This Privacy Policy explains the nature, scope and purpose of the processing of personal data (hereinafter "data") in connection with the use of the Supercount AI website and platform. Where we process data within the platform on behalf of our customers, the data processing agreement (DPA) concluded with the respective customer pursuant to Art. 28 GDPR applies in addition.

1. Controller

Supercount AI FlexCo, Peter-Behrens-Platz 10, 4020 Linz, Austria. Email: markus@supercount.ai. Managing Directors: Mag. Markus Waghubinger, Sebastian Kaiser-Mühlecker, MSc.

2. Categories of data processed and purposes of processing

a) Provision of the website: We process technically necessary data (including IP address, date and time of access, page requested, referrer, browser and device information) in order to provide the website and to ensure the security of our systems. Legal basis: legitimate interests (Art. 6(1)(f) GDPR).

b) Contacting us (email, contact form): We process the information you submit in order to handle your enquiry. Legal basis: performance of a contract or pre-contractual measures (Art. 6(1)(b) GDPR); otherwise, legitimate interests (Art. 6(1)(f) GDPR).

c) Performance of contract: Master, contact, contract and payment data for the provision of our services, invoicing and customer support. Legal basis: performance of a contract (Art. 6(1)(b) GDPR). We process our customers' client and accounting data exclusively as a processor on the basis of the DPA; the respective customer remains the controller.

d) Web analytics and cookies: We use only technically necessary cookies for authentication and session management. Our website is provided via the website builder Framer (Framer B.V., Netherlands). For audience measurement, we use Framer's privacy-friendly, cookieless analytics; no cookies or comparable tracking technologies are set, and the data is used solely for technical optimisation. Legal basis: legitimate interests (Art. 6(1)(f) GDPR).

3. Recipients of data / sub-processors

To provide our services, we engage carefully selected service providers that are contractually bound in accordance with Art. 28 GDPR. Information on regions describes the region configured for product processing; it does not mean that all support, security or account-related processes of the respective providers take place exclusively in that region.

a) Website and platform front end: The marketing website is provided via Framer (Framer B.V., Netherlands). The front end of the platform (app) is delivered by Vercel Inc. (USA) via a global edge network with EU regions. No receipt images or accounting content are hosted on Vercel; technical usage data (e.g. IP address, headers, user agent) may be processed in this context.

b) Back end, database and authentication: Supabase Pte. Ltd. (Singapore) – configured project region: EU (Frankfurt). The data processing agreement executed for Supercount was originally concluded with Supabase Inc.; the current contracting entity is Supabase Pte. Ltd. The technical place of storage and processing is Frankfurt. Global support or intra-group ancillary processing may give rise to access from third countries; such access is subject to the contractual safeguards, including the EU Standard Contractual Clauses (SCCs). In addition: Google Cloud (EU regions) for infrastructure and processing.

c) AI services for automated accounting processes: Google Vertex AI (Gemini models) via Google Cloud EMEA Limited – restricted exclusively to EU regions and EU endpoints (primarily Frankfurt); no training on customer data. AWS Bedrock (Anthropic Claude models) via Amazon Web Services EMEA SARL – exclusively in AWS regions within the EU via the EU inference profile (Frankfurt, Ireland, Paris, Stockholm, Milan, Spain; no processing outside the EU). Zero data retention is configured for this processing path (no model invocation logging, no storage of inputs or outputs by AWS), and no training on customer data takes place. Models that require mandatory retention or the sharing of data with the model provider are not available under the AWS configuration applicable to Supercount and are not used.

Optional AI path (only upon activation by the respective firm): OpenAI functionality exclusively via the chain Supercount AI → finothek GmbH (Linz) → OpenAI Ireland Ltd. (Dublin). Supercount AI does not maintain a direct OpenAI account. Under the finothek data processing agreement, content logging on the OpenAI endpoint is fully disabled, and the Supercount project interfaces do not permit content logging; finothek does not access the content. Training and feedback sharing are disabled; no training on customer data. OpenAI retains API data on its side for a maximum of 30 days and deletes it thereafter; no zero data retention beyond this is committed. Any intra-group transfer to OpenAI OpCo, LLC (USA) is safeguarded by EU Standard Contractual Clauses.

Further optional AI paths (only upon activation by the respective firm): Mistral AI SAS (Paris, France) and Scaleway SAS (Paris, France) via EU endpoints in France; no training on customer data. Without express activation by the firm, no processing takes place via these paths; the processing path is never switched automatically.

Further optional features (only upon activation by the respective firm, subject to consent at the time of activation): DATEV integration via Klardaten GmbH (Berlin) or Riecken Webservice & Application GmbH (Vienna); bank connectivity for retrieving account transactions via BANKSapi Technology GmbH (Munich); submission of receipts via WhatsApp through WhatsApp Ireland Limited (Dublin; onward transfer to WhatsApp LLC, USA, on the basis of the EU-U.S. Data Privacy Framework, alternatively Standard Contractual Clauses); shop integration for retrieving order data from the client's Shopify store (Shopify International Limited, Dublin; Shopify acts as processor on behalf of the shop operator). Without express activation, no processing takes place via these paths.

d) Email services: Plus Five Five, Inc. d/b/a Resend (USA) for transactional system emails; the Ireland region (eu-west-1) is used for the configured sending domain. Mailgun Technologies, Inc. (Sinch) for EU-based inbound processing of receipts and emails.

e) Error and security monitoring: Functional Software, Inc. d/b/a Sentry – EU endpoint (de.sentry.io). PII scrubbing is enabled; receipt and content data are not intended to be transmitted, and error data is technically minimised.

f) DATEV interface (optional, only upon activation by the firm): Klardaten GmbH (Berlin, Germany) – processing within the EU; bilateral data processing agreement expressly referring to Section 203 of the German Criminal Code (StGB) and Section 80 of the Austrian Public Accountants and Tax Advisors Act 2017 (WTBG 2017).

g) Payment processing: There is currently no automated payment processing via the platform; invoicing and payment are handled manually outside the software.

4. Transfers of data to third countries

Product processing is restricted to EU regions and EU endpoints (in particular AWS regions within the EU, configured Google EU regions and Supabase Frankfurt). This technical region restriction does not preclude individual providers from processing data in third countries for support, account or security purposes. Where processing takes place outside the EU/EEA, we rely on appropriate safeguards under Chapter V GDPR, in particular an adequacy decision (EU-U.S. Data Privacy Framework, DPF) or the EU Standard Contractual Clauses (SCCs).

As of 24 July 2026, Vercel Inc., Functional Software (Sentry), Mailgun Technologies, Inc. and Resend are listed on the Data Privacy Framework List; SCCs apply to the Supabase arrangement and to the optional finothek/OpenAI chain. DPF status is re-verified prior to any major transfers.

5. Retention period

We store data only for as long as is necessary for the respective purposes. Accounting and contract data are subject to retention obligations under commercial and tax law (in Austria, generally seven years pursuant to Section 132 of the Federal Fiscal Code (BAO) and Section 212 of the Austrian Commercial Code (UGB)). Enquiry data is deleted once the enquiry has been dealt with, unless a statutory retention obligation applies. Data in the customer platform is subject to the provisions of the respective DPA (including a 30-day export window after termination of the contract, followed by deletion from production systems; technically isolated backup copies are overwritten in accordance with the documented rotation and deletion cycles of the respective providers).

Purpose and limits of storage: Data is stored on a per-case basis solely so that the AI functions used by the users of a case receive the most useful context for that case. No training of AI models and no commercial exploitation take place; storage serves solely the provision of our services. When a case or client is deleted, the associated data and patterns are removed virtually immediately. Only individual objects, such as receipt images, may remain briefly with infrastructure providers (e.g. Google) for recovery purposes and are subsequently deleted as well. The 30-day window, by contrast, relates exclusively to the option of exporting data following termination of the contract.

6. Your rights as a data subject

Subject to the conditions of the GDPR, you have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and the right to object to processing based on legitimate interests (Art. 21). You may withdraw any consent you have given at any time with effect for the future (Art. 7(3) GDPR).

7. Right to lodge a complaint

If you believe that the processing of your data infringes data protection law, you have the right to lodge a complaint with a supervisory authority; in Austria, this is the Austrian Data Protection Authority (Datenschutzbehörde, www.dsb.gv.at).

8. Changes to this Privacy Policy

We update this Privacy Policy whenever our processing activities, the services we use or legal requirements change materially. The version published on the website at the relevant time shall prevail.