Amtvia

This is an English translation for your convenience. Only the German version is legally binding.

Privacy policy

1. Controller

Muhammad Tauqeer Khalid
Pestalozzistraße 9
Bamberg
Deutschland

E-mail: support@amtvia.de (see also the Impressum)

2. In short

Amtvia explains letters from authorities and other organisations and helps you reply. We do not store your uploaded files, the AI only receives text in which your personal data has been replaced by placeholders, and we only keep results if you explicitly want us to.

3. Uploaded letters

  • Transfer and reading: your file (PDF or photo) is sent encrypted (HTTPS) to our server in Frankfurt am Main, where the text is read in memory (photos with text recognition).
  • The file is not stored: it is discarded right after reading. We keep no original photos, scans or PDFs of your letters.
  • Privacy vault: before any text goes to the AI provider, our server automatically replaces personal details with placeholders (e.g. [NAME_1], [IBAN_1]): names, addresses, birth dates, e-mail addresses, phone numbers, bank details, tax, insurance and ID numbers and reference numbers. The placeholder → real value mapping stays on our server, is not stored, and is only used to put the real values back into the answer sent to your browser. For every result you can check exactly what the AI received under “See exactly what the AI received”.
  • Purpose and legal basis: explaining the letter and drafting replies at your request (Art. 6(1)(b) GDPR). Letters can contain special categories of data (e.g. health); we process them only because you upload the letter yourself and ask for the explanation (Art. 9(2)(a) GDPR), and only for that purpose.

4. Questions (“Ask a question”)

Your question is sent – with the same placeholders for personal data – to the AI provider and to a search service to find suitable official sources (Art. 6(1)(b) GDPR).

5. Account, history and deadlines

  • Account: e-mail address, password (only as an encrypted hash), plan, usage counts and your answers from the welcome questions (e.g. language, federal state, city) – to provide the service (Art. 6(1)(b) GDPR).
  • History: explanations and answers are only kept if you switch on “Keep my history” (off by default) or save a result yourself. You can delete entries at any time.
  • My deadlines: only if you add deadlines (or have history switched on): title, date and type of the deadline, never the letter itself.

6. Recipients and processors

  • Supabase (Supabase Inc., USA) – login and database; data stored in the EU (Frankfurt).
  • Render (Render Services Inc., USA) – runs our server; location Frankfurt (EU).
  • Vercel (Vercel Inc., USA) – delivers the website; technically necessary connection data (e.g. IP address) is processed.
  • Groq (Groq Inc., USA) – AI model for text analysis. It only receives the anonymised text (see 3).
  • Tavily (USA) / DuckDuckGo – web search for official sources for questions; only search terms without personal data are sent.
  • Brevo (Sendinblue SAS, France) – sends account e-mails (confirmation, password reset).
  • Lemon Squeezy (Lemon Squeezy LLC, USA) – sells and bills the Pro plan as reseller (“Merchant of Record”). Lemon Squeezy does not pass your payment details to us; we only receive your subscription status. Lemon Squeezy’s privacy policy also applies.

Where providers are based in the USA, data is transferred on the basis of the EU-US Data Privacy Framework (if the provider is certified) or the EU Commission’s standard contractual clauses (Art. 45, 46 GDPR).

7. Cookies and browser storage

  • Necessary (no consent needed): your login and your website language are kept in your browser’s storage; the cookie “amtvia_consent” remembers your cookie choice for 12 months (§ 25(2) TDDDG).
  • Analytics: We currently use no analytics or tracking tools.
  • Fonts are loaded from our own website, not from Google.

8. How long we keep data

Uploaded files: not at all (see 3). Account data: until you have your account deleted. History, saved results and deadlines: until you delete them or your account is deleted. Server logs (time, address called, status code – no letter contents) only as long as needed for operation and security.

9. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object (Art. 21 GDPR). You can withdraw consent at any time with effect for the future (Art. 7(3) GDPR). Write to support@amtvia.de.

You also have the right to complain to a data protection supervisory authority (Art. 77 GDPR), for example the authority of your federal state.