Privacy Policy

Website assistant and contact inquiries

The assistant uses reviewed public TrueDue knowledge. When AI is enabled, a limited, partly redacted excerpt of up to three recent user questions, approved public evidence and a pseudonymous caller identifier are routed through the shared Neithra support service. AI selects approved passages or writes a short answer based on this knowledge, including a follow-up question or a suggestion to contact the team. Invoice records, account credentials, name and email are not automatically attached to chat requests. Neithra keeps request receipts, identifiers, quotas and cost evidence; cached selections in the passage-selection mode expire after 24 hours while replay protection remains. Closing or resetting clears only the local conversation, not server receipts or provider records. Contact submissions separately include your details and any excerpt you explicitly select; signed-in requests use your verified account details and customer number. Depending on the configured support policy, the permitted AI providers are OpenAI alone or OpenAI and Google Gemini. The privacy notice lists these recipients. Processing may take place particularly in the United States. The privacy notice identifies recipients, transfer safeguards and your rights. Abuse-prevention request receipts are kept for that purpose separately from your local conversation; necessary contractual and accounting evidence is subject to the statutory retention periods described there.

1. Controller

The controller within the meaning of Art. 4(7) GDPR for the processing described here is Neithra Technologies – Fabian Lorenz (owner: Fabian Lorenz), Thaler Weg 2a, 51647 Gummersbach, Germany. TrueDue is a product of Neithra Technologies. You can reach the controller at [email protected] or by phone at +49 2266 4889976 (Germany), +1 332 287 9966 (USA); further provider details are given in the Legal notice.

2. Data protection officer

Whether a data protection officer has to be designated follows from Art. 37 GDPR and § 38 of the German Federal Data Protection Act (BDSG). Please address data protection enquiries directly to the controller at [email protected].

3. Categories of personal data processed

Depending on how the product is used: technically necessary connection data when you visit the website (IP address, date and time of the request, requested page, browser type); details submitted through the contact form (name, email address, company, message) and what you type into the support assistant; order data entered at checkout (company, contact name, business email address, billing address, country and – where required – VAT ID, optionally a purchase order number); account data of platform users (name, business email address, role); the receivables data a customer imports (the company name or name of each debtor, the contact details of their contact persons or — where the debtor is a private person — of the debtor, the customer type and country stated by the customer, invoice metadata and amounts); and the email correspondence in the connected collections mailbox. Where an incoming reply carries file attachments, the file name, file type and file size of each attachment are stored. From PDF attachments the software additionally reads the text (at most 3 PDF files per message, the first 10 pages of each) and stores, together with the message, a shortened extract of at most 6,000 characters per file; the file itself is not stored and remains in the customer's mailbox. The extract is evaluated by fixed rules only — for example to recognise a remittance advice for an open invoice — and is not transmitted to an AI model. Where a customer connects its mailbox over IMAP/SMTP rather than through Microsoft 365 or Google Workspace, the access credentials for that mailbox are processed as well (server settings, user name and a password — preferably an app password); the password is stored only in encrypted form and is never displayed again after it has been saved.

The connection data is needed to deliver the website and to keep it secure. To limit abuse of sign-in, the contact form and checkout, the IP address is additionally held briefly in the application's working memory as a rate-limiting key; it is not written to the database. The contact form additionally checks submissions with a small computation puzzle solved in the browser, an invisible field and the time taken to fill in the form – without third parties and without cookies. Every page of the website is shown in the language of its address. As long as you have not chosen a language, the country your request comes from and then your browser’s language setting decide whether a page offers you a short notice linking to the same page in your language, and in which language the order and sign-in pages open; the country is supplied by Cloudflare with the request, and your IP address is not stored for this.

For the receivables data a customer imports, that customer is the controller and TrueDue acts as a processor on its behalf. That relationship is governed by the Data Processing Agreement.

4. Purposes and legal bases

The data is processed in order to answer conversation requests, to provide the contracted service (importing receivables data, sending payment reminders, reading and classifying replies, and surfacing exceptions to the customer's finance team), to keep an audit trail of collection activity, and to keep the platform secure.

Enquiries, registration, contracting and provision to individuals who are our contractual partners are based on Art. 6(1)(b) GDPR. We process business contacts and users of our business customers under Art. 6(1)(f) GDPR to perform and support the business relationship reliably. Access protection, abuse prevention and necessary security records rely on Art. 6(1)(f) GDPR to protect accounts and the service. Invoices and tax records are processed under Art. 6(1)(c) GDPR together with statutory retention duties. Consent under Art. 6(1)(a) GDPR is used only for processing expressly described as optional; acknowledging this notice is not blanket consent. For imported receivables and mailbox data, the customer determines the legal basis as controller; we process that data on documented instructions under the DPA.

5. Cookies and access to your device (§ 25 TDDDG)

Merely visiting the website stores nothing on your device. The following cookies and browser storage entries are set only when you use the function they belong to — and, with the exception of Stripe’s payment form in the payment step of an order (see below), each of them only by this website itself:

Every one of these entries is strictly necessary to provide a service you have expressly requested — the language you selected, the sign-in you started, the order you placed, the application you use. Storing and reading them is therefore permitted without consent under § 25 (2) no. 2 TDDDG (and Art. 5(3) of the ePrivacy Directive), which is why no consent banner is shown. No advertising tools and no cross-site tracking tools are used: no advertising or tracking cookies, no pixels and no identifiers stored on your device. Audience measurement runs without cookies on our own server statistik.neithra.dev, as described below. Apart from that, no content is loaded from other servers — fonts are delivered from this website itself. The one exception is the payment step of an order: once you continue to payment on the order page, our payment service provider Stripe shows its payment form – embedded in the order page, for which your browser loads it from js.stripe.com, or on a page of Stripe’s own to which you are redirected. Stripe then receives your IP address and information about your browser and device and sets its own cookies and similar entries. They are set only in this payment step, serve to process the payment you asked for securely and to prevent fraud, and are technically required for that; the form may load further services Stripe uses for this purpose (for example hCaptcha and, for Google Pay, Google).

Audience measurement (Umami)

We measure how this website is used with the open-source software Umami, which we operate ourselves on a server of netcup GmbH in Germany. Umami sets no cookies and stores no identifier on your device. Your IP address is used only briefly to determine your approximate location (country, region, city) and to form a daily rotating identifier that cannot be traced back to you; it is not stored. We store the pages viewed, referring page, browser, operating system, device type, language, approximate location and events such as opening the checkout or submitting a form. Data is transmitted via Cloudflare, which we use to deliver our websites. The legal basis is our legitimate interest in improving our offering (Art. 6(1)(f) GDPR). Data is deleted after 24 months. If your browser sends “Do Not Track” or “Global Privacy Control”, no measurement takes place.

There is no consent dialog because no cookies and no identifiers are stored on your device for this. Should that change — in particular if a tool that is not strictly necessary and stores or reads information on your device were to be introduced — your consent will be obtained beforehand, and this section will be updated first.

6. Recipients and processors

The application and primary database run on a server we manage with netcup GmbH in Nuremberg, Germany. Cloudflare provides the network connection and security functions. Plus Five Five, Inc. (Resend) delivers system emails. App AI for customer correspondence is switched on for an organization until its administrator switches it off in the settings. Incoming replies are classified by built-in rules first. Only a reply from a confidently matched business customer that the rules leave unresolved can optionally be read by Google Gemini. This requires the organisation’s consent, a valid contract with verified payment, complete provider configuration and verified prices, and sufficient budget within the existing limits. Selected reply text is pseudonymised before transmission. A model interpretation is checked against supporting text in the original reply; unsupported or still unresolved cases go to a person with the original and a reason. Payment reminders, including their greeting and closing, use tested templates with financial figures inserted deterministically; no AI model writes them. The selected sending mode and send checks govern sending. Replies from private persons, and from debtors whose customer type has not been confirmed yet, are not sent to an AI model even then; they are classified by built-in rules only. Website support is separate and uses the providers listed on the subprocessors page through the central Neithra system, according to the configured support policy. The scope and activation conditions are described on the Subprocessors page. Microsoft 365, Google Workspace or another mailbox provider connected by the customer is used only for the chosen integration; the customer’s own agreement with its mailbox provider remains in place. Stripe handles online payments – by card with strong customer authentication (3-D Secure), including Apple Pay and Google Pay – and receives billing and payment details; it is an independent controller for its own payment, fraud-prevention and statutory purposes. You enter card details directly into Stripe’s form; TrueDue does not receive full card details. If you pay with Apple Pay or Google Pay, Apple or Google processes your payment data under its own terms; we receive no card data in that case either. For individually agreed offers, Neithra Technologies handles invoicing and accounting using Haufe-Lexware. Personal data is not sold or disclosed to third parties for advertising.

7. Transfers to third countries

The primary application database is located in Germany. Network, email and AI providers may also process data outside the EU and EEA, particularly in the United States. Such transfers rely on the European Commission’s standard contractual clauses under Art. 46(2)(c) GDPR incorporated into the relevant data processing agreement, together with the supplementary safeguards required for the transfer. Where a valid adequacy decision covers the recipient and the particular processing, Art. 45 GDPR may instead provide the basis. Details of the recipient and safeguards, and a copy of the relevant clauses, are available through the data protection contact in the imprint; legitimate trade secrets and other people’s data are protected.

8. Retention

Account and business data are processed for the contract and the agreed return or deletion. After the contract ends or a valid erasure instruction, data is returned or deleted under the DPA, generally within 30 days; necessary statutory records are kept separately and restricted to their purpose. Business contract correspondence is generally retained for six years, invoices and accounting vouchers for eight years, and statutory books and records for ten years after the end of the relevant calendar year (section 147 AO, section 257 HGB, section 14b UStG). Termination and withdrawal evidence constituting contractual correspondence is retained for six years after the end of the year of receipt. Necessary evidence for specifically documented ongoing proceedings or longer statutory obligations remains restricted for that additional period. Afterwards the data is deleted or anonymised. Backup copies remain protected until overwritten under their managed cycle and are subject to renewed deletion after restoration.

9. Your rights as a data subject

As a data subject you have the right of access (Art. 15 GDPR), to rectification (Art. 16 GDPR), to erasure (Art. 17 GDPR), to restriction of processing (Art. 18 GDPR), to data portability (Art. 20 GDPR) and to object (Art. 21 GDPR). To exercise these rights, write to [email protected]. Applicable rights under the UK GDPR and Swiss FADP remain available, including access and correction and, where the conditions are met, erasure or objection. Requests follow the applicable time limit (ordinarily one month under the UK GDPR and 30 days for Swiss access requests); you may complain to the ICO or FDPIC respectively.

Where a request concerns receivables data imported by a customer, that customer is the controller: the request is passed on to them and answered on their instructions.

10. Right to lodge a complaint with a supervisory authority

You have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The supervisory authority competent for the controller is:

You may equally lodge your complaint with the supervisory authority of the EU/EEA Member State of your habitual residence or place of work, or of the place of the alleged infringement.

11. Withdrawal of consent and right to object

Where processing is based on consent, you may withdraw that consent at any time with effect for the future (Art. 7(3) GDPR); the lawfulness of the processing carried out before the withdrawal is unaffected. Where processing is based on a legitimate interest, you may object to it at any time on grounds relating to your particular situation (Art. 21(1) GDPR); where data is processed for direct marketing, you may object at any time without giving reasons (Art. 21(2) GDPR).

12. Whether you have to provide personal data

There is no statutory or contractual obligation to provide personal data through the contact form. Without the details asked for there, however, a conversation request cannot be answered. For platform users, the account data listed above is required in order to use the service.

13. Notice for United States residents (including California — CCPA/CPRA)

This notice supplements our privacy policy for US residents and describes our practices under applicable online-privacy transparency rules, including California CalOPPA. CCPA/CPRA rights apply where the statutory business thresholds and other conditions are met; they can then also cover business contacts. Offering a B2B service alone does not exclude those rights. This notice does not assert that statutory applicability thresholds have already been reached. The service does not send payment reminders to private persons with an address in the United States. Requests under applicable US state privacy laws are handled through [email protected].

Categories of personal information collected

Identifiers and business contact information (name, business email address, company, optionally phone number); professional information (job role, platform role, information you choose to include in your message); commercial information (order data if a plan is purchased, and the receivables data a customer imports, including the contact details of its debtors and their contact persons and the email correspondence in its connected mailbox); internet or other electronic network activity, limited to the strictly necessary connection data described in section 3 and the cookieless audience measurement described in section 5. We do not collect precise geolocation, biometric information or data about protected characteristics, and we do not create profiles.

Sources

Directly from you (contact form, checkout, account, email); from your employer or a business partner that is our customer and imports receivables data or connects a mailbox; and automatically from your browser when you visit the website (connection data and the cookieless audience measurement described in section 5).

Business purposes

Answering conversation and sales requests; providing, maintaining and supporting the contracted service; keeping the audit trail of collection activity; securing the service and preventing abuse; and complying with legal obligations. For receivables data and mailbox content imported by a customer, Neithra Technologies acts as that customer's service provider and processes the data only on its instructions.

No sale, no sharing

Neithra Technologies does not sell personal information and does not share it for cross-context behavioral advertising, and has not done so in the preceding 12 months. This includes personal information of consumers under 16. Personal information is disclosed for business purposes only to the service providers listed on the subprocessors page.

Sensitive personal information

Neithra Technologies does not use or disclose sensitive personal information for the purpose of inferring characteristics about you. Sign-in takes place through Microsoft or through a one-time link sent by email; TrueDue never receives or stores a sign-in password. The only password TrueDue stores is the access credential for a collections mailbox that a customer connects over IMAP/SMTP, and it is kept only in encrypted form.

Retention

Personal information is kept for as long as it is needed for the purpose it was collected for and, beyond that, for as long as statutory retention duties require, as described in section 8.

Your rights

Subject to the conditions of the law, you have the right to know what personal information we collect, use and disclose and to access specific pieces of it; the right to delete it; and the right to correct inaccurate personal information. The right to opt out of the sale or sharing of personal information and the right to limit the use of sensitive personal information exist as well, but there is nothing for them to act on: we neither sell nor share personal information, and we do not use sensitive personal information to infer characteristics.

Non-discrimination

We will not discriminate against you for exercising any of these rights — for example by denying you the service, charging a different price or providing a different quality of service.

How to submit a request

Send your request to [email protected]. We confirm receipt within 10 business days and respond within 45 calendar days; where the law allows an extension, we tell you within that period why more time is needed. If your personal information was imported by one of our customers, that customer is responsible for it: we forward your request and assist the customer in answering it.

Verification

To protect your information, we verify a request by matching the details you give — in particular the email address you write from — against the information we hold, and may ask for further information where that is necessary. Information provided for verification is used only for that purpose.

Authorized agents

You may have an authorized agent submit a request for you. We may ask the agent for your signed permission and ask you to verify your identity directly with us, unless the agent holds a power of attorney under California Probate Code sections 4121 to 4130.

Global Privacy Control and Do Not Track

A Global Privacy Control (GPC) signal is honored as a valid request to opt out of the sale and sharing of personal information. Neither takes place, with or without the signal. In addition, if your browser sends a Global Privacy Control or Do Not Track signal, the audience measurement described in section 5 does not take place. Cross-site tracking does not take place in any case.

Children

The service is intended for businesses and is not directed to children. We do not knowingly collect personal information from anyone under 16, and in particular not from children under 13.

14. Online appointment booking (video call)

When you book a call on this site, we process the details from the form (name, company, email address, optionally phone number and your message), the chosen time, your time zone and the page language, solely to arrange and hold this call. The legal basis is Art. 6(1)(b) GDPR (steps prior to entering into a contract at your request) and your consent under Art. 6(1)(a) GDPR, which you may withdraw at any time with effect for the future.

TrueDue is offered by Neithra Technologies – Fabian Lorenz; the controller is the provider named in the legal notice. All products share one appointment calendar on our own servers in Germany so that no time is booked twice.

For the invitation and the video link we use Google Calendar and Google Meet (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland) as a processor; Google receives your name, email address and the appointment. A transfer to the USA is possible; Google LLC is certified under the EU-US Data Privacy Framework (adequacy decision of the European Commission of 10 July 2023). For our own scheduling we also copy the appointment with your name and company to the owner's Apple iCloud calendar (Apple Distribution International Ltd., Ireland). Confirmation and reminder emails are sent via our email service provider.

You can reschedule or cancel the appointment yourself at any time using the link in the confirmation. We automatically delete your details 180 days after the appointment; only a record without personal data remains. The booking does not subscribe you to any marketing.