Last updated: 29 May 2026
Privacy Policy
This English version is provided for convenience. If legal interpretation differs, the German version applies unless mandatory law provides otherwise.
1. Controller
The controller for the processing of personal data in connection with clutr is:
Proximo Systems Dreessen & Haensch GbR
Bauernholztal 33
21149 Hamburg
Germany
Represented by Philipp Dreessen and Johannes Haensch, both partners.
Email: pd@proximo-systems.de
Email: jh@proximo-systems.de
2. Purpose and functionality of clutr
clutr is a cloud-based document filing service. Users can upload, store, read by OCR, classify with AI support, search, export and optionally integrate documents through external storage, APIs or email import. Processing serves the provision, security, management and improvement of these functions.
3. Categories of data processed
Depending on use, we process account data such as username, name, email address, password hash, two-factor authentication, passkey information, roles, workspace memberships and settings.
We process contract and billing data such as plan, credits, payment status, PayPal and Stripe references, invoice and usage data, storage use, traffic, document and page quotas.
We process document data such as uploaded files, file names, folder structures, document content, OCR text, previews, search index, classifications and export files.
We process metadata extracted from documents or maintained by users, such as provider, document type, document date, amounts, invoice numbers, customer numbers, contract numbers, insurance numbers, case references, tax numbers, VAT IDs, IBANs, license plates, search terms and summaries.
We process technical data such as IP address, access time, browser and device data, logs, session information, security events, API calls and error data.
4. Legal bases
Processing is based on Art. 6(1)(b) GDPR where required to provide the user account, workspaces, document filing, billing and booked functions.
Where we comply with legal obligations, for example commercial or tax records, processing is based on Art. 6(1)(c) GDPR.
For security logs, abuse prevention, error analysis, protection of infrastructure and enforcement of legitimate claims, we process data based on Art. 6(1)(f) GDPR.
Where consent is required, for example for non-essential cookies, optional integrations or certain communication channels, processing is based on Art. 6(1)(a) GDPR. Consent can be withdrawn at any time with effect for the future.
5. Special categories of personal data
Users may upload documents containing special categories of personal data, such as health data, union membership, religious information or other sensitive information. We do not specifically request such data but cannot exclude its presence in user files. Processing takes place solely to provide the document functions chosen by the user.
6. AI, OCR and automatic metadata
For OCR, classification, folder logic, search functions and questions to documents, document content, file names, OCR text and metadata may be processed automatically. External AI service providers may be used. Processing serves the analysis and filing requested by the user. Results may be incomplete or incorrect and should be reviewed for important decisions.
We do not use uploaded documents for our own advertising purposes. We do not use document content to train our own generally available AI models.
7. Hosting, storage and infrastructure
clutr is operated on server and cloud infrastructure. In particular, Amazon Web Services may be used for server operation, databases, encrypted storage, email delivery, backups, logs and security functions. Documents may be stored encrypted in object storage.
Users may also connect external storage or services such as Google Drive, Dropbox, OneDrive or STRATO HiDrive. When such integrations are used, the required authentication, path, file and metadata are processed.
8. Email import, API and notifications
When email import is used, incoming emails, attachments, senders, recipients, subject lines, timestamps, technical mail headers and email content may be processed where required for import, spam and security checks, classification and filing.
When the API is used, API tokens, uploads, downloads, timestamps, status messages and technical access data are processed. Folder notifications may be sent to email addresses stored by the user.
9. Payment service providers
Payment service providers such as PayPal may be used for payments and credit top-ups. We process payment status, amount, currency, order or transaction references and assignment to the user account. Payment processing itself takes place with the respective payment provider.
10. Cookies and local storage
clutr uses technically necessary cookies and comparable storage mechanisms, especially for login, session management, security, workspace selection and service functionality. Non-essential cookies, tracking or marketing technologies are used only where valid consent exists.
Specifically, clutr currently uses the technically necessary session cookie session for login, security status, workspace selection and ongoing authentication; optionally the cookie clutr_trusted_device when users select "Trust this device for 30 days" at login; the cookie clutr_lang for language selection; and browser localStorage to remember that the cookie notice has already been shown. Tracking, analytics or marketing cookies are not set.
11. Recipients and processors
Personal data is transferred to recipients only where required for operation, security, contract performance, payment processing, support or legal obligations. This may include hosting providers, cloud providers, AI service providers, payment service providers, email service providers, external storage providers and technical service providers.
Where service providers process personal data on our behalf, we enter into data processing agreements pursuant to Art. 28 GDPR. Where business customers use clutr to process personal data of third parties, we provide a data processing agreement where required.
12. Transfers to third countries
When individual service providers are used, processing outside the European Union or the European Economic Area cannot be excluded. In such cases, we ensure appropriate safeguards, such as adequacy decisions, standard contractual clauses, additional protective measures or contractual commitments by the service providers.
13. Retention period
We store personal data only as long as required for the respective purposes, statutory retention obligations, potential claims or security and evidence obligations.
Documents, OCR text, metadata and storage objects are generally deleted when users delete them or when the account or workspace ends, unless legal or legitimate reasons prevent deletion. Backups and security copies may remain for a limited time before they are regularly overwritten or deleted.
14. Security
We use technical and organizational measures to protect personal data against loss, misuse, unauthorized access and manipulation. These include transport encryption, server-side encryption, access restrictions, role and workspace separation, two-factor authentication, passkeys, malware scanning, logging, backups and regular maintenance.
15. Data subject rights
Data subjects have the rights under the GDPR to access, rectification, erasure, restriction of processing, data portability, objection to certain processing and withdrawal of consent. To exercise these rights, a message to the contact details above is sufficient.
16. Right to lodge a complaint
Data subjects have the right to lodge a complaint with a data protection supervisory authority. The authority at the controller's registered office or at the data subject's place of residence may be competent.
17. Changes to this Privacy Policy
We may update this Privacy Policy if functions, service providers, legal bases or technical processes change. The current version is available through the application.
18. Data protection documents for business customers
In addition to this Privacy Policy, the following documents are available for the data protection and security framework of clutr:
Data Processing Agreement pursuant to Art. 28 GDPR