App Privacy Policy

1. Who is responsible

ANTURICS GmbH
Brunnenweg 7
61352 Bad Homburg
Germany

Amtsgericht Bad Homburg v. d. Höhe, HRB 12596 · VAT identification number DE 288380918. Full company details are in our Impressum.

For TouchCompany: touchcompany@anturics.com
For Pilot Checklists and everything else: info@anturics.com
Data protection officer: André Neu, touchcompany@anturics.com

2. Which apps this policy covers

• TouchCompany — invoicing, payments and basic accounting (Android)
• Pilot Checklists — voice-guided aviation checklists (Android and iOS)

The two apps work very differently, so they are described separately. Where an app is not mentioned in a section, that section does not apply to it. TouchCompany also shows this policy inside the app, in English, German, Spanish, French, Dutch, Polish and Romanian.

3. TouchCompany

Two different roles, and why it matters to you

TouchCompany handles two kinds of personal data, and our responsibility is different for each.

• Your own data — your name, e-mail address, company details and subscription — is data for which ANTURICS GmbH is the controller. We decide what is collected and why, and this policy explains it.
• Your customers’ data — the names, addresses, e-mail addresses, telephone numbers, VAT identifiers and invoice records you enter — is data for which you are the controller and we act only as a processor. We store and process it on your behalf, on your instructions. We do not use it for our own purposes, we do not sell it, and we do not share it with anyone except the processors named below.

A data processing agreement under Art. 28 GDPR is available on request at touchcompany@anturics.com.

What we collect, and why

• Your account. Your e-mail address and password so you can sign in; your company name, address, tax and registration identifiers, bank details and logo, because they appear on the invoices you issue. Legal basis: performance of the contract between us, Art. 6(1)(b) GDPR.
• What you create in the application. Customers and contacts, articles and services, projects and recorded time, invoices, offers, delivery notes and their line items. This is your business record. Legal basis: performance of our contract with you, and — for the invoices themselves — compliance with a legal obligation, Art. 6(1)(b) and (c) GDPR.
• Your subscription. Whether you hold an active subscription, which product, and when it expires. We never receive or store your payment card details. Legal basis: performance of the contract.
• Technical data needed to run the service. A session token so that you stay signed in, and server logs recording that a request was made and how it was answered. Legal basis: our legitimate interest in operating and securing the service, Art. 6(1)(f) GDPR.

We do not collect location data. The address and country you enter are there so that your invoices are correct — they are not taken from your device’s location.

What we do not do

We do not use analytics. We do not use crash or usage reporting. We do not show advertising, and we carry no advertising software. We do not track you across other applications or websites, and we do not build profiles. We do not sell or rent personal data to anyone, and we do not make automated decisions that produce legal effects for you.

Who else processes data, and what for

• Google Play (Google Ireland Limited) — sells and processes subscriptions. When you subscribe you transact with Google under Google’s own terms. Google receives and holds your payment details; we receive only a purchase token and the resulting subscription status, which we verify with Google.
• Google sign-in — if you choose to sign in with a Google account, Google confirms your identity to us. We receive an identity token; we do not receive your Google password.
• SendGrid (Twilio) — sends the e-mail we need to send you, such as a password reset. It receives the recipient address and the content of that message.
• SumUp — if you take a card payment through the application, SumUp processes that payment. Card details are entered into SumUp’s own component and are not seen or stored by TouchCompany. To process the payment we also pass SumUp the amount, the currency, the invoice number, your customer’s e-mail address so that SumUp can send them a receipt, and the reference we hold for that customer.

These are the only third parties that receive personal data through the application. We may also disclose data where we are legally required to do so.

How your documents reach your customers. We do not send them. An invoice, offer or delivery note is shared from your own device, using your phone’s own sharing function — your mail application, or whichever app you choose. The document does not pass through us, and we never receive your customer’s address for that purpose.

Where your data is stored

On our own servers, which we operate ourselves on our own hardware in our own datacenter in Germany. They hold your account and everything you create in the application. We do not use a third-party cloud provider for this.

And on your own device: the application keeps a local copy of your business data so that it works while you are using it, and stores your sign-in details so that you are not asked to sign in every time. Data on your device is protected by your device’s own security, and is removed when you uninstall the application. The application is configured so that this local data is not included in Android cloud backups.

How long we keep it

Your account data is kept while your account exists. Invoices and the records belonging to them are kept for as long as the law requires — in Germany, business records of this kind must be retained for ten years under section 147 of the Abgabenordnung. Those records are your own accounting documents, and erasing them on request would destroy documents you are required to keep.

When you ask us to delete your account, we delete the logins for your company, revoke every session, and remove the personal identifiers on those logins. The business records described above remain, because of the retention obligation, but they are no longer reachable through the application. We say this plainly rather than promise a deletion we do not perform.

Security

Data sent between the application and our server is encrypted in transit. Access to the server is limited to those who need it. We are a small company and we do not claim certifications we do not hold.

If a breach occurs that is likely to result in a risk to your rights, we will notify the supervisory authority and, where required, you.

4. Pilot Checklists

Data we collect

We do not collect personal data from this app. Your selected aircraft, checklist progress and app settings are stored on your own device and are not transmitted to ANTURICS. We do not use analytics, crash reporting or advertising in this app either.

Microphone and voice confirmation

The app listens for spoken confirmations such as “ok”, “checked” or “done” so that you can work through a checklist without taking a hand off the controls. The microphone is active only while a checklist is running.

Speech is recognised by your operating system’s cloud speech service — Google on Android, Apple on iOS. That means the audio is sent to, and processed by, the platform provider under their own privacy terms, not by us. ANTURICS does not receive your audio and does not store recordings. If you would rather this did not happen, do not grant the microphone permission — you can still work through every checklist by tapping instead of speaking.

See Google’s privacy policy and Apple’s privacy policy for how they handle speech data.

Bluetooth

Bluetooth permission is used to connect to your headset so you can hear the checklist. No data is sent to ANTURICS through this connection.

Purchases

Aircraft-specific checklists are offered as in-app purchases. Payment is handled entirely by Google Play Billing or the Apple App Store. ANTURICS never sees or stores your payment card details; we receive only confirmation that an entitlement has been purchased.

5. Permissions we ask for

Neither app asks for location access. You can withdraw any permission at any time in your device settings; the related feature then stops working.

6. Children

Neither app is directed at children. TouchCompany is a tool for businesses. We do not knowingly collect data from anyone under 16. If you believe a child has provided us with personal data, please contact us and we will delete it.

7. Your rights

Under the GDPR you have the right to ask us for a copy of your personal data; to have inaccurate data corrected; to have data erased, subject to the retention obligation described above; to restrict or object to processing; to receive your data in a portable form; and to withdraw consent where processing rests on consent.

You can exercise these rights using the contact details in section 1. You also have the right to complain to a supervisory authority — in our case the Hessischer Beauftragte für Datenschutz und Informationsfreiheit, or the authority where you live or work.

Where we act as processor for your customers’ data, requests from those customers should be directed to you as the controller, and we will assist you in answering them.

8. International use

ANTURICS is based in Germany, our servers are in Germany, and our processing is governed by German and European data protection law. The third parties named in section 3, and the platform speech services named in section 4, may process data outside the European Economic Area under their own terms.

9. Changes to this policy

If we change this policy materially we will say so in the application before the change takes effect. The date at the top tells you which version you are reading.

10. Contact

ANTURICS GmbH
Brunnenweg 7, 61352 Bad Homburg, Germany
Amtsgericht Bad Homburg v. d. Höhe, HRB 12596
VAT identification number: DE 288380918

TouchCompany: touchcompany@anturics.com
Pilot Checklists: info@anturics.com