Privacy Policy

Rechna. Version 1.0, 6 November 2026. English translation for information; the German version governs.

This policy describes which personal data we process as controller when you use Rechna at app.rechna.at.

1. Controller

Football Path X GmbH, Othmargasse 34/16, 1200 Vienna, Austria. FN 641126 h. For privacy questions, contact privacy@rechna.at.

2. Two roles: controller and processor

We are the controller for the data we need to run Rechna ourselves: your user accounts, sign-in, billing for your subscription, communication with you and the security of the service. That is what this policy covers.

We process on behalf of your business everything your business records in its workspace: customers, vendors, products, documents, payments and expense receipts. Your business is the controller for that data, and the Data Processing Agreement applies. If you are a customer of a Rechna user and have questions about your data, please contact the business that issued your document.

3. Which data we process and why

Registration and user account. Name, email address, business name, role in the workspace and a password. We store the password only as a salted hash, never in plain text. The purpose is to provide Rechna. The legal basis is performance of the contract (Article 6(1)(b) GDPR).

Email verification and password reset. We send verification and reset links to your email address. The links expire and can be used once. The legal basis is Article 6(1)(b) GDPR.

Sign-in and session. After you sign in, we store a session identifier as a hash with an expiry time. The session ends after 12 hours at the latest, or when you sign out. The legal basis is Article 6(1)(b) GDPR.

Sign in with Google. If you choose "Sign in with Google" or "Continue with Google", we send you to Google. Google sends us your email address, confirmation that it belongs to your Google account, and an identifier of your Google account. We store the identifier and the email address to connect your Google account to your Rechna user account. If the address has no Rechna account yet, you can also sign up with Google: we then hold the identifier and the address for at most 30 minutes until you enter your name and company, and only then create the account. If you stop, both are deleted when that time runs out. We never receive your Google password and get no access to other Google services. Signing in with Google is optional, and you can still sign in with your email and password. The legal basis is Article 6(1)(b) GDPR.

Abuse protection. To limit attacks on sign-in, registration and password reset, we count attempts per email address and per IP address in short time windows. For this we store a hash of the email or IP address together with a counter and the end of the window, not the address itself. The legal basis is our legitimate interest in the security of the service (Article 6(1)(f) GDPR).

Technical logs. For every request, our hosting provider Cloudflare processes technically necessary data such as IP address, time, requested address and browser identifier. We use Cloudflare's logging to find errors and monitor operation. The legal basis is Article 6(1)(f) GDPR.

Billing. For a subscription, we store the identifiers of your customer account and subscription at Stripe, the chosen plan, its status and the end of the paid period. We do not receive card details. The legal bases are Article 6(1)(b) GDPR and, for retention, our legal obligation (Article 6(1)(c) GDPR).

Communication. When you write to us, we process your message and contact details to reply. The legal basis is Article 6(1)(b) or (f) GDPR.

We do not use your data for advertising, do not sell it and make no automated decisions within the meaning of Article 22 GDPR.

4. Cookies

Rechna sets only cookies that the service requires:

• rechna_session keeps you signed in. Scripts cannot read it, and it expires after 12 hours.
• rechna_language remembers the language you chose, for one year.
• rechna_oauth (named __Host-rechna_oauth over encrypted connections) exists only while you sign in with Google. It connects the return from Google to your browser, scripts cannot read it, and it is deleted afterwards, after 10 minutes at the latest.
• rechna_gsignup (named __Host-rechna_gsignup over encrypted connections) exists only while you sign up with Google. It connects the second step of sign-up to your browser, scripts cannot read it, and it is deleted after sign-up, after 30 minutes at the latest.

We use no analytics, advertising or tracking cookies, and we do not load third party services such as fonts or maps from other servers. No consent is required for these cookies (section 165(3) of the Austrian Telecommunications Act 2021).

5. Recipients

We use the following providers. They process data only on our instructions, unless they are expressly named as controllers in their own right.

• Cloudflare, Inc. (USA, with establishments in the EU): hosting, database, file storage, delivery and logs. The production database and files are stored in the EU. Requests are delivered through Cloudflare's global network.
• Resend, Inc. (USA): sending email, such as verification and reset links and documents you send from Rechna.
• Stripe Payments Europe, Ltd. (Ireland): payment processing for subscriptions. Stripe is a controller in its own right for payment data, and Stripe's privacy policy applies.
• Google Ireland Limited (Ireland): sign-in and sign-up with Google, only if you choose it. Google is a controller in its own right for signing in to your Google account, and Google's privacy policy applies.
• Microsoft Ireland Operations Ltd. (Azure, West Europe data centre): automatic receipt recognition, only where it has been expressly enabled for your workspace.

Beyond this, we disclose data only where the law requires us to.

6. Transfers outside the EEA

Cloudflare and Resend are based in the USA. We base transfers there on the European Commission's adequacy decision for the EU-US Data Privacy Framework where the recipient is certified, and otherwise on the European Commission's Standard Contractual Clauses (Article 46(2)(c) GDPR).

7. Retention

• User account and workspace: for the duration of the contract and afterwards until deletion after the contract ends, as described in the Terms.
• Sessions: until they expire after at most 12 hours, or until you sign out. Verification and reset links stop working when they expire.
• Abuse protection counters: no longer evaluated after their window and overwritten at the next attempt from the same source.
• Technical logs at Cloudflare: a few days, as set by Cloudflare.
• Billing records: seven years under section 132 BAO.

8. Your rights

You have the right of access (Article 15 GDPR), rectification (Article 16), erasure (Article 17), restriction of processing (Article 18), data portability (Article 20) and to object to processing based on legitimate interests (Article 21). Write to privacy@rechna.at.

You may also complain to the Austrian Data Protection Authority, Barichgasse 40 to 42, 1030 Vienna, www.dsb.gv.at.

9. Security

Connections to Rechna are encrypted. The database and files are stored encrypted at Cloudflare. Every access to a workspace's data is restricted to that workspace on the server, with the one exception of an administrator overview named in Annex 1. Details are in Annex 1 of the Data Processing Agreement.

10. Changes

We update this policy when Rechna or the law changes. The current version is at app.rechna.at/legal/datenschutz.