Datenschutz

Controller

Scope

This notice explains how BotBerlin processes personal data when you visit the app, create an account, configure a search, browse or act on listings, receive alerts, contact support, or use payment features once they are enabled.

App Access And Security

When you access BotBerlin, Cloudflare and our application infrastructure process connection data such as IP address, request time, requested path, browser information, and security or error data. We use this data to deliver the app, prevent abuse, diagnose failures, and keep the service secure. The working legal basis is our legitimate interest under Art. 6(1)(f) GDPR in operating a secure and reliable service.

Accounts And Search Preferences

Supabase processes your email address, authentication identifiers, login state, account security information, setup state, rent and apartment preferences, WBS preference, neighborhoods, browse filters, listing actions, and alert settings. We process this data to provide the service you request. The working legal basis is Art. 6(1)(b) GDPR.

Listing Monitoring And Matching

BotBerlin obtains listing facts from supported provider pages, including source URL, title, rent, rooms, size, postal code, availability, WBS status, timestamps, and coarse location enrichment. Full descriptions, exact addresses, coordinates, protected media, and contact details are not retained. Exact addresses may be processed transiently for neighborhood resolution and are discarded before listing storage. The working legal basis for necessary listing monitoring is Art. 6(1)(f) GDPR. Our stated interests are helping users find relevant housing offers and operating the matching service. You may object to processing based on legitimate interests.

Automated Decisions

BotBerlin compares preferences with listing facts and may add explanatory Smart Labels. This ranking and filtering does not decide whether you receive a home, viewing, or contract. Housing providers make those decisions. BotBerlin does not make decisions that produce legal or similarly significant effects within the meaning of Art. 22 GDPR.

Alerts

We process your selected channel, delivery address or identifier, matched listing facts, and delivery outcome to send requested alerts. Email is delivered through Brevo. Telegram is an optional channel chosen and linked by you; Telegram processes data under its own privacy policy as an independent controller. Browser push is optional and sends data through the push service identified by your browser endpoint. The working legal basis for requested alert delivery is Art. 6(1)(b) GDPR.

Analytics And Error Monitoring

BotBerlin uses PostHog in its EU region for limited product and operational events and error monitoring. Automatic pageview capture, general autocapture, session recording, surveys, and console recording are disabled. The app records a limited app-loaded event and identifies the Supabase user ID after sign-in so we can measure activation and service reliability. Cloudflare Web Analytics also provides aggregate traffic measurement. The working legal basis is Art. 6(1)(f) GDPR. The separate German terminal-access and consent assessment for client analytics must be completed before paid launch receives legal approval.

Support, Legal, And Privacy Requests

We process your contact information, message, attachments, and case history when you contact support or make a privacy, deletion, payment, refund, withdrawal, complaint, or legal request. The legal basis depends on the request and may be Art. 6(1)(b), Art. 6(1)(c), or Art. 6(1)(f) GDPR. Sensitive cases receive human review through support@botberlin.com, legal@botberlin.com, or hello@morhaf.dev.

Payments

When Search Pass payment is enabled, Stripe will process checkout, payment, tax, fraud, refund, and receipt information. Stripe acts as a processor for some functions and as an independent controller for others. BotBerlin stores Stripe identifiers, amount, access, refund, and entitlement state, but does not receive complete card details. The working legal bases are Art. 6(1)(b) GDPR for the purchase and Art. 6(1)(c) GDPR for applicable accounting duties. Payment remains disabled until the paid-launch legal review is complete.

Recipients And Service Providers

Depending on the features you use, personal data may be disclosed to or processed by:

• Supabase for authentication, database, and account and service data in the EU Frankfurt region.
• Cloudflare for application hosting, content delivery, security, edge processing, and Web Analytics.
• PostHog for limited analytics and error events in its EU region.
• Brevo for transactional email delivery.
• Telegram as an independent controller when you choose Telegram alerts.
• Browser push services selected by your browser when you enable push alerts.
• Hetzner Cloud and Berlin Atlas for listing collection, temporary operational logs, and location enrichment.
• Stripe when payment features are enabled.

International Transfers

We prefer EU processing regions where available. Cloudflare operates a global edge network, and some providers or sub-processors may process data outside the EEA. Depending on the recipient, safeguards may include an adequacy decision, the EU-US Data Privacy Framework, or EU Standard Contractual Clauses. Telegram describes separate storage and transfer terms in its own privacy policy.

Retention And Deletion

• Account and preference data is retained while your account exists.
• Notification audit rows are deleted after 90 days.
• Database scrape-job records are deleted after 30 days.
• Browser push endpoint records are deleted after 180 days or earlier when you disable push or delete your account.
• Listings last seen more than 30 days ago are deleted unless linked to an applied or favorite user action.
• Support, legal, payment, tax, and complaint records are retained according to the purpose, statutory duties, and legal-defense needs.
• PostHog, Cloudflare, VPS, support, and processor retention settings remain subject to the final retention schedule and legal review.

You can delete your account from the account page. Some records may be retained where a legal obligation or overriding legal-defense need applies.

Your Rights

Subject to the applicable conditions, you may request access, rectification, deletion, restriction, data portability, or object to processing based on legitimate interests. Where processing relies on consent, you may withdraw it for the future. Contact hello@morhaf.dev or legal@botberlin.com. You may also complain to the Berlin Commissioner for Data Protection and Freedom of Information at datenschutz-berlin.de.

Legal Review Status

This notice reflects the current system. BotBerlin has not obtained a qualified German/EU legal opinion. Payment stays disabled until the operator's paid-launch control gate has production evidence and all unresolved legal questions remain recorded as exceptions.