1. Data Controller
Go Maklerfrei GmbH (in formation)
Musterstraße 1, 80331 Munich
Email: datenschutz@go-maklerfrei.de
Phone: +49 89 123 456 78
2. Data Collected
We collect and process the following personal data:
- Master data: Name, email address, phone number, address
- Property data: Address, property details, photos, floor plans, documents
- Payment data: Processed directly via Stripe (we do not store credit card numbers)
- Usage data: IP address, browser type, access times, pages visited
- Communication data: Messages via the platform, email correspondence
3. Legal Basis
- Art. 6(1)(b) GDPR (Performance of contract): Processing to provide our services (image optimization, expose creation, platform usage)
- Art. 6(1)(a) GDPR (Consent): For optional services such as newsletters, analytics cookies, AI-assisted image editing
- Art. 6(1)(c) GDPR (Legal obligation): Tax retention obligations, Anti-Money Laundering Act (where applicable)
- Art. 6(1)(f) GDPR (Legitimate interest): Platform security, fraud prevention, system optimization
4. AI-Assisted Data Processing
Notice pursuant to the EU AI Act (Regulation (EU) 2024/1689) — Transparency obligation
Our platform uses AI systems for the following processing purposes:
- Image optimization (Real-ESRGAN): Automatic enhancement of property photos (upscaling, sharpening, brightness adjustment). Provider: Replicate Inc., San Francisco, USA. Legal basis: Art. 6(1)(b) GDPR (performance of contract). Images are temporarily transferred to servers in the USA and deleted after processing.
- Virtual Staging (Stable Diffusion): AI-generated furnishing of empty rooms. Provider: Replicate Inc., USA. Note: The generated images are AI-generated and labelled as such.
- Text generation (OpenAI GPT-4): Automatic creation of property listing texts. Provider: OpenAI Inc., San Francisco, USA. Only property data (no personal data) is processed.
Risk classification pursuant to the EU AI Act: The AI systems used fall under the category "AI with limited risk" (transparency obligation). These are not high-risk AI systems. All AI-generated content is labelled accordingly.
5. Data Sharing with Third Parties
Data is only shared with the following data processors:
| Provider | Purpose | Location | Legal Basis |
|---|---|---|---|
| Stripe Inc. | Payment processing | USA/EU | DPF, SCC |
| Replicate Inc. | AI image processing | USA | SCC, Art. 49 DSGVO |
| OpenAI Inc. | AI text generation | USA | SCC, Art. 49 DSGVO |
| Supabase Inc. | Database hosting | EU (Frankfurt) | AVV |
| Resend Inc. | Email delivery | USA | SCC |
| fal.ai Inc. | AI video generation | USA | SCC, Art. 49 DSGVO |
| Sprengnetter GmbH | Property valuation (AVM) | Deutschland | AVV |
| EstateSync GmbH | Portal syndication (ImmoScout24, Immowelt, Kleinanzeigen) | Deutschland | AVV |
| Sentry (Functional Software Inc.) | Error monitoring and performance tracking | USA | SCC, DPF |
| IONOS SE | Email delivery (SMTP) | Deutschland | AVV |
| Better Stack (Logtail) | Log aggregation and monitoring | EU | AVV, SCC |
DPF = EU-US Data Privacy Framework; SCC = Standard Contractual Clauses; DPA = Data Processing Agreement
6. Third Country Transfers
When using AI services (Replicate, OpenAI), data is transferred to the USA. The transfer is based on EU Standard Contractual Clauses (SCC) pursuant to Art. 46(2)(c) GDPR as well as supplementary technical and organizational measures (encryption, pseudonymization).
For Stripe, the EU-US Data Privacy Framework additionally applies (adequacy decision of the European Commission).
7. Data Retention
- Account data: Until account deletion, no longer than 3 years after last activity
- Property photos and data: Until deletion by the user or 1 year after contract termination
- Billing data: 10 years (§ 147 AO, § 257 HGB)
- AI-processed images at third-party providers: Deleted immediately after processing
- Server log files: 30 days
8. Your Rights
Under the GDPR, you have the following rights:
- Access (Art. 15): Information about what data we have stored about you
- Rectification (Art. 16): Correction of inaccurate data
- Erasure (Art. 17): Right to be forgotten
- Restriction (Art. 18): Restriction of processing
- Data portability (Art. 20): Export of your data in a machine-readable format
- Objection (Art. 21): Against processing based on legitimate interests
- Withdrawal of consent (Art. 7(3)): At any time with effect for the future
Please direct inquiries to: datenschutz@go-maklerfrei.de
9. Automated Decision-Making
Pursuant to Art. 22 GDPR, we inform you that on our platform no purely automated decisions with legal effect are made. AI-assisted processing (image optimization, text generation) serves as support and can be reviewed and adjusted at any time by the user or our team.
10. Cookies
We exclusively use technically necessary cookies for authentication (session cookie: "better-auth.session_token") and language settings. These cookies are required for the operation of the platform and cannot be disabled.
Analytics or marketing cookies are not used.
11. Right to Lodge a Complaint
You have the right to lodge a complaint with a data protection supervisory authority. The competent authority is the Bavarian State Office for Data Protection Supervision (BayLDA), Promenade 18, 91522 Ansbach, Germany, poststelle@lda.bayern.de
Last updated: March 24, 2026