# Privacy notice This notice describes how we handle your data when you use Catius Documents. ## Controller The controller for this processing is Evgenii Shiriaev, Calle de Mendez Alvaro 2, 28045 Madrid, Spain, e-mail: [info@catius.app](mailto:info@catius.app) (see the [legal notice](/de/en/impressum/)). ## Which data we process - The photo or PDF of your Mahnbescheid that you upload. - The details read out of it and confirmed by you, for example the court, the case number, the amount claimed and the date of service. - Your e-mail address, to deliver the result and for any queries. - Payment data, which arises solely at our payment provider Stripe. - Technical data from bot detection (Cloudflare Turnstile). ## The scan you upload Your photo or PDF is used solely for automated text recognition and is deleted immediately afterwards. For that one step the file is transmitted to the providers named below under «Recipients of your data»; which of them receives it depends solely on whether the file already contains machine-readable text. Deletion is immediate: the file is removed directly after processing, whether the processing succeeded or failed. The scan exists in our system only for the duration of that single processing step. ## Automated reading: please check it The court, the case number, the amount claimed, the date of service and the remaining details are read out of your scan by machine, using text recognition and a language model. This reading can be wrong. We show you the values that were read before the document is created, for you to confirm; check them carefully before you continue. ## How long we keep your case For as long as you have not paid, your case is deleted after 48 hours. After a successful payment it is kept for 14 days, or 30 days if you choose an extension. Once that period ends we delete the files belonging to your case and set your e-mail address and the remaining case details to null. For accounting purposes only the case ID, the amounts, the country that governs VAT and the timestamps of your order are kept, for as long as tax and commercial retention obligations require. ## Contact data for marketing If you separately consent to your e-mail address being used for similar offers of our own, we store that address separately from your case in its own contact list, on the basis of your consent. This contact data is not deleted together with your case; you can object to its use at any time, without any particular form. ## Recipients of your data - **Cloudflare**: hosting, database, object storage for your files, and bot detection (Cloudflare Turnstile). The database and the object storage are pinned to locations in the EU. - **Stripe**: handling your payment. We never see your full payment data; it stays with Stripe. - **Resend**: sending the e-mails with your result. Account and log data at Resend is held in the USA, which is why our e-mails to you carry no details of your case in either the subject or the body, only a link to your status page. - **Cloudflare Workers AI**: reading the text out of PDF files that already contain a text layer, and the language model that sorts the recognised text into the individual fields. By Cloudflare’s own undertaking, the content processed here is not used to train AI models. Unlike the database and the object storage, this processing step is not pinned to the EU; the processing rests on the data processing agreement with Cloudflare including the standard contractual clauses. - **Mistral AI SAS**, Paris, France: text recognition for photographs and for scanned PDF files that contain no text layer. According to the provider, the processing takes place in the European Union. We have expressly declined the use of our API calls to train Mistral AI’s models. ## Other people’s data in your document Your Mahnbescheid, and the objection letter prepared for you, also contain personal data of other people, in particular of the claimant. We process that data because it is necessary in order to produce the document you ordered. ## Legal bases - Article 6(1)(b) GDPR: performance of the contract concluded with you, including the processing of your scan and of the details you confirm. - Article 6(1)(f) GDPR: legitimate interest in producing the document ordered, including insofar as it contains third party data. - Article 6(1)(a) GDPR: your consent, insofar as you have agreed to your data being used for marketing. - Article 6(1)(c) GDPR: statutory retention obligations for the accounting details that remain after the retention period ends. ## Your rights You have the right of access, rectification, erasure, restriction of processing, data portability, and objection to the processing of your data. To exercise them write to [info@catius.app](mailto:info@catius.app) or use our [contact form](/de/en/kontakt/). ## Supervisory authority You have the right to complain to a data protection supervisory authority, in particular the authority for your habitual residence in Germany. The Spanish authority, the Agencia Espanola de Proteccion de Datos (AEPD), is also competent for the controller. ## No third party cookies This marketing site embeds no third party cookies or scripts.