Privacy Policy

1. Scope

Necesso is a product of CONCEPTS Gabriela Prett-Preza KG. This privacy policy applies to all personal data we process within our company and to data processed by companies we have engaged (processors). Personal data means information within the meaning of Art. 4(1) GDPR, for example a person’s name, e-mail address and postal address.

This policy covers:

• all online presences, in particular the website necesso.ai
• the Necesso platform (web application) for trade businesses, including AI assistants, WhatsApp integration, telephony features and bank connection
• the Necesso mobile apps for iOS and Android
• social media presences and e-mail communication

2. Legal bases

We process data on the basis of the General Data Protection Regulation, Regulation (EU) 2016/679 of 27 April 2016, available on EUR-Lex.

We only process your data if at least one of these conditions applies:

• Consent (Art. 6(1)(a) GDPR): you have given consent, for example to the recording of a call or to loading external fonts.
• Contract (Art. 6(1)(b) GDPR): processing is necessary to perform a contract or pre-contractual measures, for example to provide the Necesso platform.
• Legal obligation (Art. 6(1)(c) GDPR): for example the statutory retention of invoices.
• Legitimate interests (Art. 6(1)(f) GDPR): for example the secure and efficient operation of our website and platform.

Other legal bases (public interest, vital interests) do not usually apply to us. If they do, we state this in the relevant section.

National laws also apply: in Austria the Data Protection Act (DSG), in Germany the Federal Data Protection Act (BDSG).

3. Controller and our role

The controller within the meaning of Art. 4(7) GDPR is:

CONCEPTS Gabriela Prett-Preza KG (provider of Necesso)
Illekgasse 8/16, 1150 Vienna, Austria
Company register number: FN 462437f, Commercial Court of Vienna
Phone: +43 676 972 9492
E-mail: office@necesso.ai
Authorised representative: Manolo D. Preza
Legal notice: necesso.ai/en/impressum

Two roles: We are the controller for the website, your user account, contract handling and communication with us. When a trade business uses the Necesso platform to process data of its own customers (for example WhatsApp messages, calls, jobs, account transactions), the trade business is the controller. We then process this data as a processor under Art. 28 GDPR, based on a data processing agreement (DPA). In this case, data subjects should first contact the respective trade business; we support it in responding.

Staff classification: Ranks and ratings of a customer company’s employees are personal data. They are visible only to owners and managers of that company. The company is the controller and Necesso acts as processor.

4. Retention period

• A company's business data: for the term of the contract; then deleted as described in the data processing agreement.
• Invoices and other accounting records: seven years (§ 132 BAO). They remain after a person's erasure and then show a neutral label; they can still allow the person to be identified and are kept only for that period.
• Issued documents are kept as they were issued.
• Erasure of a person: a person with full rights in the company can erase a customer or a former employee; the data is deleted, or identifying details are replaced by a neutral label where records must be kept. An employee's absences (including sick leave), sessions, preferences, chat history and craftsman classification are deleted with it. Every person can also delete their own account (see “Deleting your account in the app”); a company whose deletion was requested is deleted within 30 days.
• The privacy gateway's register of known values (encrypted): values taken from the company's records — as long as those records; values the gateway found only in free text (for example in an e-mail) — until a person's erasure finds them; an old or differently spelled value may remain. Placeholders themselves are valid only for one request.
• The gateway's privacy evidence (no values): [period to be set].
• Call recordings: the audio file is deleted 14 days after its transcript exists; WhatsApp voice messages and job audio: 7 days after. The transcripts stay with no end date (they are the record). A recording without a transcript is kept until it is deleted. Call recordings are deleted at Twilio immediately after being fetched.
• Recordings in our internal backups: a recording deleted from the program remains in our internal backups — the nightly copies of the database and the files on a separate storage at Hetzner in Germany and in a second copy at Scaleway in Paris (France), kept with no end date. They are not encrypted by Necesso beyond the access controls of those storages (Scaleway stores the second copy encrypted), are never shown to customers or users, and are used only to restore the service after a failure; after a restore the deletion runs again.
• Job videos: with the job (business data).
• Search analytics: 12 months, then deleted automatically.
• Support chat history: kept until it is deleted (no automatic deletion).
• Server logs: 30 days.
• E-mail suppression list (undeliverable or rejected addresses): without a time limit; an entry is never deleted, only released again by the Necesso team.
• Mistral AI (the assistant, the help chat, receipts, spoken input including the recordings Voxtral turns into text) keeps inputs and outputs for the time needed to answer and then 30 days to monitor abuse, unless zero data retention has been agreed (Mistral's privacy policy, legal.mistral.ai, as of October 2026); it does not train on them (Mistral's commercial terms §4.2).
• Voice recordings (dictation, "speak instead of fill in", the voice assistant): not stored by us.
• Login sessions: end after 14 days, with "stay signed in" after a year without use.
• Backups: nightly backups of the database and the files are kept for 14 days on the server and without a time limit on the backup storage (Hetzner Storage Box, Germany), with a second copy at another provider (Scaleway Object Storage, Paris, France) — locked against change and deletion, also without a time limit. Every backup is encrypted by us before it leaves the server (AES-256, with a key kept separately from the backups), so neither storage provider can read it. A backup cannot be edited, so data erased in the program remains in backups taken before the erasure. Backups are only read to restore the service; every erasure is recorded in an erasure log (which person's internal id, when — never the erased data), and after any restore every recorded erasure is applied again before the service is used.
• Your rights of access and portability: the company can download a complete export of everything stored about you (one ZIP file with every record and file linked to you) and hand it to you.

5. Your rights under the GDPR

You have the following rights:

• Access (Art. 15): whether and which data we process, for what purpose, who receives it, how long we store it, where it comes from and whether profiling takes place
• Rectification (Art. 16) of inaccurate data
• Erasure (Art. 17)
• Restriction of processing (Art. 18)
• Data portability (Art. 20) in a common format
• Objection (Art. 21) to processing based on legitimate interests, and at any time to direct marketing and profiling
• No solely automated decisions (Art. 22): our AI assistants produce suggestions; decisions with legal effect are always made by a person
• Withdrawal of consent at any time with effect for the future
• Complaint (Art. 77) to a supervisory authority

The competent authority is the Austrian Data Protection Authority, Barichgasse 40–42, 1030 Vienna, www.dsb.gv.at. In Germany, the data protection authority of the respective federal state is competent; information is available from the Federal Commissioner for Data Protection and Freedom of Information (BfDI).

6. Data transfers to third countries

We transfer personal data outside the EU and EEA only under the applicable requirements of Art. 44 et seq. GDPR. Depending on the provider, the following lawful transfer mechanisms may apply:

• Adequacy decision: the recipient actively participates in the EU-US Data Privacy Framework (DPF). You can check the status at dataprivacyframework.gov.
• Standard Contractual Clauses (SCCs) of the European Commission under Art. 46(2)(c) GDPR, if the recipient does not participate in the DPF.

Transfers outside the EEA: Four safeguards apply to transfers to Anthropic:

1. The data is encrypted in transit (TLS 1.2 or higher) and at rest.
2. Direct identifiers have been removed or replaced by placeholders beforehand, in particular names, telephone numbers, e-mail addresses, postal addresses, account numbers and audio recordings.
3. The key that links placeholders to the real data remains exclusively in the EU and is never transmitted.
4. There is a legal basis under Art. 44 et seq. GDPR: an adequacy decision (including the EU-US Data Privacy Framework) or the EU Standard Contractual Clauses.

These technical measures reflect the documented architecture. For certain features, Mistral also receives personal data through its EU endpoint. Once Twilio calls or SMS are activated, phone numbers, call times and SMS content may be processed in the USA under Twilio’s DPA and the EU Standard Contractual Clauses. Meta’s terms apply to WhatsApp (section 10).

The necesso.ai website is hosted separately from the Necesso platform by Netlify. GoDaddy manages the domain and is not the web host. The platform runs on Hetzner servers in Germany, with additional encrypted offsite backups stored at Scaleway in Paris.

Section 15 lists which providers receive data in third countries.

Important: Pseudonymised information remains personal data. Keeping the re-identification mapping in the EEA reduces risk but does not remove the requirement for a lawful international transfer mechanism under Art. 44 et seq. GDPR. Information about applicable contractual safeguards is available at office@necesso.ai.

Transfers to Anthropic and other recipients outside the EEA are subject to an applicable transfer mechanism under Art. 44 et seq. GDPR. The safeguards depend on the relevant provider agreements. Pseudonymisation alone is not a transfer mechanism.

7. Security of processing

We apply technical and organisational measures under Articles 25 and 32 GDPR. The supplied technical documents describe TLS for external connections, role-based access and database tenant segregation, AES-256 encryption of selected stored secrets, and AES-256 encryption by Necesso of nightly backup files before transfer to Hetzner Storage Box and Scaleway. Encryption keys for those secrets and backups are managed separately from the encrypted data.

Backups remain on the server for 14 days and, under the current documentation, without a fixed expiry in offsite storage. They may contain data already erased from the live service. Erasures are re-applied after restoration, but the retention limit for historical copies still requires legal and technical resolution.

The privacy gateway limits the fields transmitted to Anthropic and pseudonymises detected details, but cannot reliably recognise every personal detail. Privileged server operators technically have database access. Operator-managed full-disk encryption and end-to-end encryption of all content are not promised. See Data security for further details.

8. Communication with us

When you contact us by phone, e-mail or online form, we process your data to handle your enquiry and the related business transaction. The data is stored for as long as the matter is ongoing or the law requires.

• Phone: call data is stored in pseudonymised form on the device and at the telecommunications provider. Name and phone number may be forwarded by e-mail to answer the enquiry. We do not record calls with us.
• E-mail: data is stored on the device and on the e-mail server.
• Website contact and account deletion form: Contact links open your e-mail application. The account deletion form prepares the message draft entirely in your browser; form entries are not transmitted to a website server. We receive your request only when you send the e-mail yourself.

The data is deleted once the matter is concluded and no statutory retention obligation applies.

Legal bases: Art. 6(1)(a) GDPR (consent), (b) (contract or pre-contractual measures, e.g. a quote) and (f) (legitimate interest in professional business communication).

Email providers: Outgoing email is sent through Scaleway in France (recipient, name, subject, message and attachments). Incoming email uses Migadu mailboxes in the EEA or Switzerland, with OVHcloud infrastructure in France and the Netherlands.

9. AI assistants (Mistral and Anthropic)

Necesso uses AI models from two providers. Their results are proposals: the assistant changes nothing unless you confirm it; drafts (quotes, dunning letters, replies to e-mails) are reviewed and sent by people.

Mistral AI (processing in the EU). For companies in the EU, the following helpers run on Mistral AI's EU endpoint (api.eu.mistral.ai, fixed in the program code). For the in-app assistant the provider is a server setting, which we keep on Mistral; were it ever switched to Anthropic, the assistant's requests would pass the privacy gateway like the other automatic steps:

• the in-app assistant (questions and the business data it reads to answer; in its help mode only the question and the product's own help articles);
• reading a shop receipt a technician photographs on a job (the photo and what was read from it);
• the AI search line in the article catalogue (the typed sentence, the company's supplier names and trade codes — never an article, never a price);
• spoken input: the recording, which Voxtral turns into text, and the text, to understand it (see "Voice on site");
• marking names and addresses for the privacy gateway (below).

Every automatic AI step — at Mistral and at Anthropic — receives only the fields it needs for its task (for example a dunning draft gets the invoice number, amounts and dates, not the customer's whole record).

Under Mistral's terms, account configuration, keys, billing, access management and usage statistics may be processed outside the EU. The correct statement is therefore processing in the EU — not that all data stays in the EU.

Anthropic (USA) — only pseudonymised, through the privacy gateway. The other automatic steps run at Anthropic, a US company, on its global endpoint: sorting e-mail and drafting replies, insurance claim reports, quote and dunning drafts, dispatch proposals and report summaries. For a company in the EU every such request first passes through our privacy gateway, which runs on our own servers in the EU:

1. It looks for names of customers, staff, suppliers and contact persons, company names, addresses, phone numbers, e-mail addresses, IBANs, licence plates and tax/VAT numbers — from the company's records (for a request made by a person, the records that person is allowed to see) and by fixed patterns; in addition Mistral (EU endpoint) marks names and addresses in free text.
2. It replaces each finding with a placeholder such as [CUSTOMER_12] or [PHONE_2]. A placeholder is valid only for this one request: the link between a placeholder and its value exists only in our server's memory while the request runs and never leaves the EU. Values from the company's records that the gateway recognises are kept encrypted in our database in the EU; for a request made by a person, other findings get only a temporary reference for that one request.
3. It checks the text once more before sending. If it still finds a known value, nothing is sent; a person at the company sees the task on the "Approvals" page.
4. The answer is re-identified in the EU: only the placeholders issued for this request are replaced — and, for a request made by a person, only with values from records that person may still see at that moment. Anything else stays a placeholder; something that merely looks like a placeholder (for example one typed into a message) is never filled in.

Anthropic therefore receives the work content with placeholders instead of those details. This is pseudonymised data, not anonymous data: details that identify a person without a name (an unusual damage description, or a date and place together) are not recognised by the gateway. Transfer mechanism: Transfers outside the EEA are subject to the applicable legal basis and safeguards under Art. 44 et seq. GDPR.

When the check fails or is incomplete. If Mistral's marking is unavailable, too slow, returns an unclear result or reports itself incomplete, or the gateway cannot complete its check for another reason, the request is not sent to Anthropic; it waits for a person at the company on the "Approvals" page. Such cases are counted monthly and reported to our operations. (While the in-app assistant runs on Mistral in the EU, as configured today, its requests do not pass the gateway at all.)

Limits of recognition. The gateway recognises what is in the company's records and what its fixed patterns describe; Mistral additionally marks names and addresses. A name or detail that none of these recognises — an unusual nickname or spelling, or a description that identifies a person without a name — can reach Anthropic as written; the gateway cannot detect that it missed it.

Evidence. Before any request is sent to Anthropic we record that it is about to be sent; if that record cannot be written, nothing is sent. After the request we record its outcome (sent, handled in the EU, refused or provider error). Both records hold company, step, provider, number of placeholders per type and times — never a name or any other value. A request without an outcome record (for example after a server crash) counts as having an unknown outcome. The company can view and download this evidence per month on its "Protokoll" page.

Companies in the USA. A company established in the USA has its requests sent to Anthropic without the gateway.

10. WhatsApp messages

From activation — when a company connects its own WhatsApp number to Necesso (through the WhatsApp Business Platform of Meta Platforms Ireland Ltd) — Meta delivers the messages customers send to that number to Necesso and sends the company's replies. Meta and Necesso process: texts, photos, documents, voice notes, phone numbers and names, and the approved message templates. Meta processes WhatsApp traffic under its own terms; the number remains the company's. The company's access token is stored encrypted with us. Voice notes are turned into text on our own server. An EU company's WhatsApp texts are never sent to Anthropic.

11. Call recording and transcription

From activation — when a company switches on a phone number in Necesso (through Twilio Ireland Ltd, region IE1, Ireland) — calls to that number work as follows:

• Announcement: at the start of every call the caller hears an announcement. The default text is "This call will be transcribed." (in German: "Dieses Gespräch wird transkribiert."); the company can set its own text.
• The call is forwarded to the company's phone and recorded.
• The recording is fetched into our file store and deleted at Twilio immediately after.
• The transcript is made on our own server (faster-whisper) — no AI provider receives the recording. An EU company's transcript never goes to Anthropic.
• The audio file is deleted 14 days after its transcript exists; the transcript stays with the case. A recording that could not be transcribed has no transcript and is kept until it is deleted. Copies in our internal backups remain (see "Retention").

SMS to that number land in the company's inbox; the office can send SMS from the number. Twilio processes the phone numbers and SMS texts in region IE1.

12. Bank connection

From activation — when a company connects its own business account (account information service under PSD2 through Enable Banking Oy, Espoo, Finland — a licensed provider, FIN-FSA) — a person at the company signs in at their bank and gives consent. Enable Banking reads the account's transactions and passes them to Necesso: IBAN and balance, and per transaction the payer's name and IBAN, the amount and the reference text — which is also personal data of the company's customers. Enable Banking states that it stores no account data; the transactions are kept in our database in Germany. The consent session is stored encrypted with us. Without a connection a company can upload statement files; no provider is involved in that.

13. Payments, accounting and wholesalers

These providers are used only from activation — when a company switches them on for itself and connects them:

• Online payments with Stripe (Stripe Payments Europe Ltd., Ireland) and Adyen (Adyen N.V., the Netherlands): the company's customers pay an invoice on the provider's payment page (hosted checkout). Necesso never sees or stores card data. Necesso stores the payment status, the amounts, the fees and the payouts to the company.
• Bank connection through Enable Banking (Enable Banking Oy, Finland): read-only access to the account transactions — amount, date, reference, the payer's name and IBAN (see "Bank connection").
• Accounting exports for DATEV, BMD and Lexware Office: the company's own data goes to its own tax adviser or into its own account with that provider. The company chooses these recipients itself; they are not processors of Necesso.
• Wholesaler connections through Open Masterdata and IDS Connect: article data (master data, prices) comes from the company's wholesaler, and orders go to it. The company chooses its wholesaler itself; the wholesaler is not a processor of Necesso.

14. Receipt reading

When a technician photographs a shop receipt on a job, the photo is stored once in our file store. It is read by Mistral AI on the EU endpoint — in two steps: first the photo is read as text, then the fields are filled from the text alone. The photo goes to no other provider; if Mistral is unavailable, the receipt is typed in by hand.

15. Voice on site

Dictation, "speak instead of fill in" and the voice assistant record in the browser; the microphone is used only when you tap it. The recording goes to our server and from there to Mistral AI's Voxtral — for a company in the EU always to Mistral's EU endpoint. Voxtral recognises the spoken language and turns the recording into text. For German, English, Hungarian and Turkish (the setting on our servers) we use Voxtral's text; in any other language our own server writes the text (faster-whisper, no provider), as it does when Voxtral does not answer. We do not store the recording — no file, no record, no log of the words. A recording made without signal waits on the phone and is deleted there once its text has come back. The browser's or phone's built-in speech recognition (which would send audio to Google or Apple) is never used. The assistant's spoken answers are produced on our server (Piper). For an EU company the transcribed text goes to Mistral's EU endpoint to structure a spoken report or understand a question. Calls, WhatsApp voice messages and audio on a job never go to Voxtral; only our own server turns them into text. Text from spoken input — dictation, voice messages, call transcripts — and WhatsApp texts keep this origin in the records Necesso creates from them (the assistant conversation, job notes, spoken reports, the job and the documents and messages linked to it): such text is processed by AI only in the EU (Mistral) and never sent to Anthropic. Text a person copies by hand into another field, and records created before this protection was introduced, do not carry this origin.

AI correction of a dictation. A dictated text for a note or a site visit goes, with the job's words (customer name, work address, articles), to Mistral's EU endpoint, which fixes misheard words and grammar. The result is a suggestion: every changed word is shown, numbers are never changed but asked; only what the technician accepts is saved. Mistral receives no recording for this.

16. Route planning

Only when a company switches route planning on (it starts off for a customer company), the addresses of the day's jobs and of the office go to OpenRouteService (HeiGIT gGmbH, Heidelberg, Germany) to compute coordinates and driving times — no names. Necesso does not determine any device's location.

17. Video and audio on a job

A technician or the office can record a video (with the phone's camera, 720p, up to 5 minutes) or an audio note on a job, or upload video files (MP4, MOV, WebM — up to 500 MB and 5 minutes) and audio files (M4A/AAC, MP3, WAV, OGG/Opus, WebM, 3GP, AMR, FLAC, CAF, AIFF — up to 200 MB). The files are stored in our file store in Germany with the job and included in the nightly backup. Audio is transcribed on our own server (faster-whisper, no AI provider); the transcript stays with the job, and the audio file is deleted 7 days after its transcript exists (the same rule applies to WhatsApp voice messages; call recordings after 14 days). Videos stay with the job like photos. A video or recording can show or contain people — the person recording is responsible for having a reason to record them.

18. Necesso search analytics

To learn what our users look for, Necesso keeps, for each search in the search bar and each question to the assistant: the company, the user, the time, the kind (search or question), and the text with names removed — before anything is stored, our privacy gateway's rules replace every name, address, phone number, e-mail address, IBAN, licence plate and tax number that the company's records or our patterns recognise with a placeholder such as [CUSTOMER_1]; the original text is never stored, and no list exists that could turn a placeholder back into a name. If a known value is still found, the text is not kept at all. A name that appears in no record and matches no pattern can remain in the text; values entered in the last few minutes may not yet be recognised. This is product analytics only: no third party receives it (no analytics provider, no AI provider), no crash or performance tracking takes place, and it is visible only to the Necesso team — as aggregated figures, with user identities hashed — never to the customer companies. The entries are deleted automatically after 12 months, and with a person's erasure. Legal basis: our legitimate interest in improving the product (Art. 6(1)(f) GDPR).

19. Support

Behind the login, "Support" opens our support page, the help chat (answers questions about every function; it runs on Mistral's EU endpoint and receives only the question and the program's own help articles — no company data) and, if you need a person, the way to call, write on WhatsApp or e-mail Necesso support. Support chat history is kept until it is deleted (Manolo's ruling): a user can remove a conversation from their list, and it is deleted with the person's erasure; it is not deleted automatically.

20. Server logs and your browser

Server logs (the program's technical messages: which address was requested, when, with what result, and errors — no passwords, no request contents, and no names, e-mail addresses, phone numbers or other personal details) are kept for 30 days. Since our servers sit behind our own proxy, the logs carry the proxy's internal address, not your IP address. The login security log (sign-ins, failed sign-ins, two-factor events) is part of the company's records and kept with them.

In your browser the program stores: the sign-in cookie necesso_session (HttpOnly; for the browser session, or one year with "stay signed in"); with two-factor login the cookie necesso_device for a remembered device (400 days, renewed on use); the language you chose; whether spoken answers are on; the day the "start your day" note was answered; an unfinished large upload so it can continue; your unsaved entries (drafts) per screen, so nothing is lost — deleted once saved or after 30 days, and at sign-out unless you chose "stay signed in"; while a two-factor code is being entered, its ticket (until the tab closes); dictation recordings made without signal (deleted as soon as their text came back, and at sign-out — the app first sends what is still waiting and tells you before it deletes a dictation that has not reached its field; a recording is only ever sent for the person who made it); and a short-term cache of recently viewed data and images for offline use (one day / seven days, cleared at sign-out); the cookie necesso_kd, which recognises a device you have signed in on before and is used only for login protection (180 days; on a shared device for at most five accounts). With a passkey (fingerprint, face or device unlock) the private key stays on your device; Necesso stores the public key, the key's id, the browser and system it was set up on and when it was last used. No advertising or tracking cookies are used.

Sign-in protection. After repeated wrong passwords, sign-in to an account is paused for a short time (never permanently) and the account holder receives an e-mail. When a password is chosen through an invitation or reset link, we check whether it appears in known data leaks: only the first five characters of a hash of the password are sent to the "Have I Been Pwned" service — never the password itself. If the service cannot be reached, the password is accepted.

21. Account deletion

Every person with a Necesso account — owners and invited employees alike — can delete their own account: in the profile under “Delete my account”, confirmed with the password (and the second step when two-factor login is on). Without signing in, use necesso.ai/konto-loeschen.

• At once: the person is signed out on every device; their sign-in, name, email address, password, settings, assistant conversations, absences and classification are deleted, or replaced by a neutral label — within 30 days at the latest.
• Stays with the company: invoices and other records the company must keep by law (in Austria seven years, § 132 BAO), and recorded working hours and reports — they then show a neutral label instead of the name. Such records can still allow the person to be identified (for example through issued documents) and are kept only as long as the law requires.
• Confirmation: an email to the deleted account's address; once it is delivered, that address is deleted from our sending log too.
• Evidence: every deletion is logged without content (which internal id, which kind, when) and runs again after any restore of a backup.
• The last person with full rights in a company first hands the company over to another person, or requests the deletion of the whole company: after the export of all company data the request is recorded, confirmed by email and carried out by the Necesso team within 30 days; until then it can be withdrawn in the profile. A company is never deleted at once by a button.

22. Sending email

Necesso sends e-mail through Scaleway (Paris, France): documents as PDF, invitations, password resets, login codes and the messages a company sends to its customers and suppliers. Test and demo companies never send mail to invented addresses: nothing is sent to reserved test addresses (such as .invalid, .example, .test) for any company, and a test or demo company sends only to addresses Necesso has explicitly allowed (its own team's). When the provider reports an e-mail as permanently undeliverable, rejected or marked as spam, the address goes on a suppression list: nothing more is sent to it until the Necesso team releases it again.

23. Hosting and server locations

The website and platform are hosted separately. The Necesso platform runs on Hetzner servers in Germany. Nightly backups remain on the server for 14 days; offsite copies at Hetzner Storage Box and Scaleway in Paris currently have no fixed expiry and are encrypted by Necesso before transmission. See section 9 for AI and section 6 for third-country transfers.

Platform hosting: Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany. A DPA under Art. 28 GDPR is in place with Hetzner. Necesso also uses Scaleway (Paris) for encrypted offsite backups and outgoing email. AI endpoints and providers are covered separately in section 9.

Website hosting: Netlify, Inc., 512 2nd Street, Suite 200, San Francisco, CA 94107, USA. The website is delivered through Netlify’s globally distributed infrastructure. Processing of website visitor data exclusively within the EU is not guaranteed. GoDaddy provides domain registration and domain management, not website hosting.

Which data: When the website is accessed, Netlify processes technically necessary request data, in particular the IP address, date and time, page accessed, technical browser and operating system details and, where transmitted, the referrer URL. This data is used to deliver the website, diagnose errors and prevent abuse.

Website log retention: Retention depends on the type of log data, the Netlify service used and its retention rules. Relevant criteria are the need to deliver and maintain the stability of the website, diagnose errors, prevent and investigate security incidents, and meet statutory retention and record-keeping obligations. Personal log data must be deleted or anonymised once the relevant purpose no longer applies and there is no lawful basis for further retention. Where Netlify processes data as a controller in its own right, the storage and deletion criteria in its privacy statement apply. The 30-day period for Necesso platform logs does not apply to website logs at Netlify.

Third countries: Global delivery may involve processing website visitor data outside the EU and the EEA, in particular in the USA. Netlify describes the EU-US Data Privacy Framework, where the transfer is covered, and supplementary or alternative EU Standard Contractual Clauses in its data protection terms. Transmission to the website is encrypted (HTTPS).

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in the secure and stable operation of the website). Processing on our behalf is governed by the Netlify data protection terms applicable to the hosting contract, including its Data Processing Agreement.

Primary storage for EU customer businesses is at Hetzner in Germany. The documented architecture calls for a separate US server before onboarding US customer businesses. AI requests to Mistral use the EU endpoint, but certain provider account and billing data may be handled outside the EU.

Platform-backup position (29 October 2026): Nightly database and file backups remain on the server for 14 days. Additional copies on Hetzner Storage Box and Scaleway Paris currently have no expiry date in the documentation. Necesso encrypts each backup itself using AES-256 before it leaves the server, with the key stored separately. The absence of a finite offsite-retention period remains a GDPR issue. The 30-day retention period concerns Necesso platform server logs, not backups.

Further information: Netlify privacy statement; Netlify Data Processing Agreement; Netlify documentation on monitoring and log data.

24. Mobile apps and user account

The Necesso apps for iOS and Android only access features of your device with your permission. You can revoke permission at any time in the device settings.

Customer contacts and app contact: Customer contacts are created and managed exclusively within Necesso. The app does not access your smartphone’s address book or phone contacts and does not require permission to access device contacts. For app enquiries, contact office@necesso.ai.

User account: To use the service, we store name, e-mail address, phone number, company and login data (legal basis: Art. 6(1)(b) GDPR).

Delete account: Individual users can delete their own user accounts directly in the app. Deletion of an entire customer company must be requested in the app; the Necesso team completes the deletion in the active system within 30 days of receiving the request, subject to statutory retention obligations. Alternatively, deletion can be requested through the Delete account website page or by email to office@necesso.ai. Data may remain in internal backups under their separate retention periods.

Apple and Google process their own data when you download and update the apps, in accordance with their privacy policies; we have no influence on this.

Location: The app does not access device location. Photo markup: Annotated copies of photos are stored with the relevant job. Local drafts: Unfinished entries are saved as drafts locally in the browser. Export: Customer companies can export their company data. Staff classification: Ranks and ratings are visible only to owners and managers of the respective customer company (section 3). Calls and SMS: Twilio (Ireland, US company) is used only after activation; it processes phone numbers, call times and SMS content, potentially including processing in the USA under its DPA and EU Standard Contractual Clauses.

Local drafts in the app: Incomplete entries are saved locally in the browser so users can resume interrupted work. They are used solely to restore the entry and are removed after saving or, at the latest, after 30 days. Depending on the sign-in option, they may also be removed on sign-out.

Photo markup and company export: When photographs are marked up or annotated in Necesso, the edited copy is saved with the job. Authorised companies can export their business data from the platform.

More details on account deletion and local storage and security are provided below.

25. Recipients of personal data

Not processors: GitHub, GoDaddy and Microsoft 365 receive no company data. DATEV, BMD, Lexware Office and the wholesalers (Open Masterdata, IDS Connect) are recipients the company chooses itself, not processors of Necesso. Fonts are loaded from our own servers (no Google Fonts). Necesso uses no third-party analytics, crash-reporting or advertising software; its own search analytics are described above.

Website and domain: The marketing site is delivered by Netlify, Inc. (US/global). Netlify Web Analytics processes CDN logs for server-side usage statistics without a browser analytics cookie. GoDaddy manages the domain only. Optional Google Fonts are requested from Google Ireland Ltd. only after consent; otherwise system fonts are used. These website vendors are separate from the Necesso platform's sub-processors.

Technical position as of 29 October 2026: Backup copies are encrypted by Necesso using AES-256 before transmission and protected against modification. Anthropic may still receive personal details that pseudonymisation fails to detect; a request is withheld only when the check explicitly fails or is identified as incomplete. Transfers outside the EEA are subject to the applicable provider agreements and safeguards under Art. 44 et seq. GDPR.

26. Cookies and local storage

Local drafts in the Necesso web app: Unfinished entries are stored locally in the browser as drafts so work can be resumed. This is separate from the marketing website’s cookie choices described below.

Cookies are small files that a website stores in your browser. Optional browser features are switched off on your first visit. We do not use analytics cookies or advertising trackers. Website statistics use server-side Netlify Web Analytics as described below.

Netlify Web Analytics: We analyse website use using server-side CDN access logs at Netlify. No browser analytics script is embedded and no analytics cookie is set for this purpose.

Statistics: These include pageviews, visitor counts, origin regions, pages requested, referring URLs and resources not found. Netlify uses distinct IP addresses to calculate visitor counts. According to Netlify’s documentation, dashboard views cover up to 30 days; this is not a guarantee that all technical or security logs are deleted after 30 days. Section 13 and the retention rules of the relevant service apply to those logs.

Purpose and legal basis: Statistical evaluation, improvement and stable operation of the website under Art. 6(1)(f) GDPR. You may object to this processing on grounds relating to your particular situation; contact: office@necesso.ai. Netlify is the recipient; section 13 covers international processing and contractual safeguards.

Cookie choice: The cookie-banner buttons control only optional browser features for the intro animation and external fonts. They do not disable server-side Netlify statistics. No advertising profiles are created, and no contact data from the Necesso platform is used for these website statistics.

Google Fonts: The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; affiliated company Google LLC, USA. Google receives your IP address and technical request data; processing outside the EU is possible. Without consent, we use system fonts.

Changing settings: You can change or withdraw your consent at any time via “Cookie settings” in the footer. “Necessary only” switches off both optional features. Withdrawal takes effect for the future; data already sent to Google cannot be retrieved. Without JavaScript, optional features remain switched off. You can also delete or block cookies in your browser at any time.

Legal framework: In Austria, Sec. 165(3) TKG 2021 applies; in Germany, § 25 TDDDG.

Technical session data: In addition to local drafts, the Necesso web app may store necessary sign-in data and settings in the browser. This functional storage is separate from the marketing website’s consent preferences. It does not use advertising cookies to manage sign-in and interrupted workflows.

27. Definitions

Where terms are defined by law, the statutory definitions apply.

• Personal data: any information relating to an identified or identifiable natural person, for example by name, identification number, location data, online identifier or specific characteristics (Art. 4(1) GDPR).
• Controller: whoever, alone or jointly with others, determines the purposes and means of processing (Art. 4(7) GDPR).
• Processor: whoever processes personal data on behalf of the controller (Art. 4(8) GDPR).
• Processing: any operation performed on personal data, such as collection, storage, analysis, transfer or erasure (Art. 4(2) GDPR).
• Pseudonymisation: data is altered so that it can no longer be attributed to a person without additional information kept separately; in our case through placeholders (Art. 4(5) GDPR).
• Third country: any country outside the EU and the EEA.
• Contact data: phone numbers, postal addresses, e-mail addresses and identifiers in messengers or social media.
• Contract data: information on contracting parties, services, prices, payment terms, term and termination.

As of: October 2026. Based on: AdSimple privacy policy generator for Austria, extended for the Necesso platform.