Privacy Policy

1. Controller

Senura AI GbR, Leitenstraße 2, 92521 Schwarzenfeld, Germany

Email: support@filento.de

2. Hosting

Our application runs in data centres within the European Union. All transmission is TLS-encrypted.

3. Server log files

When you access our website, the server automatically collects information that your browser transmits and that is technically required to display the site and ensure its stability and security. The legal basis is our legitimate interest in secure, fault-free operation (Art. 6(1)(f) GDPR). This includes in particular:

• IP address of the requesting device
• date and time of access
• name and URL of the file/page accessed
• amount of data transferred and notification of successful retrieval
• browser type and operating system used
• the previously visited page (referrer), if transmitted

4. Data we process

• Account data: email address (for registration, login and account management).
• Uploaded documents: When using the direct mode ("instant filling"), your uploaded source documents are processed only transiently (in memory) for extraction and form filling and are not stored permanently; only the paid result document you generate is stored so you can download it again. When using the automation / upload-link feature (submitting documents to an operator), the uploaded documents and the filled result are stored in our database so the operator can review them; the uploaded source documents are deleted once the operator approves the submission.
• Payment data: handled by Stripe; we do not store full payment details.
• Usage/log data: technically required (e.g. to enforce usage and request limits).

5. Purposes and legal bases

Processing is based on contract performance (Art. 6(1)(b) GDPR), legal obligations (lit. c), our legitimate interest in secure, abuse-free operation (lit. f) and, where required, consent (lit. a).

6. Recipients / processors

• Anthropic (Claude API): AI-based detection, extraction and form filling. Content may be transferred to a third country (USA), safeguarded by EU Standard Contractual Clauses (SCC). Transferred data is not used to train the models per contractual assurances.
• Supabase (Supabase Inc., USA; data hosted in an EU data centre – Frankfurt): authentication and database (account/billing data). Any access from a third country (USA) is safeguarded by EU Standard Contractual Clauses (SCC).
• Stripe (Stripe Payments Europe, Ltd., Ireland): payment processing and storage of the payment method for recurring payments/subscriptions. Stripe processes certain payment and fraud-prevention data as an independent controller; any transfers to the USA are safeguarded by the EU-US Data Privacy Framework or EU Standard Contractual Clauses (SCC).
• Google (Firebase Cloud Messaging): push notification delivery in the mobile app (only when enabled; third-country transfer USA, EU-US Data Privacy Framework or SCC).
• All-Inkl / KAS (ALL-INKL.COM – Neue Medien Münnich GmbH, Germany): transactional email delivery (e.g. notifications, confirmations) via SMTP; servers within the EU/Germany.
• Twilio (Twilio Inc., USA): sending the SMS confirmation during newsletter sign-up (only when SMS verification is enabled). Third-country transfer USA, safeguarded by the EU-US Data Privacy Framework or EU Standard Contractual Clauses (SCC).
• Google (Google Ireland Ltd.): authentication via "Sign in with Google" (OAuth), if you use this login option.
• Hostinger (Hostinger International Ltd.): application hosting on a dedicated server (VPS) in a data centre within the EU (Germany, Frankfurt).
• HighLevel (HighLevel Inc., "GoHighLevel" / "LeadConnector"): CRM and email-marketing platform for our newsletter and contact management. Only data of persons who have explicitly opted in to the newsletter (double opt-in) is transferred. In addition, we operate a LeadConnector/HighLevel support chat on our website: it is loaded only after your active consent (cookie banner); when the chat is loaded and used, data such as your IP address and the content you enter in the chat (e.g. name, email address, message) is transmitted to and processed by HighLevel. Third-country transfer USA, safeguarded by the EU-US Data Privacy Framework or EU Standard Contractual Clauses (SCC). You can withdraw your consent at any time with future effect ("Cookie settings" button).

7. Newsletter and SMS verification

If you subscribe to our newsletter, we process the data you provide (in particular your email address and, where applicable, your mobile number) solely to send the newsletter. The legal basis is your consent (Art. 6(1)(a) GDPR).

Sign-up uses a double opt-in procedure: after registering you receive a confirmation request and are only added to the list once you confirm. Where SMS verification is enabled, we additionally transmit your mobile number to our processor Twilio in order to send you a confirmation code by SMS.

You can unsubscribe and withdraw your consent at any time with future effect — e.g. via the unsubscribe link in every newsletter email or by message to support@filento.de. After you unsubscribe, the data stored for the newsletter is deleted unless statutory retention obligations apply; we retain proof of your consent to meet our accountability obligation (Art. 5(2) GDPR).

Sending and contact management are handled by our processor HighLevel (see section "6. Recipients / processors").

8. International data transfers

Where we transfer data to service providers outside the EU/EEA — in particular to the USA — we rely on one of the following mechanisms: if the recipient is certified under the EU-US Data Privacy Framework (DPF), the transfer is based on the European Commission's adequacy decision of 10 July 2023 (Art. 45 GDPR); if the recipient is not certified, the transfer is based on the EU Standard Contractual Clauses (SCC, Art. 46(2)(c) GDPR), supplemented by appropriate additional safeguards. Which mechanism applies to a given recipient follows from section "6. Recipients / processors".

9. AI transparency (under the EU AI Act)

Filento uses AI systems (Anthropic's Claude language model) to detect form fields and fill them automatically using data from your uploaded source documents. When you use this feature you are interacting with an AI system within the meaning of Art. 50 of Regulation (EU) 2024/1689 (the "EU AI Act"); we disclose this to you before processing (consent checkbox at upload) and again when results are shown. We also offer an optional AI explanation assistant (chat) that explains form questions in your language, and an optional automatic translation of form questions — both are likewise interactions with an AI system, not legal or tax advice.

The content this produces (filled form fields, translations, chat answers) is AI-generated and may contain errors. You are actively prompted in the product, and are required, to check results for accuracy and completeness before use.

Risk classification: Filento does not decide on your application, does not assess eligibility for any benefit, and does not submit your application to an authority or other body on its own. The completed document is provided only to you — or, when using the automation/upload-link feature, to the operator for review — for you or the operator to check, correct if needed, and submit yourselves; a human review step is always foreseen at this point. No automated decision with legal effect within the meaning of Art. 22 GDPR takes place. For these reasons we do not classify Filento as a high-risk AI system under Annex III of the EU AI Act, in particular not as a system to evaluate eligibility for essential public assistance benefits and services (Annex III(5)(a)), since that evaluation always remains with the relevant authority.

Anthropic, as the provider of the underlying AI model, does not use the data transmitted for processing to train its models, per contractual assurance. Questions about our use of AI systems are welcome at the email address above.

10. Cookies and consent

We use strictly necessary cookies required for login and session maintenance. These are essential for operating the application and do not require consent. We do not use tracking or analytics cookies.

In addition, we embed a third-party support chat (LeadConnector/HighLevel, USA). This service is only loaded after your active consent via our cookie banner (opt-in pursuant to § 25(1) TDDDG, Art. 6(1)(a) GDPR). Without your consent, no such script is loaded and no data is transmitted to the provider. We store your consent locally in your browser so the banner does not reappear on every visit. You can withdraw your consent at any time with future effect via the "Cookie settings" button.

11. Your rights

• Access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20), objection (Art. 21), withdrawal of consent, and the right to lodge a complaint with a supervisory authority (Art. 77 GDPR).

12. Contact

For privacy enquiries: support@filento.de