Version: 1.0
Last updated: 2026-05-05
These Terms govern the use of the service provided by JTB UG (haftungsbeschränkt) (“Provider”) to business customers (“Customer”).
The Service is offered exclusively to businesses, freelancers, public bodies, and other entities acting in the course of their commercial or professional activity (B2B). It is not directed at consumers within the meaning of § 13 BGB. By creating an account, the Customer confirms that it is acting in such a business capacity.
To the extent the Provider processes personal data on behalf of the Customer, this document also constitutes a Data Processing Agreement (DPA).
The Provider offers a SaaS platform to collect data via forms, generate reports, send emails, and provide APIs and integrations with third-party services. Optional AI-based text optimization and form creation may be used if triggered by the Customer.
The Customer is the data controller.
The Provider is the data processor and processes personal data only on behalf of the Customer.
The Customer is responsible for:
- Ensuring a lawful basis for all data processing
- Informing all individuals (including users, clients, and subcontractors) about the collection and processing of their data
- All data submitted to the Service, including data collected from third parties
- Ensuring that it has all necessary rights and authorizations to process and share such data
- The content of submitted data, including personal data and confidential or sensitive business information
- Deciding whether to use AI features for specific data, particularly where such data is confidential or sensitive
The Provider uses sub-processors, including:
- Render.com (application hosting and database storage)
- Hetzner (object storage for uploaded files)
- Sentry (error monitoring and logging)
- Postmark (email delivery)
- Anthropic (AI processing, optional)
- Third-party integrations opted in by the Customer (e.g. Dropbox, Microsoft OneDrive)
The Provider may update the list of subprocessors from time to time and will make the current list available to Customers.
AI-based processing is performed only upon Customer instruction.
Data may be transmitted to a third-party provider (Anthropic) for this purpose.
The Provider does not use Customer data to train AI models.
Personal data may be transferred outside the EU/EEA (e.g. to the United States).
Such transfers are safeguarded using Standard Contractual Clauses (SCCs).
The Provider processes personal data to:
- Store and manage form inputs
- Generate reports
- Send reports via emails, APIs and other integrations
- Perform optional AI-based processing
Types of data may include:
- Names of users
- Addresses
- GPS locations
- Signatures
- Photos and videos
- Free-text inputs
All data is provided by the Customer or its users. The Provider does not control submitted data.
The Provider processes personal data only on documented instructions from the Customer.
Use of the Service, including configuration and use of optional features, constitutes such instructions.
Persons authorized to process personal data are bound by confidentiality obligations.
The Provider implements appropriate technical and organizational measures, including:
- Encryption in transit (HTTPS)
- Encryption at rest
- Access controls
- Automated and frequent backups
The Provider assists the Customer in fulfilling data protection obligations, including handling data subject requests.
The Provider will provide reasonable information necessary to demonstrate compliance with this DPA upon request.
The Provider will notify the Customer without undue delay after becoming aware of a personal data breach.
Data is stored for the duration of the Customer’s use of the Service.
The Customer may delete the entire account at any time.
Selective deletion of individual records can be requested via support.
Bulk deletion is performed via account deletion.
Upon account deletion, all data is deleted within 30 days, except for backups retained for a limited period.
Upon termination, personal data will be deleted unless legal obligations require retention.
Data may be transmitted via email or third-party integrations.
Such transmissions may not be fully secure. The Customer is responsible for deciding how to use these features.
These Terms are governed by the laws of Germany. Exclusive place of jurisdiction for all disputes arising out of or in connection with these Terms is Mainz, Germany, to the extent permitted by law.
By creating an account or using the Service, the Customer agrees to these Terms and the Data Processing Agreement.