Privacy Policy

1. Controller

emoose GmbH

In den Hallen 9/13, 66115 Saarbrücken

Email: post [at] zertally.com | Website: zertally.com

Represented by the management.

2. General Data Processing on the Website (Server Log Files)

When you access our website, our web server automatically collects technical information (e.g., browser type, operating system, referrer URL, IP address, date and time of access).

• Purpose: Provision and delivery of the website, ensuring IT security, and threat prevention.

• Legal basis: Art. 6(1)(f) GDPR (legitimate interest in stable and secure operations).

• Retention period: Log files are deleted as soon as the respective purpose has been achieved, at the latest after 14 days, unless statutory retention obligations or incidents require longer storage.

3. Contacting Us

If you contact us via email or contact form, we process your details (name, email address, message content) to handle the inquiry.

• Legal basis: Art. 6(1)(b) GDPR (contractual or pre-contractual measures) or Art. 6(1)(f) GDPR (legitimate interest in responding to user inquiries).

• Erasure: Data is deleted as soon as your inquiry has been conclusively resolved and no statutory retention periods preclude this.

4. User Account and App Features of Zertally

For the use of Zertally (groups, expense management), we collect and process data:

• Registration: Email address, login credentials.

• Content in groups: Group names, names of participants, expenses, payments, change logs (who entered/deleted what and when), as well as voluntarily deposited IBANs and PayPal names. This data is visible to members of the respective group. Exception: the IBAN and PayPal name of a member with their own account are visible only to that member and to members who currently owe them money according to the settlement. Details of people without their own account are managed jointly by the group and are visible to all members.

• Purpose & legal basis: Performance of a contract or provision of the service (Art. 6(1)(b) GDPR).

• Account deletion: You can delete your account at any time under "My account". Personal details are removed; expense entries in groups remain stored in anonymised form in order to preserve the integrity of group settlements.

5. Hosting and Infrastructure (Lovable, Supabase, Cloudflare)

Our application and databases are hosted via technical service providers:

• Lovable Labs Inc. (USA) – App hosting & platform

• Supabase, Inc. (Singapore/USA) – Database and authentication

• Cloudflare, Inc. (USA) – Content Delivery Network and security filter

Database storage location: The database containing your account and group data is located in a data centre in the European Union (Ireland). The website itself is delivered via Cloudflare's global network.

In doing so, master, usage, and communication data are processed on the servers of these providers. Insofar as data is transferred to third countries (e.g. USA), this is carried out on the basis of data processing agreements and appropriate safeguards (EU Standard Contractual Clauses or EU-US Data Privacy Framework). The legal basis is Art. 6(1)(b) GDPR (performance of a contract) and Art. 6(1)(f) GDPR (legitimate interest in a modern and secure IT infrastructure).

6. External Interfaces & Functions

• Exchange rates (ExchangeRate-API): To retrieve daily updated exchange rates, we use open.er-api.com. No personal data is transmitted to the provider.

• Receipt scanning: When you photograph a receipt, the image is transmitted via Lovable to an AI language model (e.g. OpenAI/Google) for extraction and discarded after text recognition. Legal basis: Art. 6(1)(b) GDPR. Please ensure that you do not photograph any sensitive third-party data.

• Group pictures: If you upload a picture for a group, it is reduced in size and stored in the EU. Only members of that group can see it. You can remove it at any time. Legal basis: Art. 6(1)(b) GDPR. Only upload pictures that the people shown have agreed to.

• WhatsApp & PayPal links: The buttons for WhatsApp and PayPal are pure links. Data is only transferred to Meta Platforms or PayPal once you actively click the button and open the provider's website/app.

7. Cookies and device storage

• Technically necessary: We store data in local browser storage that is strictly necessary for operation (login status, session, cookie decision, offline entries). Legal basis: § 25 (2) TDDDG in conjunction with Art. 6 (1) lit. f GDPR.

• Requiring consent (Statistics & Advertising): Tools such as Google Analytics and Google AdSense are activated exclusively after your express consent via the cookie banner. Legal basis: § 25 (1) TDDDG and Art. 6 (1) lit. a GDPR. You can adjust or withdraw your settings at any time via the 'Cookie settings' link in the footer.

8. Google services (Analytics, Ads, AdSense)

Provided you have granted consent via the cookie banner, we use services of Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland; parent company: Google LLC, USA):

• Google Analytics: Analysis of user behavior for website optimization.

• Google AdSense / Ads: Delivery and measurement of personalized advertisements to finance the free service.

In this process, cookies are set and usage data (e.g., IP address, click paths, device data) is processed. Data transfer to the USA is safeguarded by the Data Privacy Framework. Processing takes place exclusively on the basis of your consent (Art. 6 (1) lit. a GDPR).

9. Your rights as a data subject

Under the GDPR, you have the following rights at any time:

• Right of access (Art. 15): Regarding your data processed by us.

• Right to rectification (Art. 16): Rectification of inaccurate data or completion of your data.

• Right to erasure (Art. 17): Erasure of your data stored with us.

• Right to restriction (Art. 18): Restriction of processing if data may not yet be erased.

• Data portability (Art. 20): Release of the data you provided in a machine-readable format.

• Objection (Art. 21): Objection to processing that we base on a legitimate interest (Art. 6(1)(f) GDPR).

• Withdrawal of consent: You may withdraw granted consent (e.g., tracking) at any time with effect for the future.

To exercise your rights, an informal communication to: post [at] zertally.com is sufficient.

In addition, pursuant to Art. 77 GDPR, you have the right to lodge a complaint with a data protection supervisory authority (e.g., with the Unabhängiges Datenschutzzentrum Saarland or the supervisory authority of your place of residence).