Privacy policy

1. Controller

The controller within the meaning of the GDPR (Art. 4 (7) GDPR) is:

Qantor One UG (haftungsbeschränkt)
c/o Miskiewicz
Blankeneser Landstraße 39
22587 Hamburg
Email: support@qantor.de

2. Legal bases for processing

Personal data is processed on the following legal bases of the GDPR:

• Art. 6 (1) (a)Consent of the data subject
• Art. 6 (1) (b)Performance of a contract or pre-contractual steps
• Art. 6 (1) (c)Compliance with a legal obligation
• Art. 6 (1) (f)Legitimate interests of the controller

3. Data collected and purposes of processing

3.1 Access logs

We keep no access logs of our own. When you open our platform, our hosting provider Vercel logs technical access data as part of running the service (IP address, timestamp, URL requested, HTTP status code, volume of data transferred, referrer URL, browser identifier). Legal basis: Art. 6 (1) (f) GDPR (legitimate interest in security and error analysis). Retention follows Vercel's own log retention; we have no influence on it and do not store this data beyond that.

Error logs from our application are sent to Sentry (see section 5.5), expressly without IP address and without any other personal data.

To protect against overload and automated bulk retrieval we store, for individual interfaces, a cryptographic hash of the IP address, that is a checksum from which the address cannot be reconstructed. Its sole purpose is counting requests per sender. Legal basis: Art. 6 (1) (f) GDPR. These values are deleted after 24 hours.

3.2 Registration and user account

When you register we collect your email address and password (stored encrypted via Supabase Auth). Processing serves the performance of the contract (Art. 6 (1) (b) GDPR). The user account is deleted at your request or after termination under § 12 of the terms. Usage data is removed at the latest 30 days after the account is deleted.

3.2a Voluntary information on how you found us

During registration we ask, on a voluntary basis, how you became aware of Klaava. The options are search engine, Instagram, LinkedIn, referral, blog or article, and other; there is no free-text field. The answer is optional, and registration continues unchanged if you skip it. We evaluate it only in aggregate, to see which channels bring users to us, and we do not link it to your usage behaviour. The legal basis is Art. 6 (1) (f) GDPR, legitimate interest in measuring our reach. The answer is not necessary for performing the usage contract, so unlike the other registration data it does not rest on Art. 6 (1) (b) GDPR. It is stored with your user account and deleted with it. Your right to object under Art. 21 (1) GDPR remains unaffected.

3.3 Termination form

If you terminate through the termination form, we store your entries (name, email address, type and time of termination, and for termination for cause the reason given) together with the time of receipt. Legal basis: Art. 6 (1) (c) GDPR. Storage is necessary because we must confirm receipt under § 312k (4) BGB (German Civil Code) and must be able to prove it in a dispute. No account is needed for this; if you terminate without signing in, we cannot assign the entries to an account and process only what you enter in the form. Retention follows the periods under section 7.

3.4 Usage behaviour (platform functions)

To provide the platform functions (saved searches, watchlists and the like), functional data is stored on the server in encrypted form. It is not used for advertising purposes and not passed on to third parties. Legal basis: Art. 6 (1) (b) GDPR.

3.5 Contract and billing data

If you take out a paid subscription, we store in your user account the plan chosen, the billing interval, the start and end of the trial, the next renewal date, any termination date, and the customer and subscription identifiers of our payment service provider Stripe. The purpose is performing the contract and controlling your access to the paid functions. Legal basis: Art. 6 (1) (b) GDPR.

We keep the invoice-relevant data for ten years under § 147 AO (German Fiscal Code). The plain access fields are deleted with your account. We do not process payment data, in particular full card numbers; it arises only at Stripe (see section 5.9).

3.6 Signing in with Google

You can also register and sign in with a Google account. If you choose this route, you are redirected to Google and sign in there. Google then passes us your email address, a unique user identifier and, where stored, your name and profile picture. In this case we neither receive nor store a password.

The legal basis is Art. 6 (1) (b) GDPR, because signing in serves the conclusion and performance of the usage contract. The redirect itself and the processing there take place under the responsibility of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google may process data in the USA; standard contractual clauses are in place, and Google LLC is certified under the EU-US Data Privacy Framework. For the data Google itself collects during sign-in, see Google's privacy policy: policies.google.com/privacy. You can undo the connection at any time in your Google account.

3.7 Data on auctioned properties and parties to the proceedings

This section does not concern the users of Klaava, but the owners and debtors of the properties shown on Klaava.

Origin of the data. We do not collect this data from you, but from publicly accessible sources: the official notices of the local courts published through the federal states' foreclosure auction portal (zvg-portal.de), the licensed portal zvg.com, and the valuation reports that are available for inspection at the competent local court under § 42 ZVG (German Foreclosure Auction Act).

Categories. Property address, case number, competent local court, auction date, appraised market value and further valuation figures, as well as property characteristics derived from the appraisal (such as year built, areas, condition, fittings, encumbrances). We do not publish the names of owners, debtors, occupants or holders of rights in rem. The official documents do contain such names; where our analysis picks them up, they are replaced by role labels before being stored (the stored wording is German, for example “Eigentümerin”, the owner, or “berechtigte Person”, an entitled party).

We hold no contact details of individuals. We do not collect, research or store telephone numbers, email addresses or postal addresses of natural persons in connection with these properties. We reproduce the local court's official notice unchanged, exactly as it appears on the federal states' foreclosure auction portal. If the court itself names a contact for prospective bidders there, for instance at the creditor bank, that detail is already part of the official publication and remains in the text we take over. We do not add to it, do not link it with other data and do not evaluate it.

Purpose. Informing the bidder market. Auction dates must be made public by law (§ 39 ZVG) so that bidders can be found. Klaava collects these already public details and presents them so that interested parties can find a case and form a view of it.

Legal basis. Art. 6 (1) (f) GDPR, legitimate interest. Our interest and the interest of bidders lie in a findable, understandable market overview. On the other side stands your interest in your financial situation not being spread beyond the official framework. The balancing takes into account that only details are processed that the local court has itself already published or made available for inspection, that no names appear, and that the data is removed again after the auction date. This balancing is a general one. Your personal situation can outweigh it, and that is exactly what the notice below is for.

Retention period. After the auction date the entry is first archived and can no longer be retrieved; 30 days later it is deleted. Associated images are removed at the latest 45 days after deactivation. The 30-day gap exists because auction dates get postponed, and a postponed case would otherwise lose its data.

Information under Art. 14 GDPR. Notifying every affected owner individually would involve disproportionate effort, as we hold no contact details and do not wish to collect any. For that case Art. 14 (5) (b) GDPR provides for the information to be made publicly available instead. This section is that provision.

4. Cookies and local storage

Klaava uses technically necessary cookies that are essential for running the platform. For optional statistics functions your consent is requested through the cookie banner. Without consent, Vercel Analytics is not loaded and no page view and no event is sent to PostHog; the identifier needed for that is not even created.

For signed-in users, saved searches, watchlists and notes are assigned to the user account on the server. The cookie consent is stored in your browser's local storage and can be reset through the cookie settings or your browser settings. No advertising cookies are used.

5. Processors and third-party services

5.1 Hosting: Vercel Inc.

The platform is hosted with Vercel Inc., 340 Pine Street, Suite 701, San Francisco, CA 94104, USA. Vercel processes access data on servers within the EU (Dublin, Ireland) and possibly in the USA. For third-country transfers there are standard contractual clauses under Art. 46 (2) (c) GDPR and a valid data processing agreement. Further information: vercel.com/legal/privacy-policy.

5.1a Statistics: Vercel Analytics

With your express consent we use Vercel Analytics to measure reach and improve the product technically. What is recorded is in particular page views, referrer, device type, browser, country/region and performance metrics. Vercel Analytics works without tracking cookies of Klaava's own. The legal basis is Art. 6 (1) (a) GDPR; consent can be withdrawn at any time through the cookie settings.

5.1b Product analysis: PostHog

With your express consent we use PostHog to understand at which point users drop out of the path to a subscription. The provider is PostHog, Inc., 2261 Market Street #4008, San Francisco, CA 94114, USA.

Where processing takes place. Solely in PostHog's EU instance with servers located in Germany. The recipient address is fixed in our program code and cannot be switched to the US region; in addition, our website's security policy allows the browser connections to the EU server only.

What is recorded. The page opened, without the query part of the address, so your search terms and filters are not transmitted; the page visited before (referrer); browser and device type. Plus exactly three events: opening a property page (with the state, your access level and whether an appraisal analysis exists for that property), clicking an unlock button, and moving to the checkout page. Name, email address and other account data are not transmitted. The IP address is technically needed for the transfer; storing it is switched off in our PostHog project.

An identifier instead of a cookie. So that several events can be assigned to the same person, we place a random identifier in your browser's local storage (klaava_analytics_id, see section 4). It is created only after your consent and is deleted when you withdraw it. PostHog sets no cookies in doing so: the transfer runs without sending and without accepting cookies.

Legal basis. Art. 6 (1) (a) GDPR and § 25 (1) TDDDG (German Digital Services Data Protection Act). You can withdraw your consent at any time with effect for the future through the cookie settings in the footer. PostHog is bound as a processor under Art. 28 GDPR. Where access from the USA occurs in the course of maintenance and support, standard contractual clauses under Art. 46 (2) (c) GDPR are in place; PostHog additionally states a certification under the EU-US Data Privacy Framework. Further information: posthog.com/privacy.

5.2 Database: Supabase

User data (email, hashed passwords, profile data) is stored with Supabase Inc. The database instance is located in the EU (Ireland). Supabase is bound by contract as a processor under Art. 28 GDPR. Further information: supabase.com/privacy.

5.3 Map services: Google Maps Platform

For geocoding and the neighbourhood view we use the Google Maps Platform (Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA). When you use this function, coordinates and search queries are transmitted to Google servers. Legal basis: Art. 6 (1) (f) GDPR (legitimate interest in providing the analysis function). Google may process data in the USA; standard contractual clauses are in place, and Google LLC is certified under the EU-US Data Privacy Framework (DPF). Further information: policies.google.com/privacy.

5.3a Satellite images: Mapbox

We obtain the satellite view of individual properties from Mapbox, Inc. (740 15th Street NW, Washington, DC 20005, USA). It is retrieved solely on the server through our own image proxy: only the property coordinates are transmitted to Mapbox, your IP address and other usage data do not reach them. Legal basis: Art. 6 (1) (f) GDPR (legitimate interest in a meaningful presentation of the property). Mapbox processes data in the USA; standard contractual clauses are in place. Further information: mapbox.com/legal/privacy.

5.4 AI services: Anthropic

For the automated analysis of appraisal PDFs, text extracts are transmitted to the API of Anthropic PBC. This concerns solely content from publicly accessible documents; personal user data is not transmitted. Anthropic processes data in the USA; corresponding standard contractual clauses are in place.

5.5 Error monitoring (Sentry)

To detect and fix technical errors we use Sentry (Functional Software Inc.). What is recorded is technical error data such as the error message, stack trace, page affected, and browser and device type. Through our configuration (sendDefaultPii disabled) no personal data such as IP addresses is deliberately transmitted, and no session replays take place. Processing takes place in the EU region (Frankfurt). Legal basis: Art. 6 (1) (f) GDPR (legitimate interest in stable and secure operation of the platform). Further information: sentry.io/privacy.

5.6 Map display and place search

The interactive property map is drawn with the open-source library MapLibre GL, which comes from our own bundle. The map tiles and the map style are loaded from the CARTO service (CARTO Inc., New York, USA) on the basis of OpenStreetMap data. When you open the map view, your IP address is transmitted to CARTO for technical reasons so that the map section can be delivered. No account or usage data is transmitted in doing so, and no usage profiles are created.

For the place search (entering a city, postcode or address) we use the Nominatim geocoding service of the OpenStreetMap Foundation. This request is made by our server, not by your browser. Your IP address does not reach Nominatim; only the search term you entered is transmitted. Legal basis: Art. 6 (1) (f) GDPR (legitimate interest in providing the central map function). Further information: osmfoundation.org and carto.com/privacy.

5.7 Images delivered by third parties

Individual decorative images on the home page are loaded from the image service Unsplash (Unsplash Inc., Montreal, Canada); occasionally property preview images may be delivered directly by the official source portals (zvg-portal.de among them). When these images load, your IP address is transmitted to the provider concerned. The property photos stored within the platform, by contrast, are delivered through our own access-protected server proxy (/api/image), so that your IP address does not reach third parties in that case. Legal basis: Art. 6 (1) (f) GDPR (legitimate interest in an informative and appealing presentation). Further information: unsplash.com/privacy.

5.8 Email delivery: Resend

We send emails through Resend, Inc. Delivery is fixed to the Ireland region (eu-west-1), so processing takes place within the EU. Your email address and the content of the message concerned are transmitted.

This concerns two cases. If you have switched on email notification for a saved search alert, we send the matching notifications. Legal basis: Art. 6 (1) (a) GDPR (consent by switching the notification on); you can switch the notification off in your account at any time and thereby withdraw your consent with effect for the future. If you terminate through the termination form, we also send the confirmation of receipt required by law. The legal basis for that is Art. 6 (1) (c) GDPR; the confirmation is mandatory under § 312k (4) BGB and is therefore not a matter of your choice. Further information: resend.com/legal/privacy-policy.

5.9 Payment processing: Stripe

We handle paid subscriptions through Stripe. The contracting party is Stripe Payments Europe Limited, The One Building, 1 Grand Canal Street Lower, Dublin 2, Ireland. Group companies, in particular Stripe, Inc. based in the USA, may join as further recipients.

What is processed is name, email address, billing address, where applicable the VAT identification number, the means of payment chosen, and the subscription and payment history. The legal basis is Art. 6 (1) (b) GDPR for performing the contract and Art. 6 (1) (c) GDPR for tax retention.

Your payment details do not reach us. Card number, bank details or payment account are entered solely on Stripe's pages. From Stripe we receive only the information whether a payment succeeded, along with the associated customer and subscription identifiers.

Any transfer to the USA takes place on the basis of the European Commission's standard contractual clauses. Further information: stripe.com/de/privacy.

6. Disclosure to third parties

Your personal data is not passed on to third parties, except:

• to the processors named under section 5, in order to perform the contract,
• to our payment service provider Stripe (section 5.9) in order to handle payments, which acts as a controller in its own right in that respect,
• where we are legally obliged to do so (official information requests, for instance),
• with your express consent (Art. 6 (1) (a) GDPR).

7. Retention periods

We store personal data only for as long as it is necessary for the respective purpose or statutory retention obligations exist (in particular § 147 AO: 10 years for tax-relevant data, § 257 HGB (German Commercial Code): 6 years for business letters). Once the retention periods expire, the data is routinely deleted or anonymised.

8. Your rights as a data subject

You have the following rights under the GDPR:

• Art. 15 GDPRAccess to the data processed
• Art. 16 GDPRRectification of inaccurate data
• Art. 17 GDPRErasure (“right to be forgotten”)
• Art. 18 GDPRRestriction of processing
• Art. 20 GDPRData portability
• Art. 21 GDPRObjection to processing
• Art. 7 (3) GDPRWithdrawal of consent given

To exercise your rights, please contact: support@qantor.de. We handle requests within 30 days (Art. 12 (3) GDPR).

If you are the owner or debtor of a property shown on Klaava, you will find the information that applies to you, and your right to object, separately under section 3.7.