Version: 5 October 2026
Privacy Policy
The following also apply to the processing of operational content Notes on company data, email and AI. Confirmation during registration records that you have read these notices. It is not blanket consent to additional processing and does not replace any required data processing agreement.
1. Data controller
Frey & Graf GmbH und Co. KG, Am Wasserturm 14b, 85131 Pollenfeld / Preith, email info@sc-v.de, telephone +49 8421 900637.
2. Accessing the website
When accessed, technically necessary connection data such as IP address, time, requested page, browser ID and server status are processed. This serves to ensure secure and stable operation based on Art. 6 Para. 1 lit. f GDPR. Security logs are only stored for as long as they are necessary for operation, error analysis and protection against misuse.
3. Company access and email verification
In the case of an access request, we process the company name, contact person, business email address, business address, country, team size, tariff, payment frequency and payment method as well as, if necessary, different invoice email, VAT ID number, order reference, telephone number and message. The processing serves to process the request, pre-contractual measures and implementation of the contract in accordance with Art. 6 Para. 1 lit. b GDPR. For contact persons of a company and to prevent misuse, we rely on Art. 6 Para. 1 lit. f GDPR; Our interest is reliable business communication and a secure service. Legally required billing and storage processing is carried out in accordance with Article 6 (1) (c) GDPR.
The mandatory information is required to set up company access; without it the registration cannot be completed. Information marked as optional is voluntary. To document the information, we save the confirmed version including document and confirmation texts, the time and the assignment to the request or to the company and administrator when the request is made and activated. This serves to provide evidence of information and to clarify disputes in accordance with Article 6 Paragraph 1 Letter f of the GDPR. The access request also contains the IP address and browser identifier to prevent misuse. Acknowledgment does not constitute consent to advertising.
To confirm, we will send a time-limited, one-time link and a six-digit code to the address provided. After successful confirmation, a unique company area will be created automatically. The requesting person then sets a password for the automatically assigned administrator account.
4. User account and client assignment
The account is assigned to a unique company. We process company ID, username, work email address, roles, permissions, password verification value, sessions and security-related events. Passwords are not stored in plain text. The processing is necessary to provide and secure the service.
5. Emailing
System emails are sent via verified SMTP access. The recipient address, subject, content, delivery status and technical shipping data are transmitted to the email provider used. The shipping is used to verify, set up and secure the account.
6. Recipients and processors
Data is received by authorized persons for setup, operation, support and system security as well as technical service providers for hosting, database, file storage, backups, email and actively used integrations. The existing AI connection uses the OpenAI API; in an AI/OCR process, the required content can be delivered to the configured service. Details on company data and possible third country transfers can be found in the additional information. The service provider, contract and protective measures status applicable to your use must be clarified before productive use; contact person is info@sc-v.de.
7. Storage period
The Service provider overview, Protective measures and Retention and deletion instructions explain the actual operation and distinguish proven settings from contractual or deletion commitments that have not yet been proven.
Inquiries and account details are stored for processing, the contractual relationship and necessary evidence. The processing status, legal retention obligations and, if necessary, the clarification or defense of claims are decisive. Data that is no longer required must be deleted as soon as these reasons no longer apply. Confirmatory evidence follows the associated inquiry or contractual relationship; they are not used for advertising purposes. One-time links are time-limited and invalid once used; their expiry does not automatically mean the deletion of the entire query data set. The agreed storage and deletion regulations apply to operational content and backups.
8. Cookies and local storage
We only use technically necessary session cookies to log in. These are used for authentication and security and are not used for advertising or profile-building analysis.
Local app settings and supported offline caches are used for operation and availability. The Community plan may contain ads in the web interface; Confirmation of the data protection information does not allow additional tracking. External links, for example to YouTube, open an independent service with its data protection information.
Optional YouTube explainer videos
Our video library initially only shows preview images and texts stored locally at Klarvexo. Neither YouTube players nor images, fonts or scripts from Google will be loaded for the videos until you agree. The videos are optional and consent is independent of registration and company access.
Only with “Agree & play” do we load the selected episode via YouTube’s extended data protection mode at youtube-nocookie.com. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google receives in particular your IP address, technical browser and device information, the originating website as well as playback and usage data. Information can be stored or read on your device and assigned to your account if you are already logged in to Google. Processing in the USA and other third countries is possible. The extended data protection mode does not mean that no data will be transmitted to Google.
The basis for voluntary integration is your consent in accordance with Article 6 Paragraph 1 Letter a of the GDPR and, insofar as information is stored or read in the end device, Section 25 Paragraph 1 TDDDG. The selection only applies to the currently selected episode and is not permanently saved by Klarvexo. Using “Unload video & withdraw consent”, changing the episode or reloading the page will remove the player; Further access by this player will then be terminated. Data that has already been transmitted cannot be retrieved and storage content set by YouTube cannot be deleted by Klarvexo. Details about Google's own processing, storage period and transmission mechanisms can be found in the Google’s privacy policy. Alternatively, you can consciously access the videos via an external YouTube link.
9. Native Klarvexo app for iOS and Android
The native app processes company ID, username, password and a protected session to log in. For the functions provided, the required project, task, deployment, calendar, time and warehouse data are transferred between the app and the Klarvexo server. Entries such as time bookings, appointment information, task status, project answers and scanned material codes are assigned to the logged in company account and user.
If you have mail authorization, the app processes the business mailboxes including mailbox address, sender and recipient addresses, display names, subject, text and HTML content, signature, folders, reading and editing status as well as attachments. When composing, replying and forwarding, To, Cc and Bcc addresses, subject, content, signature and deliberately selected files are transferred to Klarvexo and processed in the business email process. Embedded and externally linked mail graphics are loaded via the Klarvexo server so that the app does not establish a direct connection from the end device to the image provider; Retrieving an external graphic can technically indicate to the respective image provider that the resource has been retrieved. Mail AI tools only process the mail content required for summary, response suggestion, reformulation, project or invoice verification after a corresponding user action via the same centrally configured company integration as the web app.
In the company's internal direct and group chat, user and display names, business email addresses of the selectable members, channel memberships, group name, presence status, messages, replies, editing times, reading status, personal archive and deliberately selected attachments are processed. Mail, chat and attachment access is subject to the same server-side company, user, mailbox and channel rights as in the web app.
The global search transfers search terms of two characters or more to the Klarvexo server as part of the requested URL and only searches the projects, tasks, emails, documents and materials shared with the logged in user. The upstream web server logs the complete requested URI including this search parameter for operation, error analysis and protection against misuse. Roll archive files are configured for 720 hours; the active file is rotated depending on its size. This does not guarantee that every single search term will be deleted after exactly 720 hours. Details are in the Storage and deletion instructions.
For entertainment receipts, the camera can capture a restaurant bill or proof of payment or tip. The recorded pages are merged into a PDF in the app and then transferred to Klarvexo together with the project, restaurant and service recipient address, billing and tax information, payment method, amounts, reason, participant names and other entries. Alternatively, the user can specifically adopt a photo, image or PDF via the system selection; The app only receives the deliberately selected file. Original and payment documents are stored in the protected Klarvexo document archive and may be retained even after a draft is removed due to operational or legal verification requirements. After accepting an original restaurant bill, the OCR/AI evaluation for pre-assignment starts; The centrally configured integration processes the document or the content read from it. The user can initiate a failed analysis again for the document that has already been saved.
General working day expenses contain the amount, currency, note, reason for correction or cancellation and optionally a deliberately selected receipt image. This information is assigned to the working day and user and transferred to Klarvexo. If there is temporarily no connection, only the processes that are expressly marked as offline-capable in the respective app can be reserved until they are transferred. Such queues are tied to server, company and user, limited in quantity and time, excluded from device backups and are removed after successful transfer. On iOS they are with full iOS file protection, on Android they are in the encrypted app storage.
The app stores session keys and local personal overviews in the operating system's protected app storage. For push notifications on supported platforms, an app-related device identifier and the respective push token are assigned to the user account; the freely named device name is not transferred. As with any server connection, the IP address is required for operation and protection against misuse and can enable a rough location assignment. The app uses no advertising and no cross-device tracking. For barcode, material and set scans, camera images on iPhone and iPad are only continuously evaluated on the device and are not saved or transferred as photos; Supported Android stock devices only pass the detected code via their protected scanner service; this does not apply to the document scans expressly described above.
Optional Android document scanner: Starting with Android trial version 0.6.0 (Build 18), Google ML Kit can detect document edges and create multi-page PDFs via Google Play Services. The image processing takes place on the device. Google receives technical device/app information, identifiers as well as usage and performance diagnostics; Scanner modules can be reloaded from Google. Details are in Google's ML Kit data notes and the ML Kit Privacy Policy. The app alternatively offers a manual camera and file import without this scanner. Only when the transfer is explicitly triggered is the checked document transferred to the Klarvexo server; A desired document analysis is then carried out via the configured company integration.
10. Deletion of an App User Account
Users can delete their personal access directly in the app More > Account & Privacy initiate and confirm after entering the password again. Alternatively, the deletion can be done without the app installed klarvexo.de/konto-loeschen be requested. Active sessions, push associations, team memberships, personal shares and filters are removed, and master data are anonymised. Project, task, time, transaction, communication and audit histories may be retained where required for operational records or statutory retention obligations; they remain associated with a deleted user, without the former name. The last active company administrator must appoint another administrator before deleting their own account.
11. Rights of Data Subjects
You have rights to information, correction, deletion, restriction, data portability and objection within the legal framework. Consent can be revoked with effect for the future. You send inquiries info@sc-v.de.
12. Right to complain
You can complain to a data protection supervisory authority. The Bayerische Landesamt für Datenschutzaufsicht, Promenade 18, 91522 Ansbach is regularly responsible for non-public positions in Bavaria.
13. Security and Changes
We use appropriate technical and organizational measures, including client separation, role-based rights, encrypted transmission, time-limited one-time links and logging of security-related processes. This declaration will be adjusted if the product, service provider or legal situation changes.
14. Operational Content and Automated Suggestions
For project, task, customer, personnel, warehouse, calendar, document, chat, email and billing data, each company decides on purposes and permissions. Where we process these data on its behalf, the separate data processing agreement applies. We act as the data controller ourselves for setting up and billing the Klarvexo contract.
Email content and attachments can be incorporated into separate projects, tasks, documents and commercial drafts. AI/OCR results are suggestions and must be checked before professional decisions are made. This acknowledgement does not authorise any decision with legal or similarly significant effects to be made solely by AI. Details on access, further processing and sharing are available under Company data, email and AI.
15. Optional website performance measurement
Only with voluntary consent do we measure product pages, trial, contact and tutorial clicks, form steps and their association with a later verified registration or activated company on our own server. The legal bases are Article 6(1)(a) GDPR and Section 25(1) TDDDG. We store only permitted source and campaign codes, page categories, events, timestamps and a random visit code. We do not store form contents, full referrer addresses, IP addresses or browser identifiers in the measurement database. Technical security logs remain separate.
Your choice is stored in the browser for 180 days. A visit code lasts at most 24 hours; a new session starts after 30 minutes of inactivity. Measurement data and registration associations are deleted after 90 days. Consent can be withdrawn at any time without disadvantage through “Measurement & privacy”. This stops measurement and deletes data still linked to the current visit code; necessary registration and contract data remains. The website works fully without consent. There are no advertising pixels, sale of measurement data or cross-device profiles.