Privacy Policy

1. Controller

M. Amin Sayegh, trading as PrinVox (a product of AIProCraft), Paul-Bertz-Str. 38, 09120 Chemnitz, Germany, e-mail: hello@prinvox.com

2. Our service and the roles

Margin Guard is for businesses (B2B). It calculates gross margin per customer and plan from revenue data you share through Stripe Connect and from usage events your own backend sends us.

We are the controller for your account and billing data. Where the identifiers of your end customers in the revenue and usage data (for example your own customer ID or a Stripe customer ID) are personal data, we may be acting as a processor for you. If you need an agreement under Art. 28 GDPR for that, write to hello@prinvox.com. We recommend sending pseudonymous identifiers only.

3. What we process, why and on what legal basis

Account and sign-in: e-mail address, account name and type, role and timestamps. Sign-in uses a one-time code by e-mail (no passwords); only a hash of the code is stored. Sessions store only a hash of the session token and expiry times. To limit abuse we count requests per key, where the key is a truncated, secret-keyed hash of the IP address (not the IP address itself). Purpose: performance of the contract and security (Art. 6(1)(b) and (f) GDPR).

Sign-in with Google (only if you use it): we request only the “openid” and “email” permissions from Google and store Google’s stable identifier (subject), the e-mail address at the time of linking and the time of last use. Purpose: sign-in (Art. 6(1)(b) GDPR).

Two-factor authentication (only if you set it up): status and type of method (authenticator app, optionally SMS), the authenticator secret and — for SMS — the phone number, each stored encrypted (plus the last four digits for display), hashes of recovery codes and short-lived verification records. Purpose: account security (Art. 6(1)(b) and (f) GDPR).

Security and audit log: event type (for example sign-in, session end, Google linking, enabling two-factor authentication), time and the account and user reference with minimal extra details; never passwords, codes or tokens. Purpose: security and traceability (Art. 6(1)(f) GDPR).

Subscription and payment: payment happens on Stripe’s hosted Checkout page; card or bank details never reach us. We store the Stripe customer and subscription identifiers, the plan, the status and the end of the billing period, to unlock the plan you bought (Art. 6(1)(b) GDPR). Invoicing and payment records are subject to statutory retention duties (Art. 6(1)(c) GDPR).

Stripe revenue data (only if you connect Stripe): the connection uses Stripe Connect (OAuth). PrinVox requests Stripe’s standard Connect permission (scope read_write; Stripe offers a read-only scope only to Stripe Apps). Our software uses it only for read requests (account, paid invoices, refunds) and never initiates payments, payouts, transfers or refunds. We store the Stripe account ID, invoice and refund amounts, currency, timestamps, the Stripe customer ID and the price ID — not your customers’ names or e-mail addresses. The access token is stored encrypted. You can disconnect at any time in the app. Purpose: calculating margin (Art. 6(1)(b) GDPR).

AI usage events (only if you send them): provider (OpenAI, Anthropic or Google Gemini), model name, number of input and output tokens, the request ID you assign (it stops a re-sent event from counting twice), your feature key, the time and optionally your customer identifier and the Stripe customer ID; from these we calculate the cost. The event format has no field for prompts, responses or AI-provider API keys, and Margin Guard does not call AI providers for you. Purpose: calculating AI cost per customer and feature (Art. 6(1)(b) GDPR).

Ingestion key: we store only a hash of the key, the provider, the status and the creation and revocation times; you see the plain key once, when it is created (Art. 6(1)(b) and (f) GDPR).

Free evaluation (where offered): one record with start, end and counters for the event quota is stored (14 days, no card; Art. 6(1)(b) GDPR).

Agent access (MCP, only if enabled): grants, permission scope and an access log (Art. 6(1)(b) and (f) GDPR).

Audience measurement: our own minimal funnel events (event name, visited path without query string, language, random session ID, time). No IP address, user agent or e-mail is stored (Art. 6(1)(f) GDPR).

Contact form and server logs: the form opens your e-mail program; no data is sent to our server. When you visit the site, our hosting provider processes technically necessary data (IP address, time, page, browser) in server logs (Art. 6(1)(f) GDPR – operational security).

Data from earlier offerings: records from a discontinued earlier offering (a check of publicly available web pages) may still exist, including a hash of the IP address used for volume limiting. No new data arises there; deletion on request (see section 6).

4. Cookies and local storage

Technically necessary: a session cookie (cs_session, HttpOnly) for signed-in users and a CSRF-protection cookie (cs_csrf). The display setting (light/dark/system) is stored locally in the browser.

The browser’s session storage holds a random session ID for funnel analysis; it expires with the tab. We set no advertising or tracking cookies. On the Stripe Checkout page and when signing in with Google, Stripe or Google may set their own cookies; their notices apply to those.

5. Recipients and processors

Railway (Railway Corp., USA): hosting of the application, background process and PostgreSQL database; processes all the data above on our behalf. Railway provides a data processing agreement that incorporates the EU Standard Contractual Clauses (Decision 2021/914). The hosting region is set in the Railway configuration; processing outside the EU/EEA cannot be ruled out.

Stripe (Stripe Payments Europe, Ireland, and affiliates, including in the USA): payment processing for your subscription and — if you connect Stripe — providing your revenue data through Stripe Connect. Stripe processes payment data partly under its own responsibility; Stripe’s privacy notice applies. For transfers to the USA Stripe names the EU-US Data Privacy Framework (Stripe is certified) and, as a fallback, the Standard Contractual Clauses.

Resend (USA): sending sign-in and security e-mails (e-mail address and message content). Resend names the EU-US Data Privacy Framework (certification) and Standard Contractual Clauses in its data processing agreement as the transfer basis.

Google (Google Ireland Limited or affiliates): only if you sign in with Google. Google processes the sign-in under its own responsibility according to Google’s privacy policy; we receive the identifiers named above.

SMS provider (Twilio): only if the operator has switched on the optional SMS code as a second factor and you set it up; the provider then receives your phone number and the code.

Not involved: OpenAI, Anthropic and other AI providers receive no data from us in connection with Margin Guard, and we never receive your keys for them.

6. Retention and deletion

No automatic deletion is implemented at present. Account, revenue and usage data are kept while the account exists, and also after a cancellation or the end of a free evaluation, until you ask for deletion. We carry out deletions on request to hello@prinvox.com; you can disconnect Stripe yourself in the app at any time.

The history window named in a plan (30 days, 12 months or full history) only determines which period reports show. It is not a deletion deadline: data outside the window is not deleted at that point.

After a free evaluation ends or a subscription is cancelled, stored data becomes viewable again once you subscribe again. Statutory retention duties (for example for invoicing data under commercial and tax law) remain unaffected and take precedence over deletion. The retention period of server logs follows the hosting provider’s settings.

7. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20) and to object to processing based on Art. 6(1)(f) GDPR (Art. 21). Contact hello@prinvox.com.

You also have the right to lodge a complaint with a supervisory authority, e.g. the Saxon Commissioner for Data Protection and Transparency, Devrientstraße 5, 01067 Dresden, Germany.

8. Changes

We update this policy when our processing changes. The current version (2026-10-20-r3) is always on this page; earlier versions are kept.