Privacy Policy (convenience translation)

1. Controller

The controller (Verantwortlicher) within the meaning of the General Data Protection Regulation (GDPR; German: Datenschutz-Grundverordnung, DSGVO) and other national data protection laws as well as other data protection provisions is:

Kolibri eCommerce GbR
Bronzeweg 10
48282 Emsdetten
Deutschland
E-mail: info@nebify.app

2. General information on data processing

As a matter of principle, we process personal data of our users only insofar as this is necessary to provide a functional website as well as our content and services. Processing takes place exclusively in accordance with the GDPR, the German Federal Data Protection Act (Bundesdatenschutzgesetz, BDSG) and the TDDDG (Telekommunikation-Digitale-Dienste-Datenschutz-Gesetz; German Telecommunications and Digital Services Data Protection Act).

3. Types of data processed

We process the following categories of personal data:

Master data (Bestandsdaten): name, e-mail address (upon registration)
Content data (Inhaltsdaten): uploaded documents (statements of ancillary costs (Nebenkostenabrechnungen), rental agreements, supplementary documents), information on apartments (address, floor area, number of occupants)
Information about third parties (Angaben Dritter): name and address of landlords or property management companies (Hausverwaltungen), insofar as they are contained in uploaded documents or you provide them to us for communication with your landlord (e.g. contact person, e-mail, telephone)
Communication data (Kommunikationsdaten): messages via the contact form, e-mail correspondence
Payment data (Zahlungsdaten): payment information is processed exclusively by our payment service provider Stripe; we do not store any credit card or account data
Usage data (Nutzungsdaten): IP address, browser type, operating system, pages visited, time of access
Log data (Protokolldaten): server log files with IP address, date, time and URL accessed

4. Purposes of data processing

We process personal data for the following purposes:

Provision and performance of our service for the digital review of statements of ancillary costs
Software-assisted analysis of uploaded documents to detect errors and to calculate savings potential
Preparation of review reports (Prüfberichte), objection letters (Widerspruchsschreiben) and comparative analyses
Communication with users (contact requests, support)
Processing of payments for paid services
Compliance with statutory retention and documentation obligations
Ensuring the security and stability of our systems

5. Legal bases

Personal data is processed on the basis of the following legal bases:

Art. 6(1)(a) GDPR (consent): insofar as you have consented to the processing, e.g. when newsletters are sent or optional cookies are used
Art. 6(1)(b) GDPR (performance of a contract): processing to provide our service (registration, upload, analysis, review report, payment)
Art. 6(1)(c) GDPR (legal obligation): processing to comply with retention obligations under tax and commercial law
Art. 6(1)(f) GDPR (legitimate interest): processing for system security, the prevention of abuse and the improvement of our service, as well as processing of information about third parties (e.g. landlords) contained in uploaded documents

6. Processors and data transfers

To provide our services, we use the following service providers with whom — where required — data processing agreements (Auftragsverarbeitungsverträge) pursuant to Art. 28 GDPR have been concluded:

Supabase Inc. (USA, EU server location) — database, authentication and file storage. Data is stored on EU servers. Standard contractual clauses (SCCs) are in place.
Anthropic PBC (USA) — software-assisted analysis of uploaded documents with the language model Claude. Uploaded documents are transmitted as image data to the Anthropic API, processed there and not used by Anthropic to train its models. Standard contractual clauses (SCCs) are in place.
Vercel Inc. (USA, edge network with EU locations) — hosting and delivery of the web application. Standard contractual clauses (SCCs) are in place.
Resend Inc. (USA) — sending of transactional e-mails (order confirmations, review reports, password resets). The recipient’s e-mail address and name are transmitted. Resend processes the data exclusively for the purpose of e-mail delivery. Standard contractual clauses (SCCs) are in place.
Stripe Inc. (354 Oyster Point Blvd, South San Francisco, CA 94080, USA; EU branch in Ireland) — payment processing. To carry out the payment, you are redirected to Stripe’s secure checkout page. In this process, Stripe processes payment data (e.g. credit card number, bank details, Apple Pay/Google Pay token) as an independent controller in accordance with its own privacy policy. Credit card and account data are processed exclusively by Stripe and are at no time transmitted to us or stored on our servers. We only receive a confirmation of successful payment and a transaction ID from Stripe.

Transfers to third countries (in particular the USA) take place on the basis of standard contractual clauses (Art. 46(2)(c) GDPR) and — where applicable — the EU-U.S. Data Privacy Framework.

7. Software-assisted document analysis

A core component of our service is the automated analysis of statements of ancillary costs and rental agreements with software (the language model Claude of Anthropic PBC). In this process, uploaded documents are transmitted as image data to Anthropic’s API and analyzed there.

The results of the analysis (identified cost items, errors, savings potential) are stored in our database and made available to you via the website. According to its own statements, Anthropic stores the transmitted data only temporarily and does not use it to train its models.

The automated analysis is preparatory work: every review report is reviewed by our team before it is released. A decision based solely on automated processing with legal effect within the meaning of Art. 22 GDPR does not take place.

Legal basis: Art. 6(1)(b) GDPR (performance of a contract).

8. Sending of e-mails

We send transactional e-mails via the service Resend Inc. (USA). In this process, your name and e-mail address are transmitted to Resend. The following e-mails are sent:

Result of the free pre-check (Vorab-Check) as well as notices about missing documents
Order confirmation after purchase of a nebify Prüfung
Notification upon completion of the review report
Password reset (via Supabase Auth with Resend SMTP)

Legal basis: Art. 6(1)(b) GDPR (performance of a contract). After a free pre-check or a registration, you will also receive up to four notification e-mails about your review result and about deadlines (legal basis: Art. 6(1)(f) GDPR, legitimate interest in providing information about the review that has been started). You can object to these notifications at any time — via the unsubscribe link in each of these e-mails or informally to info@nebify.app. Beyond this, we do not send any advertising e-mails and do not pass your address on to third parties.

9. Cookies and tracking

Our website uses technically necessary cookies that are required for the operation of the site (in particular session cookies for authentication). These cookies are set on the basis of Art. 6(1)(f) GDPR (legitimate interest) and do not require consent.

In addition — exclusively with your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG) — we use services for reach measurement, advertising success measurement and personalized advertising: Google Tag Manager and Google Analytics as well as Google Ads (Google Ireland Ltd.), Meta Pixel (Meta Platforms Ireland Ltd.) and PostHog (PostHog Inc., processing on EU servers). With Google Ads and the Meta Pixel, we can show you advertising for nebify on other websites and in apps after you have visited our website (remarketing). In this process, data may be transferred to third countries, in particular the USA.

On your first visit, we ask for your decision via a cookie banner. Without consent, these services are not loaded. You can change or withdraw your decision at any time with effect for the future — via the “Cookie-Einstellungen” (cookie settings) link in the page footer or directly here: .

To measure site performance, we also use Vercel Web Analytics and Vercel Speed Insights (Vercel Inc.). These services do not set cookies and do not store cross-device identifiers. The legal basis is our legitimate interest in a stable and fast website (Art. 6(1)(f) GDPR).

For our online tools (e.g. the rent reduction table (Mietminderungstabelle) with calculator), we count on our own servers which functions are used — for example page views, search terms in the table, the calculator or a generated letter. We store the type of use, the time and, if you are logged in, your customer ID; we do not store IP addresses for this purpose. The legal basis is our legitimate interest in improving our offerings (Art. 6(1)(f) GDPR). Only if you have consented in the cookie banner do we additionally store a random identifier in your browser’s storage for the duration of your visit, so that we can count visits instead of individual clicks (Art. 6(1)(a) GDPR, § 25(1) TDDDG). We delete the entries after 14 months at the latest.

If you create a letter with one of our tools (e.g. a notice of defects (Mängelanzeige) to your landlord), we process your entries only in order to generate the document; we do not store the content. For this you need a free customer account (name, e-mail address, password). The legal basis is Art. 6(1)(b) GDPR.

On the homepage, we embed a review widget from Trustpilot A/S (Copenhagen, Denmark). When it loads, your IP address is transmitted to Trustpilot. The legal basis is our legitimate interest in collecting genuine customer reviews (Art. 6(1)(f) GDPR).

We load fonts from our own servers; no connection to Google Fonts is established.

10. Contact form and communication

If you contact us via the contact form on the website, your name, your e-mail address and your message are stored in order to process your request. If you write from an e-mail address that is assigned to a registered account, the message is automatically linked to your customer profile. Our e-mail inbox is hosted by Google (Google Workspace, Google Ireland Ltd.); e-mails to us are stored and processed there.

Legal basis: Art. 6(1)(b) GDPR (pre-contractual measures) or Art. 6(1)(f) GDPR (legitimate interest in processing inquiries).

11. Storage period

Personal data is deleted or blocked (gesperrt) as soon as the purpose of storage no longer applies:

Account data and uploaded documents: are stored for as long as your account exists. When the account is deleted, all data, including uploaded documents, is irrevocably deleted.
Review reports and analysis results: are deleted together with the account, unless statutory retention obligations apply.
Invoice data: is stored for 10 years in accordance with retention obligations under tax law (§ 147 AO, § 257 HGB).
Contact requests: are deleted once the request has been dealt with, at the latest after 12 months, unless further retention obligations apply.
Server log files: are automatically deleted after 30 days at the latest.

12. Your rights

Under the GDPR, you have the following rights with regard to your personal data:

Right of access (Art. 15 GDPR): You can request information about your data stored by us.
Right to rectification (Art. 16 GDPR): You can request the rectification of inaccurate data.
Right to erasure (Art. 17 GDPR): You can request the erasure of your data, unless statutory retention obligations prevent this. You can delete your account and all associated data yourself at any time in the settings.
Restriction of processing (Art. 18 GDPR): You can request the restriction of the processing of your data.
Data portability (Art. 20 GDPR): You can request to receive your data in a structured, commonly used and machine-readable format.
Right to object (Art. 21 GDPR): You can object at any time to the processing of your data based on Art. 6(1)(f) GDPR.

To exercise your rights, please contact: info@nebify.app

13. Withdrawal of consent

Insofar as the processing is based on your consent, you can withdraw it at any time with effect for the future, without affecting the lawfulness of the processing carried out on the basis of the consent until its withdrawal. You can send your withdrawal by e-mail to info@nebify.app.

14. Right to lodge a complaint with a supervisory authority

You have the right to lodge a complaint with a data protection supervisory authority about the processing of your personal data. The supervisory authority responsible for us is the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia:

Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen
Postfach 20 04 44
40102 Düsseldorf
www.ldi.nrw.de

15. Data security

We use technical and organizational measures to protect your data against accidental or intentional manipulation, loss, destruction or access by unauthorized persons. Our security measures include, among other things:

Encrypted data transmission (TLS/SSL)
Row Level Security (RLS) in the database — users can only access their own data
Signed URLs with time limits for document access
Authentication and authorization via Supabase Auth
Regular review of the security measures

16. Changes to this privacy policy

We reserve the right to amend this privacy policy as necessary in order to adapt it to changes in the legal situation or in the event of changes to our service or to the data processing. You can always find the current version at nebify.de/datenschutz.

Privacy Policy(convenience translation)