--- title: "Privacy · Quittio" description: "Privacy policy of Quittio: hosting, Cloudflare, audience measurement with PostHog, browser storage and your rights." canonical_url: "https://quittio.dev/en/privacy" locale: en meta: "og:description": "Privacy policy of Quittio: hosting, Cloudflare, audience measurement with PostHog, browser storage and your rights." "og:image": "https://quittio.dev/og/quittio-en.jpg" "og:image:alt": "Quittio: Invoices, settled. E-invoicing for PHP and Laravel, with a validated sample invoice." "og:image:height": "630" "og:image:type": image/jpeg "og:image:width": "1200" "og:title": "Privacy · Quittio" "twitter:image": "https://quittio.dev/og/quittio-en.jpg" "twitter:image:alt": "Quittio: Invoices, settled. E-invoicing for PHP and Laravel, with a validated sample invoice." --- > Index of every page on this site: [llms.txt](https://quittio.dev/llms.txt) # Privacy This is a translation; the German version is legally binding. This privacy policy explains which personal data is processed when you visit this website, for which purpose and on which legal basis, and which rights you have. ## Controller The controller within the meaning of the General Data Protection Regulation (GDPR) is Niklas Forst – Softwareentwicklung, Niklas Forst, Zum Beulstein 1, 56244 Ettinghausen, Germany. Phone: [+49 170 2346167](tel:+491702346167), email: [kontakt@niklasforst.de](mailto:kontakt@niklasforst.de). Further details in the [imprint](https://quittio.dev/en/imprint). No data protection officer has been appointed, as there is no legal obligation to do so. ## Overview You can use this website without signing up and without providing personal data. The following is processed: - technical connection data that arises with every page request (hosting and delivery), - settings that are stored only in your browser (language, color scheme), - usage data for audience measurement with PostHog: without consent only anonymously counted page views, with consent in more detail, - data for the spam check once you start filling in a form (Cloudflare Turnstile), - data you provide yourself when you contact me or sign up for early access. ## Hosting and delivery of the website ### Hetzner The website is hosted by Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany. The servers are located in data centers in Germany or the EU. A data processing agreement under Art. 28 GDPR is in place with Hetzner. More information: [Hetzner privacy policy](https://www.hetzner.com/legal/privacy-policy/). ### Cloudflare The website is delivered through the network of Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA. Cloudflare serves the pages from servers close to you (content delivery network) and protects the website against attacks and abuse. In doing so, Cloudflare processes the technical connection data of your request. Cloudflare is certified under the EU-U.S. Data Privacy Framework; transfers to the USA are therefore covered by the adequacy decision of the European Commission (Art. 45 GDPR). In addition, the standard contractual clauses of the European Commission are part of the data processing agreement with Cloudflare. More information: [Cloudflare privacy policy](https://www.cloudflare.com/privacypolicy/). To protect against automated access (bots), Cloudflare may set technically necessary cookies, in particular `__cf_bm`, which expires after 30 minutes of inactivity. They are strictly necessary for the secure provision of the website and therefore do not require consent (sec. 25 (2) no. 2 TDDDG). ### Data processed Every request to the website technically involves the following data: - IP address of the requesting device, - date and time of the request, - requested address (URL) and HTTP method, - amount of data transferred and HTTP status code, - referrer URL (the previously visited page), if your browser sends it, - browser type, operating system and language setting (user agent). This data is required to deliver the website to you, to ensure its stability and security and to detect abuse. The legal basis is Art. 6 (1) (f) GDPR; my legitimate interest lies in the secure and error-free provision of the website. The data is not combined with other data sources. Log data is stored only as long as necessary for these purposes and is then deleted or anonymized. ## Fonts and icons Fonts and icons are served from my own server. Visiting the website does not open connections to Google Fonts or other font and icon services. ## Storage in your browser So that the website keeps your settings, it stores the following in your browser's local storage (`localStorage`): - `q-locale`: the selected language, - `nuxt-color-mode`: the selected color scheme (light, dark or system), - `q-stack`: whether code examples are shown for Laravel or for plain PHP, - `q-bar-…`: that you have closed a notice bar, - `q-consent`: your decision on audience measurement (consent, rejection or objection to the anonymous count) with date and time, so that you are not asked again on every visit. These entries do not leave your browser and are not transmitted to me. They are strictly necessary to provide the settings you requested and therefore do not require consent (sec. 25 (2) no. 2 TDDDG). They remain stored until you delete them in your browser. ## Audience measurement with PostHog I use PostHog to understand which pages are used and where the website can be improved. The provider is PostHog Inc., 2261 Market St., #4008, San Francisco, CA 94114, USA. I use PostHog's EU cloud; the data is stored on servers in Frankfurt am Main (Germany). How much is recorded depends on whether you consent. ### Without consent: anonymous count of page views As long as you have neither consented nor rejected, and after you have rejected, PostHog only counts page views. Nothing is stored in your browser. What is transmitted is the address visited, the previously visited page (referrer) and the browser identifier (user agent) that your browser sends with every request anyway, together with the browser, operating system and device type derived from it; screen size, language setting, time zone, scroll depth and clicks are not transmitted. On its servers, PostHog forms a hash from the IP address, user agent, host name and a random value that changes daily, in order to group the page views of one day. Visits on different days therefore cannot be linked, and no personal profile is created. The legal basis is Art. 6 (1) (f) GDPR; my legitimate interest lies in measuring the reach of the website in a data-minimizing way. You can object to this count at any time (Art. 21 GDPR) by turning it off for your browser with the switch below; your objection is noted in your browser's local storage (`q-consent`). If your browser sends a Global Privacy Control or Do Not Track signal, the count does not take place without your consent. ### With consent: audience measurement with an identifier If you consent, PostHog additionally processes: time spent, clicks and navigation on the website, browser, operating system, device type and screen resolution, approximate location (country/region, derived from the IP address) and a randomly generated identifier used to recognize repeat visits. The identifier is stored in your browser's local storage (`ph_*`); PostHog sets no cookies for this. I do not use session recordings, heatmaps or surveys. The legal basis is your consent under Art. 6 (1) (a) GDPR and sec. 25 (1) TDDDG. You can withdraw your consent at any time with effect for the future by opening “Cookie settings” at the bottom of any page and choosing “Reject”; the data PostHog stored in your browser is deleted in the process, and the anonymous count described above applies from then on. Alternatively, you can delete the local storage of this website in your browser. The lawfulness of the processing carried out before the withdrawal remains unaffected. ### Transmission and data processing In both cases your browser does not connect to PostHog directly: the data is sent to my server (path `/api/data/collect`) and forwarded from there to PostHog. Your IP address and user agent are transmitted as well, which PostHog needs for the hash and the approximate location. The full IP address is not stored. A data processing agreement under Art. 28 GDPR is in place with PostHog. Where access from the USA is possible for support or maintenance, it is covered by the European Commission's adequacy decision on the EU-U.S. Data Privacy Framework (Art. 45 GDPR), under which PostHog is certified; in addition, the standard contractual clauses of the European Commission are part of the agreement (Art. 46 (2) (c) GDPR). The usage data collected is deleted after 12 months at the latest. More information: [PostHog privacy policy](https://posthog.com/privacy). ## Contacting me If you contact me by email, phone or the contact form, I process the information you provide (e.g. name, email address, phone number, company and the content of your message) to answer your request. Information from the contact form is delivered to me by email and not stored on the web server. The legal basis is Art. 6 (1) (b) GDPR if your request relates to a contract or its preparation, and otherwise Art. 6 (1) (f) GDPR; my legitimate interest lies in answering your request. Your data is deleted once the request has been dealt with, unless statutory retention obligations (e.g. under commercial or tax law) apply. ## Early access to Quittio Managed If you sign up for early access, I process your email address to inform you once by email when Quittio Managed launches. Voluntary information (company, role, number of projects, whether your customers issue invoices in your app themselves, what you need most) helps me to align the offer with these needs. The information is delivered to me by email and not stored on the web server. The legal basis is your consent (Art. 6 (1) (a) GDPR). You can withdraw it at any time with effect for the future, for example by email to [kontakt@niklasforst.de](mailto:kontakt@niklasforst.de). I delete your information once the launch information has been sent or you withdraw your consent. ## Spam protection of the forms with Cloudflare Turnstile I protect the contact form and the early access form against spam and automated submissions with Cloudflare Turnstile. The provider is Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA. Turnstile is only loaded once you start filling in a form; merely visiting a page does not establish a connection to Turnstile. To check whether the input comes from a human, Cloudflare processes in particular your IP address and information about your browser, operating system and device. The result of the check is sent to my server together with the form and confirmed there with Cloudflare. The Turnstile service does not receive your form entries. The legal basis is Art. 6 (1) (f) GDPR; my legitimate interest lies in protecting the forms against abuse and spam. Where information is stored on or read from your device for this purpose, this is necessary to provide the service you requested, namely submitting the form (sec. 25 (2) no. 2 TDDDG). Transfers to the USA are covered by Cloudflare's certification under the EU-U.S. Data Privacy Framework (Art. 45 GDPR, see above). More information: [Cloudflare privacy policy](https://www.cloudflare.com/privacypolicy/). ## External links and documentation This website links to offerings of third parties, such as GitHub and Packagist. Merely visiting this website does not transmit any data to these providers. Only when you follow a link do the privacy policies of the respective provider apply. The documentation at docs.quittio.dev is a separate website with its own [privacy policy](https://docs.quittio.dev/datenschutz.html) (in German). ## Recipients Personal data is only passed on to the service providers named above and to my email provider, which delivers the form entries, who process it on my behalf, or where I am legally obliged to do so. It is not passed on for advertising purposes. ## Your rights You have the right at any time to: - access the data I process about you (Art. 15 GDPR), - rectification of inaccurate data (Art. 16 GDPR), - erasure (Art. 17 GDPR), - restriction of processing (Art. 18 GDPR), - data portability (Art. 20 GDPR), - withdraw consent with effect for the future (Art. 7 (3) GDPR). To do so, contact [kontakt@niklasforst.de](mailto:kontakt@niklasforst.de). ### Right to object **Where I process data on the basis of Art. 6 (1) (f) GDPR, you have the right to object to the processing at any time on grounds relating to your particular situation (Art. 21 GDPR). I will then no longer process the data unless I can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing serves the establishment, exercise or defense of legal claims.** ### Right to lodge a complaint You have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for me is the State Commissioner for Data Protection and Freedom of Information of Rhineland-Palatinate (Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Rheinland-Pfalz), Hintere Bleiche 34, 55116 Mainz, Germany, [www.datenschutz.rlp.de](https://www.datenschutz.rlp.de). ## No automated decision-making No automated decision-making, including profiling within the meaning of Art. 22 GDPR, takes place. You are not legally or contractually obliged to provide personal data; without the technical connection data, however, the website cannot be delivered. ## Changes I update this privacy policy when the website or the legal situation changes. The version published here applies. As of: October 2026 ```json {"@context":"https://schema.org","@graph":[{"@id":"https://quittio.dev/en#website","@type":"WebSite","description":"E-invoicing for PHP and Laravel: create, validate, read and archive ZUGFeRD, XRechnung and Peppol invoices.","inLanguage":"en","name":"Quittio","url":"https://quittio.dev/en","publisher":{"@id":"https://quittio.dev/#identity"},"translationOfWork":{"@id":"https://quittio.dev/#website"}},{"@id":"https://quittio.dev/en/privacy#webpage","@type":"WebPage","description":"Privacy policy of Quittio: hosting, Cloudflare, audience measurement with PostHog, browser storage and your rights.","name":"Privacy","url":"https://quittio.dev/en/privacy","breadcrumb":{"@id":"https://quittio.dev/en/privacy#breadcrumb"},"isPartOf":{"@id":"https://quittio.dev/en#website"},"potentialAction":[{"@type":"ReadAction","target":["https://quittio.dev/en/privacy"]}],"primaryImageOfPage":{"@id":"https://quittio.dev/#logo"}},{"@id":"https://quittio.dev/#identity","@type":"Organization","description":"Open-Source-Bibliothek für E-Rechnungen in PHP und Laravel (ZUGFeRD, XRechnung, Peppol) und Quittio Managed.","email":"kontakt@niklasforst.de","legalName":"Niklas Forst – Softwareentwicklung","name":"Quittio","url":"https://quittio.dev","founder":{"@type":"Person","name":"Niklas Forst","url":"https://quittio.dev/ueber"},"logo":{"@id":"https://quittio.dev/#logo"},"sameAs":["https://github.com/Quittio/quittio","https://packagist.org/packages/quittio/quittio"]},{"@id":"https://quittio.dev/en/privacy#breadcrumb","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","name":"Home","item":"https://quittio.dev/en","position":1},{"@type":"ListItem","name":"Privacy","position":2}]},{"@id":"https://quittio.dev/#logo","@type":"ImageObject","caption":"Quittio","contentUrl":"https://quittio.dev/logo.png","inLanguage":"en","url":"https://quittio.dev/logo.png"}]} ```