Skip to content
Sign inDeutsch

Version of 2026-11-11

Draft for legal review, version 2026-11-11, not approved

Privacy Notice for opifina

This notice explains which personal data we process when you register for and use opifina. It fulfils our duty to inform you under Art. 13 of the General Data Protection Regulation (GDPR). Personal data is any data that can be used to identify you personally.

opifina is software for trade businesses. It runs as a web app and as an app on smartphones and tablets. Among other things, it helps you create quotes with the support of artificial intelligence (AI).

1. Data protection at a glance

Who is responsible?

The provider is responsible for data processing at opifina. You will find the contact details in section 2.

Which data do we process?

We process data that you give us yourself, for example when you register or when you enter details about your business. Other data is created technically when you use opifina, for example session data and logs of security-relevant actions.

What do we use your data for?

We use your data to provide you with an account, to sign you in securely, to run opifina for your business and to prevent misuse.

What we do not do

We do not use tracking or advertising cookies. We do not embed third-party analytics tools or social media plugins. We do not sell your data.

What rights do you have?

You have the right to access, rectification, erasure, restriction of processing, data portability and objection. You can withdraw consent at any time. You can also lodge a complaint with a supervisory authority. Details are in section 13.

2. Controller

The controller responsible for data processing is:

[Provider name] [Legal form] [Address] Represented by: [Authorised representative] Register entry: [Register court and registration number] Email: [Contact email] Phone: [Phone number]

The controller is the body that, alone or jointly with others, decides on the purposes and means of processing personal data.

3. Data protection officer

[Name and contact details of the data protection officer, or a statement that none has been appointed]

4. Two roles: your data and your customers' data

opifina handles two kinds of data, and different rules apply to each.

  • Your data as a user and your business data: We are responsible for this. This notice describes how we handle it.
  • Your customers' data (end customers): If you enter data about your customers in opifina, such as name, contact details and address, we process it only on your behalf and according to your instructions. Your business is then the controller. The basis is the data processing agreement under Art. 28 GDPR, which is part of the terms of use. You inform your customers about this processing yourself.

5. Registration and account

Which data?

For registration we collect:

  • email address
  • first name and last name

To confirm your email address, we send you a six-digit code by email. Your account becomes active only after you enter this code.

We do not accept addresses from disposable email services.

Purpose and legal basis

We need this data to create your account, to recognise you and to communicate with you about your account. The legal basis is Art. 6(1)(b) GDPR (contract and pre-contractual measures). Blocking disposable addresses protects against misuse. The legal basis is our legitimate interest under Art. 6(1)(f) GDPR.

6. Sign-in and account security

Sign-in methods

You sign in in one of two ways:

  • with a passkey stored on your device, or
  • with a password plus a code from an authenticator app.

For passkeys we store only the public part of the key. The secret part never leaves your device. We do not store passwords in plain text.

Emergency sheet with backup codes

So that you can get back into your account without your device, you receive an emergency sheet with backup codes. We store these codes only as a hash. The code cannot be calculated back from the hash.

Check against known data breaches

When you set a password, we check whether it appears in known data breaches. For this we use the service "Have I Been Pwned" with a k-anonymity method. Only the first five characters of the SHA-1 hash of your password are transmitted. Neither your password itself nor your email address is transmitted. The service cannot identify your password or you from this request.

Protection against bots

We protect forms such as registration with ALTCHA. ALTCHA runs on our own servers. No data is sent to third parties and no cookies are set. Your browser solves a small computing task that makes automated mass requests harder.

Purpose and legal basis

These measures protect your account and your business data. The legal basis is Art. 6(1)(b) GDPR insofar as secure sign-in is part of our service, and otherwise our legitimate interest in secure operation under Art. 6(1)(f) GDPR. At the same time we meet our duty to ensure the security of processing under Art. 32 GDPR.

7. Details about your business

Which data?

To use opifina, you enter details about your business:

  • business name and legal form
  • country and address
  • trades
  • entry in the register of craftspeople (Handwerksrolle) or trade registration

Where these details relate to a person, for example in the case of a sole trader, they are personal data.

Purpose and legal basis

We need these details to set up opifina for your business, for example for quotes with the correct company details. The legal basis is Art. 6(1)(b) GDPR.

8. Using opifina

Sessions

To keep you signed in, we create a session. For this we store session data on our server and a technically necessary session cookie in your browser. [Check the list of stored session data against the code before approval]

Logs of security-relevant actions

We log security-relevant actions, for example sign-ins, changes to sign-in methods and important changes to data. This lets us detect misuse and trace who changed what and when. [Check the list of logged actions and data fields against the code before approval]

The legal basis for sessions is Art. 6(1)(b) GDPR. The legal basis for the logs is our legitimate interest in the security of opifina and in being able to prove changes under Art. 6(1)(f) GDPR.

Server logs

When you access opifina, our server technically processes connection data, such as IP address, time of the request and browser type. We need this data to provide opifina reliably and securely. The legal basis is Art. 6(1)(f) GDPR. We do not combine this data with other data sources. [Check scope and retention period of server logs]

AI features

opifina offers features based on artificial intelligence, for example for creating quotes. These features run through our own AI gateway. We process only the data needed for the feature in question. The results are suggestions. You check them and decide yourself what to use. [Add details on downstream AI services, storage location and third-country transfers if data leaves our own server]

The legal basis is Art. 6(1)(b) GDPR. For your customers' data, the data processing agreement applies.

Connection to AI clients (MCP)

You can connect opifina to an AI client that you use yourself. This connection is made only if you expressly agree to it. Through the connection, the AI client can access data in opifina within the scope of your approval. Processing within the AI client itself is governed by the terms of the provider you have chosen. You can disconnect at any time.

The legal basis is your consent under Art. 6(1)(a) GDPR. Withdrawal takes effect for the future.

Trial period

The trial period lasts 30 days. We do not collect payment data for it.

9. Cookies

opifina uses only technically necessary cookies. This is mainly the session cookie that keeps you signed in. Sign-in does not work without this cookie.

We do not need consent for technically necessary cookies. The legal basis for storing and reading them is Section 25(2) No. 2 of the German Telecommunications Digital Services Data Protection Act (TDDDG); the legal basis for further processing is Art. 6(1)(b) GDPR.

We do not use tracking, analytics or advertising cookies. That is why we do not show a cookie banner.

You can delete or block cookies in your browser. You will then no longer be able to sign in to opifina.

10. Recipients and service providers

We share personal data only where this is necessary for the contract, where we are legally obliged to do so, where we have a legitimate interest or where another legal basis permits it. Service providers that process data on our behalf are bound by a data processing agreement.

We use the following service providers:

  • Hosting and database: Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany. Servers and database are located in Germany.
  • Email delivery: Lettermint, for confirmation codes and messages about your account. [Check registered office and contracting party]
  • Backup copy: Google Drive, for backup copies. [Check contracting party, registered office and encryption of backup copies]
  • App distribution: Apple and Google, if you download the app from their app stores. The privacy terms of the respective store also apply.
  • Payments (later): Stripe, once paid plans are offered. We do not collect payment data during the trial period.

A list of sub-processors is also included in the data processing agreement in the terms of use.

11. Transfers to third countries

Some of the service providers listed are based outside the EU or belong to companies based outside the EU, for example in the USA. Data is transferred there only if the requirements of Art. 44 et seq. GDPR are met. [Check and state the basis for each service provider, for example adequacy decision or standard contractual clauses]

12. Retention period

We store personal data only for as long as necessary for the purpose. If you request erasure or withdraw consent, we delete your data unless a legal obligation or another permissible reason requires further storage, for example retention periods under tax or commercial law. In that case we delete the data as soon as the reason no longer applies.

In detail:

  • Account data: until the account is deleted. [Add period after account deletion or after the end of the trial period]
  • Unconfirmed registrations: [Add period]
  • Sessions: until you sign out or the session expires. [Add maximum duration]
  • Logs of security-relevant actions: [Add period]
  • Server logs: [Add period]
  • Backup copies: [Add period]

13. Your rights

Access, rectification and erasure

You have the right at any time to obtain free information about your stored data, its origin and recipients and the purpose of processing (Art. 15 GDPR). You can request the rectification of incorrect data (Art. 16 GDPR) and the erasure of your data (Art. 17 GDPR).

Restriction of processing

You can ask us to restrict the processing of your data (Art. 18 GDPR). This applies in particular if:

  • you dispute the accuracy of your data, for the duration of our review,
  • the processing is unlawful and you want restriction instead of erasure,
  • we no longer need the data but you need it for legal claims,
  • you have objected and it has not yet been decided whose interests prevail.

Apart from storing it, we may process restricted data only with your consent, for legal claims, to protect the rights of others or for important reasons of public interest.

Data portability

You can ask us to hand over data that we process automatically on the basis of your consent or a contract in a common, machine-readable format (Art. 20 GDPR). On request we transfer it directly to another controller, where technically feasible.

Withdrawal of consent

You can withdraw consent at any time with effect for the future (Art. 7(3) GDPR). Processing carried out before withdrawal remains lawful.

Right to object under Art. 21 GDPR

If we process data on the basis of Art. 6(1)(f) GDPR (legitimate interest), you can object at any time on grounds relating to your particular situation. We will then stop processing the data unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing serves to establish, exercise or defend legal claims.

If we process your data for direct marketing, you can object to this at any time. We will then no longer use your data for this purpose.

Right to lodge a complaint

You have the right to lodge a complaint with a data protection supervisory authority, in particular in the member state of your habitual residence, your place of work or the place of the alleged infringement (Art. 77 GDPR). Other legal remedies remain unaffected.

The authority responsible for us is: [Competent supervisory authority with address]

How to reach us

For all questions about data protection and to exercise your rights, write to [Contact email] or to the address in section 2.

14. Obligation to provide data

The details for registration and sign-in are required for the contract. Without them we cannot provide you with an account. Connecting AI clients is voluntary.

15. Automated decisions

We do not make decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you (Art. 22 GDPR). The AI features make suggestions. You make the decision.

16. Encrypted transmission

The connection to opifina is encrypted with TLS. Third parties cannot read data you send to us while it is in transit.

17. Changes to this notice

We update this notice when opifina or the legal situation changes. The current version published in opifina applies.

As of: [Date of approval]