Privacy policy

1. Controller

Mathias Gort, MSc, Relay Studio, Badidastraße 81, 6811 Göfis, Austria. Contact: support@relaystudio.org.

2. Uploaded statements and ledgers

Bank statements and ledger exports you upload are processed only to reconcile them (Art. 6(1)(b) GDPR). Each file is read in the memory of a server in Frankfurt am Main and discarded when the request ends; neither the file nor its transactions are stored. Matching runs in your browser, and the report is created there.

Scanned statements without a text layer are sent to Mistral AI SAS, 15 rue des Halles, 75001 Paris, France (processor), for text recognition. Mistral processes the file only to return its text.

For each bank statement we store only the time and a one-way hash of the file, so that the same statement is counted once. This is linked to your account if you are signed in, otherwise to a hash of your IP address that changes every calendar month. The purpose is counting plan statements (Art. 6(1)(b) and (f) GDPR). Entries without an account are deleted after 35 days.

3. Account

For an account we store your email address, your plan and subscription status for each Relay Studio tool, and whether you want product news by email (consent, Art. 6(1)(a) GDPR, revocable at any time). One account works on every Relay Studio tool. You sign in with your email address and a password; only a hash of the password is stored. The database and sign-in are run by Supabase Inc. as processor, with data held in the EU (Frankfurt).

We delete the account and its usage records within 7 days of a request to support@relaystudio.org.

4. Payments

Payments are handled by Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Dublin 2, Ireland. We do not receive card details; we see name, email, country, plan and invoices. Invoice records are kept for 7 years (§ 132 BAO).

5. Hosting and server logs

The site runs on Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA, with functions in the Frankfurt region. Vercel processes technical data on each request (IP address, time, URL, browser) to deliver and protect the site (Art. 6(1)(f) GDPR). Transfers to the US rely on the EU-US Data Privacy Framework and standard contractual clauses.

To measure reach we use Vercel Web Analytics. It sets no cookies and builds no profiles; we see only aggregated page views, referring pages, countries and device types, and visitors are not recognised across days (Art. 6(1)(f) GDPR).

6. Cookies and browser storage

Only cookies needed for sign-in are set. There are no advertising or tracking cookies.

The tool stores nothing in your browser: the statement, the ledger and the matches stay on the page until you close or reload it.

7. Your rights

You have the right of access, rectification, erasure, restriction, portability and objection, and to withdraw consent. Write to support@relaystudio.org. You can complain to the Austrian Data Protection Authority (dsb.gv.at).