Privacy policy

Last updated: 24 October 2026

Here we explain how Plainunit processes personal data — on the website, in your account, when you pay and when you use our software.

Controller and contact details

1. Website and hosting

STRATO GmbH, Otto-Ostrowski-Straße 7, 10249 Berlin, Germany, is the intended hosting provider for the public website at plainunit.com. When you visit a page, data may include your IP address, the time, the requested URL, technical browser and operating system details and, where applicable, the referring page. This data is used to deliver, troubleshoot and secure the website. The legal basis is Article 6(1)(f) GDPR; our legitimate interest is in providing a secure, functioning website.

STRATO states that complete IP addresses are stored for no more than seven days to detect and prevent attacks. According to STRATO, hosting access logs with anonymised IP addresses are available for up to six weeks. Non-personal statistics derived from them may be retained for longer. Processing on our behalf is governed by the agreement with STRATO. Further information: STRATO privacy information.

2. Sign-in and account

We use Supabase Auth, provided by Supabase Pte. Ltd., for Plainunit accounts. The data processed includes your email address, an internal account identifier, your selected language for account messages, sign-in and session data and technically necessary security logs. Our project's database region is Ireland. The legal basis is Article 6(1)(b) GDPR for setting up and using your account; security and abuse prevention are also based on Article 6(1)(f) GDPR.

You sign in without a permanent password, using a one-time code sent by email. The code is valid for ten minutes. This validity period does not mean that all delivery and security logs are deleted after ten minutes. Sign-in information necessary to maintain your session is stored in the browser's session storage. This processing provides the account access you expressly requested; strictly necessary access to your device is covered by Section 25(2), point 2 of the German TDDDG.

Your invoice files are not automatically uploaded to Supabase for account management. Having a database region in Europe does not completely exclude access by international service providers for operations or support. Details of processing on our behalf, subprocessors and safeguards for transfers: Supabase data processing agreement and Data locations and transfers.

3. Account messages and email

Sign-in codes and necessary account messages are sent through our STRATO mailbox anmeldung@plainunit.com. This involves processing the recipient address, message content and technical delivery data. The legal basis is Article 6(1)(b) GDPR and, for necessary security messages, also point (f). A factual reminder three days before an activated trial ends is planned. This does not subscribe you to a newsletter.

4. Payments and subscriptions

We use Stripe for checkout and subscription management. We send Stripe the information necessary for payment, including contact details, where applicable your name and billing address, the ordered product, price, currency and tax information. You enter payment details directly on the payment page. We do not store complete card numbers or card security codes on our server.

We receive payment and subscription status information and customer, invoice and subscription identifiers, and store the information needed for access, billing and accounting. The legal bases are Article 6(1)(b) and (c) GDPR; security and fraud prevention may be based on point (f). Depending on its role, Stripe processes data as a service provider and as an independent controller for its own legal obligations and certain security purposes. If you select an additional payment method, that provider's information also applies. Information on recipients, international transfers and safeguards is available in the Stripe privacy policy.

5. Licence and trial access

When you use account-based licensing functions, we process the account identifier, product, trial start, expiry date and paid access period to verify your entitlement. A randomly generated installation identifier is intended to identify an installation; invoice contents are not needed for this check. Technical connection data may be processed to handle the request securely. The legal bases are Article 6(1)(b) and (f) GDPR.

Licence validation is a technical check of the entitlement you have agreed. If you believe access has been refused incorrectly, contact us for a review. Account-based functions are provided in the relevant software version; this policy does not claim they are available in older versions.

6. Local processing in finfolder

Under the intended local processing model, receipts, bank statements, recognised invoice details and archives are processed on your device or in the storage location you choose. Local text recognition does not require automatic transmission of these documents to Plainunit or a cloud OCR service. Credentials and connection tokens are stored in the operating system's protected keychain where supported by the relevant version.

When you connect directly to your email provider, messages and attachments are retrieved through its interfaces. Depending on the version, this may include Google, Microsoft or an IMAP provider you choose. A read-only permission may technically allow access to the entire authorised mailbox; it is not automatically limited to invoices. The provider sees connection requests and processes data under its own terms.

Links to documents may contact the relevant document provider. If you choose an archive folder synchronised through a cloud provider, that provider may synchronise the files stored there. Exports are created locally; with a prepared email, you decide whether to send it in your email application. Removing a connection in the app does not automatically delete imported documents or revoke a permission granted to the email provider. You can also revoke that permission with the provider.

7. Contact and support

If you email or call us, we process your contact details, your enquiry and the information needed to handle it. Depending on the reason, this is to take steps before a contract or perform a contract under Article 6(1)(b) GDPR, or is based on our legitimate interest in responding to other enquiries under point (f). Emails are processed in our STRATO mailbox. An email link only opens your email application.

Please send only necessary documents, and no passwords or one-time codes. If you send documents to support, we receive the data they contain and process it to handle your particular enquiry. This does not give us general access to your local archive.

8. Recipients and international processing

Personal data is only made available to people and service providers who need it for the purposes described. These include hosting and email providers, account services, payment providers and, where required to fulfil legal obligations, tax advisers and authorities. Processors are engaged in accordance with Article 28 GDPR. Where a provider is an independent controller, its own information also applies.

Processing outside the European Economic Area must satisfy Articles 44 et seq. GDPR. Depending on the recipient, this may involve an adequacy decision or appropriate safeguards, in particular EU Standard Contractual Clauses with any necessary supplementary measures. You can ask us for information about the relevant safeguards. A European server region alone does not replace this assessment.

9. Retention periods

We retain personal data for as long as it is needed for the relevant purpose and to fulfil legal obligations. Account data is processed for the duration of the account and any necessary contractual administration. Following a valid erasure request, data that is no longer needed is deleted; billing data subject to statutory retention is kept separately for the required period.

Accounting vouchers must generally be retained for eight years, and business correspondence subject to retention for six years; certain books and records must be kept for ten years. The period generally starts at the end of the relevant calendar year. Statutory extensions and the necessary preservation of specific legal claims may prevent earlier deletion. This does not mean that all account data is automatically retained for eight years.

Support enquiries are deleted once they have been resolved and no statutory or specifically necessary evidential purposes require retention. Security and technical logs are retained for limited periods and specific purposes. You manage and delete local archives on your own device; deleting an account does not automatically delete those files.

10. Your rights

Subject to the statutory conditions, you have rights of access, rectification, erasure, restriction of processing and data portability. Where processing is based on consent, you may withdraw that consent for the future; processing carried out before withdrawal is not affected.

Right to object: You may object to processing based on Article 6(1)(f) GDPR on grounds relating to your particular situation. You may object to direct marketing at any time. We may need proportionate evidence of your identity to handle your request.

You also have the right to complain to a data protection supervisory authority, particularly in the place of your habitual residence, your workplace or the alleged infringement. One authority responsible for our location is the Brandenburg Commissioner for Data Protection and Access to Information, Stahnsdorfer Damm 77, 14532 Kleinmachnow, Germany.

If you confirm account deletion, free access is deactivated immediately. If automatic renewal of a paid membership is still enabled, you must first cancel it. If renewal has already been disabled, account deletion begins after the paid access period. From the start of deletion, we retain the account for seven days solely to allow possible restoration. Personal account data that is no longer needed is then permanently deleted. Billing records subject to statutory retention are handled separately. Your statutory data protection rights remain unaffected; deleting an account does not delete archives stored locally on your device.

11. Required information, security and changes

We need your email address to provide an account. Without it, we cannot deliver a sign-in code. Payment and billing data is required if you order a paid service or where required by law. Other information is voluntary unless expressly stated otherwise.

We use technical and organisational safeguards appropriate to the risks, including encrypted connections and restricted access. Absolute security cannot be guaranteed. The marketing pages we create currently contain no advertising trackers or externally loaded fonts. Payment pages and other providers' services may use their own technically necessary storage mechanisms. We would only use optional technologies requiring consent after providing information and obtaining that consent.

We update this policy when processing activities or legal requirements change. We will provide appropriate notice of material changes.

Cookies and similar technologies

We use Session Storage and Local Storage for the functions described below. Rules governing access to your device also apply to these types of storage, not just to cookies.

• Sign-in: Necessary session data is stored in the current browser tab’s Session Storage to maintain the account access you requested. It is removed when you sign out and generally remains until the tab is closed; browser session restoration may extend storage.
• Language choice: When you select DE or EN, we remember this non-identifying preference in Local Storage under plainunit.language. It remains until you change your choice or clear your browser data.
• Privacy notice: After you click “Got it”, we store only the acknowledged notice version in Local Storage under plainunit.privacy-notice. This prevents the same notice from appearing on every page. The entry remains until browser data is cleared; a new notice version may be shown again. The click does not constitute consent to advertising or optional tracking.

Section 25(2)(2) TDDDG applies where storage is strictly necessary to provide the account access and settings you expressly requested. Where personal data is processed, the GDPR legal bases stated in the relevant section apply.

Stripe payment pages: When you open an available payment or subscription management function, you are taken to a separately hosted Stripe page. We do not load Stripe.js or an embedded checkout on our information pages for this purpose. Stripe pages may use cookies and similar technologies, in particular for processing payments, authentication, security and fraud prevention. The technologies, storage periods and any additional features depend on the payment method and the settings chosen there. Information and any required choices are provided on the relevant Stripe page and in the Stripe Privacy Center.

You can clear or restrict browser storage through your browser settings. This may remove your sign-in state and saved language choice. If we introduce analytics, advertising or other optional technologies requiring consent on our website, we will activate them only after obtaining the corresponding consent.

12. Controller and contact details

Email: info@plainunit.com
Telephone: +49 176 45225000

For privacy enquiries, please contact info@plainunit.com. This policy covers processing for which we are responsible. If you use our software to process your customers' or employees' data, you remain responsible for your own processing activities.

Print / save as PDF