We appreciate your interest in our company. Data protection is of particularly high importance for the management of Supercount AI FlexCo. This privacy policy informs you about the type, scope, and purpose of processing personal data (hereinafter referred to as "data") within our online offer and the associated websites, functions, and content as well as external online presences, such as our social media profiles.

1. Responsible Entity

Supercount AI FlexCo
Peter-Behrens-Platz 10,
4020 Linz
Email: sebastian@supercount.ai
Managing Directors: Mag. Markus Waghubinger, Sebastian Kaiser Mühlecker, MSc.

2. Types of Processed Data and Purposes of Processing

We process data for the following purposes and on the basis of the mentioned legal grounds:

Provision of the Online Offer (Website):

• Data: Usage data (e.g. visited websites, access times), meta/communication data (e.g. IP addresses, device information).

• Purpose: To ensure smooth connection setup and convenient use of the website, ensuring system security.

• Legal Basis: Our legitimate interest (Art. 6 para. 1 lit. f GDPR) in a secure and functional presentation of our company.

Contact (via email, contact form):

• Data: Inventory data (e.g. names), contact data (e.g. email, telephone numbers), content data (your message).

• Purpose: Processing and answering your inquiry.

• Legal Basis: Fulfillment of a contract or to carry out pre-contractual measures (Art. 6 para. 1 lit. b GDPR).

Contract Fulfillment (for our customers):

• Data: Inventory data, contact data, contract data (e.g. contract object, term), payment data.

• Purpose: Provision of our contractual services (SaaS, consulting), billing, and customer service.

• Legal Basis: Fulfillment of a contract (Art. 6 para. 1 lit. b GDPR).

Web Analysis & Cookies:

We use solely technically necessary cookies for authentication and session management on our website. These are required for the operation of the platform.

• Legal Basis: Our legitimate interest (Art. 6 para. 1 lit. f GDPR) in a secure and functional platform.

We additionally use Vercel Analytics for anonymized, cookie-less capturing of usage statistics (page views, load times, performance metrics). This data is not stored long-term and is solely used for the technical optimization of our offering.

• Legal Basis: Legitimate interest (Art. 6 para. 1 lit. f GDPR).

• Data Protection: https://vercel.com/legal/privacy-policy

A cookie banner is not required since only technically necessary cookies and cookie-less analytics are used.

3. Recipients of Data

We only pass on your data to third parties if it is necessary for contract fulfillment, we are legally obliged to do so, or you have given your consent.

To provide our services, we utilize the following specialized service providers (processors):

a) Frontend Hosting:

• Vercel Inc. (USA) – EU-US Data Privacy Framework (DPF) certified

• Function: Delivery of frontend code (HTML/CSS/JavaScript) via a global edge network with automatic distribution in EU regions (including Frankfurt, Dublin, London). Only static program files are delivered, no user data is transferred or stored through Vercel.

• Web: vercel.com | Data Protection: vercel.com/legal/privacy-policy

b) Backend, Database & Authentication:

• Supabase Inc.

• Region: EU (Frankfurt, Germany)

• Function: Secure data storage, user management, backend services

• Web: supabase.com | Data Protection: supabase.com/privacy

• Google Cloud Run

• Region: EU (Belgium)

• Function: Data processing

• Web: cloud.google.com/run

c) AI Services for Automated Accounting Processes:

• Google Vertex AI (Gemini Models)

• Region: EU (Frankfurt, Germany)

• Function: Document analysis, automated booking suggestions, document processing

• Data Residency: Data remains guaranteed in the EU region

• Web: cloud.google.com/vertex-ai

• Google Cloud Run

• Region: EU (Belgium)

• Function: Serverless AI processing

• AWS Bedrock (Anthropic Claude Models)

• Region: EU (Frankfurt, Germany)

• Function: Advanced AI analytics, plausibility checks

• Web: aws.amazon.com/bedrock

• OpenAI (GPT Models)

• Region: EU Data Residency (Dublin, Ireland)

• EU-specific endpoint with zero retention

• Function: Complementary AI functions

• Web: openai.com | Data Protection: openai.com/privacy

d) Email Dispatch:

• Resend Inc. (USA) – EU Standard Contractual Clauses

• Function: Dispatch of system notifications and transactional emails

• Web: resend.com | Data Protection: resend.com/legal/privacy-policy

Payment Processing:

Currently, no automated payment processing is conducted through the platform. Invoicing and payment processing are conducted manually outside the software.

All service providers have been carefully selected and contractually committed pursuant to Art. 28 GDPR to process your data securely and only according to our instructions.

4. Data Transfer to Third Countries

If data processing takes place outside the European Union (EU) or the European Economic Area (EEA) (e.g. through the use of US cloud services), this only occurs if an adequacy decision by the EU Commission exists for the third country, we have agreed EU Standard Contractual Clauses with the service provider, or there is another suitable guarantee according to Art. 44 et seq. GDPR.

The following services are specifically used:

a) Services WITH EU Data Processing (no third country transfer):

• Supabase: Exclusively EU region (Frankfurt, Germany)

• Google Vertex AI: Exclusively EU region (Frankfurt, Germany)

• Google Cloud Run: Exclusively EU region (Belgium)

• AWS Bedrock: Exclusively EU region (Frankfurt, Germany)

• OpenAI: EU Data Residency (Dublin, Ireland) with zero retention

b) Services WITH Third Country Transfer:

• Vercel Inc. (USA): EU-US Data Privacy Framework (DPF) certified

• Note: Only frontend delivery, no transmission of user data

• Resend Inc. (USA): EU Standard Contractual Clauses (Art. 46 GDPR)

All services with third country transfer have a suitable guarantee according to Art. 44 et seq. GDPR.

5. Storage Duration

We only store your data for as long as necessary for the purposes for which it was collected. Data from contractual relationships must also be stored due to tax and corporate retention obligations (usually 7 years in Austria). Inquiry data will be deleted once it is no longer required for processing.

6. Your Rights as Data Subject

You have the right at any time to:

• Information about the data stored about you (Art. 15 GDPR).

• Correction of incorrect data (Art. 16 GDPR).

• Deletion ("Right to be Forgotten") (Art. 17 GDPR).

• Restriction of processing (Art. 18 GDPR).

• Data portability (Art. 20 GDPR).

• Objection against the processing of your data (Art. 21 GDPR).

• Revocation of a given consent with effect for the future (Art. 7 para. 3 GDPR).

To exercise these rights, please contact the above-mentioned contact details.

7. Right to Complain to the Supervisory Authority

If you believe that the processing of your data violates data protection law, you have the right to complain to the competent supervisory authority. In Austria, this is the Data Protection Authority (www.dsb.gv.at).