Privacy

Controller and contact

This service is provided by Softwinx.com. The provider identity and address are available in the legal notice at https://softwinx.com. Privacy requests: info@softwinx.com. This notice applies to carbon.softwinx.com.

Hosting and connection data

Hostinger infrastructure processes IP addresses, access time, requested addresses, browser information and technical errors to operate and secure the website. The EU basis is legitimate interests under GDPR Article 6(1)(f). Hosting logs are kept according to the hosting agreement only as required for operation, troubleshooting and security; this app does not use them for advertising.

Calculations and documents

The calculation API receives quantity, selected category or custom unit, factor and scope to provide the requested calculation under GDPR Article 6(1)(b). Original invoices, filenames and custom labels are not sent to this API. Calculation contents are not stored in its usage database. Previews remain in the browser. The separate local Docling application processes documents on the device where it runs.

Usage limits and verified email

Free users share 33 uses per UTC calendar month for calculations, document previews and AI questions. Guests additionally share five uses per UTC day. An email sign-in requires a six-digit code, valid ten minutes with five verification attempts. Email is sent by the hosting mail system to the address entered; delivery and mail logs are subject to its terms. The database stores a keyed email identifier and code digest, not the clear email address or code. The email identifier also links the monthly account quota across networks. Known disposable domains are blocked using the disposable-email-domains community list. Gmail dot and plus aliases are normalized. IP addresses are converted into keyed monthly identifiers, with an additional daily identifier for guests. Accounts sharing an IP share its monthly quota; changing accounts or deleting browser storage does not reset it. This cannot reliably identify a person or prevent all VPN and new-IP abuse. Monthly counters and keyed request digests expire after the following calendar month; daily entries after the following UTC day. Verification records expire in ten minutes; authentication throttle records in thirty minutes. Expired rows are removed on subsequent API calls. The EU bases are GDPR 6(1)(b) for requested email sign-in and 6(1)(f) for proportionate abuse prevention. Email sign-in sessions, like owner privileges, expire after eight hours. A document preview and a later manual calculation are separate uses. No browser fingerprint is collected.

Browser storage and owner sessions

Templates and optionally saved activities remain unencrypted in your browser profile until you or the browser delete them. Saving and deletion are initiated by you. These requested functions use necessary storage; GDPR Article 6(1)(b) and, for Germany, TDDDG Section 25(2) apply. A necessary Secure HttpOnly session cookie supports security and owner access. Owner privileges expire after eight hours; the session cookie expires when the browser session ends. No advertising or analytics trackers are included.

AI questions and IBM watsonx.ai

Only when you submit a question and AI is configured, the question, selected language and public factor information are sent through the server to IBM watsonx.ai AI. Invoices, owner passwords and API keys are not provided as conversation content. Do not enter personal data, credentials or confidential documents. The app does not store a server conversation history. IBM watsonx.ai processes requests under the applicable operator agreement and its terms and privacy notice: https://www.ibm.com/terms and https://www.ibm.com/privacy. The EU basis is the requested answer under GDPR Article 6(1)(b). The model has no tools to execute code or change your records.

Recipients and international processing

Hosting, email and, if used, the AI provider receive data necessary for their functions. Exclusively European software provenance or processing is not guaranteed. Transfers outside the EEA must satisfy GDPR Articles 44 onward, including adequacy decisions or safeguards such as standard contractual clauses. Ask info@softwinx.com about recipients and safeguards relevant to your request.

EU and EEA rights

Subject to the GDPR you may request access, correction, erasure, restriction and portability. You may object to legitimate-interest processing based on your particular situation, withdraw consent prospectively where consent applies, and complain to a supervisory authority, including where you live or work. Contact info@softwinx.com. Requests are handled within the applicable statutory deadlines.

United States privacy rights

Where applicable US state laws, including California CCPA/CPRA, apply, you may request access/knowledge, correction, deletion and a copy, and opt out of sale, targeted advertising/sharing and certain profiling. This app does not sell personal information, share it for cross-context behavioural advertising or make legally significant automated decisions. No such processing is performed in disregard of Global Privacy Control signals. Rights may be exercised without discrimination. Requests, authorised-agent requests and appeals where available may be sent to info@softwinx.com. Proportionate identity verification may be required; unnecessary sensitive information is not requested.

Contact, children and updates

Email correspondence is retained to handle the request and comply with applicable retention duties. This business application is not directed to children under 16. Applicable laws determine the specific rights; no worldwide legal certification is claimed. Effective date: 20 October 2026.