Scope

This privacy policy applies to the Organice mobile application. For data processing when you visit the STUDIO 42 website – in particular hosting, cookies or audience measurement – the general privacy policy of the website applies in addition.

Controller

STUDIO 42 Reuther und Reuther GbR
Represented by Joshua Reuther and Patrick Reuther
Herderstraße 42
40721 Hilden, Germany

Email: info@studio-42.com
Phone: +49 (0) 176 30171819

Documents, metadata and iCloud

Organice processes the documents you scan or import, as well as metadata you enter or that is recognized, for example title, sender, document type, date, amount, tags, notes, tax year, and deadline or warranty details.

Apple's privacy information applies to iCloud. Whether and to what extent iCloud data is end-to-end encrypted depends, among other things, on the data category, your country and your Apple Account settings.

Text recognition, Apple Intelligence and Private Cloud Compute

On-device text recognition

Basic text recognition can be performed on your device using Apple system frameworks. This makes a document's text and layout available for further processing.

Analysis with Apple Intelligence

When you turn on or start the analysis feature, Organice uses Apple Intelligence to suggest details from the document. Depending on the task, Apple Intelligence decides whether processing can take place directly on your device or requires Private Cloud Compute.

With Private Cloud Compute, the data required for the specific request is transferred to Apple-operated systems running on Apple silicon. Before the transfer, Organice replaces IBANs, tax identification numbers and email addresses in the text with placeholders; an image of the page sent along with it remains unchanged. According to Apple, the request and response are not stored there and are not made accessible to Apple. Organice does not gain any server access of its own to your document as a result.

To the extent the optional analysis is based on your consent, the legal basis is Art. 6(1)(a) GDPR. You can withdraw your consent for the future in the app settings. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.

More information: Apple Intelligence and Privacy and the Private Cloud Compute Security Guide .

Purchases, subscriptions and RevenueCat

Purchases and subscriptions are processed through the Apple App Store. Organice uses RevenueCat to check subscription status and unlock Pro features. In particular, this may involve processing purchase history, Apple receipt data, a pseudonymous or randomly generated app user ID, the time of last use, and technical information such as IP address, app, operating system or device type, App Store country, the identifier for apps from the same developer (IDFV) and your answer to Apple's tracking prompt.

In addition, Organice records three fixed attributes with RevenueCat: which path you took through onboarding (own document, sample, skipped or canceled), how you answered the AI question (yes, no or not available) and what the first analysis ran with. This shows us where people stop during onboarding and whether they start a trial.

RevenueCat does not receive any documents you store in Organice or their content. The processing serves to perform the contract, manage subscriptions, restore purchases and prevent abuse; the legal basis is Art. 6(1)(b) GDPR. For the onboarding attributes, the legal basis is our legitimate interest in improving the app's onboarding (Art. 6(1)(f) GDPR). Where data is transferred to the United States, the applicable data protection safeguards are used, in particular the data processing agreement concluded with RevenueCat and the Standard Contractual Clauses incorporated therein.

Anonymous usage statistics

To understand which features are used and where the app has problems, Organice counts anonymously how it is used – for example how often analyses succeed, where people stop during onboarding, or which way to import is chosen most. We use TelemetryDeck, a provider based in Germany.

To the extent personal data is processed at all, the legal basis is our legitimate interest in improving Organice and finding errors (Art. 6(1)(f) GDPR). TelemetryDeck processes the data on our behalf.

Optional feedback and diagnostic data

If you expressly consent in the app and send feedback, the feedback text you enter and technical information such as app version, iOS version, device model and time are transmitted to Notion Labs, Inc. Under the same consent, diagnostic data such as time, signal and technical call stacks may be transmitted to Notion after a crash or hang. Organice does not automatically add your archived documents or their content to these reports.

Notion is used to process feedback in a structured way and to analyze errors. The processing serves exclusively support, bug fixing and improving the app – not advertising or cross-app tracking. The legal basis is Art. 6(1)(a) GDPR. You can withdraw your consent with effect for the future in the app settings. Notion processes this information on our behalf; Notion's privacy terms apply. Notion may process data in the United States; the safeguards provided for this apply, in particular the EU-U.S. Data Privacy Framework or Standard Contractual Clauses.

Ad measurement

We run ads for Organice, currently on Facebook, Instagram, TikTok and in App Store search (Apple Ads). To find out whether an ad led to an install or a subscription, there are three separate methods.

Apple's aggregated ad measurement (SKAdNetwork / AdAttributionKit)

If you found Organice through an ad, Apple reports to the ad network that ran the ad that an install took place. For this purpose, Organice tells Apple a number between 0 and 4 at five points: at first launch, after setup is completed, when you have filed your first document, when a free trial starts and at the first payment. Apple transmits this information with a time delay, in aggregated form and without an advertising identifier, device identifier or other characteristics that could identify you, and only if enough other installs relate to the same campaign. Neither we nor Meta or TikTok learn who you are. Document content is never involved.

This measurement is part of iOS and runs regardless of whether you consent to ad measurement with Meta and TikTok. The legal basis is our legitimate interest in measuring the effectiveness of our advertising (Art. 6(1)(f) GDPR).

Apple Ads – attribution via Apple

If you found Organice through an ad in App Store search, this can be checked with Apple. For this purpose, Organice requests an attribution code from iOS (AdServices token) and passes it to RevenueCat. On our behalf, RevenueCat asks Apple whether the install goes back to one of our Apple Ads ads. If it does, RevenueCat receives from Apple the identifiers of the campaign, ad group and keyword as well as the country and time of the ad, and links them to the random customer identifier of your installation. This shows us which ads and search terms lead to free trials and subscriptions.

The attribution code contains no advertising identifier (IDFA) and does not require permission for cross-app tracking. Apple only attributes ads from its own App Store; Meta and TikTok learn nothing about it. If your install did not come from Apple Ads, Apple does not return any campaign data. The check only runs in the App Store version, not in test versions. Document content is never involved. The legal basis is our legitimate interest in measuring the effectiveness of our advertising (Art. 6(1)(f) GDPR).

Ad measurement with Meta and TikTok – only with your consent

In addition, Organice can report individual steps to Meta and TikTok. This happens only if you have consented to ad measurement in Organice. Without this consent, ad measurement is off and Organice sends nothing to Meta or TikTok. What exactly is transmitted also depends on your answer to Apple's prompt for cross-app tracking:

Which steps: app installed and opened, setup completed, first document saved (only that it happened, never which one), first analysis completed, subscription screen viewed, checkout started, free trial started, subscription purchased. For a purchase, also the selected plan and the price and currency of that subscription. Free trial, subscription purchase and renewals are reported to Meta by RevenueCat on our behalf (section 05); the app itself reports free trial and subscription purchase to TikTok, but not renewals.

What your device sends along: the advertising identifier (IDFA) only if you have allowed it in iOS. Always a random identifier for this installation and, for TikTok, also the identifier for apps from the same developer (IDFV). In addition, technical information such as IP address, device model, iOS version, language and time zone, the length of your sessions and diagnostic data from the Meta and TikTok software components.

Not transmitted: your documents and anything in them – titles, senders, amounts from your receipts, account numbers, categories, search terms or your name; not even in encrypted or hashed form. The amounts mentioned are exclusively the prices of our subscription.

The purpose is to measure and optimize our ads on Facebook, Instagram and TikTok. The legal basis is your consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG). Your choice is stored on your device together with the date and the version of the consent text. You can withdraw your consent at any time with effect for the future in the app settings under Privacy with the "Ad measurement" switch; from the moment of withdrawal, no further events are reported, and Meta's identifier is removed from RevenueCat as soon as your device is online. We cannot retrieve data that has already been transmitted; Meta's and TikTok's deletion procedures apply to it.

Meta, TikTok and RevenueCat may also process this data outside the EU, in particular in the United States; for Meta, a transfer to Meta Platforms, Inc. is possible. The transfer is based on your consent and the safeguards of the recipients, in particular the EU-U.S. Data Privacy Framework or Standard Contractual Clauses.

Retention and deletion

• Documents and metadata: until you delete them in Organice or in your iCloud space, or remove the corresponding iCloud data.
• Subscription and transaction data: in line with the term of the contract, the settings, and the statutory retention obligations of Apple, RevenueCat and STUDIO 42.
• Anonymous usage statistics: The random identifier remains on your device until you turn off the statistics or delete the app data. The signals stored at TelemetryDeck are not linked to any person.
• Feedback and diagnostics: as long as necessary for handling, bug fixing and documentation, or until any consent given is withdrawn, unless another legal basis or retention obligation applies.
• Ad measurement: Your choice remains stored on your device until you change it or delete the app data. Meta's and TikTok's deletion procedures apply on their side; Meta's identifier at RevenueCat is removed when you withdraw consent.

Simply uninstalling the app does not necessarily delete all data stored in iCloud or subscription information held by Apple or RevenueCat.

Your privacy rights

Subject to the statutory requirements, you have in particular the following rights:

Competent supervisory authority: Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia), Kavalleriestraße 2–4, 40213 Düsseldorf, Germany, ldi.nrw.de .

Your rights if you live in the United States (e.g. California)

We do not sell personal information. Under some U.S. state laws, such as the California Consumer Privacy Act (CCPA/CPRA), ad measurement with Meta and TikTok may count as "sharing" for cross-context behavioral advertising. It only takes place if you have consented in Organice, and you can stop it at any time under Settings → Privacy with the "Ad measurement" switch. Depending on your state, you may also have the right to know and access the personal information we hold about you, and to have it deleted or corrected; we will not discriminate against you for exercising these rights. Send requests to info@studio-42.com ; we may need to verify your identity. Organice is not directed at children under 13, and we do not knowingly collect personal information from them.

Security and updates

Organice uses the security features of the Apple ecosystem and appropriate technical and organizational measures. However, no system can guarantee absolute security. Protect your Apple Account with a strong password and two-factor authentication, keep iOS up to date, and turn on the app lock if it is available on your device.

We update this policy when features, service providers, the legal situation or technical processes change significantly. The date of the current version is shown at the top of this page.

This policy is available in German and English. The German version is binding; the English version is a translation.