Privacy Policy

1. Responsible Party

Oleksandr Makovetskyi, handelnd unter der Bezeichnung „Renthelfer"
Kleeblatt 64
42119 Wuppertal, Deutschland
E-Mail: legal@renthelfer.de
Telefon: +49 170 9054363

A Data Protection Officer has not been appointed under § 38 BDSG, as Renthelfer does not, as a rule, have 20 or more persons continuously engaged in the automated processing of personal data. For data protection questions, please contact the email address above.

2. Processed Data

• Contact Data: Email address, name, phone number (optional)
• Address Data: Street, house number, postal code, city, state, country
• Access Data: Password (stored as a hash), login timestamp
• Contract Data: Subscription status, Stripe customer ID, payment period
• Usage Content: Created rental letters, uploaded documents, AI analyses, chat histories
• Technical Data: IP address (in server logs, rotated by volume — no fixed cap), browser type
• OAuth Data: External Google/Facebook user ID, profile picture URL
• Places in the apartment comparison: names, addresses and means of transport of the places you saved (e.g. work, school, daycare) If you share a comparison via a link, your places are visible only if you explicitly enable this; the link is valid for 14 days and can be revoked at any time.
• Session data: for each sign-in, IP address, device, browser, operating system and approximate location, so that you can see and end your active sessions.
• Usage statistics without cookies: individual events (e.g. registration, purchase, function used) with your account identifier, recorded server-side to improve the service and find errors.
• Security data: hash values formed from IP addresses for rate limiting and temporary sign-in locks (short-lived, not in plain text).
• Support chat without an account: messages and a session identifier, where applicable the e-mail address you provide; they remain stored until you request deletion (legal@renthelfer.de).

3. Legal Bases

• Art. 6 Abs. 1 lit. b DSGVO — Contract Fulfillment: Service provision, account creation (including via Google login), subscription management, registered mail dispatch
• Art. 6 Abs. 1 lit. a DSGVO — Consent: analytics cookies (Google Analytics 4, Google Tag Manager) and sign-in with Facebook, revocable at any time (cookie settings or Profile → Linked accounts)
• Art. 6 Abs. 1 lit. f DSGVO — Legitimate Interests: IT security, fraud protection, server logs, session management, rate limiting, usage statistics without cookies
• Art. 6 Abs. 1 lit. c DSGVO — Legal Obligation: Retention of billing data (§ 147 AO, 8 years)

4. AI Processing by OpenAI

For AI letter generation, document analysis, the AI Assistant, and the Support Chat, we use OpenAI Ireland Ltd. (Ireland; processing may also be carried out by the parent company OpenAI, LLC, USA). Your letter contents, uploaded documents (images/PDFs), and chat requests are transmitted to OpenAI. Uploaded documents (e.g. letters, handover-protocol photos) may also contain personal data of third parties, such as a landlord's or co-tenant's name and address — we base this processing on our legitimate interest (Art. 6 para. 1 lit. f GDPR) in handling your own request. API requests are not used for training OpenAI models (according to OpenAI API usage terms); OpenAI additionally retains requests for up to 30 days for abuse monitoring. Because OpenAI Ireland Ltd. is contractually bound and based in the EU, a separate third-country transfer is generally not required for this part of the processing; any sub-processing by OpenAI, LLC (USA) takes place under the EU Standard Contractual Clauses (Art. 46 GDPR). OpenAI is contractually bound as a processor under Art. 28 GDPR. This also applies to voice messages in the support chat: the audio is sent to OpenAI (Whisper) to be converted into text.

Defect photos (rent reduction): if you upload a photo in the rent reduction calculator, the image is sent to OpenAI to detect the type of defect automatically (purpose: suggesting the matching defect category; legal basis Art. 6(1)(b) GDPR); OpenAI stores requests as described in this section. In addition we store the photo together with your calculation as evidence and documentation (purpose: proof of the defect in the PDF report and in the case; legal basis Art. 6(1)(b) GDPR), encrypted on our servers and without location data (EXIF). The photo stays stored until you delete it or your account is deleted; it is passed on to OpenAI only for the analysis. Please do not photograph people or documents containing personal data. For each photo you may voluntarily enter your own description in your own words (at most 300 characters); it is stored together with the photo and your calculation and appears in the PDF report. We also store the answer of the AI analysis (description of the image content, suggestions) and your decision on it (accepted, rejected or added without analysis) with the photo. To improve defect recognition we additionally log the suggestions and your decision — without the image and without your texts.

Legal Basis: Art. 6 para. 1 lit. b and f GDPR. Data Protection: openai.com/privacy

5. Payment Processing (Stripe)

Payments for subscriptions and one-off purchases are processed through Stripe (Stripe Payments Europe, Ltd., Ireland, where applicable with the involvement of Stripe, Inc., USA); for payment processing we transmit your email address to Stripe. Stripe processes complete payment method data (e.g. credit card, SEPA direct debit, Apple Pay, Google Pay) directly and does not pass it on to us. Stripe processes payment data partly on our behalf and partly as an independent controller (e.g. for fraud prevention and statutory obligations); Stripe's privacy policy applies in this respect. We store the Stripe customer ID, the subscription period, and the amount, product and status of your payments; we retain this booking data because of statutory tax and commercial-law retention obligations (Art. 6(1)(c) GDPR).

Legal Basis: Art. 6 para. 1 lit. b and c. Data Protection: stripe.com/privacy

6. Location and Market Data (Geoapify, Nominatim/OpenStreetMap, GeoMap)

For address suggestions, maps and travel times (e.g. the Apartment Location Check, the apartment comparison with “My places”) we use the Geoapify service of KEPTAGO LTD (Paphos, Cyprus) and the Nominatim geocoding service of the OpenStreetMap Foundation (United Kingdom). We send them the address you enter or the coordinates derived from it, plus search text, and for “My places” also the addresses and coordinates of the places you saved (e.g. work, school, daycare) and of the compared apartments, but not your name or e-mail address. Requests go through our server, your IP address is not passed on. For market data (e.g. average asking rents) we query Real Estate Pilot AG (Leipzig, “GeoMap”); only the postcode or region is sent there, no personal data.

Legal Basis: Art. 6 para. 1 lit. b GDPR (function you requested).

7. Housing market (listings, inquiries, application profile, saved searches)

Listings are publicly visible: title, description, photos, street without house number, district and an approximate map point. Prospects only see contact details and the exact address after the landlord has replied. For commercial providers, the company name and the legal notice (Impressum) are publicly visible. Anyone who sends an inquiry transmits their name, message and – only if they choose to – a snapshot of their application profile (income, documents, phone, photo) to the respective landlord, who is an independent controller for any further processing. Inquiries, replies and declines are stored in the conversation of both sides. Share links for the application profile are time-limited (90 days at most) and can be revoked at any time; accesses are logged, and new share links share nothing by default; when sending an inquiry you choose yourself what your profile snapshot contains; links created before 20 October 2026 remain as they were set up. Photos are stored without metadata (EXIF/GPS) and scanned for malware on our own server, without involving third parties. For saved searches (search agent) we store your filters and notification settings; you can unsubscribe from e-mail notifications at any time. If you report a listing, we store you as the reporter and the reason for moderation. For address suggestions and address verification, address data is sent to Geoapify and Nominatim (see the section "Location and market data"). Retention: until deleted by the users or until account deletion; a declined inquiry remains as evidence, including the profile snapshot (income and phone only if selected), until both sides have deleted it; the snapshot is removed as soon as you delete the inquiry. When an account is deleted, listings, inquiries, application profile, share links, favourites and saved searches are deleted.

Legal Basis: Art. 6 para. 1 lit. b GDPR (contract or pre-contractual measures), Art. 6 para. 1 lit. f GDPR (fraud prevention, moderation).

8. Registered Mail Dispatch (Pingen / Deutsche Post)

When you use the "Send Registered Mail" function, sender and recipient data as well as the letter content are transmitted to Pingen GmbH (Zurich, Switzerland), which arranges printing and dispatch, and, for delivery, to Deutsche Post AG. This transfer is necessary for contract fulfillment. A data processing agreement under Art. 28 GDPR is in place with Pingen; an adequacy decision of the EU Commission applies to Switzerland.

Legal Basis: Art. 6 para. 1 lit. b GDPR.

9. Email Dispatch (Resend)

Transactional emails (confirmation, password reset) are sent via Resend, Inc. (USA). Your email address is transmitted to Resend. Resend processes data solely for delivery and not for its own purposes. Resend is contractually bound as a processor under Art. 28 GDPR. Incoming e-mails to our contact and support addresses are processed via Google Workspace (Google Ireland Limited).

Legal Basis: Art. 6 para. 1 lit. b GDPR. Data Protection: resend.com/privacy

10. Google Login (OAuth)

If you choose "Sign in with Google", you will be redirected to Google LLC (USA). After your consent, Google transmits your email address, name, and possibly profile picture to us. The Google Identity Services script is loaded only on the login/registration page, independent of cookie consent — it is technically required to provide the sign-in function you requested.

Legal Basis: Art. 6 para. 1 lit. b GDPR (contract performance — sign-in you requested). Data Protection: policies.google.com/privacy

11. Facebook Login (OAuth)

If you choose "Sign in with Facebook", you will be redirected to Meta Platforms Ireland Ltd. After your consent, Facebook transmits your email address, name, and possibly profile picture to us. You can disconnect the link at any time under Profile → Linked accounts.

Legal Basis: Art. 6 para. 1 lit. a GDPR (consent). Data Protection: facebook.com/privacy

12. Hosting (ServerDiscounter)

The service is operated on servers of ServerDiscounter (Metaliance ISP Systems e.K., Berlin, Germany); according to the operator, the data centers are located in Stuttgart. The database and uploaded files are stored on these servers. In addition, encrypted backups are stored with Backblaze, Inc. (USA) in a data center in the EU; we encrypt the data ourselves before uploading it, and Backblaze has no access to the contents. Some further service providers named in this policy are based in the USA or process data there (see section "Transfers to third countries").

Protection of your data (technical and organisational measures)

We use technical and organisational measures to protect your data. No service can promise complete security; the overview below describes what we currently have in place.

• Transmission: the connection between your device and our servers is encrypted with TLS.
• Database: access to the database is protected by credentials. The database cannot be reached directly from the internet.
• Encryption of individual content: personal content in the following areas is additionally stored encrypted at field level: letters, utility bill checks (Nebenkosten), letter scanner, rental file (Mietakte), broadcasting fee check (Rundfunkbeitrag), handover protocols (details on parties, property, rooms, meters and keys), application profile, CV and applications, contacts, deposit overview, text blocks, chats with the AI assistant, support requests and error reports.
• Keys: keys are kept separately per account, analysis or case. When your account is deleted, the associated keys are deleted; the encrypted content can then no longer be read.
• Other areas are not yet encrypted at field level, in particular account data (e-mail address, name, telephone, address), messages between tenants and landlords, paper letter orders, cases and deadlines, and property analyses; we are extending the protection step by step. Timestamps and status information remain unencrypted for operational reasons. Backups created before 31 October 2026 still contain some fields in plain text (the files themselves are encrypted); they will be replaced after 30 days at the latest.
• Files and backups: uploaded documents and photos, as well as all backup copies, are stored encrypted.

13. Cloudflare Turnstile (CAPTCHA) & Sentry (Error Monitoring)

To protect against bots, we use Cloudflare Turnstile (Cloudflare, Inc., USA); the script is loaded when pages of this website are opened and analyzes browser signals for bot detection without visible image puzzles. For error monitoring we use Sentry (Functional Software, Inc., USA; data stored in the EU). Error reports may be sent from our server and, for errors in your browser, directly from your browser; for technical reasons your IP address is transmitted to Sentry in the process. We have configured Sentry so that no names and no content are sent along. Legal Basis: Art. 6 para. 1 lit. f GDPR (legitimate interests: IT security, operational reliability).

14. Web Analytics (with consent)

With your consent, we use Google Analytics 4 (Google Ireland Limited, Ireland; data may also be processed by Google LLC, USA) for pseudonymous usage analysis, and Google Tag Manager as a container for this script. The script is only loaded after your consent in the cookie banner (Google Consent Mode v2, default: denied) and can be revoked at any time via "Cookie Settings" in the footer.

Legal Basis: Art. 6 para. 1 lit. a GDPR (consent). Data Protection: Google

15. Cookies and Local Storage

For login and core functions we use technically necessary cookies or localStorage. With your consent, we additionally use Google Analytics 4 (see section 14 above). Details on all technologies: Cookie Policy

• renthelfer_token — JWT session token (necessary, session duration)
• renthelfer_dark_mode — Color scheme preference (necessary)
• renthelfer_cookie_consent_v2 — Your cookie consent + timestamp (12 months)
• Other technically necessary local storage: selected language, session and consent of the support chat, handover data between pages, guest identifier for use without signing in, app installation notice, and drafts in the CV section; when signing in with Facebook, additionally short-lived cookies (10 minutes) for the sign-in process.

16. Storage Duration

• User account + all content: until account deletion by the user
• Server logs (IP): rotated by volume (no fixed cap)
• Billing and payment data (including paid letter dispatches): 8 years from the end of the calendar year (§ 147 para. 3 AO, § 14b UStG). After account deletion without name, e-mail and letter content; then deleted automatically
• Deleted files: immediate marking, final deletion from backups within 30 days
• Email tokens: verification 24 h, password reset 1 h
• Uploaded photos and documents (e.g. utility bill statements, defect photos, handover protocol photos): subject to the same rule as above — retained until deleted by the user or account deletion, permanently removed from backups within 30 days.
• Log of administrator access to accounts (no content; accountability under Art. 5(2) GDPR): after account deletion only as an identifier that can no longer be linked to you
• Declarations made via the cancellation button (§ 312k BGB) and the withdrawal function (§ 356a BGB) — name, email, contract, time: 3 years from the end of the calendar year of receipt (regular limitation period, §§ 195, 199 BGB), also after account deletion, as proof that your declaration was received and processed (Art. 17(3)(e) GDPR); deleted automatically afterwards
• Session data of expired sessions: regular cleanup; usage statistics (events): 180 days; support chats without an account: until deleted at your request

17. Your Rights (Art. 15–22 GDPR)

• Art. 15 — Information about stored data
• Art. 16 — Correction of incorrect data (profile settings)
• Art. 17 — Deletion: account + all data (profile → "Delete account")
• Art. 18 — Restriction of processing, e.g. while we review a rectification or an objection (request to legal@renthelfer.de)
• Art. 20 — Data portability: JSON export (profile → "Export data")
• Art. 21 — Objection to processing based on legitimate interests
• Art. 7(3) — Revocation of consent (e.g. analytics/marketing cookies) possible at any time

Withdrawal of consent does not affect the lawfulness of the processing carried out until then (Art. 7(3) GDPR).

Automated decision-making, including profiling within the meaning of Art. 22 GDPR, does not take place. The AI functions create draft texts and analyses, and you decide on them yourself.

Account creation requires an e-mail address and a password; without them we cannot perform the contract. Further details are voluntary; without them, individual functions are only available to a limited extent.

Requests to: legal@renthelfer.de

18. Right to Complain

You have the right to lodge a complaint with the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia:

Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen
Kavalleriestr. 2-4, 40213 Düsseldorf · ldi.nrw.de

19. External geo and statistical data

For location and market analyses (e.g. Apartment & Location Check, Market & Location Analysis, Commercial Location Check) we query public geo and statistics services: OpenStreetMap (map data, points of interest), BBSR/INKAR (demographics, purchasing power) and Destatis/Regionalstatistik.de (business registration statistics). These queries use the postcode, coordinates or the official municipality/district key; we do not send your name or e-mail address (for address search see the section on location and market data). When an interactive map is shown, your browser loads the map tiles directly from the servers of the OpenStreetMap Foundation; for technical reasons your IP address is transmitted in the process (Art. 6(1)(f) GDPR, display of the map you requested). The other services process no personal data and are not data processors under Art. 28 GDPR; they are listed here for transparency.

20. Resume & Cover Letter

When you use the "Resume & Cover Letter" section, we additionally process the following – exclusively to prepare your applications for you, and only for you:

• Resume details: Name, contact information, career path, education, skills, and languages – entered by you or extracted from a resume you uploaded. A date of birth will not be included in your application documents.
• Attachments (e.g., certificates, diplomas) and a photo: only if you upload them yourself. The photo is included in an application only at your request. You can view, download, and delete any file at any time.
• Job postings you insert, including contact person (name, position, email, phone), as far as the job posting itself mentions them: We only store what the posting publishes and use it only so that you can address the right person. The information is not shared further.
• Application journal: Status, dispatch date and method, notes, and the created documents (up to 10 previous versions per document).
• Reminder: About two weeks after dispatch, we inquire via email if there are any updates. You can disable this in the notification settings or via the unsubscribe link in the email. A click on the link never automatically changes the status of your application.
• Job center setting (voluntary): Whether you have enabled the overview for the job center and the number from your cooperation plan, which you enter yourself, we store separately from your resume. They are not used for analysis and are not shared further.

AI: For extracting a resume, analyzing a job posting, drafting texts, and preparing for interviews, we transmit the necessary texts to OpenAI (see Section 4). There is no automated decision-making within the meaning of Art. 22 GDPR: The AI does not evaluate, score, or classify you. It only compares lines of the posting with your resume and annotates each match with a quote from it. You review and modify all texts yourself; nothing is sent automatically – you send the application yourself, e.g., via your email program.

Company website: Only upon your click does our server read the public website of the company, provided their robots.txt allows it; job portals and social networks are excluded. A brief summary is stored, not the page itself. The website sees the address of our server, not yours.

Storage duration, deletion, and export: All information in this section remains stored until you delete it. "Delete account" removes resume, attachments, photo, journal, and settings. The export (Profile → "Export data") includes them; the journal is additionally available as CSV. For the activation of additional documents, Section 5 (Stripe) applies.

Legal basis: Art. 6 para. 1 lit. b GDPR (function requested by you), for the contact person from the posting Art. 6 para. 1 lit. f GDPR. If an uploaded resume contains special categories of personal data (e.g., severe disability or religion), we only include them if you expressly consent on the review screen (Art. 9 para. 2 lit. a GDPR); otherwise, they are discarded.

21. Internal notifications (Telegram)

So that we notice faults and urgent matters quickly, we send short internal notifications to a private Telegram chat of the operator. They contain no letters, documents or chat contents, only what is needed: for support escalations a short conversation ID, plan, role and a brief reason; for bug reports the title you entered, the type and the page address; for reported listings the title, city and number of reports; for payment events (refund, dispute) the amount, product and reference number, without your e-mail address. Please do not put sensitive data in the title of a bug report. Recipient: Telegram Messenger Inc., Road Town, Tortola (British Virgin Islands), with an EU representative in Brussels; according to Telegram, data of users in the EEA is processed in data centres in the Netherlands, and transfers within the Telegram group rely on the EU Standard Contractual Clauses.

Legal basis: Art. 6 para. 1 lit. f GDPR (legitimate interest in operational security and prompt handling).

22. Transfer of data to third countries

Some of the service providers mentioned above are based in the USA or process data there (in particular Stripe, Cloudflare, Sentry, OpenAI, Resend and Backblaze; with your consent or use of the sign-in function also Google and Meta; for internal notifications Telegram, British Virgin Islands). Adequacy decisions of the EU Commission exist for Switzerland (Pingen) and the United Kingdom (OpenStreetMap/Nominatim). For transfers to the USA we rely on the adequacy decision on the EU-US Data Privacy Framework (Art. 45 GDPR, where the recipient is certified) or on EU standard contractual clauses (Art. 46(2)(c) GDPR), which form part of the contracts with the service providers. You can obtain a copy of the respective safeguards on request at legal@renthelfer.de.

23. Team accounts (Business plan)

The Business plan is currently not available for purchase. If in future you set up a team account on the Business plan or are invited into one, we process the team members' e-mail address and name as well as a team log: with a timestamp, it records who sent, accepted or withdrew an invitation, who approved letters or changed them after approval, and who created, changed or deleted jointly used data (e.g. maintenance entries, deposits, text blocks, properties, company name and logo), as well as bulk mailings that were started. The team log is visible only to the owner of the team account. For the content that the owner and their team process in Renthelfer (e.g. data of their tenants, letters, deposits), the owner is the controller; we process it on their behalf under the data processing agreement (AVV). For a bulk mailing to tenants, the recipient address, name and message content are passed to our e-mail provider (Resend) or our postal provider (Pingen).

Legal basis: Art. 6(1)(b) GDPR (performance of the contract) and Art. 6(1)(f) GDPR (the owner's legitimate interest in being able to trace the work in the team account). The team log is deleted together with the team account.

24. Handover protocol: data of the counter-signer (second contract party)

With the handover protocol, tenant and landlord document the handover of the flat. The other contract party does not need an account with us: they can view and sign the protocol via a personal link. For this we process:

• Counter-signer data (second contract party): name, e-mail address, signature image, time of signing, and the content of the protocol as shown to you (see below). We receive name and e-mail address from the contract party who invites you to sign (Art. 14 GDPR).
• Handover content: photos, notes, meter readings and key details in the protocol. Photos and notes may show or concern third parties; the uploading party is responsible for having the right to upload them.
• Purpose and recipient: documenting the handover between the two contract parties. The recipient is the respective other contract party. Invitation and copy e-mails are sent by our processor Resend (see section on recipients and third countries). The protocol data itself is stored on our servers in the EU.
• Copy by e-mail: anyone who signs via the link receives a one-time PDF copy of the signed protocol at the e-mail address given.
• Retention: until the account of the protocol owner is deleted. Signed protocols are not deleted but archived and remain retrievable until then. Erasure on request, unless retention or evidentiary interests prevent it.
• Your rights: access, rectification, erasure, restriction, data portability and objection (Art. 15–21 GDPR). Contact legal@renthelfer.de.

Legal basis: for the counter-signer (second contract party), Art. 6(1)(f) GDPR. Our legitimate interest, and that of the two contract parties, is to document the handover of the flat in a tamper-evident manner and to attribute the signature to a person (proof of the time and a cryptographic fingerprint of the signed content). There is no contract between us and the counter-signer; use of the link is voluntary. For the account holder who creates the protocol, the legal basis is Art. 6(1)(b) GDPR (user agreement). You may object to the processing at any time under Art. 21 GDPR on grounds relating to your particular situation. Providing your data is neither legally nor contractually required; however, without your signature the protocol cannot be confirmed on your side.