Privacy Policy

The data controller pursuant to the GDPR is statycs GmbH, Liechtensteinstrasse 59, 1090 Vienna, Austria. For any data protection inquiries, please contact us at [email protected].

We have not appointed a data protection officer, as the criteria of Art. 37 GDPR are not met. For privacy matters, the most direct channel is [email protected].

We collect personal data that you provide to us directly, together with data generated through your use of the platform.

Account information. When you register, we collect your name, your email address, your company name, and any further contact details you provide.

Usage data. We collect information about how you interact with the platform, including pages visited, features used, IP address, browser type, device information, and session duration.

Financial data. Data that you upload to the platform - such as accounting records, reports, and financial plans - is processed to deliver the service. statycs may access this data to operate the platform, respond to support requests, fulfill legal obligations, and - in aggregated and anonymized form only - to improve the product and generate anonymous industry benchmarks, as further described in the Terms. No statycs employee accesses identifiable customer content for any other purpose.

Providing account data is required to use the platform; without it, we cannot deliver the service. All other data - analytics, marketing, optional integrations - remains voluntary.

Your personal data is used for the following purposes:

• Providing, operating, and maintaining the statycs platform
• Authenticating you and managing your account (via Hanko)
• Responding to your inquiries and delivering customer support
• Sending relevant product updates and marketing communications, where you have opted in
• Analyzing and improving our platform and services (via Google Analytics and PostHog)

Legal bases. We process your personal data on the following legal bases:

• Art. 6(1)(b) GDPR (contract) - to deliver the platform, authenticate you, and provide customer support.
• Art. 6(1)(c) GDPR (legal obligation) - to comply with statutory retention duties, in particular §132 BAO, which requires seven years of retention for invoicing and accounting records.
• Art. 6(1)(f) GDPR (legitimate interests) - to secure the platform and prevent fraud, to improve our product through aggregated analytics, and to communicate directly with our existing customers.
• Art. 6(1)(a) GDPR (consent) - for marketing emails and non-essential cookies.

We do not set non-essential cookies before you have given your consent. On your first visit, a cookie banner offers two choices: Accept all or Essential only.

If you select Accept all, we load analytics tools, including Google Analytics and PostHog. If you select Essential only, no tracking cookies are set - only cookies that are strictly necessary for the website to function.

You can withdraw your consent at any time by clearing the consent cookie in your browser or by contacting us at [email protected].

We share personal data only with the service providers necessary to operate the platform. Our current sub-processors are:

• Google Analytics (Google LLC, USA) - analytics
• PostHog (PostHog Inc., USA; PostHog Cloud EU hosted in Germany) - product analytics
• Hanko (Hanko GmbH, Germany) - authentication
• Zero (Zero Inc., Finland) - CRM
• Hetzner (Hetzner Online GmbH, Germany) - hosting
• Chatwoot (Chatwoot Inc., USA) - live chat for website visitors, not app users

Each provider is contractually bound to comply with the GDPR. This list mirrors §06 of our Data Processing Agreement and is kept in sync with it.

Transfers to third countries. For providers outside the European Economic Area (in particular in the United States), we rely on appropriate safeguards under Art. 46 GDPR - the EU Standard Contractual Clauses and, where applicable, adequacy decisions of the European Commission. A copy of the safeguards is available on request at [email protected].

We do not sell your personal data to third parties.

Under the GDPR, you have the following rights in respect of your personal data:

• Right of access - to confirm whether your data is being processed and to request a copy
• Right to rectification - to correct inaccurate or incomplete data
• Right to erasure - to request deletion of your data where no compelling reason justifies further processing
• Right to restrict processing - to limit how your data is used in certain circumstances
• Right to data portability - to receive your data in a structured, machine-readable format
• Right to object - to object to processing based on legitimate interests
• Right to withdraw consent - to withdraw your consent at any time, without affecting the lawfulness of processing already carried out

To exercise any of these rights, please contact us at [email protected]. We will respond within one month of receipt. This period may be extended by up to two further months where necessary, taking into account the complexity and number of requests, in accordance with Art. 12(3) GDPR; where that happens, we will inform you within the first month of the extension and the reasons for it.

Automated decision-making. We do not use automated decision-making or profiling within the meaning of Art. 22 GDPR.

Right to lodge a complaint. You have the right to lodge a complaint with a supervisory authority. In Austria, the competent authority is the Austrian Data Protection Authority (www.dsb.gv.at).

We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction. These measures are regularly reviewed and updated.

We retain personal data only as long as needed. The main categories and retention periods are:

• Account and project data (including content you upload): 30 days after the contract ends, then permanently deleted.
• Invoicing and accounting records: 7 years, as required by §132 BAO.
• Marketing contact data: until you withdraw consent or unsubscribe.
• Support communications: for as long as needed to resolve and document the issue.
• Usage and analytics data: up to 14 months.

After the applicable period, data is securely deleted or anonymized.

We may update this privacy policy from time to time to reflect changes in our practices, services, or legal obligations. Updates are published on this page, with the effective date clearly indicated at the top.

If you have any questions about this privacy policy or our data practices, please contact us at [email protected] or write to statycs GmbH, Liechtensteinstrasse 59, 1090 Vienna, Austria.