Privacy Policy
Privacy Policy
Last updated: 01.05.2026
1. Controller
The controller within the meaning of the General Data Protection Regulation (GDPR) is:
Dennis Piskovatskov
Alte Weinsteige 12
70180 Stuttgart, Germany
Email: [email protected]
Please direct data-protection requests to the same email address. A data protection officer has not been appointed; an obligation to appoint one under § 38 BDSG does not exist.
2. Categories of data, purposes and legal bases
2.1 Account and authentication data
- Data: Email address, password hash, Supabase user ID, login timestamps.
- Purpose: Provision of the user account, authentication, session management.
- Legal basis: Performance of contract, Art. 6(1)(b) GDPR.
2.2 Profile and contact data (for SELLER plans)
- Data: Name, phone number, email, address of the listing, languages spoken, photo/logo, descriptive texts.
- Purpose: Publication of the seller profile and display of the contact block on the listing detail page.
- Legal basis: Performance of contract, Art. 6(1)(b) GDPR.
2.3 Listing data
- Data: Location (lat/lng), address, price, size, number of rooms, energy class, photos.
- Purpose: Display of listings on the public pages of Secrets.RealEstate, computation of location-based analyses.
- Legal basis: Performance of contract, Art. 6(1)(b) GDPR.
2.4 Payment data
- Data: We do not collect card data. Stripe processes the payment; we only store the Stripe customer ID, subscription ID, status, and invoice amounts.
- Purpose: Processing of paid plans, invoicing, accounting.
- Legal basis: Performance of contract (Art. 6(1)(b) GDPR) and statutory retention obligations (Art. 6(1)(c) GDPR in conjunction with § 147 AO, § 257 HGB).
2.5 Server logs and security data
- Data: IP address, user agent, timestamp, requested URL, HTTP status. These are logged via Cloudflare and our hosting server (Hetzner).
- Purpose: Security, abuse prevention, error analysis.
- Legal basis: Legitimate interest, Art. 6(1)(f) GDPR.
2.6 Support correspondence
- Data: Content of your enquiry, email address, any further information you provide.
- Purpose: Handling your enquiry.
- Legal basis: Legitimate interest (Art. 6(1)(f) GDPR) or pre-contractual measure (Art. 6(1)(b) GDPR).
3. Recipients / processors
We use the following processors and service providers:
| Provider | Location | Purpose |
|---|---|---|
| Hetzner Online GmbH | Germany | Hosting of the application and databases |
| Cloudflare, Inc. | USA | CDN, DDoS protection, edge delivery |
| Supabase, Inc. | USA | Authentication, database for accounts |
| Stripe Payments Europe Ltd. (parent: Stripe, Inc., USA) | Ireland / USA | Payment processing for paid plans |
| Anthropic, PBC | USA | AI-assisted analyses |
| OpenAI, L.L.C. | USA | AI-assisted analyses |
| OpenStreetMap Foundation | United Kingdom | Geocoding and map tiles |
| Google LLC | USA | Air-quality data (Google Air Quality API); website analytics (Google Analytics 4) |
| Telegram Messenger Inc. | USA / United Arab Emirates | Internal operational notifications (no end-user data) |
Contracts under Art. 28 GDPR are in place with all processors.
4. Transfers to third countries
Some of the recipients listed above are located outside the EU/EEA (USA, United Kingdom, UAE). Transfers take place:
- to the USA: based on the EU Standard Contractual Clauses (Implementing Decision (EU) 2021/914) and, where the provider is certified, the EU-US Data Privacy Framework (adequacy decision of 10 July 2023);
- to the United Kingdom: based on the European Commission’s adequacy decision of 28 June 2021;
- to the UAE: based on EU Standard Contractual Clauses; no adequacy decision exists.
A copy of the Standard Contractual Clauses can be requested at [email protected].
5. Retention periods
| Category | Retention period |
|---|---|
| Account and authentication data | until account deletion; thereafter 30-day backup tail, then deletion or anonymisation |
| Profile and contact data (SELLER) | until withdrawal or account deletion |
| Listing data | until deletion by the user; aggregated, anonymised market data may be retained beyond that |
| Payment data / invoices | 10 years (§ 147 AO, § 257 HGB) |
| Server logs | 30 days |
| Support correspondence | up to 3 years after last contact (limitation period, § 195 BGB) |
6. Cookies and similar technologies
We use technically necessary cookies (e.g. Supabase session cookies for sign-in, language preference). These are required for the operation of the website; consent is not required pursuant to § 25(2) no. 2 TDDDG.
To the extent any non-essential cookies or comparable technologies are used, we will request your consent before they are set, via a consent banner (Art. 6(1)(a) GDPR in conjunction with § 25(1) TDDDG). You can withdraw this consent at any time with effect for the future.
6.1 Inventory of cookies and storage keys
| Name | Vendor | Purpose | Duration | Category |
|---|---|---|---|---|
sb-*-auth-token | Supabase, Inc. | session authentication | session (typically 7 days) | strictly necessary |
welcomeOverlayAgreed | Secrets.RealEstate | remembers that you confirmed the welcome overlay | persistent (until you clear site data) | strictly necessary |
analyticsConsent | Secrets.RealEstate | stores your analytics consent (granted/denied) | persistent (until you clear site data) | strictly necessary |
noTrack | Secrets.RealEstate | legacy tracking opt-out flag | persistent (until you clear site data) | strictly necessary |
lang | Secrets.RealEstate | UI language preference | persistent (until you clear site data) | strictly necessary |
ref | Secrets.RealEstate | affiliate referrer attribution | 30 days | functional |
_clck, _clsk | Microsoft Clarity | session recording and usage analytics | _clck 1 year; _clsk 1 day | analytics (consent required) |
_ga, _ga_* | Google Analytics 4 (Google LLC) | website usage analytics (visitor and traffic measurement) | 2 years | analytics (consent required) |
Cookies and storage keys in the “analytics” category are only set after you have explicitly clicked “I agree” in the cookie banner. You may withdraw your consent at any time by clearing the keys above in your browser or by appending ?noTrack=1 to the URL.
7. Your rights
You have the right at any time:
- to access the data stored about you (Art. 15 GDPR);
- to rectify inaccurate data (Art. 16 GDPR);
- to erasure of your data (“right to be forgotten”, Art. 17 GDPR);
- to restriction of processing (Art. 18 GDPR);
- to data portability (Art. 20 GDPR);
- to object to processing (Art. 21 GDPR);
- to withdraw any consent given, with effect for the future (Art. 7(3) GDPR);
- to lodge a complaint with a supervisory authority (Art. 77 GDPR).
The competent supervisory authority for the controller is:
Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg
Lautenschlagerstraße 20
70173 Stuttgart
https://www.baden-wuerttemberg.datenschutz.de
8. Data security
We take appropriate technical and organisational measures pursuant to Art. 32 GDPR to protect your data against unauthorised access, loss, and manipulation (TLS encryption, password hashing, access restrictions, regular backups).
9. Third-party links
Our service may contain links to other websites. The respective operators are responsible for their privacy practices.
10. Children’s privacy
Our offering is not directed at persons under 16. We do not knowingly collect personal data from children.
11. Changes to this Privacy Policy
We may update this Privacy Policy, for instance when processors change or new features are introduced. The current version is available on this page with the date of the last update.
12. Contact
Dennis Piskovatskov
Alte Weinsteige 12, 70180 Stuttgart, Germany
Email: [email protected]
