Your financial data, handled carefully
Designed for GDPR compliance, with a data processing agreement available for every client and no certification claims we have not earned.
What we collect, where it lives
Plainly stated, because this is the part most software pages make deliberately vague.
What is collected
Invoices, receipts and settlement documents from the sources you connect, plus the account data needed to run your portal login.
Where it is processed
On GDPR-compliant infrastructure, with access limited to the systems that need it to run the categorisation and sync pipeline.
Who controls it
You do. For document data we act as a processor under Art. 28 GDPR, on your instruction and under a signed DPA.
How long it is kept
Only as long as needed to run the service and meet legal retention duties. Deletion terms are set out in the DPA.
Who else touches the data
Every provider in the processing chain, named — the list is kept current in the Datenschutzerklärung.
| Category | Provider | Purpose |
|---|---|---|
| Hosting & infrastructure | Lovable Cloud (Supabase) | Operating the website and client portal |
| AI categorisation | Named in the Datenschutzerklärung | Automated categorisation suggestions |
| Email delivery | Named in the Datenschutzerklärung | Notifications and password resets |
| Accounting connection | Lexware Office (Haufe-Lexware GmbH & Co. KG) | Transferring approved, categorised entries |
What we do not claim
Designed to support GoBD-relevant workflows. Not certified as something we are not.
Not your system of record
Lexware Office remains the authoritative accounting record. VatBlitz is a processing layer, not the only copy of your documents.
No automated legal decisions
Categorisation suggestions are not automated decisions with legal effect under Art. 22 GDPR — you review and approve before anything posts.
No unearned certifications
We say GDPR-compliant infrastructure and DPA available, because that is what is true. We do not claim certifications we do not hold.