Skip to main content
Legal

Privacy Policy

1. Controller (Art. 13 (1) lit. a GDPR)

Controller within the meaning of the GDPR:
[Name]
[Straße, Nr.], [PLZ, Ort]
Email: kontakt@example.com

Note: free testing phase — no personal data is stored

KlarMiet is currently in a free testing phase. During this phase there is no registration and no sign-in, and no personal data is stored in any database. In particular, no user accounts are created, no analysis cases are saved, no documents are uploaded or processed by AI, and no payment data is processed. The calculators run entirely in your browser, without storing your inputs.

The sections below describe the data processing that applies only once accounts, AI analysis and payment functions are activated. Until then, the processors named there (e.g. Stripe for payments, Anthropic for AI analysis) are not active. Technically necessary server log files at the hosting provider (see the Hosting section) may still occur.

2. Overview of processing activities

The following overview summarises the types of data processed and the purposes of their processing, and refers to the data subjects affected.

  • Inventory data (e.g. name, email address)
  • Usage data (e.g. pages visited, access times)
  • Content data (e.g. uploaded documents, rental data)
  • Payment data (e.g. in the case of Stripe transactions)
  • Meta / communication data (e.g. IP addresses, browser type)

3. Legal bases

We process personal data on the basis of the following legal grounds:

  • Consent (Art. 6 (1) lit. a GDPR) — e.g. when uploading documents for AI analysis.
  • Performance of a contract (Art. 6 (1) lit. b GDPR) — e.g. account creation, payment processing, provision of the commissioned analyses.
  • Legitimate interests (Art. 6 (1) lit. f GDPR) — e.g. security, abuse prevention, service improvement.
  • Legal obligation (Art. 6 (1) lit. c GDPR) — e.g. tax-related retention obligations.

4. Data collection in detail

4.1 Registration and sign-in

When you register, we store your email address and, where applicable, your name (in the case of Google sign-in). The legal basis is Art. 6 (1) lit. b GDPR (performance of a contract). Data is stored for the duration of account use and removed within 30 days of account deletion.

4.2 Rental data and document upload

When you use our analysis tools, we process the rental data you enter (address, rent amount, living space, year of construction) as well as uploaded documents (PDF files). This data is used exclusively to provide the commissioned analysis.

Uploaded documents are stored temporarily on servers operated by Vercel (Vercel Inc., USA, using EU data centres) and automatically deleted once the analysis is complete. The maximum storage period is 24 hours.

4.3 AI analysis

To carry out the rent and contract analysis, we transmit the relevant data to the API of Anthropic (Anthropic PBC, USA). Anthropic processes the data exclusively to respond to the specific request and does not store it permanently. The legal basis is Art. 6 (1) lit. b GDPR. We have concluded a data processing agreement (DPA) with Anthropic on the basis of the EU Standard Contractual Clauses.

4.4 Payment processing

Payments are processed via Stripe (Stripe Inc., USA / Stripe Payments Europe Ltd., Ireland). We do not receive full credit card details from Stripe, only a confirmation of payment with a transaction ID. Stripe processes your payment data as an independent controller in accordance with its own privacy policy.

4.5 Google OAuth

When you sign in via Google, we receive your name, your email address and your profile picture. We do not gain any access to your Google account data beyond this. The legal basis is Art. 6 (1) lit. b GDPR.

5. Hosting and infrastructure

This website is hosted by Vercel Inc. (USA). Vercel operates European data centres (Frankfurt am Main). When the website is visited, technical data is collected automatically (IP address, browser type, time of access). This data is required for technical operation and is stored in server log files. The legal basis is Art. 6 (1) lit. f GDPR.

6. Cookies and local storage

We use technically necessary cookies for session management (authentication), which may be set without consent pursuant to § 25 (2) TTDSG. For optional cookies (functional, analytical or marketing cookies) we obtain your express consent pursuant to § 25 (1) TTDSG via our cookie banner. You can withdraw your consent at any time.

7. Processors and third-country transfers

We use the following service providers:

  • Vercel Inc. (USA, EU data centres) — hosting, file storage. EU Standard Contractual Clauses.
  • Anthropic PBC (USA) — AI analysis. EU Standard Contractual Clauses / DPA.
  • Stripe Inc. / Stripe Payments Europe Ltd. (USA / Ireland) — payment processing. Independent controller.
  • Google LLC (USA) — OAuth authentication. EU Standard Contractual Clauses.

Insofar as a transfer to the USA takes place, we rely on the EU Standard Contractual Clauses (Art. 46 (2) lit. c GDPR) and, where applicable, the EU-U.S. Data Privacy Framework.

8. Storage period

  • Account data: until the account is deleted by the user, then 30 days.
  • Uploaded documents: a maximum of 24 hours after analysis.
  • Analysis results and cases: until deleted by the user or until account deletion.
  • Payment data: in accordance with tax-law retention periods (up to 10 years, § 147 AO).
  • Server log files: a maximum of 30 days.

9. Your rights

You have the right at any time to:

  • Access to your stored data (Art. 15 GDPR)
  • Rectification of inaccurate data (Art. 16 GDPR)
  • Erasure of your data (Art. 17 GDPR)
  • Restriction of processing (Art. 18 GDPR)
  • Data portability (Art. 20 GDPR)
  • Objection to processing (Art. 21 GDPR)
  • Withdrawal of consent given (Art. 7 (3) GDPR)

To exercise your rights, please contact: kontakt@example.com

You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The competent supervisory authority is: the State Commissioner for Data Protection and Freedom of Information Baden-Württemberg (Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg).

10. Automated decision-making

No automated decision-making within the meaning of Art. 22 GDPR takes place. The AI-powered analyses serve solely as a basis for information and produce no legal or similarly significant effect. All results are guidance, not legally binding decisions.

11. Data protection officer

Given the scope of our data processing, the appointment of a data protection officer pursuant to Art. 37 GDPR is not currently required. If you have any questions about data protection, please contact: kontakt@example.com

12. Changes

We reserve the right to amend this privacy policy so that it always complies with current legal requirements or in order to implement changes to our services. The new privacy policy will then apply to your next visit.

As of: July 2026

Privacy Policy