Privacy

How we handle a declarations page you send us · last updated 4 October 2026

Who is responsible

Christian Burkardt, Oklahomastraße 25, 66482 Zweibrücken, Germany · info@dectrace.com. Write to that address for anything on this page.

Visiting this website

This site is a set of static pages. Apart from the upload page, described below, it sets no cookies; it contains no tracking pixels. To count visits we use Cloudflare Web Analytics: a small script from Cloudflare records which page was viewed, the page you came from, your country, and your browser and device type. It sets no cookies, stores nothing on your device and does not follow you across other sites; we see only totals, never individual visitors. Legal basis: Art. 6(1)(f) GDPR — our legitimate interest in knowing whether the site is found and read. Our host, Cloudflare, records the usual server data (IP address, time, requested page, browser identifier) to deliver the page and defend against attacks. We do not build profiles from it and cannot connect it to you.

Sending us a declarations page — as a sample

If you email us a declarations page before you subscribe, we process the document to produce your sample output and to answer you.

• Purpose: producing the sample output you asked for, and our reply.
• Legal basis: Art. 6(1)(b) GDPR — steps taken at your request before entering into a contract; and Art. 6(1)(f) GDPR, our legitimate interest in answering enquiries.
• Retention: the copy we work on is deleted as soon as your sample has been delivered, and the output we build is kept for up to seven days so a failed send can be retried, then deleted. What remains is the email you sent, with your document attached, and our reply, with the output attached — both stay in our mailbox so we can answer follow-up questions. Write to us and we delete them.

A declarations page usually contains personal data of your client — name, address, property details. Please send only what you are permitted to send, and remove anything that is not needed for the sample.

Sending us documents as a subscriber

Once you subscribe, we process the documents you send in order to perform the contract described in our terms.

• Purpose: reading the documents you send and returning the output you pay for.
• Legal basis: Art. 6(1)(b) GDPR — performance of the contract between us.
• Retention: the copy we work on is deleted as soon as the output has been delivered, and that output is kept for up to seven days so a failed send can be retried, then deleted. What remains is the email you sent, with your document attached, and our reply, with the output attached — both stay in our mailbox. Write to us and we delete them; ending your subscription does not by itself remove earlier correspondence.

On the documents themselves you are the controller and we act on your instructions. The people whose data appears in a declarations page are your clients, not ours — you decide what is sent and why. If your own obligations require a written data processing agreement under Art. 28 GDPR, write to info@dectrace.com and we will put one in place before you send anything.

Uploading a document on this website

Instead of emailing us, you can upload a declarations page on dectrace.com/upload. What we said above about samples and subscriptions — purpose, legal basis, and that you remain the controller of your client’s data — applies unchanged. What differs is the route:

• Bot check. The upload page runs Cloudflare Turnstile. To tell a person from an automated script, Cloudflare processes technical signals from your browser — your IP address, the TLS fingerprint, the browser identifier and the page the check runs on — and may set a cookie that is strictly necessary for this check; it is not used to track you. Cloudflare processes these signals for us to secure the upload, and on its own account to improve its bot detection; it states that they are not used to identify, profile or target anyone. Legal basis: Art. 6(1)(f) GDPR — our legitimate interest in keeping the upload free of abuse.
• Temporary storage. The file is stored in our private storage at Cloudflare (R2), which nobody can reach from the internet. Our server collects it from there and deletes it as soon as your output has been built or your upload has been answered; if processing fails, it stays until the automatic deletion described next. Independently of that, the storage deletes every file automatically after one day.
• Confirmation. We send one email to the address you enter, with a link. Your document is read only after that link is used. If it is not, the document is never read and is deleted with the rule above. We use the address only for this confirmation and for sending your output. Once the link has been used, your browser keeps one cookie for 90 days that records that this address was confirmed on it; with it, further uploads with the same address from the same browser are processed without another email. The cookie holds only the address, its expiry and a signature, is not readable by scripts and is strictly necessary for this function; delete it and the next upload simply asks for confirmation again.
• What remains. Once your output is built, the uploaded file is gone. Unlike an email, an upload leaves no copy of your document in our mailbox — only our reply with the output remains there, and we delete it if you ask.

Cloudflare acts as our processor under its data processing agreement. Cloudflare may process data outside the EU; such transfers are covered by the EU Standard Contractual Clauses in that agreement. Reading the document then works exactly as described under The AI services that read the document.

Paying

Payments run through Stripe. When you subscribe, Stripe collects your email address, name, company name, billing address and card details and processes them to take payment. The card number never reaches us. From Stripe we receive what is needed to run the subscription and to keep proper books: who subscribed, what was charged, when, and whether it succeeded.

• Legal basis: Art. 6(1)(b) GDPR for performing the contract, and Art. 6(1)(c) GDPR for the records German commercial and tax law obliges us to keep.
• Retention: billing records are kept for the statutory periods, which run up to ten years. That obligation overrides a deletion request for those records — it does not touch your documents, which follow the rule above.

Stripe also processes payment data as a controller in its own right; what it does with that is set out in Stripe’s privacy policy.

The AI services that read the document

To turn the document into structured rows, each page is sent as an image to Nous Research, the AI provider we use. Nous runs the reading on models operated by OpenAI (two of the three readings) and Google (the third reading, used as an independent check). Nous passes the page to those model operators only to produce the reading; we have no direct contract with them. We use no other recipients for the document itself.

We have Privacy Mode enabled on our account. Under that setting Nous states that it does not store the transmitted content and does not use it for training, product improvement or support. OpenAI and Google process the content only to return the reading to Nous; what they keep and for how long is set by their terms with Nous, not by us. Neither Nous nor these operators state that processing stays inside the EU, so a transfer outside the EU cannot be ruled out; where that occurs we rely on Art. 49(1)(b) GDPR, the transfer being necessary to perform what you asked us to do.

Emails you send us. So that a person can triage incoming mail quickly, the text of an email sent to a DecTrace address is summarised through the same provider, Nous Research (model operated by OpenAI). Attachments are not part of that summary. If that service is unavailable, your email reaches us without a summary — it is never sent to another provider instead.

We do not sell your document, and we do not share it for advertising or marketing.

If we emailed you first

We found your business address on your company’s website and use it only for that message, at most one follow-up, and to honour a request not to be contacted again (Art. 6(1)(f) GDPR). We write only to company addresses. Unanswered contacts are deleted after six months; a “do not contact” request is kept so that we never write again. Reply “unsubscribe” or write to info@dectrace.com at any time.

Your rights

You may ask us for access to your data, and for correction, deletion or restriction of it. You may object to processing based on legitimate interest, and you may ask to receive your data in a portable form. One email to info@dectrace.com is enough — we do not require a particular form.

You also have the right to complain to a data protection supervisory authority. The competent authority for us is the Landesbeauftragter für den Datenschutz und die Informationsfreiheit Rheinland-Pfalz, Hintere Bleiche 34, 55116 Mainz, Germany.

Changes

If this page changes, the date under the heading changes with it.