This policy describes the personal data processed when you visit and use mahevi.solutions.
1. Controller
mahevi solutions, Alexander Schaffer, Austria
E-mail: alexander@mahevi.solutions, phone: +43 664 2081526. Full postal address in the imprint.
No data protection officer has been appointed; there is no legal obligation to do so.
2. Visiting the website (server and access logs)
Every request causes the server to process technical access data: IP address, timestamp, endpoint called, HTTP status, response time, referrer, user agent, language and a technical session identifier. These logs serve operation, troubleshooting and abuse prevention. To protect against overload, requests are counted and limited per IP address.
Legal basis: legitimate interest in secure, stable operation (Art. 6(1)(f) GDPR).
Retention: automatic deletion after 90 days.
3. First-party usage measurement
If cookies are accepted, the website additionally reports the pages you open and individual interactions to our own server in order to evaluate usage and errors – exclusively within our own system. Without consent this does not happen at all. No third-party analytics services are used: no Google Analytics, no tag manager, no social media pixels, no advertising networks.
Legal basis: consent (a), revocable at any time – see cookies.
4. User account
An account requires an e-mail address, a password (stored only as a cryptographic hash), a name and the assigned roles. Registration requires acceptance of the terms of use and this privacy policy; that acceptance is logged with its timestamp and version.
Legal basis: performance of a contract (b).
Retention: until the account is deleted, thereafter until statutory retention periods expire.
5. Enquiries, forms and surveys
Information submitted through contact and questionnaire features is stored in order to process it. In calculation and analysis tools the values you enter generally stay in your browser; if results are saved or sent, they are associated with your account.
Legal basis: pre-contractual measures or performance of a contract (b), otherwise the legitimate interest in responding (f).
6. Reporting a problem (tickets)
Through “Report a problem” you can report a bug, a wish or a question. We store the title and description, every later addition and – without signing in – your name and e-mail address, or, when signed in, the link to your account. So that we can reproduce the problem, we also store the page the report was sent from, the window size, the browser identifier (user agent), the IP address and the technical session identifier.
Screenshot and attachments: When the dialog opens, a picture of the page currently shown is taken. It can show anything that was on screen at that moment. You see it before sending and can mark it up, crop it or remove it; it is only transmitted when you send the report. Without signing in you can add one picture; signed in, pictures and videos (including a screen recording). Pictures sent without an account are re-encoded (removing their metadata) and stored privately; attachments of signed-in users are files of their own account and can be deleted there.
Confirmation: Without signing in, a report is only handled once you have confirmed it through the link in the confirmation e-mail. You then receive news about your report by e-mail, each time with a personal link valid for five days. Your consent in the dialog is kept in your browser (local storage), the link for the duration of the session.
Recipients: the operators of this website (owners and administrators) and the platform operator; e-mail notifications go to them and to you.
Legal basis: your consent in the dialog (lit. a); for signed-in users also performance of a contract (lit. b) or our legitimate interest in fixing faults (lit. f).
Retention: Unconfirmed reports and their pictures are deleted after seven days. IP address, browser identifier and session identifier are removed after 90 days. Confirmed reports are kept until they are resolved and deleted; on request we delete them earlier.
7. Orders and payments
Paid services are currently not available and no payment provider is connected. No payments are therefore processed and no payment data is collected.
Order and invoice data from earlier purchases is still stored; full card numbers were not held in our system then either.
Legal basis: legal obligation for invoices (c).
Retention: invoicing and accounting data for seven years under § 132 of the Austrian Federal Fiscal Code.
8. E-mail and newsletter
System e-mails and newsletters are sent via Azure Communication Services. The newsletter requires explicit sign-up with confirmation of the e-mail address (double opt-in); every mailing contains an unsubscribe link. For each dispatch we log which message went to which address at what time and whether delivery succeeded. Open and click tracking is disabled.
Legal basis: contract for system e-mails (b), consent for the newsletter (a).
Retention: dispatch logs 90 days; a subscription lasts until you unsubscribe.
9. Chat and AI-assisted features
If a chat or assistant feature is used, your input and the associated history are transmitted to Microsoft's Azure OpenAI Service for processing and additionally stored in our system. Please do not enter sensitive personal data or data about third parties there.
Legal basis: consent through active use, or legitimate interest (a/f). Processing takes place within Microsoft's EU Data Zone (the resource is located in Sweden); no transfer to OpenAI or to the USA takes place.
Receipts in invoicing. If you capture a receipt in invoicing with Automatisch auslesen switched on, the receipt is read so that the form fills itself in:
- An e-invoice and a PDF with text are read on our server, without being passed on.
- A photo or a scanned PDF is read by our own text recognition (Tesseract or PaddleOCR) in Microsoft data centres in the EU.
- The recognised text – with the names, addresses, bank details and amounts on the receipt – is then sent to the Azure OpenAI Service, as described above, to be assigned to the fields.
- A payment QR code is read in your browser only.
For a single receipt nothing is stored while it is read; the receipt and its details are stored only when you save. If several receipts are uploaded as a batch, the files and the result of reading them are stored at once so that they can be read in the background. A batch and a receipt captured as Privat are visible only to the person who uploaded them and to the platform operators. With the switch off nothing is read and nothing is transmitted.
Legal basis: performance of the contract (b) with the account using invoicing; for third-party details on a receipt, the statutory record-keeping obligation (c) or the legitimate interest in proper bookkeeping (f). If you capture health data (such as pharmacy or doctor receipts) as private receipts, you do so at your own express initiative (Art. 9(2)(a) GDPR).
Retention: saved company receipts for the statutory retention period (seven years under § 132 BAO, eight years under § 147 AO for German tenants); a deleted company receipt stays in the bin until that period ends, a private receipt is removed at once when deleted. Unsaved receipts of a batch are deleted with the batch, after 30 days at the latest.
10. Documents (personal document storage)
When signed in, you can keep and search your own documents under Documents – for example contracts, insurance, bank and tax papers, letters from authorities, health, vehicle and housing documents. You photograph the pages or upload pictures or a PDF. We store the pages (photos turned upright and without metadata such as the place they were taken, cropped if you wish), a PDF assembled from them, the text read from each page and the document's details: title, category, date, issuer, tags, a short summary and further details such as amounts, numbers or dates. Categories you create yourself are stored too.
Reading and classifying: After the upload the document is read in the background:
- A PDF with text is read on our server, without being passed on.
- Photos and scanned pages are read by our own text recognition (Tesseract or PaddleOCR) in Microsoft data centres in the EU.
- The recognised text is sent to the Azure OpenAI Service, which suggests the title, category, date, issuer and further details. You check and change the suggestions yourself; details you have confirmed or changed are no longer overwritten automatically.
- So that you can also search your documents by meaning, text and details are split into passages and converted by the Azure OpenAI Service into numeric vectors (embeddings); passages and vectors are kept in our AI database. Your search term is converted for this as well. When you are signed in, the website's search also shows hits from your documents.
The Azure OpenAI Service processes this data within Microsoft's EU Data Zone (the resource is located in Sweden); no transfer to OpenAI or to the USA takes place. Under Microsoft's terms the content is not used to train AI models.
Who sees the documents: When capturing a document you choose Private or Company.
- Private: the document, its text and its details are visible only to you – in the list, in search and in the assistant. Administrators of this website and of the platform cannot open a private document through the application either. In the overview of AI conversations that administrators can view, passages from private documents are hidden, as are the questions and answers based on them.
- Company: the document belongs to the company it was captured for. It is visible to that company's owners, administrators and staff, to members with access to invoicing and to the platform's administrators; members with access to invoicing can capture, change and delete it.
Only the person who captured a document can switch it between private and company. The files are stored non-publicly in Azure Blob Storage and are only handed out through signed links valid for 15 minutes. Those who run the technical infrastructure (servers, databases, storage) have technical access to the stored data; it is used only as far as operation, security or troubleshooting require.
Assistant: Where the AI assistant is available (currently to the platform's administrators only), it also looks up your documents to answer your questions – only your private documents and the company documents you can see anyway. For the answer, your question and the passages found are sent to the Azure OpenAI Service. The answer may quote details from your documents verbatim and is stored like any conversation (section 9); if you share a conversation, the other person reads it too. A conversation is kept until you delete it and is removed for good 30 days later – whether or not the document still exists.
Counts: Per account and company we count the pages read and the units processed by the AI (tokens), to enforce limits and allocate costs. Our logs contain identifiers and numbers for this, no content, titles or file names.
Legal basis: performance of the contract (b) with the account using the document storage, for company documents with the company; for third-party details in a document, the legitimate interest in orderly record-keeping (f). Documents may contain special categories of personal data, such as health data. We process them only because you upload such documents yourself and on your own initiative; this constitutes your explicit consent (Art. 9(2)(a) GDPR). You can withdraw it at any time by deleting the documents. Only upload sensitive data about other people if you are entitled to do so.
Retention: until you delete the document. On deletion it is removed from the search index, its database entries are deleted and its files with all their earlier versions; individual pages can be removed the same way. From then on it can no longer be reached through the application. The storage keeps deleted files recoverable for 7 more days, after which they are gone for good; the database backups (restore window 7 days) no longer contain deleted entries after 14 days at the latest. If your account is deleted, your private documents and your own categories are deleted in the same way; company documents belong to the company and remain there.
11. Cookies and local storage
Details can be found on the cookies page.
12. Recipients and processors
- Microsoft (Azure App Service, Azure SQL, Azure Database for PostgreSQL, Blob Storage, Azure Container Apps, Azure Communication Services) – hosting, databases, media and documents, text recognition and e-mail delivery, EU data centres
- Microsoft Azure OpenAI Service – processing of input to AI-assisted features (Sweden, EU)
Data is neither passed on for advertising purposes nor sold.
13. Your rights
You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20) and objection (Art. 21). Consent given may be withdrawn at any time with effect for the future. A message to alexander@mahevi.solutions is sufficient.
You have the right to lodge a complaint with the Austrian Data Protection Authority, Barichgasse 40-42, 1030 Vienna, dsb.gv.at.
14. Changes
This policy is updated when the processing changes. The version published on this page is the authoritative one.
Last updated: October 2026