DocuAI24
DE·TR·EN
Get the app

Privacy Policy

Transparency about what data the DocuAI24 app and this website process — and the rights you have.

Last updated: 19 August 2026 · The legally binding version is the German text: Datenschutzerklärung

1. Controller

The controller within the meaning of the GDPR is:

SAG Consulting
Hasan Saglam
An den Wiesen 18a
55218 Ingelheim am Rhein, Germany
Phone: +49 6132 4229028
Email: info@sag-consulting.de

Further details can be found in the Legal Notice.

2. Overview

DocuAI24 is an AI-powered assistant for official mail and government documents. To provide its features, we process personal data — exclusively for the purposes described below. In short:

  • Your data is stored on servers in Frankfurt am Main (EU).
  • Documents and requests are transmitted to AI providers (Anthropic, OpenAI) for analysis — only as far as required for the feature.
  • We do not sell data and do not show advertising based on your data.
  • You can delete your account and all data at any time in the app.

3. Account and authentication

An account is required to use the app. We process your email address and login credentials (password hash). Authentication is handled via our hosting provider Supabase (see section 10). Legal basis: Art. 6(1)(b) GDPR (performance of contract).

4. Profile data

You can voluntarily store profile data (name, address, phone number, preferred language, voice and notification settings). We use it to automatically fill letters and forms with your details and to display the app in your language. Legal basis: Art. 6(1)(b) GDPR.

5. Documents and AI analysis

The app's core feature is analyzing documents (photos, scans, PDFs) that you upload. These documents may contain sensitive information (e.g. financial, health or residence data). We process them exclusively to provide the features you request:

  • Storage: encrypted at Supabase in Frankfurt (EU); accessible only through your account (row level security).
  • Analysis: documents are transmitted to the AI API of Anthropic (Claude) for evaluation. Anthropic does not use API data to train its models and retains it only for limited abuse monitoring.
  • Results: summaries, detected deadlines and recommendations are stored in your account.

Legal basis: Art. 6(1)(b) GDPR; where special categories of personal data (Art. 9 GDPR) are involved, your explicit consent given by actively uploading the respective document (Art. 9(2)(a) GDPR). Please upload only documents you want analyzed.

6. AI chat, correspondence and form assistant

Your chat messages, generated correspondence (applications, objections, emails) and form answers are stored in your account so you can revisit histories and drafts. To generate AI responses, the relevant content (including necessary document and profile data) is transmitted to Anthropic. Legal basis: Art. 6(1)(b) GDPR.

7. Voice features (read-aloud and voice input)

For text-to-speech (read aloud) and speech-to-text (voice questions) we use services provided by OpenAI. The texts to be read or your voice recordings are transmitted to OpenAI and processed there solely to provide the feature; OpenAI does not use API data to train its models. Legal basis: Art. 6(1)(b) GDPR.

8. Email integration (Google Gmail)

You can optionally connect your Gmail account to DocuAI24. In doing so, you grant us the following permissions via Google OAuth:

  • gmail.readonly — reading your emails so the app can recognize, display and explain official mail in your inbox;
  • gmail.send — sending emails that you composed in the app and explicitly approved;
  • userinfo.email / openid — identifying the connected account.

8.1 What Google user data we access

When you connect your Gmail account, DocuAI24 accesses the following data from your Google account: your email address (account identification) and, via gmail.readonly, the messages in your mailbox — i.e. headers (sender, recipient, date, subject), message body and attachments. Via gmail.send, only messages you composed in the app are sent through your account; no additional data is accessed. Access and refresh tokens are stored encrypted and exclusively server-side.

8.2 How we use Google user data

We use this data solely to provide the user-facing features of the app: displaying your mailbox in the app, recognizing incoming official letters and — at your request — explaining or summarizing them in plain language, drafting replies at your request, reading messages aloud if you ask, and sending emails you approved through your account. Google user data is not used for advertising, not sold, and not used to train general AI models. Humans access this data only with your explicit consent, for security purposes (e.g. abuse investigation), or where required by law.

8.3 Sharing, transfer and disclosure of Google user data

We do not share, sell or transfer Google user data to third parties — with the following narrow exceptions, which are necessary to operate the features you use:

  • Supabase (hosting/database, servers in Frankfurt, EU) — encrypted storage of connection tokens and technical operation;
  • Anthropic (AI service) — only when you trigger an AI feature for a specific email (e.g. “explain” or “draft a reply”), the content of that email is transmitted for processing; Anthropic does not use API data to train its models;
  • OpenAI (speech service) — only when you have an email read aloud, its text is transmitted for speech synthesis; OpenAI does not use API data to train its models.

Beyond that, data is disclosed only where we are legally required to do so. All service providers are contractually bound to our instructions and to purpose limitation (Art. 28 GDPR).

Google Limited Use: DocuAI24's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

You can disconnect at any time in the app or revoke access at myaccount.google.com/permissions; disconnecting deletes the stored tokens. Legal basis: Art. 6(1)(a) GDPR (consent); you may withdraw consent at any time with effect for the future. A Microsoft Outlook connection may be offered in the future; the same principles will then apply.

9. Letter and fax dispatch

When you send a document as a physical letter or fax, we transmit the document and recipient details to our dispatch providers:

  • onlinebrief24 (onlinebrief24.de, Germany) — printing and postal delivery of letters;
  • Faxsuite — fax transmission.

Transmission happens only upon your explicit instruction (dispatch confirmation in the app). Legal basis: Art. 6(1)(b) GDPR.

10. Hosting (Supabase, Frankfurt)

Our backend infrastructure (database, file storage, authentication, server functions) runs on Supabase; data is stored in the Frankfurt am Main region (AWS eu-central-1). A data processing agreement pursuant to Art. 28 GDPR is in place with Supabase. Access is protected by encryption (TLS) and row-level access controls (RLS).

11. Subscriptions and payments

Premium subscriptions are purchased through the Apple App Store or Google Play. Payment processing is handled entirely by Apple or Google; we never receive payment details (e.g. card numbers), only your subscription status. Legal basis: Art. 6(1)(b) GDPR.

12. Recipients and international transfers

Recipients of personal data are exclusively the processors and service providers named in this policy. Processing by Anthropic and OpenAI (both USA) may take place in the United States. Transfers are based on adequacy decisions (EU-US Data Privacy Framework, where certified) or EU Standard Contractual Clauses (Art. 46(2)(c) GDPR).

13. Retention and deletion

We store your data for as long as your account exists. You can delete individual documents, chats and letters in the app at any time. When you delete your account (in the app: Profile → Delete account), all personal data is irrevocably deleted, unless statutory retention obligations require otherwise.

14. Your rights

Under the GDPR you have the right to:

  • access (Art. 15), rectification (Art. 16), erasure (Art. 17),
  • restriction of processing (Art. 18), data portability (Art. 20),
  • object to processing based on legitimate interests (Art. 21),
  • withdraw consent with effect for the future (Art. 7(3)),
  • lodge a complaint with a data protection supervisory authority (Art. 77).

To exercise your rights, an informal email to info@sag-consulting.de is sufficient.

15. Data security

We implement technical and organizational measures pursuant to Art. 32 GDPR: encrypted transmission (TLS), database-level access controls, server-side custody of all API keys (no keys in the app) and the principle of data minimization.

16. No automated decision-making

There is no automated decision-making with legal effect within the meaning of Art. 22 GDPR. The app's AI outputs are aids that you review yourself and whose use you decide on yourself.

17. Children

The app is not directed at children under 16. We do not knowingly process data of children under 16 without parental consent.

18. Website

When you visit this website, our server processes technically necessary connection data (IP address, time, page accessed) in server logs to operate the service (Art. 6(1)(f) GDPR). The website uses no cookies and no analytics or tracking services.

19. Changes to this policy

We update this privacy policy when features or the legal situation change. The current version is always available at this address; we announce significant changes in the app.