Privacy Policy

Protecting your personal data is important to us. Below we inform you in accordance with Art. 13, 14 of the General Data Protection Regulation (GDPR) about the processing of your data when using the Nutze.app platform.

1. Controller

The controller within the meaning of the GDPR is:

Chris Wernsmann
Vennstr. 3
48619 Heek
Germany
Email: hello@nutze.app

2. What data we process and for what purposes

Depending on your use of the platform, we process the following data:

Account and profile data: name, email address, encrypted password (for classic email sign-in), phone number, profile picture. Purpose: provision of the user account and communication. Legal basis: performance of a contract (Art. 6 (1) (b) GDPR).
Listing and booking data: titles, descriptions, photos, prices, item location, chat messages between the parties. Purpose: processing of rental contracts between users. Legal basis: performance of a contract (Art. 6 (1) (b) GDPR).
Handover and return protocols: photos of the condition of the items, timestamps and confirmations (digital handshake). Purpose: preservation of evidence and contract processing. Legal basis: legitimate interest in dispute resolution (Art. 6 (1) (f) GDPR) and performance of a contract.
Payment data: information about processed payments. Note: we do not store full credit card details ourselves. Purpose: payment processing. Legal basis: performance of a contract (Art. 6 (1) (b) GDPR).
Technical usage data (server log files): IP address, browser type, date and time of access. Purpose: security, stability and troubleshooting. Legal basis: legitimate interest (Art. 6 (1) (f) GDPR).

3. Use of local storage (TDDDG) and cookieless analytics

We use technically necessary storage technologies (such as local storage in the browser) to keep you logged in and to ensure essential functions of the app (e.g. the booking process).

The storage of this strictly necessary data on your device is based on § 25 (2) no. 2 TDDDG (German Telecommunications Digital Services Data Protection Act). The subsequent processing of the personal data takes place in accordance with Art. 6 (1) (f) GDPR (legitimate interest in providing the app) or Art. 6 (1) (b) GDPR.

For reach measurement we use Vercel Analytics and Speed Insights. These services work cookielessly and collect data (such as page views) only in anonymised form. No user profiles are created across websites.

In addition to classic registration by email, we offer the option of signing in via the services of Google and Apple.

If you choose this option, we are authorised directly by the respective third-party provider and receive certain profile data from them (such as your name and email address) in order to create your Nutze.app account or log you in. The legal basis for this is the performance of a contract (Art. 6 (1) (b) GDPR) or your consent through the active selection of the provider (Art. 6 (1) (a) GDPR).

The providers are Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland) and Apple Distribution International Ltd. (Hollyhill Industrial Estate, Hollyhill, Cork, Ireland).

5. Recipients of the data and US data transfer (DPF)

To provide our platform, we use specialised service providers (processors pursuant to Art. 28 GDPR).

Important note on data transfer to the USA

Some of our service providers are based in the USA. The European Commission has issued an adequacy decision for the EU-US Data Privacy Framework (DPF). Insofar as our US service providers are certified under the DPF, the transfer of data to the USA is permissible under data protection law.

We use the following service providers:

Vercel Inc. (USA): hosting of the web application and cookieless reach measurement. (Certified under the EU-US DPF.)
Supabase Inc. (USA): hosting of the database, user authentication and storage of uploaded images. Supabase uses European data centres, but support access from the USA is possible. (Certified under the EU-US DPF.)
Resend Inc. (USA): sending of purely transactional system and notification emails (e.g. booking confirmations). (Certified under the EU-US DPF.)
Upstash Inc. (USA): cache (Redis) for the technical protection (rate limiting) of the platform.
Functional Software, Inc. ("Sentry", USA): error and stability monitoring to detect and fix technical errors. We operate Sentry in the EU data region (data centre in the EU), so error data is processed within the EU. Session replay is disabled; transmitted error reports are also stripped of personal data (e.g. IP addresses, email addresses, cookies). (Certified under the EU-US DPF.)

Payment processing via Stripe

For processing payments we use Stripe Payments Europe, Ltd. (Ireland) or its parent company in the USA (certified under the EU-US DPF).

Stripe processes payment information (e.g. credit card details) partly as our processor, but also as an independent controller in order to comply with its own legal obligations (e.g. anti-money-laundering). You can find further information in Stripe's privacy policy: https://stripe.com/privacy.

6. Map services and geocoding

To show you the locations of listings, we embed interactive maps. For data-protection reasons (privacy by design), we host the underlying map tiles (Protomaps/PMTiles) on our own servers. When simply viewing the map, no location data is therefore transmitted to third-party map providers.

However, the following applies to certain additional map functions:

Map assets: to display fonts and symbols (sprites) on the map (MapLibre), files are loaded from GitHub (protomaps.github.io). For technical reasons, your IP address is transmitted to GitHub (USA) in the process. The same applies when loading fallback tiles via the servers of the OpenStreetMap Foundation.
Geocoding: when you enter an address in the search field or create a listing, we convert this address into coordinates in the background. This conversion (geocoding) takes place server-side via the interfaces of Geoapify (Geoapify GmbH, Austria/EU) and Nominatim / OpenStreetMap.

The legal basis for this processing is our legitimate interest in a functioning and appealing location search (Art. 6 (1) (f) GDPR) and the performance of a contract (Art. 6 (1) (b) GDPR).

7. Storage period

We only store your data for as long as is necessary for the respective purpose. If you delete your account, your profile data will be deleted. However, we are required to store data on completed rental contracts and payments for up to 10 years due to statutory retention periods (in particular commercial and tax law requirements under the German Commercial Code (HGB) and Fiscal Code (AO)).

When you request or accept a booking, we pass on your name and the location required for handover to the respective other contracting party. This is strictly necessary for the performance of the rental contract between you (Art. 6 (1) (b) GDPR).

9. Your rights

You have the following rights with regard to your personal data:

Right of access (Art. 15 GDPR)
Right to rectification or erasure (Art. 16 and 17 GDPR)
Right to restriction of processing (Art. 18 GDPR)
Right to data portability (Art. 20 GDPR)
Right to withdraw a given consent (Art. 7 (3) GDPR)

Right to object (Art. 21 GDPR): insofar as we process your data on the basis of legitimate interests (Art. 6 (1) (f) GDPR), you can object to the processing at any time.

To exercise your rights, an email to hello@nutze.app is sufficient.

10. Right to complain to a supervisory authority

You also have the right to complain to a data protection supervisory authority. The supervisory authority responsible for our registered office is:

Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW)
Kavalleriestraße 2-4
40213 Düsseldorf, Germany

Last updated: July 2026