Privacy Policy

Last updated: 7 March 2026
Version: 1.1

The Service is operated by a private individual. This policy is drafted in accordance with the General Data Protection Regulation (GDPR) and applicable European data protection laws.

1. Data Controller

The data controller within the meaning of the General Data Protection Regulation (GDPR) is:

Ali Akbar Rahimi
Steindamm 80
25337 Elmshorn
Germany

Email: privacy@credio.online
General contact: contact@credio.online

Ali Akbar Rahimi operates the Credio Service as a private individual.

For customer accounts created by an owner, the respective owner acts as an independent data controller for the personal data they enter. In this context, Ali Akbar Rahimi processes such data on behalf of the respective owner in accordance with Article 28 GDPR.

2: Supervisory Authority

Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work, or place of the alleged infringement.

The competent supervisory authority for the data controller is:

Unabhängiges Landeszentrum für Datenschutz Schleswig-Holstein (ULD)
Holstenstraße 98
24103 Kiel
Germany

Phone: +49 431 988-1200
Email: mail@datenschutzzentrum.de
Website: https://www.datenschutzzentrum.de

3: Categories of Personal Data

The following categories of personal data in connection with the Service are processed:

3.1 Account Identification Data

  • Full name
  • Address
  • Email address
  • Phone number
  • Username
  • Account status information

This data is required to create and manage user accounts.

3.2 Notebook Entry Data

  • Entry amount
  • Entry description
  • Entry type (credit/debit classification within the notebook context)
  • Timestamp of entry

This data is entered by users and stored solely for displaying and organizing personal notebook records.

3.3 Communication Data

  • Chat message content
  • Sender role
  • Message status (sent, delivered, read)
  • Timestamps

Chat data is accessible only to the related account participants.

3.4 Authentication and Security Data

  • Password hashes (passwords are never stored in plain text)
  • Login timestamps
  • Security-related status indicators
  • App lock configuration status
  • Push notification tokens

This data is processed to secure accounts and prevent unauthorized access.

3.5 Technical and Log Data

When users interact with the Service, certain technical metadata may be processed automatically in order to ensure secure system operation and to document security-relevant account actions.

  • IP address
  • User agent information (device and browser information)
  • Device-related connection metadata
  • System and security logs

The IP address and user agent may be recorded specifically when a user submits an account data rectification request (for example when requesting a change of email address, phone number, or address). This information is stored together with the corresponding request record.

The purpose of this processing is to document the origin of account modification requests, detect potential misuse, investigate security incidents, and provide evidence in case of disputes related to account changes.

This processing is limited to what is necessary for secure operation, system integrity, abuse prevention, and dispute resolution.

Render, as hosting provider, may additionally process infrastructure-level logs as a data processor in accordance with its Data Processing Addendum.

3.6 Email Communication Data

When users send or receive emails through the Service, the following data are processed:

  • Email address
  • Email content
  • Message metadata (timestamp, delivery status)

Outgoing emails are processed via Brevo.
Incoming email is handled by Google Workspace.

4: Hosting and Infrastructure Providers

4.1 Hosting and Infrastructure (Render)

Backend application, database, and supporting infrastructure are hosted by Render Services, Inc., United States.

Render provides application hosting, managed database services, and infrastructure-level security monitoring. Production services are deployed in the Frankfurt (Germany) region.

Render acts as a data processor within the meaning of Art. 28 GDPR. A Data Processing Agreement (DPA) has been concluded.

As Render is a U.S.-based provider, personal data may be transferred to the United States. Such transfers are safeguarded by:

  • Certification under the EU–U.S. Data Privacy Framework, and
  • Standard Contractual Clauses (SCCs), where applicable.

Render may engage authorized subprocessors to provide its services. An up-to-date list of subprocessors is available at:

https://render.com/trust

4.2 Push Notifications (Firebase Cloud Messaging)

This application uses Firebase Cloud Messaging (FCM), a service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, to send push notifications.

When the app is installed, a device-specific push token is generated by Firebase. This token is transmitted to the backend server and stored together with the corresponding user ID. The token is used solely to deliver notifications related to the functionality of the application.

No additional personal data is transmitted to Firebase for this purpose beyond what is technically required to deliver push notifications.

The legal basis for this processing is Article 6(1)(b) GDPR (performance of a contract), as push notifications are necessary for the proper operation of the user account within the app.

The push token is deleted when:

  • the user account is deleted, or
  • the token becomes invalid or is replaced.

Users can disable push notifications at any time in the device settings.

4.3 Email Communication (Google Workspace)

Incoming emails to addresses under the domain credio.online (e.g., admin@, privacy@, contact@) are processed using Google Workspace, provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

Google Workspace is used solely for receiving and storing emails sent to the above addresses.

The legal basis for processing email communication is Article 6(1)(b) GDPR (performance of a contract) and Article 6(1)(f) GDPR (legitimate interest in handling inquiries and account-related communication).

Google acts as a data processor within the meaning of Art. 28 GDPR. The Cloud Data Processing Addendum (DPA) has been accepted.

As Google may process data outside the European Union, transfers are safeguarded by:

  • Certification under the EU–U.S. Data Privacy Framework, and
  • Standard Contractual Clauses (SCCs), where applicable.

Emails are retained only as long as necessary to handle the respective request or fulfill legal obligations.

4.4 Transactional Email Delivery (Brevo)

Outgoing transactional emails (e.g., account-related notifications) are sent using Brevo, provided by Sendinblue SAS (Brevo), 106 Boulevard Haussmann, 75008 Paris, France.

Brevo processes recipient email addresses and the content of transactional emails solely for the purpose of delivering such communications.

Brevo acts as a data processor within the meaning of Art. 28 GDPR. A Data Processing Agreement forms part of Brevo’s General Conditions of Use and applies automatically upon account usage.

Data is processed exclusively for the delivery of transactional communication and is not used for marketing purposes.

5: Purposes and Legal Basis of Processing

Personal data is processed solely for the following purposes and on the following legal bases pursuant to Article 6 GDPR:

5.1 Account Creation and Account Management

Personal data is processed to:

  • Create and maintain user accounts
  • Authenticate users
  • Enable secure access to the Service
  • Manage account status

Legal basis:

Article 6(1)(b) GDPR (performance of a contract).

5.2 Provision of Notebook Functionality

Personal data is processed to:

  • Store and display notebook entries
  • Classify entries
  • Provide chronological organization and account-related functionality

Legal basis:

Article 6(1)(b) GDPR (performance of a contract).

5.3 In-App Communication (Chat)

Communication data is processed to:

  • Enable secure messaging between related account participants
  • Display message delivery and read status
  • Maintain conversation history

Legal basis:

Article 6(1)(b) GDPR (performance of a contract).

5.4 Security and Abuse Prevention

Technical and security-related data is processed to:

  • Prevent unauthorized access
  • Detect misuse or abuse
  • Maintain system integrity and availability
  • Log security-relevant events

Legal basis:

Article 6(1)(f) GDPR (legitimate interest).

The legitimate interest consists in ensuring the security, stability, and lawful operation of the Service.

5.5 Push Notifications

Push tokens are processed to:

  • Deliver account-related notifications
  • Ensure timely system communication

Legal basis:

Article 6(1)(b) GDPR (performance of a contract).

Users may disable push notifications at any time via device settings.

5.6 Email Communication

Personal data is processed to:

  • Send transactional emails
  • Respond to user inquiries
  • Provide account-related communication

Legal basis:

Article 6(1)(b) GDPR (performance of a contract)
and
Article 6(1)(f) GDPR (legitimate interest in handling inquiries).

No marketing emails are sent.

6: Data Retention and Storage Periods

Personal data is retained only for as long as necessary to fulfill the purposes of processing or to comply with statutory retention obligations.

6.0 How Users Can Request Account Deletion

Users can request deletion of their account directly within the mobile application.

  • Customers can submit an account deletion request from the application dashboard by opening the menu bar icon at the top and navigating to Security → Request Account Deletion.
  • Customers may only request account deletion if their account balance is zero.
  • Owners can submit an account deletion request from their dashboard by opening the menu bar icon at the top and navigating to Security → Request Account Deletion.
  • Owner account deletion requests are subject to review and approval by a Super Admin.

Once a deletion request is submitted, the account will immediately lose access and the deletion process described below will begin.

6.1 Customer Accounts

Customers may request account deletion only if their account balance is zero.

Once a deletion request is submitted:

  • The customer immediately loses access to the account.
  • The account is marked as “pending deletion”.
  • All personal data and notebook entries remain visible to the respective owner for a grace period of 30 days.

During this 30-day period, no access is possible for the customer.

After expiration of the 30-day grace period:

  • All personal data of the customer is permanently deleted.
  • Notebook entries and accounting-related records are retained only in anonymized form.
  • The customer name is replaced with “anonymized customer” and a technical identifier is retained solely for internal accounting clarity within the owner’s reports and account management.

This anonymized data cannot be used to re-identify the former customer.

6.2 Owner Accounts

Owners may request account deletion only if no active customer accounts exist.

If active customers exist, account deletion is not possible.

Deletion requests are reviewed by a Super Admin.

Upon approval:

  • The owner account is permanently deleted.
  • All associated personal data and notebook data are permanently removed from active systems.
  • Access to the account is irreversibly disabled.

6.3 Technical and Log Data

Technical and security-related metadata may be stored in connection with specific account actions, including account data rectification requests.

Where such requests are submitted, the associated IP address and user agent may be stored together with the request record in order to document the origin of the request and to support investigation of potential disputes or security incidents.

This information is retained only as long as the corresponding request record remains in the system and is automatically deleted when the related account and associated records are permanently removed.

Infrastructure-level logs processed by the hosting provider may be retained separately in accordance with the provider’s internal security policies.

6.4 Push Notification Tokens

Push notification tokens are stored only as long as the corresponding user account is active.

Tokens are deleted when:

  • The user account is deleted
  • The token becomes invalid
  • The token is replaced

6.5 Communication Data (Chat)

Chat messages are stored for the duration of the respective account relationship.

If a customer account enters “pending deletion” status:

  • The customer immediately loses access to the account.
  • Chat messages remain visible to the respective owner during the 30-day grace period.

After expiration of the 30-day grace period:

  • Chat messages associated with the deleted customer account are permanently deleted together with the customer’s personal data.
  • No anonymized version of chat messages is retained.

If an owner account is permanently deleted, all associated chat data is permanently deleted together with the account.

6.6 Email Communication Data

Emails are retained only as long as necessary to:

  • Handle the respective inquiry
  • Fulfill contractual obligations
  • Comply with statutory retention requirements

Where statutory retention obligations apply (e.g., under German commercial or tax law), data will be retained for the legally prescribed period and subsequently deleted.

7: Automated Processing and Decision-Making

Credio uses automated processing for analytical and statistical purposes in connection with account management and financial reporting.

These automated processes are limited to aggregated calculations and internal analytics, including exposure summaries, transaction statistics, and risk concentration metrics.

No automated decision-making within the meaning of Article 22 GDPR takes place.

In particular:

  • No automated decisions are made that produce legal effects concerning users.
  • No automated decisions significantly affect users in a comparable manner.
  • No automated approval, rejection, suspension, restriction, or termination of accounts is carried out.
  • No automated credit scoring or profiling within the meaning of Article 4(4) GDPR is performed.
  • Account-related actions that may affect user rights are subject to human review.

All relevant decisions affecting user accounts require human involvement and are not based solely on automated processing.

8: International Data Transfers

Personal data is processed primarily within the European Union.

Where service providers are established outside the European Union or where data processing may involve access from third countries (in particular the United States), transfers are carried out in accordance with Chapter V GDPR.

Where applicable, transfers are safeguarded by one or more of the following mechanisms

  • Certification under the EU–U.S. Data Privacy Framework (DPF)
  • Standard Contractual Clauses (SCCs) adopted by the European Commission
  • Additional contractual, technical, and organizational safeguards where required

The following providers may involve processing in the United States:

  • Render Services, Inc.
  • Google (including Google Workspace and Firebase services)

Transfers are carried out on the basis of legally recognized transfer mechanisms in accordance with Chapter V GDPR.

Where service providers are established within the European Union (e.g., Brevo, France), processing takes place within the EU unless subprocessors located in third countries are engaged under legally valid safeguards.

No transfers are carried out without an appropriate legal basis under Articles 44–49 GDPR.

9: Technical and Organizational Security Measures

Appropriate technical and organizational measures are implemented in accordance with Article 32 GDPR to ensure a level of security appropriate to the risk.

These measures include in particular:

  • Encryption of data in transit (HTTPS / TLS)
  • Secure password hashing
  • Role-based access control
  • JWT-based authentication
  • Two-factor authentication where applicable
  • Secure token handling
  • Logging of security-relevant events
  • Infrastructure-level security monitoring by the hosting provider
  • Access restriction to administrative interfaces
  • Regular software and security updates

Access to personal data is restricted to what is necessary for the respective processing purpose.

10: Updates to This Privacy Policy

This Privacy Policy may be updated where necessary to reflect:

  • Changes in legal requirements
  • Changes in processing activities
  • Technical or organizational modifications

The current version number and last update date are indicated at the beginning of this document.

Material changes will be communicated through the application where appropriate.

11: Data Subject Rights (GDPR Articles 12–23)

As a data subject under the General Data Protection Regulation (GDPR), you have the following rights, subject to statutory limitations:

  • Right of Access (Art. 15 GDPR): You may request confirmation whether personal data concerning you is being processed and obtain access to that data.
  • Right to Rectification (Art. 16 GDPR): You may request correction of inaccurate personal data and completion of incomplete data.
  • Right to Erasure (Art. 17 GDPR): You may request deletion of your personal data where statutory grounds apply.
  • Right to Restriction (Art. 18 GDPR): You may request restriction of processing where legal conditions are met.
  • Right to Data Portability (Art. 20 GDPR): Where applicable, you may receive your data in a structured, machine-readable format.
  • Right to Object (Art. 21 GDPR): You may object to processing based on legitimate interests.
  • Right to Withdraw Consent (Art. 7(3) GDPR): You may withdraw consent at any time with future effect.
  • Right to Lodge a Complaint (Art. 77 GDPR): You may file a complaint with a supervisory authority.

Exercise of Rights

Requests may be submitted to: privacy@credio.online