Privacy policy

This privacy policy explains which personal data is processed when you visit yourtinyoffice.com and when you use the application at app.yourtinyoffice.com (the "Service"). Version: 2026-11-02.

1. Controller

A data protection officer is not legally required and has not been appointed.

2. Two roles: controller and processor

For the data of website visitors and for the account and contract data of our customers we act as controller within the meaning of Art. 4(7) GDPR.

For the data our customers enter into the Service (in particular data about their own customers and contacts, service and time records, invoice and offer content, expenses, income and bank transactions) we act as processor within the meaning of Art. 28 GDPR. The respective customer is the controller of that data. The legal basis is the Data Processing Agreement, which forms part of our Terms of Service. Data subjects whose data a customer processes with us should direct their requests to that customer; we support the customer in responding.

3. Visiting the website

3.1 Server logs

When you open the website or the Service, the following data is processed as technically necessary: IP address, date and time, requested URL, HTTP status code, browser type and version, operating system, referrer. This data serves secure operation, error analysis and protection against attacks (rate limiting). The legal basis is Art. 6(1)(f) GDPR. Logs are deleted after 14 days.

3.2 Cookies and browser storage

We only use strictly necessary cookies and browser storage:

• sb_session: encrypted session cookie for the login; up to 30 days, removed on logout.
• csrf_token: protects forms against cross-site request forgery; 7 days.
• sb_recovery: encrypted cookie that only the password reset form reads, so that a rejected new password can be retried without a new e-mail; 15 minutes.
• ui_theme: your light/dark display choice, only if you pick one in the settings; 1 year.
• ads_consent: whether you accepted or declined the ad measurement banner (section 3.6); set only when you arrive through a ChatGPT ad and make a choice; 180 days.
• ads_oppref: the click ID of the ChatGPT ad, only after you accept that banner; 30 days.
• htmx-current-path-for-history (session storage): the address of the current page for the browser's back and forward navigation; deleted when the tab is closed.

Apart from the two ad measurement cookies, which are only set with your choice or consent, they are not used for analytics or advertising and do not require consent (§ 165(3) Austrian Telecommunications Act 2021). The cookieless usage analytics are described in section 3.5, the ad measurement in section 3.6.

3.3 External content

All fonts, scripts and stylesheets are delivered from our own servers. Opening our pages does not establish connections to third parties (such as Google Fonts or content delivery networks); the only exceptions are the usage analytics described in section 3.5 and, with your consent, the ad measurement described in section 3.6. Our pages load no scripts from OpenAI; the measurement is reported by our own server.

The landing page offers a short product video hosted on YouTube. It is loaded only after you click "Watch the video"; no connection to YouTube is made before that. With the click, your browser fetches the video in YouTube's privacy-enhanced mode (youtube-nocookie.com) from Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google then receives your IP address and technical details about your browser and device and may process data under its own rules, including in the USA; see policies.google.com/privacy. The legal basis is your consent given by the click (Art. 6(1)(a) GDPR); without the click no data flows. Links to further videos on YouTube open YouTube directly in a new tab.

3.4 Free public invoice tools

The public VAT number checker sends the VAT ID you enter to the European Commission’s VIES service. We return the current result and any name and address made available by VIES. We do not save the submitted VAT ID or the result in our database.

The public Factur-X and ZUGFeRD validator temporarily processes the PDF you upload on our server in Germany. The file is passed only to our private validation sidecar, is not saved in our database or file storage and is deleted from temporary storage when the request finishes. Technical logs contain the request identifier, file size, result class, elapsed time and issue counts, but not the PDF, embedded invoice content or validation messages.

For both tools, the IP address is used for short-lived in-memory rate limits and is also covered by the server logging described above. A strictly necessary CSRF cookie protects form submissions. The purpose is to provide the requested tool securely and prevent abuse; the legal basis is Art. 6(1)(f) GDPR. Our legitimate interests are operating these free tools securely and keeping them available.

3.5 Usage analytics (TelemetryDeck)

To see which parts of the website and the Service are used and where errors occur, our pages send pseudonymous usage signals to TelemetryDeck GmbH, Germany: the page visited (identifiers in the address are removed), the action performed (for example saving a form), error codes, the browser language and, on the first page view, the referring website and campaign parameters. When you are logged in, your user ID and the ID of your company account are transmitted only as SHA-256 hashes (pseudonyms), so TelemetryDeck does not receive the IDs themselves. On public pages each page view gets a new random ID, so visits are not linked to one another. The analytics itself stores nothing on your device (no cookies, no local or session storage) and builds no profiles across websites. The purpose is improving the Service and detecting errors; the legal basis is Art. 6(1)(f) GDPR. Our legitimate interest is a stable, useful product. More information: telemetrydeck.com/privacy.

3.6 Conversion measurement for ads in ChatGPT (OpenAI)

We advertise in ChatGPT. When you open our start page through such an ad, the address carries a click ID assigned by OpenAI, and a banner asks whether we may measure the ad. Only if you click "Accept" do we store the click ID in the cookie ads_oppref (30 days). If you then create an account (when accepting the Terms) or book a paid plan, our server reports this to OpenAI through its Conversions API: the click ID, the type of event (registration or subscription), its time, the address of the page it happened on and, for a paid plan, the plan and its net price. We do not transmit your name, e-mail address, IP address or any other data about you; OpenAI links the report to the ad click on its side. Your choice itself is kept in the cookie ads_consent (180 days) so that the banner is not shown again.

The recipient is OpenAI Ireland Ltd, The Liffey Trust Centre, 117-126 Sheriff Street Upper, Dublin 1, Ireland, which processes the data as an independent controller for its advertising services; a transfer to OpenAI, L.L.C. in the USA is possible and is safeguarded by the EU-US Data Privacy Framework and the EU Standard Contractual Clauses. The purpose is measuring and improving our advertising; the legal basis is your consent (Art. 6(1)(a) GDPR, § 165(3) TKG 2021). You can withdraw it at any time by deleting the two cookies in your browser; reports already sent are not affected. Without your consent nothing is stored or reported. OpenAI's privacy policy: openai.com/policies/privacy-policy.

4. Registration, account and contract

On registration we process your e-mail address, password (as a hash only), time of registration, the accepted version of the Terms and the company data stored in the account (company name, address, VAT ID, bank details, logo, invoice settings, optionally your own SMTP credentials and an API key for an AI service). The purpose is providing the Service and performing the contract; the legal basis is Art. 6(1)(b) GDPR. Bank details are only printed on the documents you create. SMTP passwords and API keys are stored encrypted (AES-256-GCM).

Required information: The e-mail address and a password are required to create the account, and the company name is required during setup so that documents can be created. For paid plans, Stripe additionally collects payment and billing data (section 5). Without these data we cannot open the account, create documents or provide a paid plan. All other company data (address, VAT ID, bank details, logo, SMTP credentials, API key) is optional and only needed for the corresponding features. There is no statutory obligation to provide the data.

Transactional e-mails (registration confirmation, password reset) are sent through the authentication services of our hosting partner Supabase.

5. Payments

Paid plans are billed through Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Dublin 2, Ireland. We transmit your e-mail address, company or display name and an internal account identifier to Stripe. Stripe collects payment details, billing address and VAT identification number (Stripe Tax) directly from you and is an independent controller for that processing. We never receive full payment details, only a customer identifier and the subscription status. The legal basis is Art. 6(1)(b) GDPR. Stripe's privacy notice: stripe.com/privacy.

6. Service features that query external systems

• VAT ID check: At the customer's request a VAT identification number is sent to the European Commission's VIES system and the result (valid/invalid, registered name and address) is stored. The legal basis is the customer's instruction under the Data Processing Agreement.
• Exchange rates: Reference rates are fetched from the European Central Bank. No personal data is transmitted.
• E-mail dispatch: Invoices and offers are sent by e-mail to the customer's recipients on the customer's instruction, either through our mail server (Hetzner Online GmbH, web hosting mail server) or through the customer's own SMTP server.
• Built-in AI (Mistral AI): Each AI feature is off until the customer switches it on in the settings; for a feature that is off nothing is transmitted. With receipt reading switched on, a receipt uploaded in the expense form or received by e-mail (photo or PDF) is sent to Mistral AI SAS to propose vendor, date, total, VAT rate and category. With items from a PDF (Pro), the uploaded document and the names and article numbers of the customer's items are sent to propose offer and invoice lines. With layout drafting (Pro), the design brief, the current layout with sample data only and an optional reference document are sent. Mistral AI SAS, 15 rue des Halles, 75001 Paris, France, processes the data as our processor (section 7) in data centers in the EU and EFTA, through its EU regional endpoint. The legal basis is the performance of the contract (Art. 6(1)(b) GDPR); personal data of the customer's own customers and suppliers contained in the documents is processed on the customer's behalf under the Data Processing Agreement. The proposals are only shown to the customer for review. Zero data retention is active for our Mistral AI account: the transmitted documents and the answers are not stored or logged longer than required to generate the answer, and they are not used to train AI models (see Mistral's privacy policy, as of 3 September 2026).

7. Recipients and processors

We use the following service providers, which are bound to us as processors under Art. 28 GDPR:

The data is stored in the regions named above. Transfers to third countries only occur insofar as Supabase Pte. Ltd. (Singapore), Supabase, Inc. (USA) and Supabase's sub-processors outside the EU have access for support, monitoring and operational purposes. Such transfers are safeguarded by the EU Commission's Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914; Art. 46(2)(c) GDPR), which are part of Supabase's Data Processing Addendum. Supabase's full list of sub-processors is published at supabase.com/legal/customer-resources/subprocessor-list. Hetzner processes data exclusively within the EU. Mistral AI processes the documents in data centers in the EU and EFTA; account and operational metadata may be handled by Mistral systems outside this region, and any access from third countries is safeguarded by the Standard Contractual Clauses in its Data Processing Addendum, and its sub-processors are published at trust.mistral.ai/subprocessors.

Independent recipients that are not our processors: Stripe for payments (section 5) and, only with your consent, OpenAI for ad measurement (section 3.6).

Beyond that, we only disclose data where legally obliged to do so.

8. Retention

• Account and contract data: for the duration of the contract; when the account is deleted, all data of the account including stored documents is removed immediately from the live Service; residual backup copies are deleted automatically within 30 days, unless statutory retention duties apply.
• Shared projects with partners: time you book on a project another account shared with you (date, hours or quantity, unit, note) is copied into that account, as are the invoices you issue to it, which it receives as expenses. These copies are the other account's own business records, for which it is the controller. They stay there when the partnership ends or when you delete your account.
• Billing records (our invoices to customers): 7 years pursuant to § 132 Austrian Federal Fiscal Code (BAO).
• Server logs: 14 days.
• Public VAT check data and uploaded e-invoice PDFs: only for the duration of the request; no database or file-storage retention.
• In-memory rate-limit entries: discarded automatically after they are no longer needed to enforce the minute and hourly limits.
• Documents created by the customer: as long as the customer keeps them in the Service. The customer is responsible for meeting their own retention duties, which depend on the country and the type of record: in Austria generally 7 years under § 132 BAO (longer in certain cases, e.g. for records relating to real estate); in Germany under § 147 German Fiscal Code (AO) 10 years for books, records and annual financial statements, 8 years for booking vouchers such as invoices and 6 years for business letters and other records. The periods usually start at the end of the calendar year in which the record was made and are extended as long as the records are still relevant for open tax assessments or pending proceedings. The customer can export all data at any time (JSON plus the original PDF and XML files).

9. Your rights

You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection (Art. 21 GDPR). Please send requests to [email protected]. You may also lodge a complaint with the supervisory authority: Austrian Data Protection Authority, Barichgasse 40–42, 1030 Vienna, dsb.gv.at.

10. Security

All transmissions are encrypted (TLS). Customer data is separated per tenant at the database level (row level security), sessions are encrypted and bound to HttpOnly cookies, and stored credentials are encrypted. Further technical and organisational measures are described in Annex 2 of the Data Processing Agreement.

11. No automated decision-making

No automated decision-making, including profiling, within the meaning of Art. 22 GDPR takes place.

12. Changes

We update this policy when the Service or the legal situation changes. The current version is always available at this address.