Privacy policy
Data controller
Jens Röcker, Südeschstraße 32, 48429 Rheine. Contact: [email protected].
Application features
Public price comparisons do not set cookies or track visitors. Filters are processed as URL parameters. Optional accounts and contributions use a separate provider portal. Fonts and styling are served without external font or analytics providers.
Requests and server operation
When you request a page, technically necessary connection data, such as your IP address, the time and the requested URL, is transmitted to the hosting infrastructure. The web server is hosted by OVH SAS (2 rue Kellermann, 59100 Roubaix, France). Cloudflare, Inc. provides DNS and DDoS protection (101 Townsend St, San Francisco, CA 94107, USA). The application counts HTTP requests without cookies, stored IP addresses or visitor identifiers. Records contain UTC time, route group, HTTP method/status, response size, server duration and a category derived from request headers (such as declared AI crawler, likely human or unknown). This count does not store full user agents or URL parameters. Categories do not verify identity. Individual events are deleted after 30 days on the next request; daily counts are retained without visitor identifiers. The upstream Traefik proxy logs every request with the IP address, country, time, requested URL, status code, browser identifier and referring page. We keep these logs, the application error logs and Cloudflare’s logs of blocked or challenged requests in full for 14 days to diagnose errors and to detect, prevent and investigate attacks. After that, we automatically shorten the IP addresses (removing the last block of digits for IPv4, keeping only the first 48 bits for IPv6) and delete the shortened entries after 90 days. Cloudflare processes connection data under its own privacy policy: https://www.cloudflare.com/privacypolicy/.
Purpose and legal basis
The necessary technical data is used to deliver this website, diagnose errors and protect against attacks. The legal basis is Article 6(1)(f) GDPR; our legitimate interest is a secure and reliably accessible service. We do not make automated decisions about visitors or engage in profiling. A website cannot be delivered without the necessary connection data.
Original offers
Provider links open the external website only after you click them. The provider’s privacy policy applies there.
Your rights
Subject to the legal conditions, you may request access, rectification, erasure and restriction of processing. You may object to processing based on legitimate interests on grounds relating to your particular situation. You also have the right to data portability for data processed automatically on the basis of consent or a contract. Please use the contact above. You may lodge a complaint with a data protection supervisory authority, in particular the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia.
Enquiries
If you contact us by email, we process your contact details and message to handle your enquiry. The legal basis is Article 6(1)(f) GDPR; for enquiries leading to a contract, Article 6(1)(b) GDPR applies. Messages are deleted once the enquiry has been resolved, unless statutory retention obligations apply.
Optional provider portal
Your account stores an email address, public display name, salted password hash and the hash of a single-use recovery code. Your email is not public. A secure, HttpOnly session cookie supports sign-in and form protection; sessions last at most twelve hours and are revoked on sign-out or recovery. Expired sessions are removed when another session is created.
Contributions and ownership proofs are stored with their account, time and moderation status. Only approved experiences and provider statements become public, with display name and time. You can delete your account and own contributions through your account; withdrawn contributions disappear from public views. No automatic email or provider notification is sent. Short-lived rate limits store hashes of the connection address; these expire within fifteen minutes and are removed during the next check.
If you set up passkeys, we store the public key, your device label, signature counter and creation/use timestamps. Private keys, PIN and biometric data remain with your authenticator. Sign-in challenges are bound to your session, usable once and valid for at most five minutes. You can remove keys through your account; account recovery removes all passkeys.