This is a translation for convenience. The German version is legally binding. Read the German version →
Last updated: October 2026
Your data is stored in Frankfurt am Main and processed exclusively in the EU, including AI processing. This policy applies to finqo.de and app.finqo.de. Finqo is a service by Accountax.
1. Controller
Accountax, owner Eyline Päpke-Jakubowski, Kienberger Allee 4, 12529 Schönefeld, Germany
Email: datenschutz@accountax.berlin, phone: +49 178 6541117
No data protection officer has been appointed (the criteria of § 38 BDSG are not met).
2. At a glance
| Service | Purpose | Provider | Location | Role |
|---|---|---|---|---|
| Website and app files | Hosting, delivery | Lovable Labs Inc., USA | CDN, standard contractual clauses | Processor |
| Database, login, server functions | Operating Finqo | Supabase Pte. Ltd., Singapore | Frankfurt am Main (DE) | Processor |
| DATEV connection | Retrieving bookings and master data | DATEV eG, Nuremberg, via Riecken Webservice & Application GmbH, Vienna | Germany, France | Processor |
| Bank connection | Retrieving balances and transactions | finAPI GmbH, Munich | Germany | Independent controller |
| AI categorisation | Category suggestions for bank transactions | Amazon Web Services EMEA SARL, Luxembourg | EU | Processor |
| Email delivery | Invitations, notifications, reports | Resend (Plus Five Five, Inc., USA) | Ireland | Processor |
Agreements under Art. 28 GDPR are in place with all processors.
3. Visiting the website
Hosting and server log files. When you visit, your IP address, date/time, page visited, browser and operating system are processed to ensure secure operation (Art. 6 (1) (f) GDPR). Standard contractual clauses apply to transfers to the USA.
Fonts. Fonts are hosted locally; there is no connection to Google.
Cookies. We do not use analytics, marketing or tracking cookies. Only technically necessary storage under § 25 (2) no. 2 TDDDG takes place, so there is no consent banner.
Demo requests. We process requests by email or phone to handle the request (Art. 6 (1) (b) GDPR). Without an order, we delete them after 12 months.
4. Using Finqo
4.1 Roles
Accountax is the controller for the user account. We process accounting and bank data as a processor under Art. 28 GDPR on the basis of the data processing agreement.
4.2 Data processed
- User account: name, email, role, login times, 2FA, security logs incl. IP
- Accounting data from DATEV
- Bank data: balances, transactions with counterparty, IBAN, payment reference, amount
- Data you create: categories, plan values, comments, approvals
Bank transactions inevitably contain third-party data; we process it only to provide the service.
4.3 Legal bases
Art. 6 (1) (b), (c) and (f) GDPR.
4.4 Bank connection via finAPI
finAPI GmbH, Adams-Lehmann-Straße 44, 80797 Munich, is a BaFin-authorised account information service. Bank login details are held only by finAPI or the bank. Access is read-only and must be confirmed every 180 days. finAPI is an independent controller.
4.5 DATEV
Read-only retrieval via Riecken Webservice & Application GmbH, Vienna, with servers in Germany and France.
4.6 Database and hosting
Supabase Pte. Ltd., exclusively in the Frankfurt data centre (eu-central-1). Standard contractual clauses apply to any possible third-country access.
4.7 AI categorisation
Via Amazon Bedrock (Amazon Web Services EMEA SARL, 38 Avenue John F. Kennedy, L-1855 Luxembourg), model Claude Haiku 4.5, only in EU data centres. Only counterparty, payment reference and amount are transferred; IBANs and email addresses are masked beforehand. No training takes place. Every suggestion is labelled as an AI suggestion and reviewed by a human; there is no automated decision-making under Art. 22 GDPR.
4.8 Email delivery
We send emails via Resend with the sending region Ireland, on the basis of standard contractual clauses or the EU-U.S. Data Privacy Framework.
4.9 Browser storage
Only technically necessary storage (§ 25 (2) no. 2 TDDDG), no tracking.
4.10 Security
TLS in transit, AES-256 encryption at rest including backups, mandatory two-factor login for all users, automatic logout when inactive, client separation at database level, access only for authorised staff bound to confidentiality, logging.
4.11 Retention
User account for the duration of the relationship; after the contract ends, deletion or handover within 30 days; if the trial ends without a subscription, deletion after 30 days; security logs 90 days. Finqo is not an archive within the meaning of § 147 AO / § 257 HGB.
5. Disclosure
We do not sell data. Data is disclosed only to the service providers named, to third parties you designate, and to authorities where legally required.
6. Your rights
You have the right of access, rectification, erasure, restriction and data portability (Art. 15–20 GDPR) and the right to withdraw consent (Art. 7 (3) GDPR).
For data processed on behalf of your company, please contact your own company first.
7. Complaints
Brandenburg Commissioner for Data Protection and Access to Files (lda.brandenburg.de).
8. Obligation to provide data
Name and email are required to use Finqo.
9. Changes
The version published at any given time applies.