Privacy Policy - Solobooks | Solobooks – Accounting for Freelancers in Germany

1. Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) is:

Solobooks UG (haftungsbeschränkt)
(currently being established)
Dorfstraße 36D
13057 Berlin
Germany

2. General Information

We take the protection of your personal data very seriously. Personal data is only processed by us in accordance with the applicable legal provisions, in particular the General Data Protection Regulation (GDPR).

This privacy policy informs you about the type, scope, and purpose of the processing of personal data when using our website and our software application Solobooks.

3. Hosting

a) Frontend / Website

Our website and web application are provided by Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA.

Cloudflare processes technical access data (e.g., IP address, timestamps, browser information) on our behalf to deliver the website and the web application. We have a data processing agreement with Cloudflare. Where data is transferred to the USA in the process, this is based on the EU-U.S. Data Privacy Framework (adequacy decision under Art. 45 GDPR), under which Cloudflare is certified.

Legal basis:
Art. 6(1)(f) GDPR (legitimate interest in secure and efficient provision)

b) Backend & Database

The backend and database are operated on servers of Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany.

Processing takes place exclusively on servers within the European Union.

Legal basis:
Art. 6(1)(b) GDPR (performance of contract)
Art. 6(1)(f) GDPR (IT security and system operation)

4. Collection of Personal Data When Visiting the Website

When accessing our website, the following data is automatically collected and temporarily stored:

IP address
Date and time of access
Browser type and version
Operating system
Referrer URL

This data is technically necessary to correctly display the website and to ensure stability and security.

Legal basis:
Art. 6(1)(f) GDPR

5. User Account & Authentication

a) Registration and Login

When registering a user account, we process in particular:

Email address
Password (stored in encrypted form)

Additionally, you have the option to sign in via Google OAuth. In this case, we only receive the data necessary for authentication from Google (e.g., email address).

Legal basis:
Art. 6(1)(b) GDPR (performance of contract)

6. Use of the Application (Solobooks)

In the course of using our software, we process the data you enter or upload, in particular:

Invoice and accounting data
Transaction and payment information
Business and client data

This data is processed exclusively for providing the features of Solobooks and is not used for other purposes.

Legal basis:
Art. 6(1)(b) GDPR

7. Identity Verification (Didit)

Before Solobooks transmits your tax return to the tax office on your behalf, we must identify you (§ 87d(2) AO). For this we use the service Didit (Didit Identity Spain, S.L., Calle Nápoles 227, P. 1, 08013 Barcelona, Spain).

During the check, you take a photo of your face and of your ID document. Didit reads the details from the document and biometrically compares your face with the photo in the document. The check only starts after you have expressly consented to the processing of your biometric data.

So that Didit can check whether the document belongs to the person we transmit for, we send Didit the first name, last name and date of birth of the taxpayer, along with an internal identifier of your tax return.

We receive and store the result of the check from Didit:

First and last name
Date of birth
Type, number and issuing state of the ID document
Time of the check and the identifier of the check at Didit

The images of your face and your document remain with Didit and are deleted there once the configured retention period has expired. Didit processes the data on our behalf under a data processing agreement, on servers in the European Union.

We store your consent with its time, language and the version of the consent text.

We store the details from the identity check for five years, counted from the end of the calendar year in which we last transmitted a return for you (§ 87d(2) AO).

You can withdraw your consent at any time with effect for the future, e.g. by email to contact@solobooks.de. Without the identity check, Solobooks cannot transmit your return on your behalf.

Legal basis:
Art. 9(2)(a) GDPR in conjunction with Art. 6(1)(a) GDPR (explicit consent)

8. Transmission to the Tax Authorities (ELSTER)

We transmit your tax return electronically to the competent tax office via the ELSTER interface (ERiC). The transmission contains the details of your return, including your personal details and, for a joint assessment, those of your spouse or civil partner. We operate the interface on our servers at Hetzner Online GmbH (see section 3 b).

The return is transmitted in one of two ways:

Solobooks transmits the return on your behalf (§ 87d AO) after you have confirmed your identity (see section 7).
You transmit with your own ELSTER certificate. For this, we store your certificate file and its password in encrypted form.

At your request, we retrieve certificates the tax authorities already hold (e.g. the Lohnsteuerbescheinigung, health and long-term care insurance contributions, wage replacement benefits) via ELSTER and add them to your return. For this, we use your tax identification number and date of birth to request a retrieval authorisation, which you confirm in Mein ELSTER.

The recipient of the data is the tax administration of the competent federal state.

Legal basis:
Art. 6(1)(b) GDPR (performance of contract)

9. Email Sending

For sending transactional emails (e.g., confirmations, system-relevant notifications), we use the following services:

Resend
Postmark (ActiveCampaign, LLC)

Processing is carried out on the basis of a data processing agreement.

Legal basis:
Art. 6(1)(b) GDPR

10. Payment Processing

For processing payments, we use the payment service provider Stripe Payments Europe Ltd., Ireland.

Stripe processes payment data (e.g., credit card or SEPA data) as an independent controller. We do not have access to complete payment data.

Supported payment methods:

Credit card
SEPA direct debit

Legal basis:
Art. 6(1)(b) GDPR

11. Referral Programme

Anyone who has paid for a tax return as a one-off purchase through Solobooks and submitted it successfully receives a personal referral code and a link containing that code. Anyone who signs up through that link or enters the code at payment receives a discount on their first tax return. Once that person has submitted their return successfully, the referrer receives a discount on their next return.

For this, we process:

for the referrer: their referral code and, once earned, the discount code for their next return with its expiry date and whether it has been redeemed or revoked
for the referred person: which code they signed up or paid with and when, and, once they have submitted their return successfully, the time of submission and which return it was

The codes are created by Stripe (see section 10) as discount codes and redeemed at payment. Stripe records the redemption. At Stripe, the codes are linked only to internal identifiers, not to names, email addresses or tax data.

The referrer sees only their own code and its status, e.g. "used" or "discount available". They are not shown who used the code. From the status "discount available", however, they can infer that the person who used their code has submitted their return. A refund to the referred person is not shown to them. The referred person sees no information about the referrer, not even a name.

We store this data as long as both user accounts exist, and delete it as soon as either account is deleted.

Legal basis:
Art. 6(1)(b) GDPR (running the referral programme you take part in)

12. Error and Performance Monitoring

For monitoring stability and error analysis, we use Sentry.

Technical information (e.g., device and browser data, error timestamps) may be processed. IP addresses are anonymized or truncated.

Legal basis:
Art. 6(1)(f) GDPR (legitimate interest in technical stability)

13. Cookies and Consent

We use technically necessary cookies that are required for the operation of the website and the application (e.g., session cookies). These are set without consent.

Additionally, we use the live chat services Crisp (Crisp IM SAS, France) and tawk.to (tawk.to inc., USA), which may set additional cookies and transfer data to external servers. Both services are only loaded after your explicit consent.

We also use the analytics service PostHog (see section 14). PostHog is likewise only loaded after your explicit consent.

When visiting our website, a cookie banner is displayed through which you can accept or decline the use of non-essential services. Your choice is stored in a cookie for solobooks.de and app.solobooks.de, so it also applies in the application, and can be revoked at any time via the "Cookie Settings" link in the footer.

Legal basis:
Technically necessary cookies: Art. 6(1)(f) GDPR
Crisp and tawk.to Live Chat: Art. 6(1)(a) GDPR (consent)
Web analytics with PostHog: Art. 6(1)(a) GDPR and § 25(1) TDDDG (consent)

14. Web Analytics (PostHog)

To understand which campaigns bring visitors to us and where they stop during registration or their tax return, we use the analytics service PostHog (PostHog Inc., USA). PostHog is only loaded on our website and in the application after your consent via our cookie banner.

The following data is processed:

pages visited and the time of the visit
campaign parameters of the link that brought you to us (e.g., utm_source, utm_campaign) and the referrer URL
browser and device information
usage events in the application, e.g., registration, email confirmation, completed steps of the tax return, submission and payment
a random identifier stored in a cookie for solobooks.de and app.solobooks.de and, after you log in, your internal user ID

We do not send names, email addresses, tax identification numbers, amounts or any other content of your tax return or accounting to PostHog. PostHog does not store IP addresses. We do not use session recordings (session replay).

The data is stored on Amazon Web Services servers in Frankfurt am Main (PostHog EU Cloud). A data processing agreement is in place with PostHog. Where PostHog Inc. accesses data from the USA for support or maintenance, this is based on the EU Standard Contractual Clauses.

Usage events are stored for at most seven years and deleted afterwards.

You can withdraw your consent at any time via the "Cookie Settings" link in the footer. After that, no further data is sent to PostHog.

Legal basis:
Art. 6(1)(a) GDPR and § 25(1) TDDDG (consent)

15. Live Chat (Crisp and tawk.to)

For providing live chat support, we use the service Crisp (Crisp IM SAS, 2 Boulevard de Launay, 44100 Nantes, France).

When the live chat is activated (after consent), the following data may be processed:

IP address
Browser and device information
Chat messages and content
Session management cookies

The service is only loaded after your explicit consent via our cookie banner.

In addition, we use the live chat service tawk.to (tawk.to inc., 187 East Warm Springs Rd, Las Vegas, NV 89119, USA). When activated, the same categories of data may be processed as with Crisp.

This involves transferring data to the USA. The transfer takes place on the basis of your explicit consent pursuant to Art. 49(1)(a) GDPR. Please note that the USA cannot be guaranteed to provide a level of data protection equivalent to European law, and that US authorities may under certain circumstances gain access to this data.

tawk.to is likewise only loaded after your explicit consent via our cookie banner.

Legal basis:
Art. 6(1)(a) GDPR (consent); for the transfer to the USA additionally Art. 49(1)(a) GDPR

16. Data Sharing

Personal data is only shared:

with the service providers mentioned above
with the tax authorities when your tax return is transmitted (see section 8)
in compliance with legal obligations

Data is not shared for advertising purposes.

17. Data Retention

Personal data is only stored for as long as necessary for the respective purposes or as required by statutory retention obligations.

We store the details from the identity check for five years, counted from the end of the calendar year of the last transmission (see section 7).

18. Rights of Data Subjects

You have the right to:

Access (Art. 15 GDPR)
Rectification (Art. 16 GDPR)
Erasure (Art. 17 GDPR)
Restriction of processing (Art. 18 GDPR)
Data portability (Art. 20 GDPR)
Objection (Art. 21 GDPR)

Please direct requests to: contact@solobooks.de

19. Right to Lodge a Complaint

You have the right to lodge a complaint with a data protection supervisory authority.

20. Currency

This privacy policy is currently valid as of October 2026.

We reserve the right to amend this privacy policy in the event of changes in the legal situation or our services.