Local scanning and OCR
Scanning and OCR text recognition use Google ML Kit on the device. ML Kit does not send document images, recognized text or results to Google. The SDK does transmit technical diagnostics and usage metrics described in the Privacy Policy.
AI contract analysis
Only when the user starts an AI analysis does the app send recognized text through api.appfabrik-ai.de to OpenAI API. OpenAI returns structured contract fields, deadlines, costs, warnings, source notes and a summary. The results are displayed for review before saving.
Submitted data includes:
- recognized OCR text
- OCR confidence and text-block and page metadata
- document source and page count
- schema, prompt and analysis identifiers
Online provider check
The separately started online provider check may send provider name, contract title, country, contract profile, contract category and existing contact fields to OpenAI. The OpenAI web search tool may check publicly available provider, cancellation, withdrawal, support and legal-notice pages. Suggestions and sources may be incomplete or wrong and must be verified before use.
Not submitted by default
- Original PDFs and image files are not sent to OpenAI.
- The local document archive is not uploaded to AppFabrik AI servers.
- AppFabrik AI does not create advertising profiles from contract data or sell contract data.
No health or other special-category data
Cloud features must not be used for health data or other special categories of personal data under Art. 9 GDPR. Before every AI analysis and online provider check, the user confirms that the submitted information contains no such data. Local management remains available.
Processing and retention
The gateway processes content only for the active request. It does not log OCR text, contract content or AI results. Technical status and usage metadata is retained for no more than 14 days.
OpenAI requests use store: false, so no response state is retained for later retrieval by the app. Under the current API data controls, OpenAI may retain abuse-monitoring logs containing prompts, responses and metadata for up to 30 days by default. API data is not used for model training unless AppFabrik AI explicitly opts in. See the official OpenAI documentation.
Consent and withdrawal
Separate consent is requested before the first AI analysis and first online provider check. The app stores the accepted text version and time locally. Consent can be withdrawn for the future under “Options > Legal & privacy”. Independently, the user confirms before every cloud request that no special categories of personal data will be submitted.
No legal advice
AI Contract Manager organizes and structures information. It does not provide legal advice. Deadlines, contract interpretation, cancellation, withdrawal and recipient details must be checked by the user.