Privacy policy

Last updated: 30 October 2026. This website does not track. The Sollmaß software processes business data so that trade businesses can work. The German original is legally binding.

2. Visiting this website

sollmass.de is delivered via Cloudflare Pages. The provider is Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA. When the site is visited, Cloudflare processes the access data that is technically necessary: IP address, time, address requested, browser identifier (user agent) and the page visited before (referrer). Purpose: to deliver the site, to protect it against attacks and to fix faults. The legal basis is Art. 6 (1) (f) GDPR; our legitimate interest is a fast, secure and available website.

Cloudflare processes this data on our behalf (Art. 28 GDPR) in a worldwide network of data centres, usually close to the visitor. A transfer to the USA is possible in the process. Cloudflare is certified under the EU-US Data Privacy Framework (adequacy decision, Art. 45 GDPR); in addition, the EU standard contractual clauses apply. We do not analyse the access data and do not create usage profiles.

There is no Google Analytics, no Meta pixel and no tag manager. We deliver fonts ourselves, not via Google.

Cookies and consent

This website does not set any cookies and currently does not load any services that require consent. This is why no banner appears. Under “Cookie settings” in the footer, you can see at any time which services are used, and you can make a choice or withdraw it.

If you make a choice there, we store it in your browser's local storage (key sollmass.consent) for 12 months, so that we do not ask again on every visit. This is technically necessary for this purpose (§ 25 (2) no. 2 TDDDG). Your choice does not leave your device.

3. Request form and contact

The form Ask a question or request a data migration sends the name and the optional details (e-mail, phone, location, request) in encrypted form to our application server app.sollmass.de. The server does not store the request in a database, but sends it via Cloudflare's e-mail service to [email protected]. Only the name is required, but without an e-mail address or phone number we cannot reply.

To prevent mass requests, the server counts requests per sender. For this, it does not store plain text in its database, but an irreversible check value (HMAC) of the IP address or e-mail address, together with a counter and the end of the time window. An hourly run deletes expired counters. Legal basis: Art. 6 (1) (f) GDPR (protection against misuse).

If you write to [email protected] or call us, we process your details in order to reply. E-mails to addresses under sollmass.de are received by Cloudflare Email Routing and forwarded to the operator's mailbox.

The legal basis is Art. 6 (1) (b) GDPR where the request aims at a contract, otherwise Art. 6 (1) (f) GDPR (answering requests). We delete the details when the request has been dealt with and there is no statutory retention obligation, for example for business letters under § 257 HGB and § 147 AO.

If Cloudflare Turnstile is included in the form, the service checks before sending whether a human is making the request. For this, Cloudflare processes the IP address and technical features of the browser; no user profile is created. Legal basis: Art. 6 (1) (f) GDPR (protection against spam and misuse) and § 25 (2) no. 2 TDDDG. For the transfer to the USA, section 2 applies.

4. Trial access and customer account

If you apply for the 14-day trial on app.sollmass.de, we store in our database first name and last name, e-mail, phone, company, trade, number of employees and the confirmation that you are a business (§ 14 BGB). Purpose: to check the application and to activate access. Legal basis: Art. 6 (1) (b) GDPR. We delete applications that do not lead to an account after 90 days.

For customer accounts, we process names, e-mail addresses, company, contract and usage data in order to provide Sollmaß and to invoice it (Art. 6 (1) (b) GDPR), and we keep invoices and business records under HGB and AO (Art. 6 (1) (c) GDPR).

Sign-in by magic link: we only store a hash of the link token and of the session, not the token itself. The app's session cookie on app.sollmass.de is httpOnly and Secure and is technically necessary for signing in (§ 25 (2) no. 2 TDDDG).

5. The Sollmaß software

What a business records in Sollmaß – contacts, sites, jobs, documents, times, absences, stock, files and photos – we process on its behalf under Art. 28 GDPR. The business is the controller for this data. Details, including the types of data and the deletion periods, are set out in the data processing agreement.

Hosting: the application, database and uploaded files are stored on servers of Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, in the Falkenstein/Vogtland data centre in Germany. Data traffic to app.sollmass.de runs through Cloudflare's network (section 2).

E-mail: all messages that the app sends – sign-in links, invitations, documents, payment reminders and dunning letters, notices to the team – run via Cloudflare's e-mail service. The sender is [email protected].

Backups: the database and the files are backed up daily. The backups are kept for 14 days on the same server; in addition, there are disk backups by Hetzner with 7 days. Older versions are overwritten.

Log: important actions in the app are recorded with time, account and job in the business's audit log, including every AI action. The log serves as evidence under GoBD and for investigating faults.

Feedback from the app: with “Share an idea or report a problem” you send us a message. We store your text, the email address of your account for the reply, your business and your role, the page of the app without identifiers, the app version, and browser and operating system in rough form. No screenshot and no data of your customers are transmitted. The purpose is to handle and answer the feedback; the reply goes to your account by email. The legal basis is Art. 6(1)(f) GDPR (improving the software and supporting users).

Usage statistics: to see which areas and features are used and how fast the app responds, the application server counts events such as “area opened”, “quote issued” or “search used”. For this we set no cookies, store nothing on your devices, read no device information and use no third-party services. Only daily totals across all businesses are stored, without IP address, without content and without any account or business identifier. So that a business counts only once per day, the server uses, for the current day, a check value (HMAC) of the business identifier with a random value that changes daily; it deletes both on the following day. The legal basis is Art. 6(1)(f) GDPR (operating and improving the software). Owners and office staff can switch off counting for their business under Settings › Language & data.

Error reports and status page: if an error occurs in the app or on the server, we store the error message without entered values, addresses and identifiers, the affected places in the program, the page without identifiers, the app version and the number of occurrences, in order to fix the error (Art. 6(1)(f) GDPR). To prevent mass reports, the server counts them per IP address only in memory, for ten minutes. The public status page app.sollmass.de/status shows only the operating state and recorded incidents.

6. AI functions

If a business uses AI functions, the inputs needed for them go to the provider used. Depending on the function, these are texts from jobs and messages, photos, for example of the type plate, of the measurement or of a document, and uploaded audio files for transcription. Texts and photos are processed primarily by IONOS SE, Montabaur, in a data centre in Germany; if IONOS is not set up, by OpenAI, Google (Gemini) or xAI. Audio files are transcribed by OpenAI or Google.

OpenAI, Google and xAI also process data in the USA. We base the transfer on the EU-US Data Privacy Framework where the provider is certified, otherwise on EU standard contractual clauses. For cost control, we count per business and account how many AI actions run. Every AI action is recorded in the business's audit log.

7. Services the business sets up itself

Some functions only work once the business stores its own access data. The business chooses these services itself; we transfer the data on its instructions. We store the access data in encrypted form.

  • E-mail mailbox (IMAP): The app fetches messages and attachments from the business's mailbox and files them with the job.
  • WhatsApp Business: Messages received via Meta's Cloud API arrive in the same inbox.
  • SMS to the on-call service: If the reception detects an emergency, an SMS goes to the scheduled on-call staff, never to the caller. It contains the name, phone number and address from the job. It is sent via the SMS service that the business enters.
  • Location (GPS): Only if the business switches it on, the location is recorded at clock in and clock out. Co-determination and internal company rules are the business's responsibility.

8. Map in the Schedule

The map of today's assignments loads a map image from staticmap.openstreetmap.de and, if you open the map, a map view from openstreetmap.org. In the process, the IP address of the device and the coordinates of today's assignments go to the map service. This does not happen if the Schedule map is not opened. Legal basis: Art. 6 (1) (f) GDPR (planning assignments on a map).

Route: If you tap “Route” or “Today’s route” in the app, Google Maps, Apple Maps or Waze opens, depending on your choice. Only with this click does the destination address (for “Today’s route”, the addresses of the stops) go directly from your device to the chosen service; that service’s privacy policy applies there. Sollmaß transmits nothing to the service and loads nothing from it beforehand.

Help videos in the app are hosted on YouTube (without cookies) or on Cloudflare Stream and are only loaded after a click.

9. Recipients at a glance

  • Cloudflare, Inc. (USA): delivery of this website, network and protection for app.sollmass.de, sending and forwarding of e-mails, where applicable Turnstile and the R2 object storage for uploaded files.
  • Hetzner Online GmbH (Germany): servers, database, files and backups of the application.
  • IONOS SE (Germany): only if a business uses AI functions (section 6).
  • OpenAI, Google or xAI: only if a business uses AI functions (section 6).
  • OpenStreetMap map service: only when the map in the Schedule is opened (section 8).
  • Services that the business enters itself (section 7): its mailbox, Meta (WhatsApp), its SMS service.

We do not sell data and do not pass it on for advertising purposes.

10. Your rights

Access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20) and objection to processing based on Art. 6 (1) (f) GDPR (Art. 21). You can withdraw consent you have given at any time with effect for the future (Art. 7 (3)). Statutory retention obligations, for example for documents, take precedence over erasure.

For data that a business keeps about its customers in Sollmaß, the business is the right contact. We support it in this: contacts can be anonymised in the app; issued documents keep their document copy, because tax law requires this (Art. 17 (3) (b) GDPR).

Complaint to a supervisory authority (Art. 77 GDPR). Competent at the registered office of High5Manufaktur GmbH: Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg, Lautenschlagerstraße 20, 70173 Stuttgart, baden-wuerttemberg.datenschutz.de.

There is no automated decision with legal effect or similarly significant impact within the meaning of Art. 22 GDPR. The AI classifies incoming messages as emergencies and then alerts the on-call staff; a human confirms suggestions for quotes, appointments and dispatch.

11. Storage period

We store personal data until the purpose no longer applies. Retention periods under commercial and tax law, in particular for documents, take precedence. In detail:

  • Trial applications without an account: 90 days.
  • Incoming messages in the app (mail, WhatsApp, emergency calls): 2 years.
  • Backups: 14 days, disk backups 7 days (section 5).
  • Counters against misuse: until the end of the time window (section 3).
  • Data of a business after the end of the contract: see Data processing agreement – shutdown, export and deletion after the retention periods have expired.
  • Access data of the website: see section 2.
  • Feedback from the app, usage statistics (daily totals) and error reports: 13 months; the daily check value of the usage statistics until the following day (section 5).

We store a business's data in Sollmaß for the duration of the contract. After the end of the contract, it remains readable and exportable for 30 days, after a trial without an order for 90 days. After that, we shut down the business and delete personal data that is not subject to a retention obligation; records subject to retention remain blocked until the end of the statutory period and are then deleted (Terms and conditions, section 3).

12. Changes

If purposes, service providers or processing change, we adapt this policy and update the date above.