Privacy Policy

We use Supabase (Supabase Inc., Singapore) for authentication and account storage. Database and storage are operated in the EU (Frankfurt) region.

Data processed: email, name, hashed password or OAuth tokens, organisation/role membership, login timestamps.

Legal basis: Art. 6(1)(b) GDPR. DPA with SCCs in place.

Data you create inside the product (projects, properties, clients, reservations, tickets, files etc.) is strictly partitioned per organisation via database-level row-level security.

Legal basis: Art. 6(1)(b) GDPR; Art. 28 GDPR where you upload data of your own data subjects (we sign a DPA with you on request — contact privacy@deal-pipe.de).

Uploaded files are stored in Supabase Storage in the EU (Frankfurt) region. Access is restricted to members of the respective organisation and protected via row-level security.

Certain features use AI models for document analysis (extraction, classification, summaries, ticket triage). Document content is sent to the following providers:

• Google (Gemini models) via Vertex AI — the contracting entity is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Model inference runs on Google Vertex AI in the europe-west4 (Netherlands) region; processing takes place entirely within the EU.
• Google Cloud Storage (EU) — larger documents are briefly staged in an EU bucket for AI processing and deleted immediately afterwards.
• OpenAI (optional document classification) — OpenAI Ireland Limited, 117-126 Sheriff Street Upper, Dublin 1, Ireland. Where enabled for your organisation, we use OpenAI's Decisions interface to classify documents and assign units, via the EU endpoint only (eu.api.openai.com). Short text excerpts or page images of uploaded documents are transmitted.

Inputs are used solely to answer the request. We have contractually ensured that providers do not use submitted data to train their models.

Legal basis: Art. 6(1)(b) and (f) GDPR. Transfers: document analysis and classification via Google Vertex AI, Google Cloud Storage and the OpenAI EU endpoint take place within the EU. Call transcription uses a US service; see section 5.14.

We use Resend (Resend, Inc., San Francisco, USA) for notifications, invitations, magic links and other transactional mail. Resend processes your email, message content and delivery metadata. DPA with SCCs in place.

We use PostHog's EU cloud for stability and error monitoring. We send scrubbed error messages, error classes, stack coordinates, timestamps, application versions and technical identifiers. Request payloads, cookies, credentials and document contents are excluded.

Server response times support operational monitoring. Browser performance and linkage to your user identifier require your analytics consent; linkage to recordings additionally requires session replay consent. Without these choices, error monitoring uses a general application identifier and sets no analytics cookies.

Legal basis: Art. 6(1)(f) GDPR for stability and IT security; Art. 6(1)(a) GDPR for optional browser analytics. Provider and international transfer information appears in section 6.4.

We use Knock Labs, Inc. (New York, USA) for in-app and cross-channel notifications. Data processed: user id, recipient data, message content. DPA with SCCs in place.

On the login page and selected endpoints we use Vercel BotID to mitigate automated abuse. Technical device signals are evaluated; no personalised profiling takes place. Legal basis: Art. 6(1)(f) GDPR (IT security).

We use Stripe to process paid subscriptions. The contracting entity for EEA customers is Stripe Payments Europe Limited, 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland. Technical processing is supported by the parent company Stripe, Inc., 354 Oyster Point Boulevard, South San Francisco, CA 94080, USA.

Data transmitted to Stripe:

• name and billing address
• email address
• VAT ID (if provided)
• payment method tokens (card or SEPA data is collected directly by Stripe and not transmitted to us — we receive only a token and the last 4 digits / expiry for display)
• invoice and subscription metadata (plan, term, amount)

Legal basis: Art. 6(1)(b) GDPR (contract) and Art. 6(1)(c) GDPR (compliance with statutory tax and commercial retention obligations).

Retention: invoice and payment data is retained in line with statutory retention periods (typically 10 years under § 147 AO).

International transfers: Stripe Inc. (US) is certified under the EU–US Data Privacy Framework. A data processing agreement including EU Standard Contractual Clauses is in place. Details: stripe.com/privacy.

Maps in the app (property locations, location analysis, aerial view) are provided by Mapbox (Mapbox, Inc., 740 15th Street NW, 5th Floor, Washington, DC 20005, US). A map loads only once you have allowed maps in your privacy settings or open it with “Load map”. The coordinates of the visible area and technical connection data (including your IP address) are then transmitted to Mapbox.

Address suggestions when you enter a property come from Google Places (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; technical processing possibly by Google LLC, US). Your input in the address field and technical connection data are sent to Google as you type.

Legal basis: maps: Art. 6(1)(a) GDPR with § 25(1) TDDDG (your consent or click); address suggestions: Art. 6(1)(f) GDPR (reliable address entry). Transfers: EU–US DPF / SCCs.

We use Upstash (Upstash, Inc., US) for rate limiting and caching. Technical data such as IP address or user id is processed briefly as a counter; this data is ephemeral and automatically deleted after a short time.

Legal basis: Art. 6(1)(f) GDPR (IT security, protection against abuse and overload).

You can optionally connect your Google (Gmail) or Microsoft (Outlook / Microsoft 365) mailbox to send and receive email directly from the Service. Only after your explicit authorisation (OAuth) does the Service access the required mailbox functions; access tokens are stored encrypted in our infrastructure (Supabase).

Providers: Google Ireland Limited (Gmail API) and Microsoft Ireland Operations Limited (Microsoft Graph). Legal basis: Art. 6(1)(b) GDPR (performing the feature you requested). The integration is optional and can be revoked at any time.

To ensure the quality and reliability of the AI features (section 5.4), to trace errors and to monitor the associated cost, we log the technical metrics using PostHog. AI model inputs and outputs are excluded from this telemetry.

Provider: PostHog Inc., USA (see section 6.4 for details). Processing and storage take place in the EU (Frankfurt data centre).

Data processed:

• technical metadata (model used, timestamp, token and cost metrics, organisation id)

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in quality assurance, error analysis and cost control of the AI features).

International transfers: EU processing and contractual safeguards are described in section 6.4. Inputs, outputs, document text and tool payloads are excluded from AI telemetry. Technical metrics assess timing and reliability, not the factual accuracy of an answer.

For managed voice and SMS communication, telephony and the recording of online meetings we use the following providers. These features are optional, enabled per organisation and active only with the explicit consent of the recorded participants.

• Twilio — Twilio Inc., 101 Spear Street, San Francisco, CA 94105, USA (contracting entity for EEA customers: Twilio Ireland Limited, Dublin). Processed: contact and phone number data, message content, connection and delivery data and call recordings. Recordings are deleted after processing. A DPA with EU Standard Contractual Clauses (SCCs) and the EU–US Data Privacy Framework is in place.
• Recall.ai — Hyperdoc Inc. (Recall.ai), 2261 Market Street #4339, San Francisco, CA 94114, USA. A meeting bot joins Zoom, Google Meet and Microsoft Teams meetings, records audio and video and returns transcripts and metadata. We use the provider's EU region (eu-central-1); media remains with Recall under the workspace's retention settings. A DPA with SCCs is in place.
• ElevenLabs (optional transcription) — ElevenLabs Poland sp. z o.o., Lipska 27/22, 03-908 Warsaw, Poland (for EEA customers); technical processing by Eleven Labs Inc., 169 Madison Ave #2484, New York, NY 10016, USA. Where configured in the Recall workspace, meeting audio is sent to ElevenLabs for transcription. Transfers to the US rely on the EU–US Data Privacy Framework and EU Standard Contractual Clauses.
• OpenAI (call transcription) — OpenAI OpCo, LLC, 1455 Third Street, San Francisco, CA 94158, USA. Audio recordings of Twilio calls are sent to OpenAI's transcription interface. Processing takes place in the US on the basis of EU Standard Contractual Clauses. Use of the data to train models is contractually excluded.

Legal basis: Art. 6(1)(b) GDPR (performing the feature you requested) and Art. 6(1)(a) GDPR (consent of the recorded participants).

International transfers: Twilio, Recall, ElevenLabs and OpenAI also process data in the US. Transfers rely on EU Standard Contractual Clauses and, where certified, the EU–US Data Privacy Framework. Art. 28 GDPR data processing agreements are in place with each provider.

To create, review and electronically sign deal documents (e.g. reservation agreements, contracts) we use PandaDoc, Inc., 3739 Balboa St. #1083, San Francisco, CA 94121, USA. Processed: recipient names and email addresses, document content and signature and delivery records. PandaDoc offers an EU data region; the processing region follows the chosen configuration.

Legal basis: Art. 6(1)(b) GDPR (contract). A DPA with EU Standard Contractual Clauses (SCCs) is in place.

Uploaded property videos are hosted for delivery via Cloudflare Stream (Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA). Processed: video content and technical access data (including your IP address). Cloudflare is certified under the EU–US Data Privacy Framework; a DPA with EU Standard Contractual Clauses (SCCs) is in place.

Legal basis: Art. 6(1)(b) GDPR (contract) and Art. 6(1)(f) GDPR (delivery to authorised users).

Authorised users may optionally enrich individual contact or company records with FullContact (FullContact, part of Ziff Davis, Inc., 360 Park Avenue South, 17th Floor, New York, NY 10010, USA). A request runs only on an explicit user action and never automatically; the contact's email address or the company website entered is transmitted. Only supported identity and business fields are stored; raw responses and sensitive attributes are discarded.

Legal basis: Art. 6(1)(b) and (f) GDPR. FullContact is certified under the EU–US Data Privacy Framework; transfers also rely on EU Standard Contractual Clauses.

We use strictly necessary cookies and local storage to keep the Service functional — in particular for:

• authentication and session management (login)
• protection against cross-site request forgery (CSRF)
• locale and theme selection
• persisting your in-app preferences

Under § 25(2)(2) TDDDG these do not require consent because they are strictly necessary for the service explicitly requested by the user. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in providing a functional service).

On our website deal-pipe.de we only use such strictly necessary storage. No audience or performance measurement runs in the browser there, and no services that require consent are loaded. The services described in 6.2 to 6.4 are used only in the application at app.deal-pipe.de.

We use Vercel Web Analytics, a service of Vercel Inc., 340 S Lemon Ave #4133, Walnut, CA 91789, USA, to measure usage of the application at app.deal-pipe.de. Vercel Web Analytics operates without cookies and without persistent tracking of individual users.

Data processed:

• requested URL and timestamp
• referrer URL
• user agent (browser, OS, device category)
• screen resolution
• approximate geographic information (country, region and city, derived from the IP address)
• a request-derived visitor hash discarded after 24 hours (no persistent identifier)

Legal basis: Art. 6(1)(a) GDPR (your voluntary consent). The service is loaded only after you opt in and can be disabled through the privacy settings.

International transfers: Vercel Inc. is certified under the EU–US Data Privacy Framework; a data processing agreement including EU Standard Contractual Clauses is in place. Details: vercel.com/docs/analytics/privacy-policy.

In the application we use Vercel Speed Insights to measure real-user load times and Web Vitals (LCP, FID/INP, CLS etc.). Operated by Vercel Inc. (address as above). The service operates without cookies and without persistent identification of users.

Data processed: technical performance metrics (render timings, interaction latency, layout shifts), requested URL, user agent, and connection quality — no personal content and no IP address in clear text.

Legal basis: Art. 6(1)(a) GDPR (your voluntary consent). Performance measurement remains disabled until you opt in.

Details: vercel.com/docs/speed-insights/privacy-policy.

Within the application at app.deal-pipe.de we use PostHog for product analytics — only with your consent — to understand how the Service is used and thereby improve it.

Provider: PostHog Inc., 2261 Market Street #4008, San Francisco, CA 94114, USA. Processing and storage take place in PostHog's EU cloud (Frankfurt data centre, AWS eu-central-1).

Data processed:

• page views and navigation paths within the application
• technical data (browser, operating system, device category, load times / Web Vitals)
• session recordings (session replay): a recording of your interactions (mouse movements, clicks, page changes) to analyse the user journey. All input fields are automatically masked; keystrokes and field contents are not recorded
• a pseudonymous user identifier (an internal, randomly assigned id — no clear-text identification such as name or email)

PostHog uses cookies or comparable storage techniques (localStorage) for this. Automatic capture of all click events ("autocapture") is disabled.

Legal basis: Art. 6(1)(a) GDPR and § 25(1) TDDDG (consent). Optional product analytics and session replay are not loaded without your consent. Minimized technical error reports are described in section 5.6. You can withdraw your consent at any time with effect for the future via the cookie settings.

Retention: session recordings are automatically deleted after one month. Event and usage data is stored pseudonymously and retained only for as long as necessary for the purposes described above; you may additionally request its deletion at any time (section 10).

International transfers: data is hosted in the EU (Frankfurt). The contracting entity is PostHog Inc. (US); a data processing agreement including EU Standard Contractual Clauses is in place. Details: posthog.com/privacy.

Analytics and session recording are separate choices. For signed-in internal users we store each decision with its time and version on the account. It applies across devices and can be changed or withdrawn in Settings → Privacy. Public shares, booking pages and customer portal access do not use this product analytics. The website stores its choice in the current browser.

First-party product analytics events are processed only with consent and deleted after 14 calendar months and when the account is deleted. Consent and contract evidence is retained for its specific purpose. Terms acceptance evidence is kept during the account lifetime and up to three years after account closure, subject to any longer statutory obligation or necessary legal defence.

We use no marketing, advertising or profiling cookies. We do not engage in cross-site user tracking, nor do we share usage data with advertising networks.