Privacy policy

As of: July 2026 Applies to: CT Site web application (ct-site.com) and associated backend API

§ 1 Controller

The controller for data processing is: Centraltec GmbH Blütenstraße 15 80799 Munich, Germany Represented by Managing Director André Scheffer Email: andre.scheffer@centraltec.de

Please direct privacy inquiries to the email address above.

§ 2 Purposes and legal bases

We process personal data only for defined purposes:

- Providing CT Site, managing user accounts and tenants (Art. 6(1)(b) GDPR) - Invoice intake, AI-assisted PDF extraction, review, and document generation (Art. 6(1)(b) GDPR) - Authentication and operationally necessary system notifications (Art. 6(1)(b) GDPR) - Abuse prevention, IT security, technical operation, and error analysis (Art. 6(1)(f) GDPR) - Web analytics to improve website and product (Art. 6(1)(a) GDPR, consent via cookie banner) - Marketing measurement (Art. 6(1)(a) GDPR, consent via cookie banner)

§ 3 Data we process

Depending on use, we process in particular:

- Master data: email address, company/tenant name - Authentication data: password (cryptographic hash only), login and session tokens - Content data: uploaded invoice PDFs, extracted line items, corrections, generated correction sheets - Technical log data: IP address, access date and time, browser/device information - With consent: usage data (pages viewed, duration, referrer)

§ 4 Cookies and consent management

CT Site uses technically necessary storage (localStorage/cookies) to keep you logged in after sign-in. These are required for operation (§ 25(2) TDDDG; Art. 6(1)(f) GDPR).

With your consent via the cookie banner, we use Google Analytics (GA4). Consent is voluntary and can be withdrawn at any time via cookie settings.

§ 5 Processors

- Hetzner Online GmbH – hosting and server operation (data centers in Germany/EU) - Anthropic – AI-assisted extraction of invoice data from PDFs - Google Ireland Limited – Google Analytics (GA4), if consented

§ 6 Transfers to third countries

AI processing by Anthropic may process data in the USA. Transfers are based on EU Standard Contractual Clauses (Art. 46 GDPR).

§ 7 Retention

We retain personal data while your account exists and as required for the respective purpose. Invoice documents are stored per tenant and can be deleted on request.

§ 8 Your rights

You have the right to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), portability (Art. 20), and objection (Art. 21 GDPR).

Contact: andre.scheffer@centraltec.de

§ 9 Right to lodge a complaint

Bavarian State Office for Data Protection Supervision (BayLDA), Promenade 18, 91522 Ansbach, Germany