Controller

The controller for this processing is Evgenii Shiriaev, Calle de Mendez Alvaro 2, 28045 Madrid, Spain, e-mail: info@catius.app (see the legal notice).

Which data we process

The photo or PDF of your Mahnbescheid that you upload.
The details read out of it and confirmed by you, for example the court, the case number, the amount claimed and the date of service.
Your e-mail address, to deliver the result and for any queries.
Payment data, which arises solely at our payment provider Stripe.
Technical data for abuse protection: your IP address is counted in order to limit the number of requests, and is stored only briefly for that.

The scan you upload

Your photo or PDF is used solely for automated text recognition and is deleted immediately afterwards. For that one step the file is transmitted to the providers named below under «Recipients of your data»; which of them receives it depends solely on whether the file already contains machine-readable text. Deletion is immediate: the file is removed directly after processing, whether the processing succeeded or failed. The scan exists in our system only for the duration of that single processing step.

Automated reading: please check it

The court, the case number, the amount claimed, the date of service and the remaining details are read out of your scan by machine, using text recognition and a language model. This reading can be wrong. We show you the values that were read before the document is created, for you to confirm; check them carefully before you continue.

How long we keep your case

For as long as you have not paid, your case is deleted after 48 hours. After a successful payment it is kept for 14 days, or 30 days if you choose an extension. Once that period ends we delete the files belonging to your case and set your e-mail address and the remaining case details to null. For accounting purposes only the case ID, the amounts, the country that governs VAT and the timestamps of your order are kept, for as long as tax and commercial retention obligations require.

Contact data for marketing

If you separately consent to your e-mail address being used for similar offers of our own, we store that address separately from your case in its own contact list, on the basis of your consent. This contact data is not deleted together with your case; you can object to its use at any time, without any particular form.

Recipients of your data

Cloudflare: hosting, database, object storage for your files, and limiting the number of requests as abuse protection. The database and the object storage are pinned to locations in the EU.
Google Ireland Limited, Dublin, Ireland: measurement of advertising performance through Google Tag Manager and Google Ads, only after your agreement. A transfer to Google LLC in the United States is not excluded; Google LLC is certified under the EU-US Data Privacy Framework.
Stripe: handling your payment. We never see your full payment data; it stays with Stripe.
Resend: sending our e-mails. The e-mail with your result carries your documents (PDF and DOCX) as attachments, so their content, including the details of your case, passes through Resend's systems. Resend processes data in the USA and is certified under the EU-US Data Privacy Framework. The subject and the text of our e-mails contain no details of your case.
Cloudflare Workers AI: reading the text out of PDF files that already contain a text layer, and the language model that sorts the recognised text into the individual fields. By Cloudflare’s own undertaking, the content processed here is not used to train AI models. Unlike the database and the object storage, this processing step is not pinned to the EU; the processing rests on the data processing agreement with Cloudflare including the standard contractual clauses.
Mistral AI SAS, Paris, France: text recognition for photographs and for scanned PDF files that contain no text layer. According to the provider, the processing takes place in the European Union. We have expressly declined the use of our API calls to train Mistral AI’s models.

Other people’s data in your document

Your Mahnbescheid, and the objection letter prepared for you, also contain personal data of other people, in particular of the claimant. We process that data because it is necessary in order to produce the document you ordered.

Legal bases

Article 6(1)(b) GDPR: performance of the contract concluded with you, including the processing of your scan and of the details you confirm.
Article 6(1)(f) GDPR: legitimate interest in producing the document ordered, including insofar as it contains third party data.
Article 6(1)(a) GDPR: your consent, insofar as you have agreed to your data being used for marketing.
Article 6(1)(c) GDPR: statutory retention obligations for the accounting details that remain after the retention period ends.

Your rights

You have the right of access, rectification, erasure, restriction of processing, data portability, and objection to the processing of your data. To exercise them write to info@catius.app or use our contact form.

Supervisory authority

You have the right to complain to a data protection supervisory authority, in particular the authority for your habitual residence in Germany. The Spanish authority, the Agencia Espanola de Proteccion de Datos (AEPD), is also competent for the controller.

Measurement with Google Tag Manager and Google Ads

We advertise our service on Google Ads. To learn which advert brings visitors to us, we use Google Tag Manager and, through it, tags from Google Ads. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

These services are loaded only once you have agreed in the notice banner. Until then nothing is transmitted to Google and no cookies from Google are set. You can withdraw your agreement at any time through “Cookie settings” at the foot of the page; from the withdrawal onwards the services are no longer loaded.

After your agreement Google processes in particular your IP address, the page you opened, the date and time, and details of your browser, and stores identifiers in cookies on your device. The legal basis for storing and reading on your device is Section 25(1) TDDDG, and for the subsequent processing Article 6(1)(a) GDPR. A transfer to the United States is not excluded; Google LLC is certified under the EU-US Data Privacy Framework.

We store your answer to the banner in a cookie on your device so that we do not have to ask you again on every page. This cookie is also set when you decline and contains nothing but your answer.

None of this is needed to prepare your document.

Privacy notice