Privacy notice (draft)

Version: 2026-10-22-draft

This notice covers the documentation at docs.acriva.de, the Acriva app and its sign-in pages.

Controller

David-Jonas Kloster
Friedenstraße 9
48712 Gescher

No data protection officer has been appointed.

Your company’s documents

The company that keeps documents and data in its workspace is responsible for them. Acriva processes them on its behalf. The data processing agreement governs that. If your data is in such a document, address your rights to the company that runs the workspace.

This notice describes what we process as the controller: your visit to these pages, your account and the operation of the service.

Documentation (docs.acriva.de)

The documentation is a static website. GitHub Pages serves it, a service of GitHub, Inc., 88 Colin P. Kelly Jr. Street, San Francisco, CA 94107, USA.

Access data: When you open a page, GitHub processes your IP address and the technical details of the request (time, page, browser) to serve the page and to protect the service. We don’t receive this data ourselves.
Transfer to the USA: GitHub also processes the data in the USA. The basis is the European Commission’s adequacy decision on the EU-US Data Privacy Framework (Art. 45 GDPR), as far as GitHub is certified under it, otherwise the European Commission’s standard contractual clauses (Art. 46 (2) (c) GDPR).
No cookies, no analytics: The documentation sets no cookies and uses no analytics or advertising services. Fonts, scripts and images come from the same website.
Your browser’s storage: When you choose the light or dark theme, your browser remembers the choice (starlight-theme). It doesn’t leave your browser.
Search: The search runs in your browser with an index that is part of the website. Your search terms are not transmitted.

The legal basis is Art. 6 (1) (f) GDPR: our interest in providing the documentation securely and reliably.

Hosting

The app, the sign-in (Keycloak), the database and the document storage run on servers of Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany, in data centres in Germany. Hetzner processes the data on our behalf (Art. 28 GDPR).

Server logs

For every request to the app and the sign-in pages the server logs:

in the access log: IP address, time, requested address, status code, amount of data transferred, referring page and browser identification,
in the app’s log: time, operation, the identifiers of the account and the workspace, and error messages.

We use the logs to find faults, to fend off attacks and to measure the load per workspace. They are kept on the same server. In the log analysis we delete them after 14 days, traces of single requests after 7 days and metrics that don’t relate to an account after 30 days. The legal basis is Art. 6 (1) (f) GDPR: our interest in secure and stable operation.

The monitoring of the service runs on the same server. Alerts to our operations go out by email through Resend (see below) and hold no personal data.

Protection against abuse

The server limits requests without sign-in, such as the sign-up, per IP address. For that it counts an IP address’s requests for 60 seconds at a time in memory. The legal basis is Art. 6 (1) (f) GDPR.

Account and workspace

When you create a company account, we process the company’s name, the workspace’s short name, your first and last name, your email address, your password and your language. We store the password only as a hash. We also store which version of the terms and conditions and of the data processing agreement you accepted and when. We store no IP address with that.

When you are invited to a workspace, we process your email address, your name and your role. An invitation expires after 7 days.

While you use Acriva, we store:

your memberships and roles and the time of your last sign-in, updated at most once an hour,
for each session the IP address and the browser identification, so that you can see and end your sessions,
your notifications in the app,
when you set up a second sign-in step: the authenticator app, the passkey or the recovery codes,
for an API key, who created it and when it was last used,
in the workspace’s audit log, who did what and when. The log is the company’s evidence of proper record keeping. Entries can’t be changed afterwards. When a document is deleted for good or a former member is anonymized, we remove the related text from the entries.

The legal basis is Art. 6 (1) (b) GDPR, the performance of the contract on the use of Acriva, and for the session data Art. 6 (1) (f) GDPR, our interest in secure accounts.

If your company signs in through its own identity provider (single sign-on, for example Microsoft Entra ID or Google Workspace), you enter your password there. We receive your name, your email address and your groups from that provider.

Cookies and your browser’s storage

The app and the sign-in pages only set cookies that are technically necessary for the sign-in (§ 25 (2) no. 2 TDDDG). That is why we don’t ask for consent. There are no analytics, advertising or third-party cookies, and fonts, scripts and images come from our own servers.

Cookie	Set by	Purpose	Lifetime
`__Host-tp-session`	App	keeps you signed in; the session itself is kept on the server	8 hours after the last use
`__Host-tp-af`	App	protects forms against forged requests (CSRF)	until you close the browser
`.AspNetCore.Correlation.`, `.AspNetCore.OpenIdConnect.Nonce.`	App	secure the way to the sign-in page and back	a few minutes during sign-in
`AUTH_SESSION_ID`, `KC_AUTH_SESSION_HASH`, `KC_RESTART`	Sign-in (Keycloak)	hold the sign-in in progress	until the sign-in is complete
`KEYCLOAK_IDENTITY`, `KEYCLOAK_SESSION`	Sign-in (Keycloak)	hold your session at the sign-in	30 minutes without use, at most 10 hours
`KEYCLOAK_LOCALE`	Sign-in (Keycloak)	remembers the language of the sign-in pages	until you close the browser

In your browser’s storage the app keeps settings so that they apply on your next visit: the language, the light or dark theme, the workspace you opened last and which hints of the home page you closed. Some entries hold the identifier of your account and of the workspace. We also store the language and the workspace you opened last in your account. This storage is technically necessary too, because the app can’t keep your choice without it.

Emails from Acriva

Acriva sends emails about your account and your workspace: the confirmation of your email address, the password reset, invitations and notifications, for example about a task or a changed role. To send them we use Resend, a service of Plus Five Five, Inc., 2261 Market Street #5039, San Francisco, CA 94114, USA, as a processor.

For that Resend receives your email address and the content of the message: your name, the workspace’s name and, depending on the message, a document’s title, a file name or the name of the person who triggered something. Resend also processes the data in the USA. The basis is the European Commission’s adequacy decision on the EU-US Data Privacy Framework (Art. 45 GDPR), as far as the provider is certified under it, otherwise the European Commission’s standard contractual clauses (Art. 46 (2) (c) GDPR).

The legal basis is Art. 6 (1) (b) GDPR. We don’t send advertising this way.

AI recognition

Acriva uses an AI model to recognise what kind of document it is and to read its values. When a document arrives in a workspace, Acriva sends its text and the list of the workspace’s document types to the model for that, and for pages that are hard to read also their image. When a workspace has scans split, Acriva also sends the company’s name and the beginnings of the pages. For the search Acriva sends passages of text to a second model, which turns them into series of numbers (embeddings). AI says what the AI does in detail.

The requests run through OpenRouter (OpenRouter, Inc., USA) as a processor, through its European endpoint eu.openrouter.ai. Acriva only allows models that are operated in the EU, requires that neither requests nor answers are stored, and rules out their use for training models. In regular operation the app doesn’t start when another endpoint is set.

We store the recognised values with the document. In the usage log we store for every AI call the workspace, the document, the task, the model, the usage and the duration, but neither the request nor the answer. The AI never approves anything: it suggests, people decide.

This processing is done on behalf of the company that runs the workspace.

Ratings of AI answers

People in a workspace can rate an answer of the AI (the assistant, a chat or a summary) as helpful or not helpful, and with “Not helpful” give a reason and a comment. Acriva stores the rating with the person, the answer it refers to, the page of the app as a template without IDs, the model, the prompt version, the duration and the names of the assistant’s tools. It doesn’t copy the answer, the question or the content of a document: they stay where they are and are deleted with them. The workspace’s administrators see the ratings of their workspace and the reasons, a comment only when they may read the documents behind the answer, and never the conversations of other people.

A person can share their own “Not helpful” rating with Acriva, and an administrator any rating of the workspace. Only then do we see it, and only as long as it is shared: the rating with its reason, model and prompt version and, only when the person shares their own rating, the comment and the question and the answer of that step, read at that moment. A comment changed after sharing is read as it is then. We never see an answer that is based on a confidential document, nor its comment. Every share, every end of a share by a person and every time we read a shared rating is recorded in the workspace’s audit log. We don’t copy a shared rating; to improve the AI we write invented test cases with the same pattern.

A rating is deleted 90 days after its last change, when its former member is anonymized, and with the summary it rates when that summary’s document is deleted. When its conversation or another document behind the answer is deleted, it loses its comment and its share. AI says how rating and sharing work. This processing is done on behalf of the company that runs the workspace; reading a shared rating is done on its instruction, which the share gives.

Email inbox

A workspace can receive documents through its own email address. A mail server that we operate ourselves on our servers in Germany accepts these emails. It limits deliveries per IP address and checks every message for spam and forged senders (SPF, DKIM, DMARC). For that it queries the Domain Name System (DNS): the sender’s domain, for blocklists the IP address of the delivering mail server, and domains from links in the message. The rest of the message’s content doesn’t leave our servers in the process.

For every message we store the Message-ID, the sender, the subject, the size, the file names of the attachments, the result of the check and the message itself. For a refused message we store the sender, the address and the reason. The log of the spam check holds the IP address of the delivering mail server, the size and the result. We discard a held message after 30 days. We hand the original message over for deletion after 365 days and remove the sender and the subject from the entry then.

This processing, too, is done on behalf of the company that runs the workspace.

Encryption and certificates

All connections are encrypted with TLS. Let’s Encrypt (Internet Security Research Group, USA) issues the certificates. Our servers only send the names of our domains for that, no data of visitors.

Backups

We back up the databases of the app and of the sign-in every night on the server and keep the backups in tiers: 7 daily, 4 weekly and 6 monthly ones. Deleted data can therefore remain in a backup for up to 6 months. The legal basis is Art. 6 (1) (f) GDPR: our interest in being able to restore data after a fault.

Test environment

Test environments (for example staging) hold only artificially generated, public or anonymized documents. Only there may the AI recognition also run through OpenRouter’s worldwide endpoint.

When you write to us

When you send us an email or call us, we process your details to handle your request. The legal basis is Art. 6 (1) (b) GDPR when it is about a contract, otherwise Art. 6 (1) (f) GDPR: our interest in answering requests.

Recipients

Recipient	Task	Place of processing
Hetzner Online GmbH	servers for the app, the sign-in, the database, the documents and the backups	Germany
Plus Five Five, Inc. (Resend)	sending emails	USA
OpenRouter, Inc.	AI recognition through the European endpoint	EU, company seat in the USA
GitHub, Inc.	serving the documentation	USA

We don’t sell data and don’t pass it on for advertising.

Storage periods

Data	Period
Server logs in the log analysis	14 days
Session in the app	8 hours after the last use
Session at the sign-in	30 minutes without use, at most 10 hours
Invitations	7 days
Links to confirm the email address and to reset the password	24 hours and 1 hour
Held emails in the email inbox	30 days
Entries about refused emails	365 days
Originals of received emails	365 days
Documents in the recycle bin	30 days
Ratings of AI answers	90 days after the last change
Backups	up to 6 months
Account and memberships	until the account is deleted or the contract ends
A workspace’s documents and audit log	according to the company’s retention rules and the statutory retention periods

After the contract ends, we delete a workspace’s data according to the data processing agreement, unless a statutory retention period prevents it.

Your rights

You have the right of access (Art. 15 GDPR), to rectification (Art. 16), to erasure (Art. 17), to restriction of processing (Art. 18) and to data portability (Art. 20).

Objection: As far as we process data on the basis of Art. 6 (1) (f) GDPR, you can object to the processing on grounds relating to your particular situation (Art. 21 GDPR).

Write to us at the address above for that.

You can also lodge a complaint with a data protection supervisory authority (Art. 77 GDPR).

The one competent for us is:

Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen
https://www.ldi.nrw.de/

Obligation to provide data and automated decisions

Without the details of your account you can’t use Acriva. There is no legal obligation to provide them. We make no decisions that are based solely on automated processing and have legal effect on you (Art. 22 GDPR).

Changes

We update this notice when the service or the law changes. The version above names its date. The provider’s details are in the legal notice.