Privacy policy

This translation is for your information. Only the German version is legally binding. Go to the German version

Last updated: 19 October 2026

This notice covers the Buchlio website. Your bookkeeping data in the Buchlio app is not transferred to this website.

Controller

PikCode, Mikayil Gacek (Einzelunternehmer)
Mühlstr. 32, 65760 Eschborn, Deutschland
Contact: support@buchlio.de or the contact form.

Website and hosting

The website and the contact form backend run on a server at Hetzner in Nuremberg, Germany. The provider is Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Deutschland. Information from the provider: Hetzner privacy policy.

To deliver the website, the server processes technically necessary connection data, in particular the IP address, the requested address and details of your browser. This also applies to the update requests of the macOS app downloaded from buchlio.de under buchlio.de/updates/. The web server currently keeps no separate log of all page views. Technical operating and error messages may be stored to ensure operation. The legal basis is our legitimate interest in providing the website securely (Art. 6(1)(f) GDPR).

Fonts and product graphics are loaded from our server. The public product pages do not embed any external font services, advertising networks or social media.

Contact by form or email

When you write to us, we process your name, your email address, your message and a phone number you provide voluntarily in order to answer your enquiry. Without the required contact details, the form cannot be sent. There is no automatic sign-up to a newsletter.

The form sends these details over an encrypted connection to our own contact form backend. Sending and the receiving mailbox are handled via Hetzner mail hosting. The message is delivered as an email; the form does not create a separate customer database. Please do not send any receipts, passwords or confidential business data via the form.

To prevent abuse and analyse errors, the form backend logs technical events with the IP address and website origin. The message text is not part of these event logs.

Contract-related enquiries are processed under Art. 6(1)(b) GDPR, other communication on the basis of our legitimate interest in answering enquiries under Art. 6(1)(f) GDPR. We keep enquiries for as long as they are needed to handle them and to keep the communication traceable. Statutory retention obligations remain unaffected. No fixed automatic deletion period is currently set up for technical operating logs; they are not used for advertising or user profiles.

Display and local browser storage

Unless you choose otherwise, the colour scheme follows your device’s setting. With the sun/moon button in the header, you can switch between light and dark display. Your browser stores this preference under buchlio-website-theme in local storage. The preference is not sent to us. This storage serves the display you have expressly requested and remains until you change the selection or clear the browser storage. After clearing, the display follows the device setting again.

If you open a page from within the Buchlio app or the account portal, the browser tab remembers this under buchlio-app in session storage (sessionStorage). This way, the further pages of this visit also appear without navigation and offers. The entry is not sent to us and is deleted when you close the tab.

Usage statistics

For usage statistics, we use our self-hosted Umami installation at hello.mikayil.dev. It also runs on our Hetzner server. The statistics start when a page is viewed, unless there is an objection as described below. The notice with “OK” informs you about this; the button only closes the notice and does not give consent. So that the notice does not appear again, the browser stores buchlio-analytics-notice-dismissed in local storage. This value contains no visitor identifier and is not transmitted to us.

We process page views, page titles, the referring page and technical details on language, screen, browser and device. Search parameters and URL fragments are excluded. We do not record form contents, invoice data, advertising profiles, session recordings or browsing histories across websites.

Umami processes the IP address technically to derive approximate location details and, together with browser details, a website-specific, pseudonymous session identifier. The identifier uses a salt that changes monthly. The IP address is not stored as a separate field in the statistics record. No analytics cookies are set. “Do Not Track” and “Global Privacy Control” are respected.

We base the usage statistics on our legitimate interest in understanding the use of our website and improving its content (Art. 6(1)(f) GDPR). You can object on grounds relating to your particular situation via the contact form. Technically, we also respect the browser signals “Do Not Track” and “Global Privacy Control”, the Umami exclusion value umami.disabled and refusals of the former statistics choice already stored under buchlio-analytics-consent. In these cases, the statistics script is not loaded. If local storage is not accessible, we also refrain from loading it. The statistics stay on our own installation; there is currently no fixed automatic deletion period for their records. More information about the software: Umami documentation.

Buchlio account and subscriptions

How the app and the account process data is described in the privacy notice for the app and account. The pages of this website load no sign-in or payment SDKs and send no visitor information to Paddle, RevenueCat or sign-in services. The only exception is the payment page at buchlio.de/kaufen (in the other languages with the language code in front, such as buchlio.de/en/kaufen), to which the account portal forwards you when you take out a subscription: it loads the checkout script Paddle.js from Paddle (Paddle.com Market Ltd., United Kingdom) and opens the checkout in it. In the process, Paddle receives your IP address, technical details on your browser and the identifier of the purchase. Paddle processes your entries in the checkout as the seller under its own responsibility (Paddle’s privacy policy). The legal basis is the purchase you started (Art. 6(1)(b) GDPR); for the United Kingdom, there is an adequacy decision of the EU Commission.

Your rights

Under the statutory conditions, you can request access, rectification, erasure, restriction of processing and data portability. Where processing is based on legitimate interests, you can object to it on grounds relating to your particular situation. You can withdraw consent at any time with effect for the future.

You can lodge a complaint with a data protection supervisory authority, in particular in the place of your habitual residence, your place of work or the place of the alleged infringement. For our registered office, the Hessian Commissioner for Data Protection and Freedom of Information (Hessischer Beauftragter für Datenschutz und Informationsfreiheit) is responsible.

For data protection requests, write to support@buchlio.de or use our contact form. No automated decision-making with legal or similarly significant effects takes place.