Privacy Policy

This is a convenience translation. The legally binding version is the German Datenschutzerklärung.

This policy covers all services of s3n GmbH: immokit.ai, bodenrichtwert.ai and kataster.ai — in each case the website, the REST API, the MCP server and the shared dashboard on immokit.ai, through which account, sign-in and billing run for all three. Where a processing activity takes place for one of the services only, we say so.

We only process the data we need for operation and billing — no advertising tracking pixels, no profiling, no disclosure to third parties for advertising purposes. We do not process owner data: personal data about property owners is excluded from the open-data scope of the official sources; we do not deliver, process or store it. At our end, personal data arises mainly from your account and from the address you query, which can relate to a person.

I. General information

1. Controller

The controller within the meaning of Art. 4(7) GDPR is:
s3n GmbH, represented by its managing director Sören Uhrbach
Trentelmoorweg 34a, 31228 Peine, Germany
Email: info@s3n.gmbh

We have not appointed a data protection officer, as we do not exceed the thresholds of § 38 BDSG (German Federal Data Protection Act). Privacy enquiries go to the email address above.

2. Legal bases

• Art. 6(1)(b) GDPR — performance of a contract or pre-contractual measures (account, sign-in, use of API, MCP server and dashboard, billing).
• Art. 6(1)(c) GDPR — legal obligations, in particular retention duties under commercial and tax law (§ 257 HGB, § 147 AO).
• Art. 6(1)(f) GDPR — legitimate interests (secure and uninterrupted operation, abuse prevention, reach measurement without personal reference, establishing or defending legal claims).
• Art. 6(1)(a) GDPR — consent, where we obtain it in individual cases. You can withdraw it at any time with effect for the future.

3. Retention

We delete personal data as soon as the purpose of processing ceases and no statutory retention obligations apply. Specific periods are stated with each processing activity. We keep invoices and accounting records for ten years and business correspondence for six years (§ 147 AO, § 257 HGB); there, restriction of processing takes the place of deletion.

4. Recipients

Within s3n GmbH, only persons who need access for their tasks receive it. External recipients are the processors listed in III.7 and — to answer your queries — the bodies listed in III.3. We do not sell data, nor do we disclose it for advertising purposes.

5. Processing outside the EU

Our database is hosted by Supabase in Paris, delivery runs through Cloudflare data centres, and we operate reach measurement ourselves in Germany. Several of our processors are based outside the EU — Cloudflare and Resend in the USA, Supabase in Singapore — and may, in justified individual cases such as support or incident handling, access data from a third country. The basis for this is the EU Standard Contractual Clauses under Art. 46(2)(c) GDPR or, where applicable, certification under the EU-US Data Privacy Framework (Art. 45 GDPR). A copy of these safeguards is available on request.

To resolve addresses in federal states for which no official address service is connected, we transmit the address line to the OpenStreetMap Foundation in the United Kingdom (see III.3). An adequacy decision of the European Commission under Art. 45 GDPR exists for the United Kingdom.

6. Your rights

You have the following rights against us:

• Access to the data stored about you (Art. 15 GDPR)
• Rectification of inaccurate data (Art. 16 GDPR)
• Erasure, unless retention obligations apply (Art. 17 GDPR)
• Restriction of processing (Art. 18 GDPR)
• Notification of recipients about rectification, erasure or restriction (Art. 19 GDPR)
• Data portability (Art. 20 GDPR)
• Objection to processing based on a legitimate interest (Art. 21 GDPR)
• Withdrawal of consent with effect for the future (Art. 7(3) GDPR)

An informal email to info@s3n.gmbh is sufficient to exercise these rights. You also have the right to lodge a complaint with a supervisory authority (Art. 77 GDPR); the authority responsible for us is the Data Protection Commissioner of Lower Saxony (Landesbeauftragte für den Datenschutz Niedersachsen), as well as any supervisory authority of the member state of your residence.

II. When visiting the websites

1. Delivery and logging

Our websites, APIs and MCP servers run on the infrastructure of Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA. We have a data processing agreement with Cloudflare under Art. 28 GDPR, including EU Standard Contractual Clauses. More information: Cloudflare Privacy Policy.

When you visit, technically necessary access data is processed: IP address, HTTP method, requested path without query string, status code, browser user agent, referrer, Cloudflare Ray ID and timestamp. IP addresses are deleted from our log files after 7 days at the latest; access data without personal reference is kept for up to 30 days for statistical evaluation. The purpose is delivery, stability and protection against attacks and overload. Legal basis: Art. 6(1)(b) and (f) GDPR.

2. Cookies

We only use technically necessary cookies — no analytics, tracking or advertising cookies. No consent is required for them (§ 25(2) No. 2 TDDDG, German Telecommunications Digital Services Data Protection Act); there is therefore no consent banner. The legal basis of the associated processing is Art. 6(1)(b) or (f) GDPR.

No Stripe cookies on our domains: Payment runs as a redirect to checkout.stripe.com. Stripe's own cookies are set exclusively on Stripe's domain — the Stripe cookie settings apply there.

3. Reach measurement (Plausible Analytics, self-hosted)

For aggregated visitor statistics we use a self-hosted instance of Plausible Analytics — not Plausible's cloud service. It runs on our own infrastructure, located in Hanover, Germany; no processor is involved.

Plausible sets no cookies and stores no persistent identifier on your device. To count unique visitors once per day, a daily-rotating, non-reversible hash is generated from IP address, user agent and the domain visited; the input values are then discarded. Recognition beyond the day or across websites is thereby excluded. We record aggregated page views, referrer, coarse country of origin and coarse device and browser type; in the dashboard we additionally count individual steps such as completing onboarding or starting a payment — without reference to your account.

Since your device is neither accessed nor used to store anything, § 25 TDDDG does not apply. The legal basis is Art. 6(1)(f) GDPR — our legitimate interest in designing the services to meet demand. Beyond this we deliberately use no advertising or profiling tools: no Google Analytics, no Google Tag Manager, no Meta Pixel, no PostHog, no Hotjar and no comparable services.

In addition, we count security-relevant events around sign-in and token issuance (such as failed sign-in attempts) in aggregated form to detect abuse. No evaluation of individuals takes place.

4. Protection against automated access (Cloudflare Turnstile)

We protect forms that can be reached without signing in against automated submissions with Cloudflare Turnstile — currently the demo lookup and the waitlist form on bodenrichtwert.ai. Turnstile checks technical characteristics of the browser to determine whether a request comes from a human; IP address and browser data are transmitted to Cloudflare in the process. Turnstile does not build user profiles and sets no advertising cookies. Legal basis: Art. 6(1)(f) GDPR — our legitimate interest in preventing abuse.

5. Waitlist

For federal states for which we may not yet deliver data, you can join a waitlist on bodenrichtwert.ai. We store your email address, the federal state, the town if given, and a salted hash of your IP address for abuse prevention, and notify you as soon as data becomes available. We delete entries six months after notification, and without notification after two years at the latest. Legal basis: Art. 6(1)(b) GDPR (at your request).

III. For signed-in users

1. Account and sign-in

Account, sign-in and billing run for all services through one shared account in the dashboard on immokit.ai. For this we process your email address, the times of creation and last sign-in, your plans per service, the status of your trial, your usage counters, your acceptance of the legal texts with time and version, and — for a paid plan — the Stripe customer ID. Sign-in uses a one-time code that we send to your address; we do not store a password. Legal basis: Art. 6(1)(b) GDPR. Without an email address we cannot provide an account.

We also send you emails about your account, for example when your trial ends or when you reach a quota. You can unsubscribe from these emails via the link in each email.

2. Connecting an AI tool or an application

When you connect a service to an AI tool (such as Claude or ChatGPT) or to your own application, we issue an access token or API key for it. We store the identifier of the connected program, the scope of the authorisation, the issue and expiry times and a hash of the token — not the token itself. The purpose is to verify the connection and be able to revoke it. Legal basis: Art. 6(1)(b) GDPR.

3. Queries

A query contains the address you want to know about. We process it exclusively on the server, resolve it to a coordinate and use it to query the responsible bodies:

• Standard land values (bodenrichtwert.ai): the Federal Agency for Cartography and Geodesy (BKG) via the BORIS-D place search for address resolution, and the service of Bezirksregierung Köln / GIS NRW for the standard land value.
• Real estate cadastre (kataster.ai) and the further information via immokit.ai (development plans, surroundings): the official address and specialist services of the responsible federal states, municipalities and federal authorities.
• OpenStreetMap/Nominatim: If no official address service is connected for a federal state, we transmit the address line to the geocoding service Nominatim of the OpenStreetMap Foundation in the United Kingdom — together with an identifier of our service, but without any account, token or user identifier. Details: OpenStreetMap Foundation Privacy Policy.

These bodies do not act on our behalf but as controllers in their own right; they receive neither your email address nor an identifier of your account. We cache responses briefly to relieve the sources — keyed by a hash of coordinate or address features and without reference to your account.

If you query addresses that relate to other persons, you are yourself responsible for that processing under data protection law. Only enter addresses you are authorised to query. Legal basis: Art. 6(1)(b) GDPR.

4. Usage log

For each successful query we log your user ID, the service, the tool, the channel (MCP or API), the display name of the connected program (such as Claude or ChatGPT), whether the response came from the cache, the federal state and the time. For standard land value queries we additionally store the resolved address, the type of use and the value determined; they form your query history in the dashboard. For all other information we do not store the address. We do not store IP addresses in the usage log.

The purpose is your query history, managing your quota and protection against abuse. Retention: 12 months. Legal basis: Art. 6(1)(b) GDPR and Art. 6(1)(f) GDPR (abuse prevention).

5. Payment processing

For paid plans we use Stripe Payments Europe Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland. When you subscribe to a plan, you are redirected to a Stripe payment page. Payment data — card or account numbers — never reaches us; it is processed exclusively by Stripe. From Stripe we receive a customer ID, the status of the subscription and the billing data we need for invoicing and to meet tax obligations. Legal basis: Art. 6(1)(b) GDPR for performance of the contract, Art. 6(1)(c) GDPR for retention.

Stripe is also an independent controller for fraud prevention. Details in the Stripe Privacy Policy.

6. Deleting your account

You can request the deletion of your account at any time by email to info@s3n.gmbh. We then delete your account data; we keep invoices and accounting records within the statutory periods (I.3).

7. Processors

We have data processing agreements under Art. 28 GDPR with all providers listed.

IV. Communicating with us

If you email us — for example at info@s3n.gmbh or at the support address of a service — we process the content, your sender address and the metadata to handle your request (Art. 6(1)(b) GDPR for contract-related requests, otherwise (f) GDPR). We delete the correspondence as soon as the request has been fully handled and no retention obligation applies — usually after 24 months at the latest.

V. For contractual partners

If you subscribe to a paid plan as a business or have another contractual relationship with us (customer, supplier, data provider, cooperation partner), we process company name, legal form, address, VAT ID, commercial register number, contact persons with name and contact details, billing and payment data (via Stripe, see III.5) and other information required to perform the contract — for the duration of the business relationship and thereafter within the statutory retention periods. Legal bases: Art. 6(1)(b), (c) and (f) GDPR (establishing or defending legal claims).

VI. Our company profile on Instagram

1. Scope

We operate a company profile on Instagram for bodenrichtwert.ai. This section concerns only the processing on the Instagram platform when you visit or interact with our profile. No Meta service is embedded on our websites — no Meta Pixel, no plugins, no social media buttons. A link to our profile transmits data to Meta only when you click it.

2. Joint controllership with Meta (Art. 26 GDPR)

Instagram is provided by Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland ("Meta"). Meta provides us with aggregated statistics on the use of our profile ("Insights"). For this processing, Meta and we are joint controllers within the meaning of Art. 26 GDPR (CJEU, judgment of 5 June 2018, C-210/16; German Federal Court of Justice, order of 25 June 2020, I ZR 186/17). Meta makes the essence of the arrangement under Art. 26(2) GDPR available in the Page Insights Controller Addendum; under it, Meta assumes primary responsibility for the Insights data and for fulfilling data subject rights in this context.

We have no influence on which data Meta collects when our profile is visited, how Meta processes it further and how long Meta stores it, and we do not learn who visited our profile.

3. Information processed

• Insights (aggregated): reach and views of our posts and profile, interaction rates, follower development and coarse information on the composition of the people reached (such as age groups, country, city, language) — exclusively in aggregated form.
• Interactions: If you follow us, comment, react, share or send us a direct message, we see your Instagram username, your public profile information and the content of your message or comment.

Meta itself also processes further data, including usage and device information and cookies. Details in the Instagram Privacy Policy.

4. Purpose, legal basis and retention

The purpose is public relations, providing expert information on standard land values, communicating with prospects and customers, and assessing whether the channel is worthwhile. The legal basis is Art. 6(1)(f) GDPR, and Art. 6(1)(b) GDPR for contract-related direct messages. Insights are available at Meta for a period determined by Meta. Comments and posts remain stored until you or we delete them; we delete direct messages like emails (section IV).

5. Processing in the USA

Meta also processes data in the USA. Meta Platforms, Inc. is certified under the EU-US Data Privacy Framework (Art. 45 GDPR); in addition, Meta uses EU Standard Contractual Clauses under Art. 46(2)(c) GDPR. Despite these safeguards, access to data by US authorities cannot be ruled out entirely.

6. Your rights

The rights in I.6 apply against both controllers. With regard to Insights, you exercise them most effectively directly against Meta; if you contact us, we forward your request to Meta without delay. All content we publish on Instagram is also available on bodenrichtwert.ai without an Instagram account; a direct message is never necessary to contact us.

VII. Changes to this policy

We adapt this policy when processing changes or a legal adjustment becomes necessary. The version published here with the date stated above applies.