Privacy Policy

Last updated: 13 August 2026

This privacy policy explains how Zahlenwerk Studio GbR ("Zahlenwerk", "we", "us") processes personal data in connection with this website (zahlenwerk.studio) and with our application, Wealth Management by Zahlenwerk (app.zahlenwerk.studio). We take the protection of your personal data seriously and process it only in accordance with the EU General Data Protection Regulation (GDPR) and the German Federal Data Protection Act (BDSG).

1. Controller

Zahlenwerk Studio GbR Laura Nogales De La Cruz & Lukas Beier Seelingstraße 5, 14059 Berlin, Germany Email: hello@zahlenwerk.studio

2. What data we process

• Server log data. When you visit the site, our hosting provider automatically collects technical data such as your IP address, browser type, referring page, and the date and time of the request. This is necessary to deliver the site securely and reliably.
• Contact data. If you write to us (e.g. via hello@zahlenwerk.studio), we process the information you provide, such as your name, email address, and the content of your message, to respond to your enquiry.
• Waitlist and access requests. If you ask for access to the application, we process the name, email address, firm and message you submit, together with the campaign parameter that brought you to the form, in order to assess the request and reply to it. The submission is also recorded in our CRM, described in section 6.
• Cookies and analytics. This site uses essential cookies required for basic operation. In addition, and only with your consent via the cookie banner, we use Google Analytics cookies (see section 5). You can withdraw your consent at any time with effect for the future.

3. Legal bases

• Art. 6 (1)(f) GDPR (legitimate interests) for securely operating and maintaining the website, including server logs.
• Art. 6 (1)(b) GDPR (pre-contractual / contractual) for handling enquiries and project communication.
• Art. 6 (1)(a) GDPR (consent) for any optional analytics or non-essential cookies.
• Art. 6 (1)(c) GDPR (legal obligation) where we are required to retain certain records.

4. Hosting and processors

Our website is hosted by a service provider that processes the above server log data on our behalf as a processor under a data processing agreement pursuant to Art. 28 GDPR. Where a processor is located outside the EU/EEA, transfers are safeguarded by the European Commission's Standard Contractual Clauses or an equivalent adequacy mechanism. We do not sell your personal data, and we do not use it for advertising profiling.

5. Google Analytics

With your consent we use Google Analytics 4, a web analytics service provided by Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland). Google Analytics uses cookies to produce statistics about how the site is used (e.g. pages viewed, approximate location, device type, and referring source) so that we can improve our offering. Your IP address is truncated / anonymised (IP masking). These cookies and the associated scripts are only loaded and set after you have consented via the cookie banner. Without your consent, Google Analytics does not run.

The legal basis is your consent under Art. 6 (1)(a) GDPR. You can withdraw it at any time with effect for the future via the "Cookie settings" link in the footer or Google's browser add-on (https://tools.google.com/dlpage/gaoptout). As part of this processing, data may be transferred to Google LLC in the USA; Google is certified under the EU-US Data Privacy Framework, and the European Commission's Standard Contractual Clauses apply in addition. We use Google Analytics solely for statistical purposes and not for advertising profiling. For more information, see Google's privacy policy at https://policies.google.com/privacy.

6. Business contact data for prospecting

We keep a small list of firms and individuals we believe may have a professional interest in our software, so that we can approach a few of them thoughtfully rather than advertise indiscriminately.

What we process. Business-context information only: the firm, the person's name, their professional role, a link to their public professional profile, the language they work in, and our own notes on any contact between us. We do not collect private contact details, we do not buy data from brokers, and we do not enrich these records from other sources.

Where it comes from. Publicly accessible business directories, professional networks such as LinkedIn, and published press coverage. We record the specific source for every single record. Art. 14 GDPR requires us to tell you where your data came from when we did not obtain it from you directly — that is what this section does, and if you would like the specific source recorded for your own entry, ask and we will tell you.

Why, and on what basis. Our legitimate interest in identifying and approaching potential business customers, Art. 6 (1) (f) GDPR. The market for this product is a few hundred firms; the alternative to a considered list is untargeted advertising, which serves nobody well. We have carried out and documented the balancing test this legal basis requires, and will share it on request.

How we make contact. Through the professional network on which the information was published, and not otherwise. We do not send unsolicited advertising email.

Who sees it, and where it is stored. Only the two partners. The list is held in Odoo, operated by Odoo S.A., Chaussée de Namur 40, 1367 Grand-Rosière (Ramillies), Belgium, acting as a processor on our behalf under a data processing agreement that forms part of their customer terms. Odoo S.A. is established in the European Union. The same CRM also holds waitlist submissions and, once a firm becomes a customer, the business contact details its account carries: the name of the firm, and the names and email addresses of the people on it, mirrored automatically from the application so that we can manage the relationship. Nothing from inside a customer's portfolio is transferred — no documents, positions, figures or bookkeeping data. None of these records is shared, sold, published, or used for automated decision-making or profiling.

How long we keep it. Until the record is no longer relevant to us, or until you object. If you object we delete the record rather than marking it inactive, and we do not add it again.

Your right to object. You may object to this processing at any time under Art. 21 GDPR, without giving reasons, by writing to hello@zahlenwerk.studio. There is no cost and no consequence to you.

7. Wealth Management by Zahlenwerk (the application)

This section covers app.zahlenwerk.studio, our finance software, which is currently in closed beta. If you hold an account there, the processing below applies in addition to the website processing described above.

• Account data. Your name, email address, profile photo if you upload one, and the team or teams you belong to. Sign-in is passwordless, via Google, Microsoft, or an emailed link, so we do not store a password.
• Content you upload or forward. Capital account statements, call and distribution notices, tax documents, contracts, bank transactions, receipts, and any other document you add, together with the structured records we extract from them.
• Portfolio records. Positions, commitments, cashflows, valuations, funds, entities and companies you record or that we derive from your documents.
• Directory and bookkeeping data. Entities, related organisations, and the bookkeeping records you maintain per legal entity.
• Assistant conversations. Questions you ask the in-app assistant and the answers returned, together with a record of any action it proposed.
• Usage and technical data. Log data generated by operating the service, and error output produced by the application.
• Billing data. Your team's licence state and the contract details behind it. Payment is by invoice outside the application, so no card or bank details are entered into it or stored by it.

The legal basis for processing account and content data is the performance of our contract with you under Art. 6 (1)(b) GDPR, and our legitimate interest in operating and securing the service under Art. 6 (1)(f) GDPR. Where you connect an optional integration, that processing rests on your consent under Art. 6 (1)(a) GDPR.

Where the documents you upload contain personal data about third parties, such as fellow investors, directors or advisors, we process that data as your processor on your instructions. We will enter into a data processing agreement under Art. 28 GDPR with you on request.

8. Where application data is stored

The database, authentication service and document storage for the application run in Supabase's West EU region, in Ireland. Model calls and PDF preprocessing are pinned to EU regions and are configured to fail rather than fall back to a region outside the EU. Some processors listed below are established outside the EU or EEA; those transfers are covered by Standard Contractual Clauses or an equivalent adequacy mechanism.

9. Processors for the application

We use the following processors to run the application. Each acts on our instructions under an Art. 28 GDPR agreement. We update this list as the product changes.

• Supabase (database, authentication and document storage, hosted in the West EU region in Ireland)
• Vercel (application hosting)
• Google Cloud Vertex AI (model calls for document extraction and the in-app assistant, pinned to EU regions)
• Modal (converting uploaded PDFs to text, pinned to an EU region)
• Inngest (background job processing, such as document extraction)
• Postmark (transactional email, including sign-in links, invitations, and reports you forward to your drop address)
• sevDesk (our invoicing and accounting: the billing details of your firm and the invoices we issue it)
• Microsoft Azure Key Vault (key custody for stored third-party credentials)
• Slack and Microsoft Teams (notifications, only where your team connects them)
• Google Drive and SharePoint (document mirroring, only where your team connects it)
• Anthropic and OpenAI (only where your team supplies its own API key)
• Odoo (our CRM: the name of your firm and the names and email addresses of its members are mirrored from the application so that we can manage the customer relationship; no documents, portfolio records or bookkeeping data are transferred — see section 6)

10. Automated processing and AI

We use AI models to read the documents you upload and to answer questions in the in-app assistant. Before a document or question is sent to a model, names of people and entities are replaced with placeholders, and the table needed to reverse that substitution stays on our systems. Amounts, dates, fund names and portfolio-company names are not substituted, and the original PDF is sent to our preprocessing service to be converted to text.

These models produce suggestions, not decisions. Extractions the model is not confident about are held for human review rather than written to your portfolio, and any change the assistant proposes to your records requires a person to confirm it. There is no automated decision-making producing legal effects within the meaning of Art. 22 GDPR.

The AI Act (Regulation (EU) 2024/1689) applies to this processing alongside the GDPR. We are the provider of the AI system you use and the deployer of the underlying model. The system is not high-risk within the meaning of Art. 6 and Annex III: it neither assesses the creditworthiness of natural persons nor supports employment decisions. The transparency duties in Art. 50 do apply. The assistant identifies itself as an AI, and reports whose narrative a model drafted are marked as artificially generated both in the document metadata and in the printed small print. Where your team supplies its own model provider key, that provider is your processor choice and your team is its deployer. Our full position is set out at zahlenwerk.studio/ai.

11. Access, export and deletion in the application

You can view and correct your records in the application at any time, and you can delete your account from your settings without contacting us. Deleting your account removes the records owned by it. If you need a copy of your data, or deletion of specific documents, write to hello@zahlenwerk.studio and we will action it.

12. Retention

We keep personal data only for as long as necessary for the purposes described above or as required by statutory retention periods. Server logs are deleted or anonymised after a short period; enquiry correspondence is retained for as long as needed to handle your request and any resulting engagement. Usage data collected in Google Analytics is deleted automatically after the retention period we have configured.

13. Your rights

Under the GDPR you have the right to access your personal data (Art. 15), to rectification (Art. 16), to erasure (Art. 17), to restriction of processing (Art. 18), to data portability (Art. 20), and to object to processing (Art. 21). Where processing is based on consent, you may withdraw that consent at any time with effect for the future. To exercise any of these rights, contact us at hello@zahlenwerk.studio.

14. Right to complain

You have the right to lodge a complaint with a supervisory authority. The authority responsible for us is the Berlin Commissioner for Data Protection and Freedom of Information (Berliner Beauftragte für Datenschutz und Informationsfreiheit), Alt-Moabit 59-61, 10555 Berlin.

15. Changes to this policy

We may update this privacy policy to reflect changes to our website or to legal requirements. The current version is always available on this page.