Privacy Policy — Amtigo
Last updated: 29 October 2026 · Applies to the Amtigo app (Android) and amtigo.app
1. Controller
Kadir Saraçoğlu (UKD Software), Helios Villa Sitesi, Yunus Emre Caddesi 33, Belek Sokak, Helios Villa 2, 07500 Serik/Antalya, Türkiye, e-mail: hallo@amtigo.app (see Impressum). No data protection officer has been appointed, as the requirements of Art. 37 GDPR are not met.
2. In short
- Text recognition (OCR) of the photographed letter runs on your device.
- For the analysis, the recognised text and the photo are sent encrypted to our server in Germany, processed there in memory only and not stored. Only the recognised text is passed to the AI provider (processor); the photo only if an image-capable model is active (currently not the case). Afterwards the data is discarded on the server.
- Results, reminders and drafts are stored only on your device.
- We do not store names, addresses or letter contents on the server; only technical usage metrics without content (timestamp, token counts, duration, error status) and your subscription status.
- No account is required; the app uses a randomly generated device identifier.
3. Data we process
| Data | Purpose | Legal basis | Location / retention |
|---|---|---|---|
| Photo of the letter (only when you start an analysis) | On-device OCR; sent to the server; to the AI model only if it supports images | Art. 6(1)(b) GDPR | Device: until you delete; server: memory only during the request |
| Recognised text incl. personal data it contains (your name, reference numbers, amounts) | AI analysis | Art. 6(1)(b); for special categories (e.g. health data in insurer letters) your explicit consent (Art. 9(2)(a)), given by starting the analysis of that letter – you choose which letters to analyse | Server: during the request only; AI provider: no storage and no training (see section 4) |
| Analysis result, draft, reminders | Display, archive, calendar | Art. 6(1)(b) | Device only (SQLite); delete anytime in Settings |
| Device identifier (random UUID) | Free first analysis, daily limit, subscription mapping | Art. 6(1)(b), (f) | Server: until deletion via web form |
| Subscription data (product, status, expiry, store; no payment data) | Unlocking Premium | Art. 6(1)(b) | Server and RevenueCat: term + statutory retention |
| Usage metrics without content (time, endpoint, model, tokens, duration, error type, language) | Operation, cost control, debugging | Art. 6(1)(f) | Server: 90 days, then deleted automatically |
| Server access logs (truncated IP – IPv4 /24, IPv6 /48 –, time, path, status) | Security, abuse prevention | Art. 6(1)(f) | Server: 14 days, rotated daily |
| Connection data at Cloudflare (IP address, time, requested address) | Routing, attack protection | Art. 6(1)(f) | Cloudflare: under its data processing agreement |
| Content reports ("Report content": analysis ID, reason, optional text) | Quality assurance, Google Play AI policy | Art. 6(1)(f) | Server log: at most 12 months |
| Deletion requests (e-mail address, hashed device identifier, time) | Carrying out and evidencing the deletion | Art. 6(1)(c) with Art. 5(2), 17 GDPR | Server: 3 years |
| Notifications (deadline reminders) | Reminder | Consent (system dialog), Art. 6(1)(a) | Device only |
Payment data is processed exclusively by Google Play; we never receive it.
4. Recipients and processors
Hetzner Online GmbH (dedicated server hosting in Germany; the database with subscription status and metrics runs on the same server); Cloudflare, Inc. (network service: TLS encryption, attack protection and forwarding of requests through an encrypted tunnel to our server; Cloudflare sees connection data and passes content through without storing it); OpenRouter, Inc. and the active AI model for the analysis and reply drafts; RevenueCat, Inc. (subscription management); Google (Play, Play Billing, on-device ML Kit). Processors act under data processing agreements.
Active AI model: DeepSeek V4.1 Flash via OpenRouter. OpenRouter routes requests only to model providers that, by their own statement, neither store inputs nor use them for training (setting "data_collection: deny"). If we switch AI providers, we update this policy before the switch.
5. International transfers
Where recipients are located outside the EU/EEA (Cloudflare, OpenRouter and model providers, RevenueCat), transfers rely on Standard Contractual Clauses (Art. 46(2)(c) GDPR) or an adequacy decision (EU-US Data Privacy Framework) where the recipient is certified. Letter text is processed only to answer the request and is not stored.
6. No automated decision-making
The AI output is a translation and explanation aid; it does not make decisions with legal effect (Art. 22 GDPR). You decide.
7. Your rights
Access, rectification, erasure, restriction, portability, objection and withdrawal of consent with effect for the future. You may lodge a complaint with any data protection supervisory authority, in particular in the member state of your habitual residence, place of work or the alleged infringement (Art. 77 GDPR); in Germany this is the authority of your federal state. Contact: hallo@amtigo.app.
8. Deletion
In the app: Settings → "Delete all data" removes all local analyses, drafts and settings. Server-side data (device identifier, subscription status, metrics) can be deleted via https://amtigo.app/delete within 30 days, subject to statutory retention obligations.
9. Children
The app is intended for persons aged 18 and over.
10. Changes
We update this policy when processing changes. The current version is available in the app (Settings → Privacy) and at https://amtigo.app/datenschutz.