Privacy Policy

This policy explains what happens to your data when you visit this website or write us an email. We have kept it deliberately short and describe only what actually takes place here. This site sets no cookies, does not measure your behaviour and loads no content from third-party servers.

This is a translation of the German original. In case of doubt, the German version at diamapps.com/datenschutz/ is the authoritative text. References to German legislation are given in their original form.

1. Controller

The controller for the processing of personal data on this website within the meaning of the General Data Protection Regulation (GDPR) is:

Email: support@diamapps.com

There is no legal obligation to appoint a data protection officer, because the conditions of Art. 37 GDPR and § 38 BDSG (the German Federal Data Protection Act) are not met here. Please address any concerns directly to the email address above.

2. Your rights

You may at any time ask us for information about the data we hold about you (Art. 15 GDPR). You also have the right to have incorrect data corrected (Art. 16 GDPR), to have data erased (Art. 17 GDPR), to have processing restricted (Art. 18 GDPR) and to data portability (Art. 20 GDPR).

Where we base processing on a legitimate interest under Art. 6(1)(f) GDPR, you also have the right to object to that processing on grounds relating to your particular situation (Art. 21 GDPR). An informal message to the email address above is enough; no particular form is required.

Independently of this, you have the right to lodge a complaint with a supervisory authority under Art. 77 GDPR. The authority responsible for us is:

3. Visiting this website (hosting with GitHub Pages)

This website is hosted on GitHub Pages, a service of GitHub, Inc. (part of the Microsoft group) based in the United States. When you open a page, your browser transmits technically necessary data to GitHub’s servers. It is recorded there in server logs: your IP address, the page requested, the previously visited page if applicable (referrer), and the identifier of your browser and operating system. We do not create such logs ourselves and do not evaluate them; GitHub also processes them for its own security purposes and, to that extent, on its own responsibility.

The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest is to provide this website reliably and securely; without the transmission of this data, no page can technically be delivered to you. How long GitHub keeps these logs is for GitHub to decide; GitHub does not state a fixed period in its privacy statement.

Because the servers are located in the United States, data is transferred to a third country. GitHub is certified under the EU-U.S. Data Privacy Framework, for which the European Commission confirmed an adequate level of protection in its decision of 10 July 2023. In addition, the standard contractual clauses under Art. 46 GDPR from GitHub’s data protection agreement apply. On request we will provide you with a copy of these safeguards at support@diamapps.com.

4. Contacting us

There are two ways to reach us: the form on our contact page, or an email straight to support@diamapps.com. Both messages end up in the same mailbox, but they take a different route to get there. That is why we describe them separately.

If you write to us directly

Your message travels straight from your email provider to our mailbox. No form or delivery service is involved, and we make no transfer to a third country in doing so. We process the details contained in your message: your sender address, your name insofar as you give it, the subject line and the content together with any attachments.

If you use the form

The form is not contacted when you merely open the page. Only once you tap “Send message” do your entries go to the service Web3Forms. The provider is Web3Creative, based in Palakkad, Kerala, India. What is transmitted: your name, your email address, the topic you selected, your message, and technical details – in particular your IP address, the time and the referring page.

The provider uses further companies for this: Amazon Web Services and Cloudflare for operation and delivery, Hetzner Online GmbH with servers in Germany and Finland, and – for screening advertising messages – CleanTalk Inc. and Automattic Inc. (Akismet) in the United States. Those two receive your IP address and your email address in the process. According to the provider, submissions are kept for up to three years.

Transfers to third countries therefore take place: to India and to the United States. There is no adequacy decision of the European Commission for India. The provider has incorporated the standard contractual clauses under Art. 46(2)(c) GDPR (Implementing Decision (EU) 2021/914) into its data processing agreement. On request we will provide you with a copy of these safeguards at support@diamapps.com.

If you would rather avoid this route, simply write to us directly – the address is above and in our legal notice. You are at no disadvantage for doing so; we answer both routes alike.

After that – in both cases

Your message sits in an email account that we operate with IONOS SE, Elgendorfer Straße 57, 56410 Montabaur, Germany. Those servers are located in Germany. IONOS processes the data on our behalf as a processor under a contract pursuant to Art. 28 GDPR.

Please note: on the way from your email provider to our mailbox we have no influence over which servers your message passes through. Our mailbox accepts messages over an encrypted connection wherever the sending server supports it; for ordinary email, however, we cannot guarantee end-to-end encryption. Please therefore do not send us particularly sensitive details – such as health data, identity document data or credentials.

The legal basis is Art. 6(1)(b) GDPR where your enquiry relates to entering into or performing a contract, and otherwise Art. 6(1)(f) GDPR – our legitimate interest is being able to answer enquiries. No consent is required for this, and we do not ask for any. You are under no obligation to write to us; without a sender address and a description of your request, however, we cannot answer your enquiry.

We delete your enquiry once it has been dealt with conclusively and no follow-up questions are to be expected. Statutory retention obligations remain unaffected. You may object to storage at any time; we will then delete the message, unless a retention obligation prevents us from doing so.

Against automated advertising messages, the form protects itself with a hidden field that humans do not fill in, together with the screening at the provider described above. No image puzzle or comparable service from a further provider is used.

5. No cookies, no tracking

This website sets no cookies, places nothing in your browser itself and uses no analytics or audience measurement. No fonts, scripts, maps or videos are loaded from third-party servers; every component of the page sits on the same server as the page itself. No user profile is created.

Because we store no information on your device and read none from it – beyond your browser’s ordinary cache, nothing happens – the consent requirement of § 25(1) TDDDG (the German act governing privacy in digital services) does not apply. That is why you will find no consent banner here – not because we forgot one, but because there is nothing for you to consent to.

6. No automated decision-making

No automated decision-making, including profiling, within the meaning of Art. 22 GDPR takes place. We do not assess you by machine and derive no classifications from your visit.

7. Our apps

This policy covers the website. Our apps are separate from it: they send no data to us. Whatever you create in an app stays on your device or – if you switch that on explicitly – in your personal iCloud, to which we have no access. Each app has its own privacy information, which you will find in the app itself and on the relevant product page. Where an app communicates with an official body or another service, that is described there.

DiamVAT is one exception, which we name explicitly: on iPhone and iPad, “Official check” and the submission go to DiamVAT’s transmission service, which we run on a server in Germany (Hetzner Online GmbH data centre, Nuremberg) – only after your consent per device, which the app asks for when you store your certificate or before the first check, and only when you trigger a check or a submission. What is transmitted: the filing record (company data, tax number or VAT ID, the figures you entered, for the EC Sales List your partners’ VAT IDs with amounts, for messages to the tax office the text and PDF attachments) and the manufacturer ID; for a submission additionally your certificate file and PIN in an envelope that only the service can open (X25519, ChaCha20-Poly1305 per RFC 9180), on top of transport encryption. The service checks the record with the tax administration’s library or submits it to the tax administration and returns the result and the transfer ticket. It stores nothing: no account, no database, no copy of the record or the attachments, no certificate, no PIN – everything exists only in memory for the duration of the call. Its access log contains time, call, status and duration, no contents. It does not store IP addresses; to protect against abuse it counts calls only under a hashed identifier that it forgets after about a minute and a half. The legal basis for this is Article 6(1)(f) GDPR, our legitimate interest in secure operation. Every request carries a proof of the app’s authenticity (Apple App Attest); Apple learns only the identifier of that proof, no tax data. Hetzner provides the server as a processor under Article 28 GDPR. The legal basis is Article 6(1)(b) GDPR. On the Mac the library runs inside the app and submits directly, without this service; you can withdraw your consent in the app at any time. The recipient of a submission is the tax administration – your tax office, or the Federal Central Tax Office for the EC Sales List. Its privacy notices apply there; the app shows them before first use.

In addition, at your request DiamVAT uses the camera to photograph an invoice for VAT ID recognition – recognition runs on the device, the image is neither stored nor transmitted – and Face ID or Touch ID to protect the PIN of your ELSTER certificate kept in the keychain. VAT ID checks go directly to the Federal Central Tax Office (BZSt) or the EU database VIES; those bodies’ privacy notices apply there.

DiamLaw works without an account and without servers of our own. The statutory texts are stored completely in the app. Only the case-law search sends your search term to the federal legal information portal (Federal Office of Justice, rechtsprechung-im-internet.de), whose privacy notice applies there. The citation scanner uses the camera solely on the device to recognise a reference such as “§ 433 BGB” – no images are stored or transmitted. Explanations and summaries with Apple Intelligence are generated entirely on the device. If you switch on iCloud sync, highlights, notes, settings and images are additionally stored in your personal iCloud; the purchase of DiamLaw Pro is handled by Apple through the App Store.

Camera and photos: on request, DiamMath can photograph a handwritten or printed function or read a photo from your library. Text recognition runs entirely on your device; the image is neither stored nor transmitted to us or to third parties. You grant access to the camera and photos explicitly in iOS or macOS and can revoke it at any time in the system settings.

8. Changes to this policy

If the technology behind this website changes or new legal requirements apply, we will adapt this policy. The version published here is the one that applies. The date at the end of the page shows you how current it is.

Last updated: October 2026