Privacy Policy

As of Aug 13, 2026

Note: This policy describes the services and data flows we actually use, but (as of this version) has not yet been reviewed by a law firm. For questions, please use the contact address below.

1. Data controller

PixelPerfect Solutions, P. Pfeiffer
Av. P. de la Reforma 250, Juárez, Cuauhtémoc, 06600 Mexico City, Mexico
Email: support@zahly-app.com

Note (EU representative under Art. 27 GDPR): Because Zahly is offered from outside the EU and targets users in the EU, we are in the process of appointing an EU representative. Their contact details will be added here once the appointment is complete. Until then, please contact us directly at support@zahly-app.com.

2. This website (zahly-app.com)

When you visit this website, our hosting provider processes technical access data (IP address, date and time, page requested, browser type, volume of data transferred) in server log files. This is necessary for the secure and stable operation of the website. Legal basis: Art. 6(1)(f) GDPR (legitimate interest).

Cookies and consent

Strictly necessary storage (e.g. your cookie choice in your browser's local storage) is used without consent. All non-essential cookies and comparable technologies — in particular web analytics — are only activated after you have given your explicit consent in the cookie banner (Art. 6(1)(a) GDPR, § 25(1) TDDDG). You can change or withdraw your choice at any time with effect for the future via the “Cookie settings” link in the footer. The lawfulness of processing carried out before withdrawal remains unaffected.

Google Analytics 4

Subject to your consent, we use Google Analytics 4, a web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”). Google Analytics uses cookies and similar technologies to analyse how you use this website, so that we can understand which content is used and improve the site.

Data processed: truncated IP address, device and browser information, approximate location (country/region), pages viewed, time on page, referrer URL and a randomly generated pseudonymous user/session identifier.

Measurement ID: G-T4XEVN37WB

Legal basis: Art. 6(1)(a) GDPR and § 25(1) TDDDG (your consent). Without consent no analytics cookie is set and no measurement takes place; we use Google Consent Mode v2 with the default set to denied.

Processing agreement: We have entered into Google's Data Processing Terms.

International transfers: Personal data may be transferred to Google LLC in the USA. Google LLC is certified under the EU–US Data Privacy Framework; EU Standard Contractual Clauses apply in addition. Despite these safeguards, access by US authorities cannot be completely ruled out.

Retention: Event-level data collected in Google Analytics is deleted automatically after 14 months. Your consent decision is stored for 6 months in your browser's local storage.

Objection / withdrawal: You can withdraw your consent at any time via “Cookie settings” in the footer. Google also offers a browser add-on to opt out: tools.google.com/dlpage/gaoptout.

More information: Google Privacy Policy

3. The Zahly application (desktop app)

Zahly is designed as a local desktop application: invoice, customer, and company data is primarily stored and processed on your own device, not on our servers. For account features (login, cloud backup, subscription) we process the following data via our backend:

Account data: email address, password hash (never stored in plain text), optional recovery email address. Legal basis: Art. 6(1)(b) GDPR (contract performance).
Records/invoice files: once an internet connection is available, these are automatically archived in our cloud, AES-256-GCM encrypted and immutable. Legal basis: Art. 6(1)(c) GDPR (statutory retention obligation under German GoBD/commercial/tax law, 8 years) as well as (b) (contract performance for the backup feature).
Billing data: your subscription status and plan are stored with us; the actual payment processing is carried out by Paddle (see section 5).

4. Service providers (data processors)

Hetzner Online GmbH (Nuremberg, Germany) — operation of our application server and database.
Backblaze, Inc. (object storage "B2") — encrypted, immutable archiving of your records (Object Lock, prevents subsequent modification/deletion during the retention period). Where this involves a transfer of data outside the EU, it is based on EU Standard Contractual Clauses.
Resend — sending of transactional system emails (login codes, password reset, account recovery, support notifications). No marketing/newsletter emails without separate consent.
Paddle.com Market Ltd. — payment processing for paid plans, see section 5.
Google Ireland Limited, Dublin, Ireland — web analytics (Google Analytics 4), only after consent.

We have, or will enter into, appropriate data processing agreements (DPAs) with all providers acting as processors within the meaning of Art. 28 GDPR.

5. Payment processing via Paddle

Payment processing for paid plans (Premium, Business) is handled by Paddle as "Merchant of Record". This means the purchase contract is formed between you and Paddle, not directly with us — Paddle issues the invoice, handles payment, and takes care of worldwide sales-tax compliance. Paddle processes your payment and billing data as an independent controller. See Paddle's privacy policy for details: paddle.com/legal/privacy.

6. Retention period

Record data is retained immutably for 8 years due to the statutory GoBD retention obligation. Account data is stored until your account is deleted; upon deletion, login identity, pending codes, and OAuth links are removed or anonymized — already archived records remain in place for legal reasons until the retention period expires (see section 3).

7. Your rights under GDPR

Right to access your stored data (Art. 15 GDPR)
Right to rectification of inaccurate data (Art. 16 GDPR)
Right to erasure of your data (Art. 17 GDPR) — available directly in the app under Profile → Account & Security, subject to statutory retention obligations for records
Right to data portability / export (Art. 20 GDPR) — available directly in the app
Right to object to processing based on legitimate interest (Art. 21 GDPR)
Right to lodge a complaint with a data protection supervisory authority

8. Contact for privacy inquiries

For privacy questions, contact support@zahly-app.com.