Version 2026-10-14.1 · English original
For the website, the Fier-Cashbook account, contracting, billing and direct support, the controller is:
Fier-Cashbook
Alaimo Aleandro
Grabenstrasse 6
45888 Gelsenkirchen, Germany
Phone: +49 (0) 151 15468060
Email: support@fier-app.de
If a data protection officer is appointed, the current contact details will be published here.
Fier-Cashbook is a cash-book service for clubs, parishes and families. For data that a customer enters about other people (for example names of treasurers, persons in reminders or item loans), the customer is normally the controller and Fier-Cashbook is its processor under the Data Processing Agreement (DPA). The customer, not Fier-Cashbook, must give those people the required information and establish a lawful basis.
Fier-Cashbook is independently responsible for its own account-holder, contract, payment, support, security and website data. This notice covers both situations and identifies the relevant role.
We process IP address, date/time, requested page, browser and operating-system information to deliver the service, prevent abuse and investigate faults. The basis is Art. 6(1)(f) GDPR (security and reliable operation). Rate-limiting counters are stored in our Cloudflare KV store for short periods (minutes to hours).
Sign-in uses one-time codes sent by email, and an authenticator-app secret (TOTP) for the administrator. We process your email address and store the one-time codes only in hashed form with a short expiry (default 10 minutes); the TOTP secret is stored encrypted (AES-256-GCM). Recovery codes are stored only as keyed hashes and each works once. Bases are Art. 6(1)(b) and (f) GDPR.
We process contact details, register name, selected plan and period, plan dates and status, PayPal subscription identifiers and payer email, invoices and payment-status information to create and administer the contract, provide support and meet legal obligations. Bases are Art. 6(1)(b) and (c) GDPR. Invoices are retained for the applicable statutory period, ordinarily eight years from the end of the year of issue under German law. Technical payment idempotency markers (webhook event identifiers) are normally retained for up to 180 days to prevent duplicate entitlement application, payment replay and unresolved-payment fraud; they are not accounting records. Other account data are deleted or anonymised when no longer needed, subject to the retention rules below.
To find and fix faults, the app in production sends us browser errors (JavaScript exceptions, unhandled promise rejections and console errors) together with the page, browser type, language and the role in use (admin/guest). Reports are scrubbed of emails, tokens and other identifiers before storage, are deduplicated by fingerprint, are retained for 7 days and are used only for fault analysis and security. The basis is Art. 6(1)(f) GDPR (reliable operation). Reports never contain your financial data.
If you contact support, we process your email address, the subject and the message to answer the request (Art. 6(1)(b) or (f) GDPR). Mailbox retention is managed so correspondence is erased when no longer needed.
Application hosting, database and content delivery: Cloudflare, Inc. / relevant group entities (global network; transfers outside the EEA are covered by EU Standard Contractual Clauses and supplementary measures). Transactional email (sign-in codes and error reports) is sent through our mailbox provider IONOS SE, Germany, via SMTP. Payments are handled by PayPal as an independent controller. The current list of sub-processors for customer-controlled data is maintained in the DPA.
One-time sign-in codes: until used or expiry (default 10 minutes).
Rate-limit counters: minutes to hours (daily counters up to 48 hours).
Browser error reports: 7 days.
Payment webhook idempotency markers: up to 180 days.
Invoices and payment records: statutory periods (ordinarily 8 years, German law).
Register content (movements, accounts, reminders, loans): until the customer deletes it or the account is closed, plus documented backup cycles.
You have the rights of access, rectification, erasure, restriction, data portability and objection under the GDPR. The Excel export in the app gives you your register data in a common format. You may lodge a complaint with a supervisory authority, for example the competent authority in Gelsenkirchen, Germany. Contact us first at support@fier-app.de.
We use a strictly necessary session cookie (signed, httpOnly, Secure) and browser local storage for your language choice and, after a successful sign-in, your email address for prefill. No advertising or analytics cookies are used.
We do not use automated decision-making within the meaning of Art. 22 GDPR. Anti-abuse measures (rate limits, payment review on refunds or disputes) are manual or rule-based security measures, not profiling of your finances.
We update this notice when the processing changes. The version and date are shown at the top; material changes will be notified in the app where practicable.