's own terms and privacy policy. Apple may store and process mail outside the EU.
• Google provides the Gmail mailbox through which we send support and notification emails (section 3). It receives the recipient address and the content of those emails, under Google's own terms and privacy policy. Google may store and process mail outside the EU.
• Software tools that we use to read and answer support tickets and to read the launch notification list (section 3). They include Claude, an AI assistant provided by Anthropic, PBC, which may process the data in the United States. Anthropic's terms and privacy policy apply.
• An AI tool that you connect to the MCP endpoint receives the notes it reads. It receives them only because you connect it and it reads them with your token; Valutorio does not send notes to it. It acts for you and is not our processor.

Under their data processing terms, AWS and OpenAI, as processors under Art. 28 GDPR, may use the data only on our instructions and have to keep it secure and confidential. We do not pass personal data to advertisers, analytics providers or data brokers.

Transfers outside the EU: CloudFront serves pages from edge locations in Europe, North America and other regions that AWS includes in its price class 100. Requests to the support and launch forms also pass through these edge locations on their way to Frankfurt, where the data is stored. OpenAI processes Assistant requests in the United States and possibly in other countries. Apple may hold our mailbox, and Google our Gmail mailbox, outside the EU. Anthropic (the Claude support tool) and the AI tool you connect to the MCP endpoint run wherever their providers run them. The safeguards are these. AWS: the adequacy decision for the EU-U.S. Data Privacy Framework (Art. 45 GDPR), under which Amazon.com, Inc. is certified for AWS, and the Standard Contractual Clauses (Art. 46 (2) (c) GDPR) in the AWS data processing agreement. OpenAI: the Standard Contractual Clauses (Art. 46 (2) (c) GDPR) or another transfer mechanism in its data processing addendum. Apple: its own terms and privacy policy. Google: its own terms and privacy policy. Anthropic: its terms and privacy policy. To get a copy of the safeguards that apply, email the address in section 1.

9. Your rights

Under the GDPR you have the right to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), and data portability (Art. 20). To exercise any of these rights, email the address in section 1. We answer within one month (Art. 12 (3) GDPR). An erasure request also covers your email address on the list of undeliverable addresses (section 5) and mail from you in our mailbox. Because our account records have no field for your name or email address, we may need details from you to find them (see "Deleting your data" in section 7). You also have the right to lodge a complaint with a supervisory authority (Art. 77); the authority responsible for us is the Hessischer Beauftragte für Datenschutz und Informationsfreiheit, Wilhelmstraße 7, 65185 Wiesbaden, datenschutz.hessen.de. You can also complain to the authority of the place where you live or work, or where the infringement took place.

Right to object (Art. 21 GDPR)

You can object at any time, on grounds relating to your particular situation, to processing that we base on legitimate interests (Art. 6 (1) (f) GDPR). We then stop that processing unless we show compelling reasons that outweigh your interests, or it serves the establishment, exercise or defence of legal claims. On request we also explain how we weighed our interests against yours. This covers the access logs, the error log and the rate-limit counters (sections 2, 3 and 4), the mail you send us (section 3), the pending launch notification request and its confirmation email (section 4), the mail handling (section 5), and the backend logs, the spend counter and the technical records (section 7). To object, email the address in section 1.

Separately from that, you can object at any time to your address being used for the launch email, whatever the legal basis (Art. 21 (2) GDPR); see section 4.

Withdrawing consent

Where we rely on your consent, you can withdraw it at any time with effect for the future (Art. 7 (3) GDPR). For the launch notification, use the unsubscribe link or write to us. For the Assistant, switch off AI data sharing in the app's settings (section 7). Withdrawal does not affect the processing before it.

Providing data, and automated decisions

You are not obliged to give us personal data. Without your email address we cannot answer a support request or send the launch email. Without the signed transaction record, Valutorio Sync, the MCP endpoint and the Assistant cannot work. We make no decisions based solely on automated processing that have legal or similarly significant effects on you, and we do not profile you. Two automatic checks exist: whether your subscription is current, from the expiry date Apple signs, and whether Assistant use is within its daily and monthly limits. If a check fails, the feature stops until you renew or the period ends.

10. Changes to this policy

If the website or the apps gain features that process personal data differently (for example a different form provider or a different AI provider), this policy will be updated before that change goes live. The current version is always at this address. This policy is published in English and in German (Datenschutzerklärung), and both versions are updated together. Our pages in other languages link to this English version.

Last updated: 20 October 2026.