wep4budget

Privacy Policy

Last updated: 17 April 2026

1. Data Controller

The data controller responsible for this website and the wep4budget service is:
wep4you e.U.
Ing. Peter Weiß
Groß-Enzersdorferstraße 74b/2/30
1220 Wien, Austria
Email: office@wep4budget.eu

2. Data We Collect

2.1 Website Visitors

Our web server logs may temporarily store:

  • IP address (anonymized)
  • Date and time of access
  • Requested page/resource
  • Browser type and version
  • Referring URL

Server logs are retained for a maximum of 7 days and are used solely for security monitoring and error diagnosis. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in ensuring the security and stability of our website).

2.1b Analytics (Umami)

We use Umami Analytics to measure aggregate website reach and service quality. Umami is self-hosted on our own infrastructure within the European Union and is specifically designed to be privacy-preserving:

  • Fully self-hosted — no data is sent to third-party analytics providers.
  • Cookieless — no cookies or similar tracking identifiers are set in your browser.
  • IP addresses are anonymized before storage; raw IPs are not retained.
  • No cross-site tracking, no advertising or re-targeting.
  • No data is transferred outside the EU/EEA.
  • Analytics data is retained in aggregated form for a maximum of 90 days.

Logged-in users: When you are signed in to the wep4budget application, we associate analytics sessions with your pseudonymous user identifier (internal user ID) and email address. This allows us to understand user journeys, identify usability issues, and improve service quality. This data is stored exclusively on our self-hosted Umami instance and is never shared with third parties.

Legal basis: Art. 6(1)(b) GDPR (performance of a contract — improving the service you use) and Art. 6(1)(f) GDPR (legitimate interest in reach analytics and service-quality measurement). All data remains within our own infrastructure in the EU.

Right to object (opt-out): You can disable analytics at any time by either enabling the “Do Not Track” (DNT) signal in your browser — which Umami respects — or by running the following command in your browser’s developer console on this site: localStorage.setItem('umami.disabled', '1').

2.2 Application Users

When you create a wep4budget account, we collect:

  • Email address
  • Name
  • Organization name
  • Budget data you enter into the application

Legal basis: Art. 6(1)(b) GDPR (performance of a contract).

2.3 Enterprise Contact Form

When you submit the enterprise contact form, we collect the information you provide (name, email, company, message). This data is used solely to respond to your inquiry. Legal basis: Art. 6(1)(b) GDPR (pre-contractual measures).

2.4 Waitlist

When you join our waitlist, we collect your email address and, optionally, your name, company, and team size. We use this data solely to notify you about early access and our upcoming launch, and to prepare your onboarding. It is stored in our management database, hosted exclusively in the EU (Hetzner, Germany). We do not use it for any other marketing without your explicit consent, and we do not share it with third parties. Legal basis: Art. 6(1)(b) GDPR (pre-contractual measures). You can request deletion of your waitlist entry at any time by emailing office@wep4budget.eu.

2.5 Payment Data

Payment processing is handled by Stripe, Inc. We do not store credit card numbers or bank account details on our servers. Stripe processes your payment data as an independent data controller under their own privacy policy. We only store:

  • Stripe customer ID (internal reference)
  • Subscription status and tier
  • Invoice amounts and dates

Legal basis: Art. 6(1)(b) GDPR (performance of a contract).

3. Data Processing and Storage

All data is processed and stored exclusively within the European Union. Our infrastructure is hosted on Hetzner Cloud (Falkenstein, Germany). We do not transfer any personal data outside the EU/EEA.

4. Data Sharing

We do not sell, trade, or share your personal data with third parties, except:

  • Hetzner Online GmbH (Germany) — infrastructure hosting. Data Processing Agreement in place.
  • Stripe, Inc. (USA, with EU data processing) — payment processing for paying customers. Stripe is certified under the EU-US Data Privacy Framework.
  • When required by law or court order.

5. Your Rights (GDPR)

Under the GDPR, you have the right to:

  • Access your personal data (Art. 15 GDPR)
  • Rectification of inaccurate data (Art. 16 GDPR)
  • Erasure (“right to be forgotten”) (Art. 17 GDPR)
  • Restriction of processing (Art. 18 GDPR)
  • Data portability (Art. 20 GDPR)
  • Object to processing (Art. 21 GDPR)
  • Withdraw consent at any time (Art. 7(3) GDPR)

To exercise any of these rights, contact us at office@wep4budget.eu. We will respond within 30 days.

6. Data Retention

  • Active accounts: Data is retained for as long as your account is active.
  • Account deletion: All personal data is permanently removed within 30 days. Backups are purged within 90 days.
  • Invoices: Retained for 7 years as required by Austrian tax law (§ 132 BAO).
  • Contact form submissions: Deleted after 6 months if no business relationship is established.

7. Security

We implement appropriate technical and organizational measures to protect your data, including:

  • Encryption in transit (TLS 1.3) and at rest
  • Isolated databases per tenant (multi-tenant data separation)
  • Role-based access controls
  • Internal security reviews and automated vulnerability scanning
  • Bcrypt password hashing with salt

8. Cookies

This website does not use cookies. The wep4budget application uses only strictly necessary session cookies for authentication. No tracking, analytics, or marketing cookies are used. Therefore, no cookie consent is required.

9. Supervisory Authority

If you believe your data protection rights have been violated, you have the right to lodge a complaint with the Austrian Data Protection Authority:
Österreichische Datenschutzbehörde
Barichgasse 40–42, 1030 Wien
dsb@dsb.gv.at
www.dsb.gv.at

10. Changes to This Policy

We may update this privacy policy from time to time. We will notify you of any material changes by posting the new policy on this page and updating the “Last updated” date. For significant changes affecting existing users, we will also send a notification via email.