This English translation is provided for convenience only. In case of any discrepancies, the German version prevails.
Last updated: August 2026
1. Controller
Christian Gerloff, Kaupmanns Kamp 5, 33775 Versmold, Germany — email: contact@tirodocs.com
2. Hosting
We run the website, the app and the databases on servers of our processor Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany; the servers are located in Germany. When you visit our pages, the server processes technically necessary connection data (IP address, time, page requested, browser identifier) in logs to keep the service running, analyse errors and fend off attacks. These logs are deleted automatically after at most 7 days — only in the case of security incidents may affected entries be kept until the matter is resolved — and are not merged with other data. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in secure and stable operation).
3. Account and login
For your account we store your email address and login timestamps. Login is passwordless via a code we send you by email; codes and session tokens are stored exclusively in hashed form. We set a technically necessary session cookie (httpOnly, lifetime approx. 30 days). We do not set tracking or advertising cookies. The legal basis is Art. 6(1)(b) GDPR (provision of the service). When you register, we also store how you became aware of Tiro (e.g. search engine or advertising campaign) — for this, the site evaluates the channel, referring domain and entry page during your visit. Nothing is stored on your device for this (no cookies, no click IDs, no sharing with third parties). The legal basis is Art. 6(1)(f) GDPR (legitimate interest in understanding the effectiveness of our channels).
You may optionally add your name, company and intended use (document type) to your profile. We use these details solely to contact and support you personally; you can change or delete them at any time in the settings. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in personal support). We send product news by email only with your explicit consent (Art. 6(1)(a) GDPR); we record the time of consent, and you can withdraw it at any time in the settings.
4. Uploaded documents and results
We process and store the documents you upload and the results extracted from them in order to provide the service to you (Art. 6(1)(b) GDPR). You control the retention period per extractor: from “delete immediately after export” up to the chosen period (at most 90 days on the free plan); once it expires, the file, its metadata and the result are deleted automatically. You can also delete documents yourself at any time; we delete your account and its data on request to privacy@tirodocs.com. Deleted data may remain in automatic backups for up to 7 additional days; we use backups exclusively to restore operations. Our technical logs contain no document contents.
5. AI-based extraction (AWS Bedrock)
To extract the data, we transmit the document in question to our processor Amazon Web Services (Amazon Web Services EMEA SARL, Luxembourg) and receive the structured result back. The processing runs on the Amazon Bedrock service with AI models from Anthropic in the AWS region Frankfurt (Germany). A data processing agreement is in place with AWS (AWS Data Processing Addendum); your documents are used neither by AWS nor by Anthropic to train AI models. Processing takes place exclusively in EU data centres; as a rule, no transfer to third countries takes place. For the exceptional case of access from the United States, Amazon is certified under the EU-U.S. Data Privacy Framework; in addition, the EU Standard Contractual Clauses apply as part of the AWS Data Processing Addendum. The legal basis is Art. 6(1)(b) GDPR.
6. Email delivery
We send login codes and account notifications via the email system of our processor Hetzner Online GmbH (Industriestr. 25, 91710 Gunzenhausen, Germany); processing takes place on servers in Germany. The data processed is your email address and the content of the respective message (e.g. your login code). A data processing agreement is in place with Hetzner. The legal basis is Art. 6(1)(b) GDPR (provision of the service).
7. Web analytics (Umami)
To measure the audience of our public website, we use the self-hosted open-source software Umami. Umami works without cookies, builds no personal profiles and does not track visitors across websites or devices; all data remains on our own systems and is not transmitted to third parties. Besides page views we count anonymous usage events (e.g. "section seen", "button clicked", "login code requested") — without e-mail addresses or other personal details. The logged-in app area is not measured. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in privacy-friendly audience measurement). You can object to this measurement at any time (Art. 21 GDPR) — an informal email is enough: privacy@tirodocs.com.
8. Your rights
You have the right of access (Art. 15 GDPR) and the rights to rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object (Art. 21). To exercise them, just email privacy@tirodocs.com — no special form needed. You may also lodge a complaint with a data protection supervisory authority.