Privacy Policy

Mathis Helan — BYF-Webdesign

Strietwaldstr. 83, 63741 Aschaffenburg, Germany

Email: contact@byf-app.de

We process personal data only to the extent required to operate PROFLOW ERP. Legal bases are Art. 6 (1)(b) GDPR (contract performance), (c) (legal obligation, in particular GoBD retention duties) and (f) (legitimate interest in secure operation).

Account data: name, company name, email address, password (stored as hash only).

Business data: client, project, quote, invoice and time-tracking records that you enter yourself.

Payment data: subscription and invoice status; card and bank details are processed exclusively by Stripe — we never store complete payment data.

Technical data: IP address, browser type and access timestamps in server logs (security-related, short-term storage).

Supabase Inc. — database & authentication, Frankfurt am Main region (EU).

Vercel Inc. — web application hosting (USA; safeguarded by EU Standard Contractual Clauses).

Stripe Payments Europe Ltd. / Stripe Inc. — payment processing (Ireland/USA; EU Standard Contractual Clauses).

Infomaniak Network AG — transactional email delivery (Switzerland; EU adequacy decision).

Data processing agreements pursuant to Art. 28 GDPR are in place with all providers listed.

Account data is retained while your account exists. Commercial and tax-relevant records (e.g. invoices) are kept for up to 10 years under GoBD / § 147 AO. After account deletion, remaining data is erased unless statutory retention duties apply.

We only use technically essential cookies (session/auth cookies for login and your language preference). No tracking, advertising or marketing analytics takes place — no cookie banner is therefore required.

You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20) and objection (Art. 21) GDPR at any time.

You also have the right to lodge a complaint with the competent supervisory authority: Bayerisches Landesamt für Datenschutzaufsicht (BayLDA), Promenade 18, 91522 Ansbach, Germany.

For any privacy request, an email to contact@byf-app.de suffices.

All transmission is TLS-encrypted. Access to tenant data is enforced exclusively through authenticated, tenant-isolated database rules (Row Level Security).

We update this policy when processing or the legal situation changes. Last updated: October 2026.