Skip to content
Sign inDeutsch

Version of 2026-11-11

Draft for legal review, version 2026-11-11, not approved

Terms of Use for the opifina Trial

1. Provider and scope

The provider of opifina is [Provider name], [Legal form], [Address], represented by [Authorised representative], registered under [Register court and registration number], email: [Contact email] (hereinafter "we").

These terms apply to the free trial of opifina. They apply to all access routes, meaning the web app, the apps and connections to AI clients.

opifina is intended exclusively for businesses within the meaning of Section 14 of the German Civil Code (BGB), in particular trade businesses. By registering, you confirm that you use opifina for your commercial or independent professional activity.

Deviating terms of the user apply only if we expressly agree to them in text form.

2. Subject of the trial

opifina is software for trade businesses that we provide as a service over the internet. Among other things, it includes features for managing business and customer data and for creating quotes with the support of artificial intelligence (AI).

The trial lets you get to know opifina. It lasts 30 days from the confirmation of your email address. It is free of charge. We do not collect payment data for it.

The features available in the trial may differ from the later paid offer. We may change, add or remove features during the trial.

3. Registration and account

You need an account to use opifina. When registering, you enter your email address and your first and last name. You confirm your email address with a six-digit code that we send to you by email.

Your details must be true and complete. Addresses from disposable email services are not permitted.

There is no right to registration. We may refuse a registration without giving reasons.

The trial contract is concluded when you have confirmed your email address and we activate your account.

4. Sign-in and security

You sign in with a passkey or with a password and a code from an authenticator app. You receive an emergency sheet with backup codes.

You are obliged to

  • keep your access credentials, meaning your passkey device, password, authenticator app and emergency sheet, safe and not pass them on to third parties,
  • inform us without delay if you suspect misuse of your account,
  • use a separate login for each person in your business who uses opifina, where opifina offers this.

We may temporarily block an account if there are specific indications of misuse.

5. Permitted use

You may use opifina only within these terms and the applicable laws. In particular, you must not

  • upload unlawful content or infringe the rights of third parties,
  • attempt to access data of other businesses or areas not released to you,
  • circumvent protective measures or disrupt the operation of opifina,
  • query opifina automatically to an extent beyond normal use, except through the interfaces provided for this purpose,
  • analyse opifina in order to build a competing product.

6. AI features

The AI features create suggestions, for example for quotes. These suggestions may be incorrect or incomplete.

You check every suggestion before you use it. You are responsible for quotes, prices and other content that you pass on to your customers.

The AI features run through our own AI gateway. You can connect opifina to an AI client that you use yourself. This connection is made only with your express agreement and can be disconnected at any time. The AI client is governed by the terms of its provider.

7. Availability

We make every effort to ensure smooth operation. During the trial we do not owe any particular level of availability. Maintenance, further development and faults may temporarily restrict use.

8. Your data

The data you enter in opifina remains your data. We use it only to provide opifina to you and otherwise only in accordance with these terms and the data processing agreement.

You are responsible for ensuring that you are permitted to process your customers' data in opifina and that you inform your customers about it.

We back up the data regularly. During the trial, you should also back up data that you need permanently yourself.

9. Data protection and data processing

The opifina privacy notice explains how we process your data as a user.

Where we process personal data of your customers for you, we do so as a processor. The data processing agreement in the annex applies to this. It forms part of these terms and takes effect upon registration.

10. Rights to opifina

All rights to opifina, in particular to the software, design and content, belong to us or our licensors. For the duration of the trial, you receive a simple, non-transferable and non-sublicensable right to use opifina for your business within these terms.

11. Liability

As the trial is free of charge, we are liable only for intent and gross negligence.

We are liable without limitation

  • for injury to life, body or health,
  • for fraudulently concealed defects,
  • under the German Product Liability Act,
  • where we have given a guarantee.

For loss of data, we are liable only to the extent that would have occurred even if you had backed up your data regularly.

Liability under Art. 82 GDPR remains unaffected.

[Legal review of the liability clause, in particular its relationship to Sections 521 and 599 BGB]

12. Term and termination

The trial ends automatically after 30 days. It does not turn into a paid contract by itself. A paid contract is concluded only if you expressly enter into one.

You can end the trial at any time by deleting your account or by notifying us in text form. We can end the trial with [Notice period] notice in text form. The right to terminate for good cause remains unaffected. Good cause exists in particular in the event of a serious breach of section 5.

After the trial ends, we delete your data after [Period until deletion after the end of the trial], unless you enter into a paid contract or there is a legal obligation to retain it. [Describe the option to export data before the end, if available]

13. Changes to these terms

We may change these terms if there is an objective reason, such as a change in the law or new features. We will notify you of changes in text form at least [Advance notice period] before they take effect. If you do not object before they take effect, the changes are deemed accepted. We will point out this consequence in the notification. If you object, either party may end the trial immediately.

14. Final provisions

The law of the Federal Republic of Germany applies, excluding the UN Convention on Contracts for the International Sale of Goods.

The place of jurisdiction for all disputes arising from this contract is [Place of jurisdiction], provided you are a merchant, a legal entity under public law or a special fund under public law.

If any provision of these terms is invalid, the remainder remains valid.

These terms are available in German and English. In case of discrepancies, the German version prevails.

Annex: Data Processing Agreement under Art. 28 GDPR

between the business that uses opifina (hereinafter "controller") and [Provider name], [Address] (hereinafter "processor").

1. Subject and duration

This agreement covers the processing of personal data by the processor on behalf of the controller when providing opifina under the terms of use (main contract).

The agreement applies for the term of the main contract. It does not end as long as the processor still processes personal data of the controller.

2. Nature and purpose of processing

The processor processes the data in order to provide opifina to the controller. This includes storing, displaying, changing, organising, transmitting to recipients chosen by the controller, backing up and deleting the data, as well as using the AI features, for example to create quotes.

The processor does not process the data for its own purposes.

3. Types of data

The following are processed in particular:

  • master data of the controller's customers, such as name and address,
  • contact details, such as phone number and email address,
  • order and quote data, such as described services, quantities and prices,
  • data of the controller's users, insofar as it arises in the course of the processing, for example in logs.

[Check list against the actual data model]

Special categories of personal data under Art. 9 GDPR are not subject to processing. The controller does not enter such data in opifina.

4. Categories of data subjects

Data subjects are in particular:

  • customers and prospective customers of the controller (end customers),
  • contact persons at the controller's customers,
  • employees and other users of the controller.

5. Obligations of the processor

The processor

  • processes the data only on documented instructions from the controller, unless required to do so by law. In that case, it informs the controller of that legal requirement before processing, unless the law prohibits this,
  • keeps the controller's data technically separate from the data of other customers,
  • processes the data in Germany or the EU, unless otherwise stated in section 9,
  • names a data protection contact for the controller: [Provider's data protection contact],
  • keeps a record of processing activities under Art. 30(2) GDPR,
  • informs the controller without delay if a supervisory authority takes action regarding the processing.

6. Instructions

The controller's instructions are initially set out in the main contract and in the use of opifina's features. The controller gives further instructions in text form.

If the processor believes that an instruction infringes data protection law, it informs the controller without delay. It may suspend carrying out the instruction until the controller confirms or changes it.

7. Confidentiality

The processor uses only persons who are committed to confidentiality or are under a statutory obligation of confidentiality. These persons have access to the data only to the extent necessary for their tasks. The duty of confidentiality continues after their work ends.

8. Technical and organisational measures

The processor takes appropriate technical and organisational measures under Art. 32 GDPR to ensure a level of security appropriate to the risk. These include in particular:

  • hosting and database in Germany,
  • separation of the data of different businesses at database level,
  • sign-in with a passkey or with a password and a second factor from an authenticator app,
  • storage of backup codes only as a hash,
  • checking new passwords against known data breaches,
  • protection of forms against bots with a self-hosted method,
  • logging of security-relevant actions,
  • regular backup copies,
  • encrypted transmission of data.

[Add a full description of the technical and organisational measures as a separate appendix]

The processor may develop the measures further as long as the level of protection does not decrease.

9. Sub-processing

The controller agrees to the use of the following sub-processors. Draft status, to be reviewed before paid sales.

  • Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany: hosting and database, location Germany
  • Lettermint: email delivery [Check registered office and contracting party]
  • Google (Google Drive): backup copy [Check contracting party, registered office and third-country transfer]
  • Apple: app distribution [Check role as sub-processor]
  • Google: app distribution [Check role as sub-processor]
  • Stripe: payment processing, only once paid plans are offered, not in use during the trial [Check registered office and role]

The processor informs the controller in advance in text form of any planned change or addition. The controller may object within [Objection period] for an important reason relating to data protection. If no agreement is reached, the controller may end the main contract.

The processor contractually binds each sub-processor to the same data protection obligations as in this agreement. Data is transferred to a country outside the EU or the EEA only if the requirements of Art. 44 et seq. GDPR are met.

Ancillary services that the processor obtains from third parties, such as telecommunications or postal services, do not count as sub-processing.

10. Support with data subject rights

The processor supports the controller with appropriate measures in responding to requests from data subjects, for example for access, rectification, erasure, restriction or data portability.

If a data subject contacts the processor directly, the processor forwards the request to the controller without delay. It does not answer the request itself unless the controller instructs it to.

11. Notification of breaches

The processor notifies the controller of a personal data breach without delay after becoming aware of it. The notification contains, as far as known:

  • a description of the nature of the breach, where possible with the categories and approximate number of data subjects and records concerned,
  • the name and contact details of a contact person,
  • a description of the likely consequences,
  • a description of the measures taken or proposed.

The processor supports the controller in meeting its notification and communication obligations under Art. 33 and 34 GDPR.

12. Further support

The processor supports the controller, within reason, with a data protection impact assessment and a prior consultation of the supervisory authority under Art. 35 and 36 GDPR. [Check rules on costs for support services]

13. Audit rights

The controller may check whether the processor complies with this agreement. The processor provides all information required for this.

On-site audits are possible after timely notice during normal business hours, without disproportionately disrupting operations. The controller may also commission an auditor bound to confidentiality who is not a competitor of the processor. Proof may also be provided through suitable certificates or audit reports.

14. Deletion and return after the end of the contract

After the main contract ends, the processor deletes all personal data of the controller or returns it, at the controller's choice. It deletes existing copies unless there is a legal obligation to store them.

Deletion takes place no later than [Period until deletion after the end of the trial]. Data in backup copies is deleted when those copies expire as scheduled after [Retention period for backup copies]. On request, the processor confirms deletion in text form.

15. Final provisions

In case of conflict, this agreement takes precedence over the other provisions of the main contract where the protection of personal data is concerned.

Liability is governed by Art. 82 GDPR. Otherwise, the liability rules of the main contract apply.

If any provision of this agreement is invalid, the remainder remains valid.