This notice explains which personal data is processed when you use Envolva at envolva.de: when you log in, in the workspaces and when you contact us. Customers are also bound by the General Terms and Conditions, all users by the Terms of Use and, where required, the data processing agreement. The German version prevails.
Controller
The controller is Kahriman GmbH, Ferdinand-Wallbrecht-Str. 34, 30163 Hannover, Germany. Send privacy requests to info@envolva.de.
Hosting and server logs
Envolva runs on Laravel Cloud. The data location is Frankfurt am Main, Germany. When pages are requested, technically necessary details such as IP address, time, requested address, browser information and error data may be processed.
This processing serves secure delivery, error analysis and the defence against abusive access. Log data is kept only as long as operations, security or legal duties require.
Account, workspaces and documents
For your account we process your name, your business email address, your role, your access rights and which version of the Terms of Use you accepted and when. When you set up a passkey, log in with it or delete it, we store the time, IP address and browser details; this also applies to failed passkey logins. These details protect your account.
In the workspaces we process the details, inputs and documents your company records or uploads for its reports. Uploaded documents are stored with the storage provider Cloudflare, with the data location in the European Union.
The processing serves the performance of the contract with your company. If you use Envolva through a Partner, Envolva processes the data for the services the Partner provides to your company.
AI functions
Some functions work with artificial intelligence: the AI assistant Helphy, AI text suggestions, reading uploaded receipts and matching emission factors. For this, Envolva sends the inputs a function needs for its result to the AI provider Mistral AI, based in France. To find matching emission factors, Envolva also sends the name, description and unit of an item to the provider OpenAI; OpenAI computes a search vector from them, which Envolva uses to search its own factor database. Customer content is not used for training AI models without explicit permission.
Payments and emails
Card payments are processed by Stripe; Stripe's privacy notices apply in addition. We keep invoices and payment data for the statutory retention periods. Emails, for example invitations and invoices, are sent through an email service provider.
PDF creation and operational monitoring
Envolva creates the sustainability report as a PDF through the rendering service of Cloudflare. For this, the report content is sent to Cloudflare; caching of the generated file at Cloudflare is switched off.
Envolva monitors errors and response times of the application with Laravel Nightwatch. This processes technical details, for example requested addresses, error messages and details of the logged-in user.
Contact
If you contact us by email, by phone or through "Contact sales", we process your details to handle the request. The legal basis depends on the occasion, in particular pre-contractual measures or our legitimate interest in answering business enquiries. We keep the request only as long as handling it, pre-contractual measures and legal duties require.
Technically necessary cookies
Envolva uses a session cookie for secure login. The session expires after 120 minutes of inactivity. The cookie is encrypted and signed, protected by HttpOnly against access by browser scripts and configured with SameSite=Lax. XSRF-TOKEN contains an encrypted protection value against cross-site requests. If you choose "Remember me" when logging in, Envolva also sets a login cookie that keeps you logged in for up to 400 days; it is deleted when you log out.
These cookies are required for security and login. Envolva uses no analytics or advertising cookies.
Transfer and own resources
Envolva is delivered over HTTPS. Envolva serves its fonts and scripts itself; no external font or script provider is contacted when pages load.
Retention and deletion
We keep data only as long as the purpose, contractual duties or legal requirements demand. Twelve months after the end of a reporting year without renewal, Envolva deletes or anonymizes its data; we announce the deletion by email beforehand. Invoices are kept for the statutory periods.
Your rights
Where the legal conditions are met, you have in particular the rights of access, rectification, erasure, restriction of processing, data portability and objection. You can withdraw a consent at any time with effect for the future. You can also lodge a complaint with a data protection supervisory authority. For requests about these rights, contact us at info@envolva.de.