Privacy Policy

1. Information We Collect

Account Information

When you create an account through Firebase Authentication, we collect your email address, display name, and authentication provider details (e.g., Google account information). We do not store your password — authentication is handled entirely by Firebase.

Uploaded Documents

When you use our transcription service, you upload images or PDF files of handwritten documents. These files are stored on our servers to provide the transcription service and allow you to access your results.

Usage Data

We automatically collect certain information when you visit our Service, including your IP address, browser type, operating system, referring URLs, pages viewed, and the dates and times of your visits.

Cookies and Local Storage

We use essential cookies and local storage to maintain your session, remember your preferences (such as dark/light mode), and store your cookie consent choice. Analytics cookies are only set with your consent.

2. How We Use Your Information

We use the information we collect to:

• Provide, operate, and maintain our transcription services
• Process your transactions and manage your credit balance
• Send you transactional emails (e.g., purchase confirmations, expert transcription quotes)
• Improve, personalize, and expand our Service
• Understand and analyze how you use our Service
• Detect, prevent, and address technical issues and fraud
• Comply with legal obligations

3. Third-Party Services

We use the following third-party services to operate GermanLetters:

• Anthropic (Claude AI) — Your uploaded documents are sent to Anthropic's API for AI-powered transcription. Anthropic processes data solely to provide the transcription and does not use your documents for model training. Data is not retained beyond the duration of the API request. See Anthropic's Privacy Policy.
• Google Gemini — Used as an alternative AI model for transcription processing. When using the paid Gemini API, Google does not use your uploaded documents for model training. Data is processed solely to generate the transcription response and is not retained by Google beyond the API request. See Google's Privacy Policy.
• Stripe — Handles all payment processing for credit purchases. We do not store your credit card information. See Stripe's Privacy Policy.
• Firebase (Google) — Provides authentication services. See Firebase Privacy Information.
• Google Analytics — Used with your consent to understand how visitors interact with our Service. See Google's Privacy Policy.
• Meta Pixel (Facebook) — Used with your consent to measure advertising effectiveness and track conversions. See Meta's Privacy Policy.
• Resend — Used for sending transactional emails (e.g., expert transcription quotes). We do not send marketing or newsletter emails. See Resend's Privacy Policy.

4. Data Sharing

We do not sell your personal information. We share your information only with the third-party service providers listed above, and only to the extent necessary to provide our Service. We may also disclose your information if required to do so by law or in response to valid legal process.

5. Your Privacy Rights — California

If you are a California resident, you have specific rights under the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA):

• Right to Know: You may request information about the categories and specific pieces of personal information we have collected about you.
• Right to Delete: You may request that we delete the personal information we have collected from you, subject to certain exceptions.
• Right to Opt-Out of Sale: We do not sell personal information. However, you have the right to opt out if this changes.
• Right to Non-Discrimination: We will not discriminate against you for exercising any of your privacy rights.
• Right to Correct: You may request that we correct inaccurate personal information.
• Right to Limit Use of Sensitive Personal Information: You may request that we limit the use of your sensitive personal information.

To exercise these rights, please contact us at st@mes-beratung.de. We will respond to your request within 45 days.

6. Your Privacy Rights — Other States

Residents of Virginia, Colorado, Connecticut, Utah, and other states with comprehensive privacy laws may have similar rights, including the right to access, correct, delete, and obtain a copy of personal data, as well as the right to opt out of targeted advertising and profiling. To exercise these rights, please contact us at st@mes-beratung.de.

7. Do Not Track / Global Privacy Control

We honor Global Privacy Control (GPC) signals. When we detect a GPC signal from your browser, we treat it as a valid opt-out request and will not load non-essential tracking technologies.

8. Cookies

By default, we only use essential cookies required for the Service to function properly. These include:

• sidebar_state (cookie) — Remembers sidebar open/closed state. Expires after 7 days.
• cookie-consent (local storage) — Stores your cookie consent preference.
• germanletters-theme (local storage) — Stores your light/dark mode preference.

Analytics cookies (Google Analytics) are only loaded after you provide consent through our cookie banner.

9. Data Security

We implement appropriate technical and organizational measures to protect your personal information, including SSL/TLS encryption for all data transmitted between your browser and our servers. However, no method of transmission over the Internet or method of electronic storage is 100% secure, and we cannot guarantee absolute security.

10. Data Retention and Deletion

We retain your personal information only for as long as necessary to provide our Service and fulfill the purposes described in this policy. You can delete individual transcription jobs (including uploaded files) at any time through your account settings. You can also delete your entire account, which will permanently remove all your personal data, uploaded documents, and transcription results from our servers.

11. Children's Privacy

Our Service is not intended for children under 13 years of age, and we do not knowingly collect personal information from children under 13. If we learn that we have collected personal information from a child under 13, we will promptly delete that information. If you believe a child under 13 has provided us with personal information, please contact us at st@mes-beratung.de.

12. International Data Transfers

Our Service is operated from and data is processed in the United States. If you are accessing the Service from outside the United States, please be aware that your information may be transferred to, stored, and processed in the United States, where data protection laws may differ from those in your country of residence.

For transfers from the European Economic Area (EEA) to third countries, we rely on EU Standard Contractual Clauses (SCCs) adopted by the European Commission as the legal safeguard for these transfers, where our third-party service providers have committed to these clauses.

13. Information for Users in the European Economic Area (EEA)

Please note: This Service is offered exclusively in the United States. If you are located in the EEA, please visit our German-language sister site at deutschebriefe.de. The following information is provided for transparency and for individuals with EEA residency who may access this Service while located in the United States.

Data Controller

ITEBV GmbH
Zehntwerderweg 201A
13469 Berlin, Germany
Email: st@mes-beratung.de

Legal Basis for Processing (Art. 6 GDPR)

We process your personal data on the following legal bases:

• Performance of a contract (Art. 6(1)(b)): Account creation, document transcription, credit management, payment processing, and providing expert transcription services.
• Consent (Art. 6(1)(a)): Analytics cookies (Google Analytics), marketing cookies, and newsletter communications. You may withdraw consent at any time.
• Legitimate interests (Art. 6(1)(f)): Ensuring IT security, preventing fraud, improving service quality, and server logging. Our legitimate interest is maintaining a secure and functional service.
• Legal obligation (Art. 6(1)(c)): Retaining invoicing and payment data as required by tax and commercial law.

Your Rights Under the GDPR

If you are located in the EEA, you have the following rights regarding your personal data:

• Right of Access (Art. 15): You may request a copy of the personal data we hold about you.
• Right to Rectification (Art. 16): You may request correction of inaccurate or incomplete personal data.
• Right to Erasure (Art. 17): You may request deletion of your personal data. You can delete your account and all associated data through your account settings at any time.
• Right to Restriction of Processing (Art. 18): You may request that we restrict the processing of your personal data under certain conditions.
• Right to Data Portability (Art. 20): You may request to receive your personal data in a structured, commonly used, and machine-readable format.
• Right to Object (Art. 21): You may object to the processing of your personal data based on legitimate interests. Where we process your data for direct marketing purposes, you have an absolute right to object at any time.
• Right to Withdraw Consent (Art. 7(3)): Where processing is based on your consent, you may withdraw it at any time without affecting the lawfulness of processing carried out before withdrawal.

To exercise any of these rights, please contact us at st@mes-beratung.de. We will respond to your request within 30 days.

Right to Lodge a Complaint

You have the right to lodge a complaint with a supervisory authority. The competent supervisory authority for ITEBV GmbH is:

Berliner Beauftragte für Datenschutz und Informationsfreiheit
Friedrichstr. 219, 10969 Berlin
www.datenschutz-berlin.de

Data Protection Officer

We are not required to appoint a Data Protection Officer under Art. 37 GDPR. For any privacy-related inquiries, please contact us at the address above.

Retention Periods

• Account data: Retained until you delete your account.
• Uploaded documents and transcriptions: Retained until you delete the individual job or your account.
• Invoicing and payment data: Retained for 10 years as required by German tax and commercial law (§ 147 AO, § 257 HGB).
• Server logs (IP addresses): Retained for up to 90 days for security and debugging purposes.
• Cookie consent preference: Stored in your browser's local storage until you clear it.

Automated Decision-Making

We do not use automated decision-making or profiling that produces legal effects or similarly significantly affects you within the meaning of Art. 22 GDPR. Our AI transcription service is a tool that generates text output from your uploaded documents; it does not make decisions about you as a person.

Necessity of Data Provision

Providing your email address is required to create an account and use our Service (contractual requirement). Providing payment information is required to purchase credits (contractual requirement via Stripe). Uploading documents is required to use the transcription service. If you do not provide this data, you will not be able to use the respective features.

14. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or applicable law. We will notify you of any material changes by posting the updated policy on this page and updating the "Effective Date" at the top. Your continued use of the Service after any changes constitutes your acceptance of the updated policy.

15. Contact Us

If you have any questions about this Privacy Policy or wish to exercise your privacy rights, please contact us:

ITEBV GmbH
Zehntwerderweg 201A
13469 Berlin, Germany
Email: st@mes-beratung.de