Privacy Policy

As of: 02.11.2026 · The German version is authoritative.

1. Controller

MechtaNet UG (haftungsbeschränkt), Wuhlestraße 7a , 12683 Berlin, represented by the managing director Sofian Mechta. Email: [email protected]

2. The most important points in brief

• We only process what is necessary for reviewing and brokering bills.
• No advertising, no tracking, no analytics tools, no sharing with data brokers.
• Bills and proofs are stored encrypted and are seen only by our review team.
• Supporters never learn your full name or your address. People seeking help do not learn who paid their bill.
• Decisions about bills are made by people, not by machines.

3. Visiting the website and the app

When you visit, our server processes technically necessary data: IP address, date and time, the address requested, browser or app version. This serves secure operation and defence against attacks (Art. 6(1)(f) GDPR). We delete server logs after 7 days at the latest. To protect against password attacks, we store failed login attempts with a pseudonymised value of the IP address for no more than 24 hours.

Our website is delivered via the Cloudflare network (Cloudflare Germany GmbH or Cloudflare Inc., USA), which makes it faster and better protected against attacks. Cloudflare processes your IP address and technical data of the request; transfers to the USA are safeguarded by the EU-US Data Privacy Framework and standard contractual clauses. From the IP address Cloudflare derives only the country – we use it exclusively to show you the right language on your first visit and do not store it (Art. 6(1)(f) GDPR).

4. Account

For an account we store your name, email address, city, country, language, an encrypted password, and the date and version of your acceptance of the Terms of Use. The legal basis is the performance of the user contract (Art. 6(1)(b) GDPR).

5. Submit a bill

We process the uploaded document, payee, IBAN, BIC, amount, due date, payment reference, category, your text, and the displayed name and city. Bills may contain special categories of personal data, for example health data in the case of medical bills. We process these only with your express consent (Art. 9(2)(a) and Art. 6(1)(a) GDPR), which you give when submitting the bill.

Who sees what:

• Public (after review): title, text, displayed name, city, country, category, amount, due date. These pages are blocked for search engines.
• Only the person who takes on your bill and has paid the fee: payee, IBAN, BIC and payment reference – so that they can transfer the money directly. The payment reference may contain your customer or invoice number.
• Only our review team: the document itself, your name and your email address.

For the review, we may ask the payee of the bill whether the bank details are correct. In doing so, we disclose only the information necessary for the review.

You can withdraw your consent at any time with effect for the future by withdrawing the bill or writing to us. If someone has already taken on the bill, we need the data until the payment has been completed.

5a. Identity verification of people seeking help

Anyone who submits bills provides their first and last name, date of birth, address, optionally a phone number, and a copy of an official ID (and optionally a photo of themselves holding the ID). The purpose is to prevent fraud with forged bills or stolen identities and to attribute the bill to a real person. The legal basis for the ID copy is your consent (Art. 6(1)(a) GDPR, § 20(2) PAuswG (German Identity Card Act)); for the other details it is our legitimate interest in a platform free of abuse and the performance of the user agreement (Art. 6(1)(b) and (f) GDPR).

The ID copy is stored encrypted, viewed only by our review team and automatically deleted 30 days after the check. You may black out the access number and the serial number. We keep the details themselves for as long as your account exists. Supporters do not learn anything about this. We compare IDs by eye only – no automated biometric analysis takes place.

6. Buying and redeeming credits

If you buy credits, we store the package, price, payment method, time, your consents and the status of your balance (Art. 6(1)(b) GDPR). For bank transfers, we receive the details of your transfer from our bank. If you buy in the app, Apple or Google is the seller and processes the payment data itself; we receive only a transaction number and verify it with Apple or Google.

When you take over a bill, we store this, the balance redeemed and your proof of payment. The proof is seen only by our review team, not by the person seeking help.

We issue an invoice for every purchase on the website. We must keep invoices and accounting data for 10 years (§ 147 AO, § 257 HGB; Art. 6(1)(c) GDPR) – even if you delete your account.

6a. Support requests

When you write to us via “Support”, we store your messages, attached photos or PDFs (encrypted) and our replies in order to handle your request (Art. 6(1)(b) GDPR). We delete completed requests, including attachments, one year after they are closed.

7. Protection against abuse

To prevent fraud, we compare information with earlier bills, e.g. whether an IBAN has already been submitted with a different payee. The legal basis is our legitimate interest and that of our users in a secure platform (Art. 6(1)(f) GDPR).

8. Emails and notifications

We send you emails that are part of the process (e.g. review result, payment, receipts). We do not send advertising. We delete notifications in the app after 180 days and sent emails in our system after 90 days.

9. Retention period

• Documents (bill, proof): 90 days after the bill is closed, immediately if withdrawn.
• Information about the bill: 365 days after closure.
• Account: until you delete it. When you delete it, we remove your data and documents, except the fee receipts (see No. 6).
• Withdrawal declarations: 3 years (limitation period).

10. Recipients and service providers

Our servers and our email server are operated in Germany by Contabo GmbH, München, with whom we have concluded a data processing agreement (Art. 28 GDPR). No transfer to countries outside the EU takes place, except for online payments (No. 6).

11. Cookies and storage on your device

We use only technically necessary cookies (§ 25(2) TDDDG (German Telecommunications Digital Services Data Protection Act)): “ipfy_sitzung” for login and form protection (30 days) and “sprache” for your language choice (1 year). That is why there is no cookie banner.

12. App

The app displays this platform. It accesses the camera, photos and files only when you yourself upload a file. The app contains no advertising or analytics tools.

If you allow notifications in the app, we store a device identifier and link it to your account (Art. 6(1)(b) GDPR). Notifications are delivered via the Apple Push Notification Service (Apple Inc., USA) or Firebase Cloud Messaging (Google Ireland Ltd./Google LLC, USA); this may involve a transfer to the USA (EU-US Data Privacy Framework). A notification only contains the type of news and the bill number – no amounts, names or bank details. When you log out, we remove the device identifier; you can also turn off notifications at any time in your device settings.

13. Your rights

You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20) and withdrawal of consent given (Art. 7(3) GDPR). You can download a copy of your data at any time under “Account”; you can also delete your account there.

Right to object (Art. 21 GDPR): you may object at any time, on grounds relating to your particular situation, to processing based on our legitimate interest (No. 3 and 7).

You can lodge a complaint with a data protection supervisory authority, for example with the one responsible for us: Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen, Kavalleriestraße 2–4, 40213 Düsseldorf.

14. Obligation to provide information and automated decisions

We need the information in your account and on bills in order to offer the platform; without it, use is not possible. No automated decision-making or profiling within the meaning of Art. 22 GDPR takes place.