Privacy policy

This privacy policy applies to sourcecloud.com and to all products and websites of SourceCloud GmbH. It starts with what applies everywhere, followed by one section per product, an overview of service providers and your rights.

Controller

For questions about data protection and to exercise your rights, simply email info@sourcecloud.com.

Summary

• We process data to deliver our websites and apps, to manage accounts and contracts, to help you in support and to meet legal obligations.
• We use no Google Analytics and no error tracking. We measure reach only on visualtradingjournal.com, with Cloudflare Web Analytics.
• Our servers are located at Hetzner Online GmbH in Germany. Some service providers are based in the USA or process data there; they are named in the sections below.
• Orders and payments are handled by Digistore24.
• AI features only use the AI provider that you choose yourself with your own key.

All websites and products

Visiting websites and apps

When you visit one of our websites or apps, our servers process technically necessary connection data: IP address, date and time, requested address, amount of data transferred, referring page, browser and operating system details and status information. We need this data to deliver the content, to secure our systems and to detect faults or attacks. The legal basis is our legitimate interest under Art. 6(1)(f) GDPR. We keep access logs only as long as these purposes require. Some applications keep no access logs at all; the respective section says so.

To prevent misuse, several applications count sign-in attempts per IP address for at most one hour.

Hosting

Our websites, apps and databases run on servers of SourceCloud GmbH at Hetzner Online GmbH in Nuremberg, Germany; exceptions are the help desk (LiveAgent) and videos in the Visual Trading Journal handbook (Adilo). Files are stored in Hetzner’s object storage in Nuremberg, backups in a Hetzner Storage Box in Falkenstein, Germany. Hetzner’s information: privacy policy.

Cloudflare

For most of our domains, Cloudflare, Inc. provides DNS and forwards requests as a proxy to deliver content securely and quickly and to fend off attacks. Cloudflare processes your IP address and the request and may set technically necessary cookies for security checks. Cloudflare also receives your browser’s network error reports (Network Error Logging). visualinvoice.com and the apps of Visual Invoice, Visual Todo, Visual File Safe and KudosFive also run via the Cloudflare proxy. Cloudflare also processes data in the USA. The legal basis is Art. 6(1)(f) GDPR. Cloudflare’s information: privacy policy.

Contact

When you contact us, we process your contact details and your request in order to handle it. The mailboxes of sourcecloud.com and visualtradingjournal.com are hosted by Google, so emails sent there are processed by Google, including in the USA. The legal basis is Art. 6(1)(b) GDPR if your request concerns a contract, otherwise Art. 6(1)(f) GDPR.

Support, appointments and remote assistance

• LiveAgent: We use LiveAgent by Quality Unit for support requests, for our help desk and the chat on visualtradingjournal.com. It stores your requests, messages and contact details. So that we can handle your request, we may see information about your customer account in the app concerned there, such as edition and contract status. The help desk sets the cookie visitor_la_sid.
• Appointments: You book support appointments via Zoom Scheduler; we manage appointments in Google Calendar. This involves your name, your email address and the appointment.
• Video calls and webinars: Calls and webinars take place on Zoom. Zoom processes connection data as well as video, audio and chat as far as you share them, including in the USA.
• Remote assistance: At your request, we help you on your screen via TeamViewer, which processes connection and screen data.

The legal basis is Art. 6(1)(b) GDPR where your contract is concerned, otherwise Art. 6(1)(f) GDPR.

System emails

Visual Trading Journal, Visual Todo, Visual Mail, Visual File Safe and KudosFive send system emails, for example for activation, sign-in or notifications, via Amazon Simple Email Service (Amazon SES) in the Frankfurt region. Amazon SES processes the recipient address and the content of the email.

Purchase and billing

You buy our products via Digistore24. Digistore24 acts as reseller and is your contractual partner for the order, payment and invoice; the Digistore24 privacy policy applies. After the purchase, Digistore24 reports the order to our order system. For this we store the complete Digistore24 notification as well as name, email address, address, company, VAT identification number, phone number, order, amount and payment method, and we activate your product. The legal bases are Art. 6(1)(b) GDPR and, for retention under commercial and tax law, Art. 6(1)(c) GDPR.

Accounts in our apps

For an account we process at least your email address, usually your name and a password, which we only store as a hash. Without this information we cannot provide an account. We keep account data as long as your account exists. You can request the deletion of your account by email at any time; in KudosFive you can also delete it yourself. Data we must retain under commercial or tax law is stored until these periods expire.

AI features with your own key

Visual Invoice, Visual Mail Automation and KudosFive offer AI features. They only work if you choose an AI provider yourself and enter your own access key. We then transmit the content required for the feature to that provider, under your contract with it. The respective section states which content this is. The providers (for example OpenAI or Anthropic) also process data in the USA.

Storage in your browser

Our apps set session cookies so that you stay signed in, and store settings such as language or appearance in your browser’s local storage (localStorage, sessionStorage). These entries are strictly necessary for the feature you requested (Section 25(2) no. 2 TDDDG); we set no advertising or analytics cookies. On visualtradingjournal.com, embedded scripts of service providers such as LiveAgent may set their own cookies; their privacy policies apply. The respective section lists the entries per product. You can delete them in your browser at any time.

Legal bases and retention

We process data to perform contracts and pre-contractual requests (Art. 6(1)(b) GDPR), to meet legal obligations (Art. 6(1)(c) GDPR), on the basis of legitimate interests in secure, working services (Art. 6(1)(f) GDPR) and, where we ask for it, with your consent (Art. 6(1)(a) GDPR). How long we store data depends on the purpose of the processing and on statutory retention obligations. The product sections state fixed periods.

Transfers to third countries

Some service providers are based in the USA or process data there: Cloudflare, Google, Amazon Web Services, Zoom, Adilo, Slack and the AI providers you choose yourself. Where a provider is certified under the EU-US Data Privacy Framework, the transfer is based on the European Commission’s adequacy decision.

sourcecloud.com and product websites

sourcecloud.com and the product websites visualtodo.com, visualinvoice.com, visualmail.com, visualfilesafe.com and kudosfive.com are static pages without forms, analytics or advertising. Fonts and images come from our own server. Contact and order requests are made by email. Cloudflare acts as a proxy for all of these domains.

sourcecloud.com stores nothing in your browser. On the product websites, your browser stores your choice between light and dark mode in localStorage (entry pw-scheme) once you switch it in the page header. The entry stays on your device and is not transmitted to us.

The e-invoice reader on visualinvoice.com runs entirely in your browser. The file you open does not leave your device.

Visual Trading Journal, Visual Steuer and Visual Wertpapierverbuchung

Visual Steuer and Visual Wertpapierverbuchung are extensions of Visual Trading Journal and run in the same app with the same account. Website and app run via the Cloudflare proxy.

Website visualtradingjournal.com

• Reach measurement: The website uses Cloudflare Web Analytics. It records page views and loading times, according to Cloudflare without cookies. We only see aggregated figures. The legal basis is our legitimate interest in improving the website (Art. 6(1)(f) GDPR).
• Fonts: The website loads its fonts via Cloudflare; your browser does not connect to Google.
• Purchase notes: Notes on recent purchases only show initials, place and time from a public Digistore24 source; our server keeps them for at most 24 hours.
• Chat: On several pages, the website loads the LiveAgent contact button after a few seconds.
• Videos in the handbook: Videos from YouTube (in privacy-enhanced mode, youtube-nocookie.com) or Adilo are only loaded when you click a video. Google or Adilo (BigCommand LLC, USA) then receive your IP address and playback information.
• Browser: The website sets no cookies of its own. It remembers whether you closed the purchase notes (sessionStorage vtj-purchase-hints-closed) and, in the handbook, the state of the sidebar (localStorage vtj.handbook.sidebar.*).
• Access log: The web server logs IP address, time, address, referring page and browser identifier.

App

• Account: Your account is created after the purchase via Digistore24 with an activation email, or during promotions by registration with confirmation of your email address. We store email address, name, password hash, shop customer numbers, booked features, terms and shares.
• Portfolio data: We store your Flex token and query IDs with your portfolio. With them, the app retrieves data from Interactive Brokers: transactions, trades, confirmations, cash balances and positions; from the account information only the account ID, dates and currency. We also store your comments, your watchlist and your chart of accounts for bookkeeping. PDF statements you upload are deleted after processing.
• Price data: For prices, the server only queries security symbols and ISINs at Financial Modeling Prep, no personal data.
• Tax advisers: If a tax adviser works with Visual Steuer on your behalf, they can work in your account for one hour at a time.
• System emails: A copy of every system email of the app goes to an internal mailbox (at Google) so that we can trace delivery and support cases.
• Browser: The app sets no cookies. It stores your session and settings in localStorage (for example session, vtj-theme, appset-*) and keeps copies of your transactions, trades and positions in the browser database (IndexedDB) so that it loads quickly. On shared devices, delete this data via your browser settings.
• Retention: Sessions end after 14 days, import jobs after 48 hours. We keep account and portfolio data as long as your account exists.

The legal basis is Art. 6(1)(b) GDPR; for access logs and security Art. 6(1)(f) GDPR.

Visual Invoice

• Account: You register with name, email address and password and set up your company as a tenant: address, VAT identification number, tax number, bank details (IBAN, BIC) and contact person. Invitations are valid for 14 days.
• Content: Your contacts, invoices and received documents. Logos, PDF and XML files are stored in Hetzner’s object storage in Nuremberg. Sent invoices are stored unalterably to meet retention obligations; only drafts can be deleted.
• Delivery: Invoices only go to destinations you set up yourself, for example your email mailbox (SMTP), WebDAV or paperless-ngx. We store the credentials for these and your AI key encrypted, and API keys only as a hash.
• AI: If you enter your key for Anthropic, we transmit received documents to Anthropic to obtain suggestions for capturing them.
• Browser: session cookie vi_session; localStorage vi-locale and vi-theme.
• Retention: Sessions end after 30 days of inactivity, at the latest after 90 days. We keep invoices as long as commercial and tax law requires.

Visual Todo

• Account: name, email address and password hash; you confirm your email address via a link. Invitations to lists are valid for 7 days and contain the invited person’s email address.
• Content: your lists, tasks, comments and private notes. Attachments are stored encrypted (AES-256-GCM) in Hetzner’s object storage in Nuremberg.
• Notifications: If you allow push notifications, we store your browser’s push address. The messages are delivered via your browser’s push service (Google, Mozilla, Apple or Microsoft).
• External AI agents: If you connect your own AI agents via the interface (REST, MCP), they get access to your lists and tasks, but not to private notes. Access ends after 90 days at the latest.
• Browser: session cookie visualtodo_session; localStorage visualtodo.preferences and visualtodo.lastList.*.
• Retention: Sessions end after 7 days. We keep the content of outgoing emails for 7 days and their metadata for 30 days. The app keeps no access logs.

Visual Mail Automation

• Account: name, email address and password hash.
• Mailbox access: So that the app can run your rules, we store the credentials of your mailboxes (IMAP password or, for Google mailboxes, an access token) encrypted. We do not store the text of your emails; we only read it when needed. Subject, sender, recipients, headers, attachment information and a short text excerpt are cached.
• Rules and spam filter: We log which rule applied to which email (subject, sender) and keep your spam lists and learning data. The spam filter runs on our servers.
• AI: If you enter an AI provider with your own key (OpenAI, Anthropic or a compatible service at an address of your choice), we transmit the subject, sender and up to 6,000 characters of text of the email concerned for analysis. We store your key encrypted.
• Browser: session cookie mf_session; localStorage for appearance, language and view (mailfilter.*, visualmail-session:*).
• Retention: cached header data 90 days, the rule log 180 days, test runs 14 days, the spam filter’s statistical learning data about 100 days. We keep records of processed emails, learning events and daily statistics as long as your account exists. Application logs redact credentials.

Visual Mail Publisher

With Visual Mail Publisher, publishers release letters and issues to their readers.

• Accounts: Reader accounts are created via the publisher’s shop or by its editorial team. We store email address, name, role and consents.
• Reading: We store reading progress, notes, highlights and feedback and, for the publisher’s statistics, on which days you opened which issue.
• Emails: We send emails via Amazon SES.
• Files and images: Files are stored in Hetzner’s object storage in Nuremberg; Cloudflare delivers images.
• Payment: You pay the publisher, via its Digistore24 account.
• Browser: session and security cookies __Secure-vmp-*; localStorage for appearance and text size; editorial drafts in sessionStorage; a copy of the issues in the browser cache for offline reading.
• Retention: We delete sessions one day after they expire and unsubscribe and feedback links from emails after 400 days. The application keeps no access logs.

Visual File Safe

• Account: Accounts are created after a purchase or by invitation. We store name, email address, company and password hash.
• Cases and files: For each case we store the client’s name and a description, the uploaded files and their details. Files are stored encrypted (AES-256-GCM) in Hetzner’s object storage in Nuremberg. People uploading files may voluntarily give an email address; it is stored encrypted.
• Virus scan: Files up to 500 MiB are checked by a virus scanner on our servers; no files leave our servers for this, we only download virus signatures.
• Notifications: In addition to emails, your company can have notifications sent to its own Slack channel.
• Browser: session cookie vfs_session; localStorage vfs.color-scheme; sessionStorage vfs-resume-* to resume interrupted uploads.
• Retention: Depending on the case setting, files remain stored for 1 to 90 days (30 days by default). We keep information about deleted files for 90 days and events for 30 days. To prevent misuse, we only use IP addresses as a hash for at most one hour.

KudosFive

• Account: Accounts are created after a purchase. You sign in without a password via a link sent by email. We store your company, logo, users and addresses for notifications.
• Reviews: People who leave a review provide a display name, email address, text, stars and categories. The email address is not published. We store invitations and block lists only as a hash of the email address.
• App store reviews: On request, KudosFive imports public reviews from the Apple App Store and Google Play.
• AI: If you enter OpenAI or Anthropic with your own key, we transmit review texts to that provider to translate them, detect their language and summarise them.
• Widgets: If a customer embeds reviews in its website via a widget, the visitors’ browsers load these reviews from our servers; this involves the connection data described in the general part.
• Webhooks: We send events to addresses you specify yourself.
• Self-service: You can export your data and delete your account yourself; the deletion becomes final after 14 days.
• Browser: session cookies kudos_session and kudos_operator; the draft of a review stays in sessionStorage until you submit it.
• Retention: technical data 7 days, unconfirmed reviews 30 days, invitations 90 days, events 400 days, complaints 365 days. We clear withdrawn reviews after 30 days. Sessions end after 12 hours of inactivity, at the latest after 30 days. Backups are kept in a Hetzner Storage Box.

Visual Rain

Visual Rain (rain.sourcecloud.com) needs no account. You determine your location in the browser via geolocation or enter it yourself; it is not transmitted to us. The radar images your browser loads from our server reveal the area shown. Our server obtains weather data from Deutscher Wetterdienst. Your browser stores your chosen appearance in localStorage (visual-rain.appearance).

GizmoParty

The apps on gizmoparty.com run entirely in your browser, without an account and without a server processing your input. Share links from CalcEdit carry the content in the part of the address after the #, which browsers do not send to servers. The start page stores your language in the cookie gizmo-lang (one year) and language and appearance in localStorage. The individual apps store your work and settings in localStorage or in the browser database (IndexedDB), each in its own namespace, for example calcedit.*.

The Hoelth

hoelth.com presents music by The Hoelth and links to streaming services such as Spotify, Apple Music, YouTube Music, Tidal, Amazon Music and Deezer without embedding them. Only when you follow a link does the privacy policy of that service apply. The page loads no scripts and stores nothing in your browser. Cloudflare Email Routing forwards emails to hoelth.com to our mailbox.

Service providers at a glance

• Hetzner Online GmbH, Germany: servers, object storage and backups for all products.
• Cloudflare, Inc., USA: DNS, proxy and security; Web Analytics and fonts for visualtradingjournal.com; images for Visual Mail Publisher; email forwarding for hoelth.com.
• Amazon Web Services (Amazon SES, Frankfurt region): system emails.
• Google: mailboxes, calendar for support appointments, videos in the Visual Trading Journal handbook (YouTube) and, if you use it, signing in Gmail mailboxes in Visual Mail Automation.
• Digistore24: order, payment and invoice as reseller.
• Quality Unit (LiveAgent): help desk and chat.
• Zoom: appointment booking, video calls and webinars.
• TeamViewer: remote assistance at your request.
• Interactive Brokers: retrieval of your portfolio data in Visual Trading Journal with your token.
• Financial Modeling Prep: security price data, without personal data.
• Adilo (BigCommand LLC), USA: videos in the Visual Trading Journal handbook.
• AI provider of your choice (for example OpenAI or Anthropic): only with your own key.
• Push services of browser vendors (Google, Mozilla, Apple, Microsoft): push notifications if you allow them.
• Apple and Google: retrieval of public app store reviews for KudosFive.
• Slack: notifications from Visual File Safe if your company sets them up.

Your rights

Within the statutory framework, you have the right of access, rectification, erasure, restriction of processing and data portability. You may object to processing based on legitimate interests on grounds relating to your particular situation. You can withdraw consent at any time with effect for the future. Please write to info@sourcecloud.com.

You may also lodge a complaint with a data protection supervisory authority, in particular the Independent Centre for Data Protection Schleswig-Holstein (ULD).