Privacy policy

This is a translation of our German privacy policy. If the two versions differ, the German version applies.

As at October 2026. This policy applies to the website reportnow.de. For the ReportNow! application itself, the data processing agreement also applies, which you can read here in advance and conclude in the application before you import any data.

1. Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) is:

LittVest GmbH
Hallesche Str. 5a, 10963 Berlin, Germany
Represented by: Ron Littmann
Email: info@reportnow.de

We have not appointed a data protection officer, as we are not required to do so under § 38 BDSG, the German Federal Data Protection Act. You can reach us at the address above with any questions about data protection.

2. Hosting

This website and the ReportNow! application are run on servers in a data centre in the European Union (EU). No personal data is transferred to third countries outside the EU/EEA in the operation of the website and the application. The exceptions are the demo appointment, for which we use services from Google (section 6), and payment by credit card through Stripe (section 10). A data processing agreement under Art. 28 GDPR is in place with the hosting provider. The service providers we use for the application are listed in Annex 3 of the data processing agreement; for the demo appointment, Google is added (section 6), and for billing the use of the service, Stripe and the German Federal Central Tax Office (section 10).

3. Visiting the website (server logs)

When you visit the website, technically necessary data is processed without which the page could not be delivered: IP address, time of access, address requested, amount of data transferred, status code, and information about the browser and operating system.

Purpose

Delivering the page, operational security, defence against attacks.

Legal basis

Art. 6(1)(f) GDPR (legitimate interest in a secure and functioning service).

Retention period

Server logs are deleted after five weeks at the latest, unless they are needed to investigate a specific incident.

Counting page views

From the same requests, we count on our server how often each page is viewed: whether the view came from another website and from which one (only its domain, such as that of a search engine), whether it came from a mobile device, and how often a sign-up, a demo booking, a questionnaire or a download of the Excel workbook was completed. We read the browser information only to filter out views by programs such as search engines.

We store only totals per day and page – no IP address, no browser information and no identifier that would link your views to one another. The totals do not allow any conclusions about individual visitors. Nothing is stored in or read from your browser for this beyond what it sends with every request anyway.

Purpose

Recognising which pages are read and where visitors come from, in order to improve the website.

Legal basis

Art. 6(1)(f) GDPR (legitimate interest in designing the website to meet demand), insofar as any personal data is processed in the counting at all.

Retention period

The totals contain no personal data and are kept without a time limit.

4. Cookies, storage in your browser and reading time

This website sets no cookies. The only thing stored in your browser’s local storage (localStorage) is your choice in the notice about cookies, so that it does not appear again on every visit. This information is not transmitted to our server.

Legal basis

§ 25(2) no. 2 TDDDG, the German Telecommunications Digital Services Data Protection Act (strictly necessary).

Deletion

If you delete the website data in your browser, the notice appears again.

Measuring reading time (only with consent)

If you choose “Accept” in the notice, a script on this website measures how long a page is visible in your browser. The clock only runs while the page is in the foreground and you have scrolled, typed, clicked or moved the mouse in the last three minutes. When you leave the page or switch tabs, the browser sends the page address and the duration in seconds to our server – without a cookie and without an identifier. The duration is stored only as a total per day and page, sorted into time bands (such as “30 seconds to 1 minute”). Your IP address is processed as with every request (section 3), but it is not stored with the duration.

Purpose

Recognising which pages are actually read.

Legal basis

Your consent (§ 25(1) TDDDG, Art. 6(1)(a) GDPR). Without consent, nothing is measured and nothing is sent.

Withdrawal

At any time with effect for the future, via “Change consent” at the foot of every page or here: Change consent

Retention period

The totals contain no personal data and are kept without a time limit.

5. No external content

Fonts, icons and images are served exclusively from our own server. No third-party services are embedded – in particular no Google Fonts, no map services, no video or social media embeds and no chat tools. Your IP address is therefore not transmitted to any third party merely by visiting the website.

6. Demo appointment

If you book an appointment, we process the data you provide: name, company, email address, optionally telephone number and a note, and the appointment you choose.

Purpose

Arranging, preparing and holding the appointment.

Legal basis

Art. 6(1)(b) GDPR (steps taken at your request prior to entering into a contract).

Calendar

We enter the appointment in a Google Calendar (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). The entry contains all the details from the form: name, company, email address and – where provided – telephone number and note, as well as the time chosen.

Video call

The appointment takes place in Google Meet; you receive the link with the confirmation. You do not need a Google account to take part. Google processes the data that a video conference technically requires: your display name, your image and sound for as long as you have your camera and microphone switched on, and your IP address and information about your device and browser. We do not record the conversation.

Google’s role

We use Google Calendar and Google Meet without Google Workspace. There is no data processing agreement with Google for this; Google processes the data in accordance with its own privacy policy.

Transfers to third countries

Google may also process the data on servers in the USA. The parent company, Google LLC, is certified under the EU-US Data Privacy Framework; the transfer is based on the European Commission’s adequacy decision (Art. 45 GDPR).

Without Google

If you do not wish to use Google, please arrange the appointment informally by email to demo@reportnow.de; we will then find another way to hold the conversation.

Retention period

We automatically delete the booking, questionnaire and calendar entry 12 months after the appointment – unless statutory retention obligations prevent this or a contract is concluded.

7. Questionnaire before the appointment

After booking an appointment, you receive a personal link to a short questionnaire. Taking part is entirely voluntary; the appointment takes place even without your answers. We ask about the size of the company, the accounting and reporting solution in use, and your biggest unsolved problem in reporting.

Purpose

Preparing the content of the appointment for your case.

Legal basis

Art. 6(1)(a) GDPR (consent by voluntarily completing the questionnaire) and Art. 6(1)(b) GDPR.

Please note

Please do not enter in the free-text field any personal data of third parties or any trade secrets that are not needed for the preparation.

Retention period

As for the demo appointment.

8. Trial account

If you set up an account, we process your name, company, the tenant ID you choose, your email address and, optionally, your telephone number. We do not store your password in plain text, only as a cryptographic hash (scrypt); we cannot see it and therefore cannot send it to you either.

The account is only created when you click the link in our confirmation email. For this purpose we log the time of confirmation – without this evidence, any address at all could be used to set up a tenant. An unconfirmed entry lapses after 7 days and is deleted automatically.

Purpose

Setting up and supporting the 14-day trial account, evidence of consent, and contacting you about it.

Legal basis

Art. 6(1)(b) GDPR; for the confirmation of the address, additionally Art. 6(1)(f) GDPR (evidence and protection against the misuse of other people’s addresses for registration).

Your content data

For the data you process in the application – balances, invoices, payroll data – you are the controller and we are the processor. This is governed by an agreement under Art. 28 GDPR, which you can read in advance and conclude in the application before you import any data. This data is not used to train AI models.

Connecting sevdesk

If you connect your sevdesk account in the application, it uses the API token you create there to fetch bank transactions, bookings and sales invoices from sevdesk GmbH – only when you start the retrieval, and read-only; for the bookings it creates an export in sevdesk without finalising any documents. What comes in is part of your content data (see above). sevdesk is your service provider, not ours: only the token, with each request, goes to sevdesk. If you save the token for your tenant, we store it encrypted; only its last four characters are shown, and you can delete it at any time. It goes with the tenant.

Connecting Lexware Office

In the same way, the application uses the API key you create in Lexware Office to fetch your sales invoices and credit notes – only when you start the retrieval, and read-only. So that not every retrieval fetches all documents again, we keep the documents retrieved in your tenant; they are part of your content data. The provider of Lexware Office is your service provider, not ours: only the key, with each request, goes to it. A saved key is treated like the sevdesk token; if you delete it, the kept documents go with it.

Conclusion of the agreement

If you conclude the agreement under Art. 28 GDPR in the application, we store the text of the agreement, the company and its address, your name, your position, your email address, the contact person for data protection if you name one, and the time, as evidence that the agreement was concluded (Art. 6(1)(b) and (c) GDPR).

Retention period

If no contract is concluded, we delete the account and content data no later than 30 days after the end of the trial period.

9. Excel workbook to download

If you request the Excel workbook, we process your name, your email address, optionally your telephone number, the language of the form and the wording of your consent. We send you the download link by email. Only when you download through it are your address and your consent regarded as confirmed; we store the time as evidence. An unused link lapses after 7 days and is deleted automatically together with your details.

Purpose

Sending the link to the workbook and – with your consent – informing you by email about new versions of the workbook with new features, and contacting you about ReportNow! by email and, if you give a telephone number, by telephone.

Legal basis

For sending the link, Art. 6(1)(b) GDPR; for contacting you, your consent under Art. 6(1)(a) GDPR and section 7(2) of the German Act against Unfair Competition (UWG); for evidence of consent, Art. 6(1)(c) and (f) GDPR.

Withdrawal

You can withdraw your consent at any time with effect for the future, informally to demo@reportnow.de or info@reportnow.de. We then delete your details unless we still need them as evidence.

Retention period

24 months after confirmation, then deleted automatically; earlier if you withdraw your consent.

10. Contract and billing

If you conclude a subscription in the application under My account › Billing or through the link in a contract offer, we process the following as the controller: the billing details (company, address, country, VAT ID or registration, the email address for invoices), the details of the contract (term, payment method, the number of companies and users booked, cancellation), which account made a declaration about the contract and when, the number of companies and authorised users per month as the basis for billing, and the invoices themselves.

Purpose

Concluding and performing the contract, invoicing, payment and meeting our tax obligations.

Legal basis

Art. 6(1)(b) GDPR; for invoices, their retention and the verification of the VAT ID, Art. 6(1)(c) GDPR (sections 14, 14b and 18e of the German VAT Act, section 147 of the German Fiscal Code).

Billing address

We first send a link to the email address for invoices; no invoices go there until you click it. We store the time of confirmation (Art. 6(1)(f) GDPR – protection against someone else’s address being entered).

Contract offer

At your request, we enter the billing and contract details ourselves and send an offer to the email address for invoices, with a link that is valid for 14 days (Art. 6(1)(b) GDPR – pre-contractual steps). Whoever opens the link can conclude the contract without signing in; we store the time of acceptance. Because the link went to that address, the address then counts as confirmed.

Email

We send invoices and notices about the contract (offer, conclusion, cancellation, price changes) through our hosting provider’s mail server in the EU; a copy goes to our own mailbox.

Verification of the VAT ID

For businesses elsewhere in the EU, we ask the German Federal Central Tax Office (Bundeszentralamt für Steuern, An der Küppe 1, 53225 Bonn, Germany) whether the VAT ID given is valid and matches the company and address. We transmit our VAT ID and yours, the company name, town, postcode and street; we keep the reply as evidence. Without this confirmation we may not issue the invoice without German VAT.

Card payment

If you pay by credit card, you enter your card details directly with Stripe (Stripe Payments Europe, Limited, 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland); they never reach our server. We transmit to Stripe the name of the tenant and the email address of the account that adds the card (when the contract is concluded through a contract offer, the company and the email address for invoices), and the amount and number of each invoice. If we cancel an invoice that was paid by card, we refund the amount to the card through Stripe; for this, the amount and the invoice number go to Stripe. We store only Stripe’s identifiers, the status of each payment and, where applicable, an error code. Stripe processes some of the data as a controller in its own right, for example to prevent fraud and to meet its own legal obligations, in accordance with its own privacy policy.

Transfers to third countries

Stripe may also process the data in the USA. Stripe, Inc. is certified under the EU-US Data Privacy Framework; the transfer is based on the European Commission’s adequacy decision (Art. 45 GDPR). If you pay by bank transfer, nothing goes to Stripe.

Retention period

We keep invoices and the records that go with them (contract details, evidence of the VAT ID check) for eight years from the end of the calendar year in which the invoice was issued (section 14b of the German VAT Act, section 147 of the German Fiscal Code). We keep a contract offer that is not accepted for six years as a business letter sent (section 257 of the German Commercial Code). Backup copies are deleted after 30 days.

11. Contact by email

If you write to us, we process your details in order to deal with your enquiry (Art. 6(1)(b) or (f) GDPR). We delete this data once the enquiry has been dealt with and no retention periods under commercial or tax law prevent this.

12. Protection against misuse

To fend off automated submissions through the forms, we check an additional field that is invisible to humans and the time taken before submission, and we limit the number of submissions per IP address. When you register for a trial account or request the Excel workbook, your browser also solves a short computational task in the background; only its result is transmitted. In addition, the total number of registrations, workbook requests and appointment bookings is limited per hour and per day respectively. No third-party services are used for any of this – in particular no reCAPTCHA. The legal basis is Art. 6(1)(f) GDPR.

13. Your rights

You have the following rights with respect to us:

• Access to the data processed about you (Art. 15 GDPR)
• Rectification of inaccurate data (Art. 16 GDPR)
• Erasure (Art. 17 GDPR)
• Restriction of processing (Art. 18 GDPR)
• Data portability (Art. 20 GDPR)
• Objection to processing based on legitimate interests (Art. 21 GDPR)
• Withdrawal of consent with effect for the future (Art. 7(3) GDPR)

To exercise them, contact us informally at info@reportnow.de.

14. Right to lodge a complaint

You have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is the Berliner Beauftragte für Datenschutz und Informationsfreiheit (Berlin Commissioner for Data Protection and Freedom of Information), Alt-Moabit 59–61, 10555 Berlin.

15. Encryption

Data is transmitted over TLS. You can tell whether a connection is encrypted by the padlock symbol in your browser’s address bar.

16. Changes to this policy

We update this policy when the processing changes – for example if we add another service. The version available here applies at any given time.

Legal notice