← Back to Levamio Form Helper

Privacy Policy "Levamio Antrag-Lotse" (app for iOS and Android)

In English-language app stores the app is called "Levamio Form Helper"; in other languages its name is translated accordingly. This policy applies to all language versions of the app.

1. Controller

NEXTLEVEL CORPORATE SERVICE PROVIDER - FZCO, Building A1, IFZA Business Park, Dubai Digital Park, Dubai Silicon Oasis, Dubai, United Arab Emirates (DIEZ License No. 67837), represented by Tassilo Peter Seitz. Levamio is a service of NEXTLEVEL CORPORATE SERVICE PROVIDER - FZCO (hereinafter "we").

E-mail for data protection questions and for exercising your rights: [email protected] (general support: [email protected])

EU representative (Art. 27 GDPR): We are not established in the EU. You can always contact us directly with any data protection matter.

Data protection officer: No data protection officer has been appointed at present. Your point of contact is the controller at the address given above.

2. Key points at a glance

• You do not need an account. We know neither your name nor your e-mail address.
• The form (photo or PDF) is sent via our server to our AI provider Anthropic (USA) only after your explicit consent and only for the purpose of the explanation. We do not store it.
• Your answers given while filling in the form (fill-in interview) do not leave your device. Neither we nor the AI provider receive them. The cheat sheet and the completed PDF are generated on your device.
• Saved forms, answers and deadlines are stored only on your device, encrypted – or not at all if you choose „Nichts speichern“ [Don't save anything].
• No tracking, no advertising, no analytics tools.

3. Overview: what we process, for what purpose, on what legal basis

You are under no obligation to provide data. Without consent you can open the app, but you cannot have forms explained. We do not make any automated individual decisions with legal effect (Art. 22 GDPR); the app does not check whether you are entitled to a benefit. We do not sell your data and do not use it for advertising.

4. AI analysis of your form

Consent: Before the first analysis, the app shows a dedicated notice: which data are sent, to whom, that we store nothing on the server, that your answers remain on the device and that forms may contain particularly sensitive information. Regarding storage at Anthropic, it states: „Wir speichern dein Formular nicht. Anthropic speichert die Anfrage nach eigenen Angaben bis zu 30 Tage zur Missbrauchserkennung (länger nur, wenn ein Verstoß gegen die Nutzungsrichtlinien festgestellt wird) und nutzt sie nicht zum Training.“ [We do not store your form. According to its own information, Anthropic stores the request for up to 30 days for abuse detection (longer only if a violation of the usage policies is identified) and does not use it for training.] Nothing is sent until you actively tick the consent box and the separate box „Ich bin mindestens 16 Jahre alt.“ [I am at least 16 years old.] and tap „Zustimmen und weiter“ [Agree and continue]. Without consent and without age confirmation, our server also rejects any analysis. If the recipients or the scope change, we will ask again.

Special categories (Art. 9 GDPR): Forms from public authorities, the family benefits office (Familienkasse), the job centre (Jobcenter), the housing benefit office, or health or long-term care insurance funds may ask for information on health, disability or care level, social benefits, residence status or religion (e.g. denomination when registering one's address). A blank form does not usually contain such information about you; if it has already been partly filled in, it may contain it. For the processing of such data we obtain your explicit consent under Art. 9(2)(a) GDPR. Your answers to such questions remain on your device; the app marks particularly sensitive fields.

Criminal or administrative offence proceedings (Art. 10 GDPR) and tax returns: Please do not upload forms relating to criminal or administrative offence proceedings (e.g. a hearing questionnaire (Anhörungsbogen)) or tax returns; the app is not intended for these and points this out on the consent screen and on the start screen. If such a form is nevertheless sent, it is transmitted and evaluated by the AI like any other form, because only then can the app recognise it; it is not stored by us. If the app recognises such a form, it does not output an explanation but only a general notice; the form is not stored and does not count as a free form. This recognition is automated and not exhaustive.

Data of other persons: Forms often ask for information about household members, children or partners. You enter this information only on your device; it is not sent to us. If a form already filled in with information about third parties is part of the photo, we process that information only so that you can understand the form (Art. 6(1)(f) GDPR). Please only send forms that you fill in yourself or process with the permission of the person concerned.

Process:

1. The app reduces the size of the photo on your device. For a PDF, it reads the number of pages on your device and – if present – the names of the PDF form fields (without values). It sends the image or PDF and this field list in encrypted form (HTTPS) to our server, a Cloudflare Worker.
2. The server checks the file type, size and number of pages (at most 8 pages in total; a longer or unreadable form is rejected before counters, subscription query or AI provider are involved), your consent and age confirmation, the free allowance or your subscription and the usage limits; for the free form, additionally the device check (section 6).
3. It forwards the image or PDF with the instruction to explain it to Anthropic (Anthropic PBC, USA, language model "Claude"). If the model is overloaded or the response is unusable, the request is sent once to another Claude model from the same provider.
4. The response (purpose of the form, each field in plain words, where to find the information, documents to be enclosed, deadlines with verbatim quotation, submission, authenticity notes) is returned to your app.
5. The fill-in interview, the cheat sheet and entering data into a fillable PDF then take place exclusively on your device.

No storage by us: Our server stores neither the image nor the PDF nor the response (exception: reported results with your separate consent, section 6a). The content is processed only in working memory for the duration of the request. Our logs contain only technical metrics without content and without device identifier.

At Anthropic: Anthropic processes the request as our processor under Anthropic's commercial terms and Data Processing Addendum. According to Anthropic's current information, data from the API are not used to train the models and are stored for up to 30 days for abuse detection; longer only if a violation of Anthropic's usage policies is identified (according to Anthropic, then for up to 2 years) or if there is a legal obligation. We have no influence over this storage. The place of processing is the USA (section 9).

AI labelling: Every result is labelled „Von KI erstellt“ [Created by AI] in the app, in the cheat sheet and in the PDF cheat sheet (transparency within the meaning of Art. 50 AI Act). The explanation is generated automatically, may be wrong or incomplete and is a general aid to filling in forms; it does not replace legal, social or tax advice and does not check whether you are entitled to a benefit. Always check information and deadlines in the original.

Withdrawal: You can withdraw your consent at any time with effect for the future in the settings („Einwilligung widerrufen“ [Withdraw consent]) (Art. 7(3) GDPR). After that, the app no longer sends any forms. Analyses already carried out remain lawful; no content from them is held on our server.

5. Data on your device

Forms, answers, checklists, deadlines: only if „Verschlüsselt auf dem Gerät speichern“ [Save encrypted on the device] is active, in the app's local database (IndexedDB), encrypted with AES-GCM-256. For fillable PDFs, the original PDF is also stored so that you can fill it in later. The key is held in the iOS keychain (on this device only, without iCloud synchronisation) or in the Android Keystore; on Android, cloud backup and transfer to a new device are switched off for the app. With „Nichts speichern“ [Don't save anything], the explanation and answers remain in working memory only for as long as you have the app open. We do not receive these data; we can neither view nor restore them.

Voice input: The app does not record any audio itself. If you dictate answers using your keyboard's microphone, this uses the dictation function of your operating system or keyboard; depending on the device and settings, its provider (e.g. Apple, Google) may process the speech online. Its terms apply to this.

Cheat sheet and completed PDF: are generated on your device. Only if you trigger „Teilen“ [Share], „Kopieren“ [Copy] or a PDF does the app pass the content on to the app or clipboard you have chosen; their terms apply there. For this purpose, the PDF is placed briefly in the app's cache and deleted after approximately one minute.

Settings: Language, display options, time and version of your consent, the random device identifier. You can view and copy the device identifier under „Einstellungen → Deine Geräte-ID“ [Settings → Your device ID].

Reminders: Deadline reminders (7 days, 2 days and on the day of the deadline) are local notifications from your device, without a server. They contain no form content, only a neutral text (e.g. „Frist in 2 Tagen – öffne den Antrag-Lotsen“ [Deadline in 2 days – open the Form Helper]), and may be visible on the lock screen.

Camera and photos: Access only after your permission in the system dialogue. When selecting from the gallery, the app receives only the images you select.

Read aloud: uses your device's text-to-speech. Depending on the text-to-speech engine installed, its provider may process the text online.

You can delete these data in the app („Alle lokalen Daten löschen“ [Delete all local data] removes the data and the key), by deleting individual forms or by uninstalling the app. The random device identifier is retained when the local data are deleted and is removed only when the app is uninstalled.

6. Free allowance, abuse protection and device check

On first use, the app generates a random device identifier (not a hardware or advertising ID). It is sent with every analysis and every report. Our server does not store it in plain text, but only as a salted hash together with counters in Cloudflare's storage (Durable Objects):

• counters for limiting requests (currently at most 5 forms per 10 minutes and 20 per day): depending on the time window, between 15 minutes and 2 days, after which they are automatically deleted;
• counter for the free allowance (currently one free form): 400 days, after which it is automatically deleted;
• one-time verification challenge for the device check: 15 minutes;
• cache of the most recently confirmed subscription status (for RevenueCat outages): 24 hours.

IP address: The free form is available at most three times per internet connection per day. For this purpose, our server creates from your IP address (for IPv6 truncated to the first 64 bits) a hash re-salted daily and stores only this hash with a counter for 2 days. We do not store or log the IP address itself; hashes from different days cannot be linked to one another. In addition, there is a daily maximum for all free forms in total. Subscribers are not affected by these free-use limits.

Device check (attestation): The free form is available only if the app confirms that it is running as a genuine app on a genuine device. On iOS the app uses Apple App Attest for this; on Android, Google Play Integrity, with our server sending the verification token to Google for evaluation. Apple or Google process data on the device and app in this context under their own terms as independent controllers; data may also be transferred to the USA in this context (section 9). We do not store the result, only the fact that the verification challenge has been used.

Without your device, we cannot identify you from the hashes; they nevertheless constitute pseudonymous personal data. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is to distribute the free allowance fairly and to prevent abuse and disproportionate costs.

6a. Reporting a result

Via „Ergebnis melden“ [Report result] you can report to us an AI explanation that is wrong, offensive or dangerous. The reason, your voluntary comment (please without personal data) and technical information are sent. Only if you tick the separate box (off by default) is the AI explanation of the form also sent (shortened, without your answers); it may contain information from the form. Photos, PDFs and your answers are never sent.

We store the report in Workers KV at Cloudflare without device identifier and without IP address; it is automatically deleted after 90 days. The server uses the device identifier and IP address only in hashed form to limit reports (at most 10 per device and 30 per connection per day). Legal basis: Art. 6(1)(f) GDPR; for form content sent along, your explicit consent (Art. 6(1)(a), Art. 9(2)(a) GDPR). As reports are not assigned to any person, please give us the date and time of the report if you wish to withdraw consent or request early deletion.

7. Subscription and purchases

You take out subscriptions in the Apple App Store or on Google Play. Payment, invoicing, cancellation and refunds are handled by the respective store; Apple or Google is an independent controller for this. We do not receive any payment data, only the information as to which subscription is active.

To manage subscriptions we use RevenueCat (RevenueCat, Inc., USA) as a processor. RevenueCat receives the random device identifier as customer ID, purchase receipts and subscription status from the store, product, price, store country, as well as technical information on device, operating system and app version, and the IP address. Only when needed: the app connects to RevenueCat only when you open the subscription page, buy a subscription or restore purchases, or when your free form has been used up or a subscription is known on the device. Only then does our server query RevenueCat as to whether your subscription is active. In a query, RevenueCat receives the device identifier in plain text as customer ID; a customer record may be created at RevenueCat in the process. The legal basis is Art. 6(1)(b) GDPR; for checking whether a subscription exists at all, Art. 6(1)(f) GDPR.

8. Storage period

• Form content and AI responses on our server: no storage (only during the request); exception section 6a.
• Your answers from the fill-in interview: never on our server.
• At Anthropic: according to Anthropic's current information, up to 30 days, longer only where a violation of the usage policies has been identified or there is a legal obligation (section 4).
• Hash and counters: rate limit 15 minutes to 2 days; free allowance 400 days; IP hash 2 days; verification challenge 15 minutes; subscription cache 24 hours. In Cloudflare's storage, deleted entries may technically still be reconstructable for up to 30 days.
• Reports on AI results: 90 days.
• Technical metrics and server logs: at most 7 days.
• Subscription data at RevenueCat: for as long as the subscription exists and thereafter in accordance with RevenueCat's retention rules or our legal obligations.
• Data on your device: until you delete them or uninstall the app.
• Support enquiries: up to 3 years after closure.

9. Recipients and third countries

USA: Transfers to the USA are covered by the adequacy decision on the EU-US Data Privacy Framework (Art. 45 GDPR), insofar as the recipient is certified. Otherwise, we base the transfer on the European Commission's Standard Contractual Clauses (Art. 46(2)(c) GDPR) with supplementary measures (encryption in transit, no storage by us, data minimisation through image reduction, answers remain on the device).

United Arab Emirates: We, as the controller, are based in the UAE; there is no adequacy decision for the UAE. Your forms and answers do not reach our systems in the UAE, because we do not store them. We may view reported AI results (section 6a) from the UAE via secure connections in order to handle the report. We apply the GDPR insofar as it applies to our service; for users in Switzerland, additionally the revised Federal Act on Data Protection (revFADP).

10. Your rights

Under the GDPR you have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21). You can withdraw your consent in the app at any time (Art. 7(3)). Withdrawal does not affect the lawfulness of processing carried out up to that point.

Right to object (Art. 21 GDPR): Insofar as we process data on the basis of legitimate interests (Art. 6(1)(f) GDPR, e.g. abuse protection, reports, operation), you may object at any time on grounds relating to your particular situation. We will then no longer process the data unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims. An informal message to [email protected] is sufficient.

As we do not maintain accounts and do not store forms, the only data relating to you that we hold are the hashes with counters and – for subscriptions – the data at RevenueCat. To obtain access to or erasure of these data, please provide us with the device identifier that the app displays under „Einstellungen → Deine Geräte-ID“ [Settings → Your device ID]; without it we cannot attribute the data to you (Art. 11 GDPR). You manage the data on your device yourself. Requests to [email protected]; we generally reply within one month.

You may lodge a complaint with a data protection supervisory authority, in particular in the EU/EEA member state of your habitual residence, your place of work or the place of the alleged infringement (in Austria: Datenschutzbehörde [Data Protection Authority]); in Switzerland with the Federal Data Protection and Information Commissioner (FDPIC).

11. Children

The app is intended for adults. The AI analysis may only be used from the age of 16 (cf. Art. 8 GDPR); before the first analysis you confirm with a separate box that you are at least 16 years old; without this confirmation our server rejects the analysis. We do not knowingly collect data from children.

12. Security

Encrypted transmission (HTTPS), no storage of form content on the server, fill-in interview only on the device, checking of file type, size and number of pages, instruction to the AI to treat form content only as data and not as instructions, checking of the AI response against a fixed schema, warning and blocking for fields asking for a PIN, TAN or passwords, salted hashes instead of identifiers and IP addresses, device check for the free form, emergency shutdown of the AI analysis in the event of security incidents, encrypted storage on the device with the key in the keychain or Keystore, no cloud backup on Android, secret keys only on the server.

13. Changes

We adapt this policy when functions, service providers or the legal situation change. In the event of changes affecting your consent, the app will ask again. The current version is available in the app and at https://levamio.com/apps/antrag-lotse/datenschutz-en/.

As of: 21 October 2026