Privacy Policy

Who is responsible?

Purple Digital UG (haftungsbeschränkt) represented by the managing director Christoph Sterkel Eifflerstraße 43 22769 Hamburg, Germany E-mail: datenschutz@halloamt.de

Data protection officer: Dr. Stefan Spörrer, LL.M., c/o DSBextern.de, Hofbauerstraße 3a, 94209 Regen, E-mail: dsb@dsbextern.de

You can contact him directly and confidentially with all questions concerning the processing of your data and your rights (Art. 38(4) and (5) GDPR).

What this is about

HalloAmt helps you fill in German government forms. To do that we process information that is very personal: your name and address, income, family circumstances, nationality, residence status and which social benefit you receive.

We are aware of what that means. This policy therefore tells you exactly which data we process, what for, who else sees it, how long we keep it and what rights you have.

Which data we process and why

1. Your account — e-mail address and password; if you sign in with Google, the identifier and e-mail address held there. Purpose: so that you can sign in and find your applications again. Legal basis: performance of a contract (Art. 6(1)(b) GDPR). How long: until you delete your account. Accounts created without registration are deleted automatically after 30 days. If you do not use your account for 12 months, we delete it with all data. Use means signing in or working with your account, for example on an application or a letter explanation. Before that, we send you an e-mail stating the day of deletion, at least 30 days in advance. If you sign in on or before that day, your account remains. Without this e-mail we do not delete. Excluded are accounts with a subscription that has not yet ended, with an open payment, an open withdrawal or with credit for forms that you have not yet used up.

2. What you enter in the chat — everything you provide so that a form can be filled in: name, date and place of birth, address, nationality, marital status, details about children and spouse, bank details (IBAN), tax identification number, details about work and income, residence status and the type of benefit you receive. Plus the conversation history. Purpose: to fill in the form correctly, and so that you do not have to enter everything again for your next application. Legal basis: performance of a contract (Art. 6 Abs. 1 lit. b DSGVO). For information about health or religious affiliation, only the explicit consent of the person concerned applies, or in the case of a child under 18, that of the parent (see “Special categories of personal data”). How long: until you delete the application or your account, at the latest until we delete an account after 12 months without use (point 1).

3. Your completed form — the filled-in PDF. Legal basis: performance of a contract. How long: free previews are deleted after 7 days, as is the watermarked preview of a paid form that you have not yet confirmed. You can request a new preview in the chat; within the same application this costs nothing. The finished, paid PDF is yours and remains until you delete it, the application it belongs to, or your account, or until we delete the account after 12 months without use (point 1). When you delete an application, a record without any content remains with us: date, status and the confirmation that you checked the form before downloading it. It contains none of your entries; we need it to count your subscription quota correctly and to be able to show, in case of a dispute, that the form was available to you before you submitted it.

4. Your payment — payment status, subscription data, customer number at Stripe. We never see your card details — you enter those directly with Stripe. When you make a purchase, we also record when your agreement to our Terms and Conditions (AGB) reached us and which version, in which language, you saw at that time. Legal basis: performance of a contract; for invoices additionally statutory retention obligations (Art. 6(1)(c) GDPR). How long: subscription data until account deletion; accounting records for as long as the law requires. We keep the record of when you agreed to the AGB and to the immediate start in the same way as the record of your purchase: up to four years (see “What account deletion does not remove”). Cancellation without signing in. If you cancel via “Cancel contracts here” without signing in, we store your email address and your other details from the form, the time it reached us, a reference number and an encrypted identifier derived from your IP address. Purpose: to confirm receipt to you, to match the cancellation to your contract and to be able to prove it, and so that you can withdraw a cancellation that did not come from you with one click. We need the identifier derived from your IP address only to prevent mass requests. Legal basis: legal obligation to confirm the cancellation (Art. 6(1)(c) GDPR in conjunction with § 312k BGB) and legitimate interest in proof and in protection against misuse (Art. 6(1)(f) GDPR). How long: three years from the end of the year in which the cancellation reached us (§§ 195, 199 BGB); if you withdraw it, from the end of the year of the withdrawal. This also applies if we find no contract for your address, and also after an account deletion. We delete the identifier derived from your IP address after 90 days.

5. Protection against misuse — an encrypted identifier derived from your IP address (not the IP address itself), usage counters and the cost per request. Purpose: so that nobody can abuse the service automatically and cause costs we cannot bear. Legal basis: legitimate interest (Art. 6(1)(f) GDPR). How long: 90 days.

6. Your feedback — what you write to us via the feedback or bug report form. This includes the text, the page you were on, the version of the interface and a rough device hint such as “Chrome on Android”. An e-mail address for follow-up questions is optional. Legal basis: legitimate interest (Art. 6(1)(f) GDPR); for the optional e-mail address your consent (Art. 6(1)(a) GDPR), which you may withdraw at any time. How long: until processed; if you delete your account, we delete your reports with it.

7. If you request a form — the name of the form, your note, if you write one, and the email address of your account. If you upload your own form instead, we also collect: the authority, your location, the file, an email address for our reply and, if you like, your name and your phone number. Your request is read and processed by HalloAmt employees. If you come from a letter explanation (point 8), we take only the name of the form and the authority from it. When doing so, we pre-fill your postcode and your location from “My data” if the fields are still empty. You can change or delete everything before you submit. We do not send your letter or your letter explanation along with it. Purpose: so that we can add the form and reply to you. Legal basis: performance of a contract and legitimate interest. How long: We delete uploaded files as soon as we have identified the form, at the latest after 30 days. The request itself remains in your account so that you can see what has become of it. We delete it 180 days after we have closed it, at the latest together with your account (point 1). We notify ourselves by email about every request. This notification contains only a process ID and a link to our administration area, no details from your request and not the file. Older notifications may still contain the details you gave in your request, but not your phone number and not the file. The notification stays in our mailbox until we delete it by hand — an automatic deletion does not reach a mailbox.

8. If you have a letter explained — the photo or PDF of a letter that you upload, and everything it contains. This is often social data (reference numbers, customer numbers, amounts), sometimes health information, and almost always also information about other people, such as your children, your partner or your landlord. Added to this are the language you have chosen and the explanation we show you. In addition, for each explanation we store when these confirmations reached us: your consent, your confirmation of the notices before uploading (among other things: no legal advice, check deadlines in the original), your agreement to our Terms and Conditions (AGB), your confirmation that you are at least 18 years old, your undertaking not to transmit sensitive information about other persons, and, if you want to save the explanation, your consent to saving it — in each case with the version of the text you saw at that time, and for the AGB also with the language of the version. We also record the same information in a separate record, kept apart from the explanation and without the content of the letter (see “How long”). You can only use the letter explanation from the age of 18. If the letter explanation is only enabled for selected accounts, for example during a trial with advice centres, we keep a list of these accounts: account ID, time of activation and a note on which organisation you are taking part through. Only letters that concern you: Only upload letters that concern you. Black out information about other persons that is not needed for the explanation beforehand. Black out sensitive information about other persons, for example about the health of your child or partner, completely; if that is not possible, please do not have the letter explained. Check on your device: Before a letter is uploaded, the page asks whether the letter is about a fine or criminal case and checks it on your device for indications of administrative fine or criminal proceedings: a PDF with a text layer on the basis of this text, a photo or a scan with text recognition that runs in your browser. If the check finds such indications or cannot read the letter reliably, it is not uploaded. We do not store your answer to the question or the result of the check in relation to you personally. We only count how often the check had which result on a given day, in the same daily counters as our reach measurement (see “Cookies and analytics”), without any link to your account and without the content of the letter. Redacting: Before uploading, you can redact parts of the letter, such as information about other persons that is not needed for the explanation. We re-render a photo on your device, even without redacting; information that a camera stores in the file, such as location or camera model, is not carried over. A PDF in which you redact something is converted on your device into images, one per page, and we upload only these images. A PDF without redaction is uploaded as it is. Letters we do not explain: letters concerning administrative fine or criminal proceedings, such as a fine notice, a penalty order or a summons. If the check on your device detects such a letter, it does not leave your device. If the check does not detect it, the AI usually detects it when reading it. The letter has then already been transferred to Anthropic in the USA, in the case of a photo or scan also for the second reading, and remains there according to the periods stated under “Transfer to the USA”. On our side, we store neither the photo or PDF nor an explanation of such a letter. All that remains is the cost record that exists for every request (point 5: account, encrypted identifier of your IP address, time, model and cost) and the record of your confirmations (see “How long”). Neither contains anything from the letter. Purpose: so that you understand what the letter says, what is required and by when, and, if you choose to save it, so that you can find the explanation again later in your account. Legal basis: for the explanation and the list of enabled accounts, performance of a contract (Art. 6 Abs. 1 lit. b DSGVO); for specially protected information about you, such as your health, your explicit consent (Art. 9 Abs. 2 lit. a DSGVO, see below); for storing the explanation beyond 24 hours, a separate, voluntary consent. We process information about other persons in the letter on the basis of the legitimate interest in your understanding a letter that concerns you (Art. 6 Abs. 1 lit. f DSGVO). You black out specially protected information about other persons before uploading (see above). We keep the record of your confirmations in order to be able to prove that you consented and to what (Art. 7 Abs. 1 DSGVO); this is our legitimate interest (Art. 6 Abs. 1 lit. f DSGVO). We base the transfer to Anthropic in the USA on the standard contractual clauses (see “Transfer to the USA”). How long: We delete the photo or PDF after 24 hours. We delete the explanation after 24 hours if you do not save it, and after about 6 months (183 days) if you have chosen to save it. Our deletion run takes place every hour. We therefore delete the photo or PDF and an explanation that has not been saved in the first hourly deletion run after 24 hours have expired, in regular operation at the latest after 25 hours. You can delete an explanation yourself before then; we then delete the associated photo or PDF along with it, at the latest after two days. Our database is backed up daily, and each backup is kept for 7 days. A deleted explanation is therefore still contained in these backups for up to 7 days; after that, it is deleted there as well. If you cancel while we are explaining the letter and the cancellation reaches us, we store neither the photo or PDF nor the explanation; if either had already been stored, we delete it again. Instead, we record that you cancelled (process ID, account, time) and delete this note after 2 days. If the cancellation does not reach us, for example because the connection is lost, the explanation may have been stored; you will then find it in your history and can delete it there. In the event of a cancellation, the letter is already with Anthropic and remains there according to the periods stated under “Transfer to the USA”. We create the record of your confirmations before we transfer the letter to Anthropic. It contains your account, the process ID, the time and version of each confirmation, the language, whether you chose to save, and when and for what reason the explanation ended (deleted by you, period expired, cancelled, account deleted or not saved). We keep it for 3 years after this end, even if you delete your account before then and even if the letter was not explained. We delete the list of enabled accounts together with your account.

If you yourself are named in a letter that someone else has explained by us, for example as a child, partner or landlord: the information about you then comes from the person who uploaded the letter (Art. 14 DSGVO). It is the information about you that appears in the letter and was not blacked out, such as your name, your date of birth or your role in the decision. We process it only to explain the letter to this person, on the basis of their legitimate interest in understanding a letter that concerns them (Art. 6 Abs. 1 lit. f DSGVO). For this purpose it goes to Anthropic in the USA, and we delete it together with the photo or PDF and the explanation (point 8, “How long”). The person must black out sensitive information about you, for example about your health, before uploading. We do not notify you individually; we rely on Art. 14 Abs. 5 lit. b DSGVO for this. To notify you, we would have to evaluate letters specifically by name, find out your address and store your information for longer than the explanation requires; that would mean more processing of your data, not less. To protect your interests, the following applies instead: only letters that concern the person uploading them should be uploaded; that person blacks out beforehand information about you that is not needed for the explanation, and sensitive information completely; we use your information only for this explanation and delete it within the periods in point 8; and we make this information public here. Your rights also apply to you, including the right to object (see “Your rights”); write to datenschutz@halloamt.de.

Who sees your data besides us

We work with service providers. There are two kinds, and the difference matters to you:

• On our behalf means: the provider may only do with your data what we tell them to. We remain responsible, and this policy here applies.
• On their own responsibility means: the provider decides themselves what to do with the data. Their own privacy policy applies to that, not ours.

On our behalf (processors, bound by our instructions)

Who	What for	Where
Supabase	account, database, storage of your data and PDFs	data centre Frankfurt am Main; contracting party is Supabase Pte. Ltd., Singapore
Anthropic	the AI that runs the chat, fills in the form and explains letters	USA; contracting party is Anthropic Ireland, Limited, Ireland
Cloudflare	delivery of the website	worldwide, EU locations
Resend	delivery of our emails — address, subject and content	USA
Stripe	processing of your payment	EU company, corporate group based in the USA

With each of these five providers there is a data processing agreement under Art. 28 GDPR.

Recipients acting on their own responsibility

Who	What for	Where
Google	only if you use “Sign in with Google”	USA
Stripe	payment	EU entity, group based in the USA
Resend	who wrote to which address and when	USA
easybell	our phone line and the announcement	Germany

Google does not act on our behalf: when you use “Sign in with Google”, you sign in with Google — Google is responsible for that itself, and Google’s own privacy policy applies. If you do not use that route, Google learns nothing about you.

Stripe has both roles, and our contract says so: Stripe handles the payment on our behalf; for its own purposes, above all fraud detection, Stripe decides itself. That is why Stripe appears in both lists.

Resend also has both roles, and that is also stated in our contract: Resend sends your email on our behalf — address, subject and content. Resend also processes the traffic data, i.e. who wrote to which address and when, for its own purposes and decides on this itself. That is why Resend appears in both lists.

We do not measure whether you open or click an email. Resend could offer this; we have not set it up. There is no tracking pixel and no rewritten links.

Beyond that we pass nothing on — in particular not to authorities, employers, landlords or credit agencies. You submit your applications yourself.

If you call us

Our phone number is answered by an automated announcement. No conversation takes place — nobody picks up, and you cannot leave a message either.

Our telephone provider easybell sends us an email after a call. It contains your phone number and the time of the call — so that we can see that someone called. Nothing is recorded: easybell does not store such calls but forwards them to us immediately by email.

easybell is itself responsible for the connection data — under the legal framework, a telephone provider always is, for the circumstances of telecommunications. That is why easybell is listed above rather than among the processors, and why there is no data processing agreement for this.

The call email lands in our inbox and is deleted manually once it has been dealt with. The legal basis is our legitimate interest in being reachable (Art. 6 Abs. 1 lit. f DSGVO).

Transfer to the USA — what you should know

So that the AI can fill in your application, your chat texts are transferred to Anthropic in the USA and processed there. This concerns exactly the information listed under point 2 above. If you have a letter explained, the same applies to the photo or PDF of the letter (point 8): it goes to Anthropic in the USA and is read and explained there. This also applies to letters concerning administrative fine or criminal proceedings that the check on your device did not detect and that we therefore only reject after reading them (point 8), and to letters whose explanation you cancel. For a photo, for a redacted PDF (which is converted into images for this purpose) and for a PDF without a readable text layer, such as a scan, a second AI model from the same provider reads the letter a second time, page by page. In this way we detect reading errors in numbers and deadlines better and can show on which page a deadline is stated. This additional reading is not an independent check; it also takes place in the USA, and we do not store its transcript. Before we show you an explanation, an AI model from the same provider also checks whether it contains any advice or assessment of its own, and we remove such sentences. For this purpose, the finished explanation, together with the translation of what the letter requires of you, is sent a second time to Anthropic in the USA; the photo or PDF is not sent along. Of this check, we record on our side only how many sentences were removed.

What applies here:

• Your data is not used to train the AI.
• We have specified that processing takes place exclusively in the USA and not in changing countries.
• We operate our own database and file storage in Frankfurt am Main. What we transmit to Anthropic is processed in the USA and may remain stored there for the periods described below.
• Not transferred are your account, your payment data and the finished PDF — that is created on our server in Frankfurt, without the AI.

The USA is not a country whose level of data protection the European Commission has generally recognised as equivalent. That is why we base every transfer on one of the safeguards the GDPR provides for this:

Recipient	What we base the transfer on
Anthropic — your chat texts and letters that you have explained	Our contracting party is Anthropic Ireland, Limited in Ireland. Processing takes place in the USA, by Anthropic, PBC and its service providers. This transfer is covered by the Standard contractual clauses of the EU Commission (Implementing Decision (EU) 2021/914, Modules 2 and 3). They form part of our data processing agreement with Anthropic.
Stripe — payment	Our contracting party is Stripe Payments Europe, Ltd. in Ireland. For onward transfers within the Stripe group, the standard contractual clauses and the certification under the EU-US Data Privacy Framework apply.
Google — only with “Sign in with Google”	Google LLC is certified under the EU-US Data Privacy Framework. This transfer is therefore covered by the adequacy decision of the European Commission — it needs no additional safeguard.
Cloudflare — delivery of the website	Standard contractual clauses of the EU Commission (Implementing Decision (EU) 2021/914). They form part of the data processing agreement which our terms of use with Cloudflare incorporate.
Supabase — account, database, storage	Our contracting party is Supabase Pte. Ltd. in Singapore. The transfer is based on the Standard contractual clauses of the EU Commission (Implementing Decision (EU) 2021/914, Modules 2 and 3). They form part of our data processing agreement with Supabase. Your data is stored in Frankfurt am Main; the transfer concerns access from outside the EU, by Supabase itself and its sub-processors, including in the USA.
Resend — delivery of our emails	Our contractual partner is Plus Five Five, Inc. in San Francisco. The transfer is based on the Standard contractual clauses of the EU Commission (Implementing Decision (EU) 2021/914, Module 2) and additionally on the certification under the EU-US Data Privacy Framework. According to the contract, processing takes place predominantly in the USA.

You can request a copy of these safeguards from us. Write to datenschutz@halloamt.de and we will send them to you.

How long Anthropic keeps your texts. Permanently, your data is stored with us in Frankfurt am Main (see above). At Anthropic the transferred text additionally remains for up to 30 days; after that Anthropic deletes it. Within that period Anthropic may review it for security and abuse-prevention purposes. This also applies to photos and PDFs of letters.

If Anthropic’s automated abuse detection flags an event, Anthropic may retain inputs and outputs for up to two years and the scores that this detection assigns in doing so (trust and safety classification scores) for up to seven years. This applies regardless of everything else and is not in our hands.

How we protect your data

• Encryption in transit and at rest.
• Within the application, each account sees only its own data; this is enforced in the database, not just in the interface. In addition, we as the operator and our provider Supabase as processor have technical access to the database. Our administration area does not show your letter explanations.
• Our administration area shows you only under an identifier, not by name. Anyone who wants to see real names needs two-factor authentication, and every such access is logged. We keep this log for 730 days.
• We store your IP address only in encrypted form.
• Your drawn signature is deleted after being inserted into the PDF and is not retained.

Your rights

You may ask us at any time for:

• Access to the data we hold about you (Art. 15 GDPR)
• Rectification if something is wrong (Art. 16)
• Erasure of your data (Art. 17)
• Restriction of processing (Art. 18)
• Portability of your data in a transferable format (Art. 20)
• Objection to processing based on legitimate interest (Art. 21)

Write to datenschutz@halloamt.de. We reply within one month.

You can delete things yourself, and there are two levels. You delete a single application under “My forms” → “Delete application”: this removes the conversation, your saved answers and the PDFs for that application — your stored details are kept and can be changed or removed individually under “My data”. Your account and all data are deleted under “Delete account”; this removes your details, your forms, your explained letters together with photos and PDFs and any running subscription. If you do not use your account for 12 months, we delete it in the same way, after having sent you an e-mail at least 30 days beforehand (point 1).

What account deletion does not remove — and why

Four things remain, even when we delete an unused account, and we tell you plainly instead of hiding them.

First: if you have bought something from us, we keep a small record of that purchase — even after the account is deleted. It contains your email address in plain text, the product bought, the price, the date, and the times of your consents, your confirmation before download, and any cancellation or withdrawal.

Why: In a dispute over a purchase, each side must be able to prove what was agreed and when. Without your address, the record would be worthless for both sides — it would only show that someone consented. That is why the address is stored there in plain text and not as an unreadable checksum: a checksum proves nothing to anyone who doesn't already know it.

Legal basis: Art. 17 Abs. 3 lit. b und lit. e DSGVO (GDPR) — the right to erasure does not apply where the data are necessary to comply with a legal obligation or to establish, exercise, or defend legal claims.

How long: up to four years (three years from the end of the year in which the claim arose, §§ 195, 199 BGB). The period begins with the last event of the purchase, such as a cancellation or the end of a subscription; as long as your subscription is running, we do not delete the record. This also applies to the times of your agreements when making a purchase (point 4). For details that also count as invoice data, longer tax-related retention periods may apply. After that, the record is deleted.

Who can see it: no one, through the application. This data is stored technically in a way that makes it unreachable from either the user area or the admin area — it is only retrieved when it is actually needed as such a record.

If you have never bought anything, this record never comes into existence at all.

Second: if you requested a form or uploaded your own, our inbox holds the email we sent ourselves to notify us of it. The "Delete account" button does not reach it — an inbox is not reached by any automatic deletion run. Write to us at datenschutz@halloamt.de, and we will find it and delete it by hand as well.

If you have never requested a form, this email does not exist.

Third: if you have had a letter explained, the record of your confirmations remains (point 8): when your consent and your other confirmations reached us, in each case with the version of the text, without the content of the letter. We keep it for 3 years after the end of the explanation so that we can prove that you consented and to what (Art. 7 Abs. 1 and Art. 17 Abs. 3 lit. e DSGVO). No one can retrieve it via the application, not even our administration area.

If you have never used the letter explanation, this record does not exist.

Fourth: if you or another person have consented to specially protected information, the record of that consent remains (see “Special categories of personal data”): for which form and for which person, who gave consent (for another person, with the name they entered themselves), when the consent and, if applicable, the withdrawal reached us, with the version and language of the text. The information itself, for example the degree of disability, is not contained in it. We keep the record for 3 years after the end of the consent, that is, after the withdrawal or the deletion of the account, so that we can prove that and for what consent was given (Art. 7 Abs. 1 and Art. 17 Abs. 3 lit. e DSGVO). After the account is deleted, no one can retrieve it via the application, not even our administration area.

If no one has consented to such information, this record does not exist.

You may also complain to a data protection supervisory authority. The authority responsible for us is Der Hamburgische Beauftragte für Datenschutz und Informationsfreiheit.

Ludwig-Erhard-Str. 22, 20459 Hamburg
Tel. (040) 428 54 – 4040 · Fax (040) 428 54 – 4000
mailbox@datenschutz.hamburg.de · datenschutz.hamburg.de

Special categories of personal data (Art. 9 DSGVO)

Some forms ask for information that is subject to special protection. For us, these are two kinds:

• Health — severe disability, degree of disability, need for care and care level, pregnancy. Asked in the Wohngeldantrag (federal form and Bavarian state form), there also for persons in your household, in the Hauptantrag Grundsicherungsgeld (formerly Bürgergeld), in the Anlage Kind to the Kindergeld, and in the application for full orphans. In the Hauptantrag Grundsicherungsgeld, we also ask whether you are able to work (erwerbsfähig), whether you need a costly diet (kostenaufwändige Ernährung) for medical reasons, whether you receive benefits for participation (Leistungen zur Teilhabe), whether you are in an inpatient facility (stationäre Einrichtung), and whether you have suffered an accident or health damage caused by another person. We ask the same in the Anlage WEP (further person aged 15 or over) for your partner and your children aged 15 or over, there also about the marker (Merkzeichen) G for a person who is not able to work (erwerbsfähig). In the Anlage KI (child under 15 years), we ask for your younger children about a pregnancy, a costly diet, an inpatient facility, and an accident or damage caused by another person. In the Weiterbewilligungsantrag Grundsicherungsgeld, we ask whether your ability to work or your health situation will change, and whether you have suffered an accident or health damage caused by another person. In the application for Bildung und Teilhabe (Landkreis Harburg), we ask whether your child receives integration assistance (Eingliederungshilfe) from the Jugendamt because of a mental disability or a threatened mental disability (§ 35a SGB VIII). In the application for a Wohnberechtigungsschein (Hamburg), we ask whether anyone in your future household has a severe disability, who that is, the degree of disability, and the markers (Merkzeichen). There, we also ask whether anyone in your future household who is no older than 60 years needs accessible housing, and who that is. In the application for a Wohnberechtigungsschein (Berlin), we ask whether anyone in your future household is severely disabled, who that is, the degree of disability, whether that person needs care at home (häuslich pflegebedürftig), and whether a severely disabled person uses a wheelchair, and who that is.
• Religious affiliation — asked in the residence registrations for Berlin and Hamburg. The registration office needs it for church tax.

The legal basis is solely your explicit consent under Art. 9 Abs. 2 lit. a DSGVO. Before the chat asks for such information, we show you a consent card with a fixed text: what it is about, what happens without the information, and the sentence you consent to. We only show the card in a conversation language for which its text has been professionally reviewed; at present that is German. If the conversation is in another language, the chat does not ask for this information: the field stays empty in the form, and you fill it in yourself before submitting. You consent by clicking "I consent" on the card; if you write "yes" in the chat, the card appears. We record when your consent reached us, which text you were shown at the time, and in which language. For filling in the chat, we transfer the information to Anthropic in the USA; the safeguard for this is the standard contractual clauses (see “Transfer to the USA”). Without consent, we do not store any such information, in any way, not even via "My data" or the correction in the preview. Please only mention such information in the chat once we ask for it: anything you write beforehand of your own accord is already sent to Anthropic with your message.

Information we did not ask for. Above the chat's input field there is a notice about this, which you confirm before your first message. If you nevertheless write something on your own about your health, a disability, a pregnancy, your religion, or another specially protected piece of information, this message is sent to Anthropic like any other. After the chat's reply, we check the stored message using a word list. If we detect such information, we replace the whole sentence in the stored chat history with a note, as well as the places where the chat's reply repeats the information. In later steps of the conversation, only this redacted version is sent to Anthropic. The word list does not detect every piece of information, and it does not prevent the first transfer to Anthropic. Excepted are answers to a question for which you previously gave consent on the consent card: we need these answers for the form.

Withdrawal. You can withdraw the consent at any time for the future, in the chat, under "My data", or by email to datenschutz@halloamt.de. When you withdraw, we delete the information concerned in your profile and in your saved forms, the PDFs we hold that contain it, and the text of the chat messages with which it was stored. PDFs you have already downloaded are outside our control. Processing carried out before the withdrawal remains lawful (Art. 7 Abs. 3 DSGVO). We then keep the record of the consent for a further 3 years, without the information itself (see “What account deletion does not remove”).

Information about other persons. Some forms also ask for such information about other persons: the Wohngeldantrag about persons in your household, the Anlage Kind and the Antrag auf Bildung und Teilhabe about your child, the application for Grundsicherungsgeld with the Anlage WEP and Anlage KI about your partner and your children, the residence registration and the application for a Wohnberechtigungsschein about the persons moving in with you. Your own consent is not enough for this. The person concerned gives consent themselves, on their own card on the same device: first the page asks you to hand the device to this person; then the person chooses their language, enters their name, and clicks. The card names Purple Digital UG (haftungsbeschränkt) as the controller and says that you, as the person who manages the account, see the information when filling out the form together. After the click, the page shows the person a confirmation: what they have declared, when, and how they can withdraw consent. For a child under 18, you consent as the parent and select whether you have sole custody (sorgeberechtigt) or are acting with the consent of the other parent who also has custody (sorgeberechtigt); without this selection we do not accept the consent. We do not require copies of ID documents. Whether the child is of legal age follows from their date of birth. When the child turns 18, the parent's consent ends. Our daily deletion run then deletes the child's specially protected information in your profile and in your saved forms, as well as the text of the chat messages with which it was stored, unless the child has since consented themselves. A PDF of the application that has already been created remains until you delete it (point 3). We record for whom and by whom consent was given (with the name entered and, for parents, the selection on custody), when, with which text, and in which language. A consent applies only to the person for whom it was given: if you remove this person from your data or change their first name or date of birth, the consent ends, and we delete this person's specially protected information from our systems. If the person is not present at the time or does not want to consent, the information stays open, and we ask again later. You can then also complete the form without this information; the information is then not entered. Add it yourself before you submit the application if it is required for your application. The person can likewise withdraw their consent, in the chat of this account or by email to datenschutz@halloamt.de; we then delete their information as described above.

What happens if you do not consent: You select "No, continue without this information" on the card and fill out the remaining information in the form. This information is not entered. Add it yourself before you submit the application if it is required for your application. Without the required information, the authority may request further information; processing or a benefit you have applied for may be affected. We do not check which entitlements you have. This causes you no disadvantage with us. For some applications, this may affect money: for housing benefit, without the information on severe disability, we cannot enter the allowance provided for it. For Grundsicherungsgeld, an additional need, for example due to a pregnancy or a disability, is then not included in the application. For Kindergeld for a child over 25 years or for full orphans over 25 years, a disability that arose before the 25th birthday is missing as a reason for the entitlement. What applies to your application is shown on the card before you decide.

Letter explanation. The purpose is to explain a letter to you and, if you choose to, to store the explanation in your account (point 8). A letter may contain specially protected information without us asking for it, for example a degree of disability, a care level, sickness benefit or a religious affiliation.

• Information about you: We ask you before uploading for your explicit consent to our processing the special categories of personal data concerning you in your letter, in particular information about health, religious or political beliefs or ethnic origin, to create your letter explanation, and transferring the letter to Anthropic in the USA for this purpose (Art. 9 Abs. 2 lit. a DSGVO). Without this consent we do not accept the letter. If you want to save the explanation in your account for about 6 months (183 days), you consent to this separately; this is voluntary, and without this second consent we delete the explanation after 24 hours. We record when your consent reached us and which text you saw at that time.
• Information about other persons: Only upload letters that concern you. Black out specially protected information about other persons, for example about the health of your child or partner, completely before uploading; if that is not possible, please do not have the letter explained. You undertake before uploading not to transmit any such information, and we record when your undertaking reached us (point 8).
• Transfer to the USA: The consent does not replace the safeguard for the transfer. We base the transfer on the standard contractual clauses (see “Transfer to the USA”). The remaining processing is based on Art. 6 DSGVO (point 8).

Withdrawal. You can withdraw your consent at any time with effect for the future by deleting the explanation or writing to datenschutz@halloamt.de. Processing carried out before the withdrawal remains lawful (Art. 7 Abs. 3 DSGVO). Together with the explanation we delete the photo or PDF, at the latest after two days; the explanation is still contained in our backups for up to 7 days (point 8). We keep the record of your consent for a further 3 years after the end of the explanation (point 8). What Anthropic has already received remains there according to the periods stated under “Transfer to the USA”.

Do you have to provide this data?

No. You decide what you enter. Without the information required by the respective form, however, we cannot fill it in — that is the purpose of the service.

Artificial intelligence — what it does and what it does not

You are talking to an AI, not to a person. The chat is run by an AI language model (Claude by Anthropic). It asks the questions, understands your answers and enters them into the fields of the official form. We tell you this because the EU AI Regulation (Regulation (EU) 2024/1689, Art. 50) requires it — and because you should know before you provide personal details.

The AI decides nothing. It fills in. Your application is decided solely by the authority. There is no automated decision-making within the meaning of Art. 22 GDPR: no assessment of whether you are entitled to something, no evaluation of your person, no rejection and no approval.

Please check the result. An AI can misunderstand something or enter it in the wrong field. That is why we always show you a preview of the completed form before you download it. You are the one submitting the application to the authority — and you should have read what it says beforehand.

What we do not do: We do not mark the completed forms as "AI-generated". They contain your own details, merely transferred into the right fields — no content invented by an AI. Such a note could also give the authority the false impression that someone else intervened in your application.

When the AI explains a letter, it reads it, translates it into your language and tells you who sent it, what is required and what deadline is stated in the letter. It does not assess whether the letter is correct, and it does not calculate any deadline. It translates a deadline into your language; a date within it remains as it appears in the letter, and below it we show the wording from the letter and, if we can determine it, the page on which it appears. We show reference numbers, numbers and the wording of a deadline only if we find them verbatim in the text layer of the PDF or in the second reading; anything we cannot confirm we mark, for example with “Please check the original”. This reduces reading errors but does not rule them out. If the letter contains legal remedy information, the AI translates it as a whole block, and we show the German wording below it. Before we show you the explanation, an AI model checks in a separate step whether it contains any advice or assessment of its own; we remove such sentences and tell you so. This check can also be wrong. We do not check whether the letter is genuine. The letter itself is always authoritative. No automated decision within the meaning of Art. 22 DSGVO takes place.

Which data is sent to Anthropic and what happens to it there is described above under "Who sees your data besides us" and "Transfer to the USA".

Cookies and analytics

We use no cookies for advertising or analytics purposes and do not measure your behaviour. Only what is necessary for operation is stored on your device: your sign-in and the current application. If you have a letter explained as a photo or scan, your browser also stores the language model of the text recognition for the check on your device (point 8), so that it does not have to be loaded again for the next letter. Your letter itself is not stored there. Under § 25 Abs. 2 TDDDG we do not need consent for any of this.

How we count our reach. We want to know how many people reach our pages and which pages are read. For this we use no third-party analytics tool — no Google Analytics, no Plausible, no tracking pixel. Our own server counts instead, as sparingly as possible:

• We store daily counters only: "this page was opened this many times today", "this many visits came from a search engine today", and, for the letter explanation, how often the check on the device had which result today (point 8). There is no record of an individual visit.
• Of the site you came from we store only the website name (for example google.com) — never your search query and never the exact address.
• From the address of the page you opened we remove everything after the question mark, and identifiers (such as a document number) are grouped together. The only exception is the identifier of one of our posters, of one of our links on social networks or of one of our ads on Google (such as ?q=flyer behind the QR code, ?q=fb-gruppe in a Facebook group or ?q=gads-de in a Google ad): if it is on our fixed list, we count the visit as “came via this poster, link or ad” and then remove the identifier from the address bar; we discard any other value.
• To avoid counting a visitor twice on the same day we form a non-reversible checksum from your IP address, your browser identifier, a secret addition and today's date. Because the date is part of it, tomorrow produces an entirely different checksum: we cannot recognise you across several days — not even retrospectively. These checksums are deleted after two days, the daily counters after 400 days.
• Nothing is stored on or read from your device for this counting — no cookie, no identifier. That is why we need neither your consent nor a cookie banner for it.

The legal basis is our legitimate interest in knowing the reach of our own service (Art. 6(1)(f) GDPR).

Changes

We adapt this policy when the service changes. The version with the date given above applies.