Privacy Policy

1. Data Controller

Christoph Perkles (sole proprietor)
Grillparzerstraße 4, 5020 Salzburg, Austria
VAT ID: ATU72203206
Email: perkles@me.com

2. Data We Collect

We process the following personal data:

• Account data: Name, email address upon registration
• Business data: Clients, invoices, projects you create in AgencyFlow
• Usage data: IP address, browser type, page views (anonymized via Vercel Analytics)
• Payment data: Processed directly by Stripe (PCI DSS compliant)

3. Legal Basis

Contract fulfillment (Art. 6(1)(b) GDPR) for providing the service. Legitimate interest (Art. 6(1)(f) GDPR) for anonymized analytics and security. Consent (Art. 6(1)(a) GDPR) for optional AI features.

4. Data Processing & Hosting

4.1 Business Data

Your business data (clients, invoices, projects) is hosted on EU servers in Frankfurt (Supabase/AWS eu-central-1). Data does not leave the EU.

4.2 AI Features

The AI assistant uses the Anthropic Claude API (US-based servers). Data is only transmitted to process your request and is not used to train AI models. A Data Processing Agreement per GDPR Art. 28 is in place with Anthropic.

4.3 Hosting & CDN

The website is served via Vercel (Edge Network). Vercel processes data according to their GDPR-compliant privacy policies.

5. Third-Party Processors

• Supabase (EU) — Database & authentication
• Stripe (USA, EU SCC) — Payment processing
• Anthropic (USA, DPA) — AI assistant
• Vercel (Global Edge) — Hosting & analytics

6. Your Rights

Under GDPR, you have the right to:

• Access your data (Art. 15)
• Rectify your data (Art. 16)
• Erase your data (Art. 17)
• Data portability (Art. 20)
• Object to processing (Art. 21)
• Lodge a complaint with the Austrian Data Protection Authority (dsb.gv.at)

Contact us at perkles@me.com to exercise your rights.

7. Cookies

AgencyFlow uses only technically necessary cookies for authentication and session management. We do not use tracking or advertising cookies. Vercel Analytics is cookieless and fully anonymized.

8. Data Security

All data transfers are TLS-encrypted. Databases are protected by Row-Level Security (RLS). Regular security audits and updates ensure the protection of your data.