Privacy policy

Last updated: 1 September 2026

1. General information and mandatory disclosures

The operators of these pages take the protection of your personal data very seriously. We treat your personal data confidentially and in accordance with statutory data protection provisions and this privacy policy.

Our websites cleverbauen24.de and www.cleverbauen24.de can generally be used without providing personal data. Where personal data (such as name, email address or telephone number) is collected on our pages, this is always voluntary. This data will not be shared with third parties without your express consent.

Please note that data transmission over the internet (e. g. when communicating by email) may have security vulnerabilities. Complete protection of data against access by third parties is not possible.

2. Controller

The controller responsible for data processing on this website within the meaning of the General Data Protection Regulation (GDPR) and § 5 DDG is:

You can contact us at any time with questions about data protection.

3. Collection and storage of personal data

3.1 Server log files

The website provider automatically collects and stores information in server log files that your browser automatically transmits to us. This includes:

• Browser type and version
• Operating system used
• Referrer URL
• Host name of the accessing computer
• Time of the server request
• IP address (anonymised)

This data cannot be attributed to specific individuals. It is not combined with other data sources. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in technically error-free presentation and optimisation of the website).

3.2 Contact form and email contact

If you contact us through a contact form or by email, your details (name, email address, message content) are stored to process your enquiry. Processing is based on Art. 6(1)(b) GDPR (steps prior to entering into a contract) or Art. 6(1)(f) GDPR (legitimate interest in responding to your enquiry).

WhatsApp: If you contact us using the WhatsApp number provided on the platform, your telephone number, WhatsApp profile name and message content are transmitted to WhatsApp Ireland Ltd. (Meta Platforms Ireland Ltd., 4 Grand Canal Square, Dublin 2, Ireland). Messages are end-to-end encrypted; however, WhatsApp processes metadata (time, participants). Transfer to third countries, particularly to Meta Platforms Inc. in the USA, cannot be ruled out; the basis is the EU-U.S. Data Privacy Framework and standard contractual clauses under Art. 46(2)(c) GDPR. Use of WhatsApp is voluntary and exclusively at your initiative. The legal basis is Art. 6(1)(b) GDPR (steps prior to entering into a contract) or Art. 6(1)(f) GDPR (legitimate interest in fast support contact). WhatsApp privacy information: whatsapp.com/legal/privacy-policy-eea

3.3 Lead forms (order form, Quickcheck, renovation calculator, specialist company referrals)

When you use our lead forms and tools (Quickcheck, quote review, order form, renovation calculator, specialist company referrals), we collect the following data:

• First and last name
• Email address
• Telephone number — optional for Quickcheck and quote review; mandatory for the renovation calculator and specialist company referrals (for renovation advice by telephone)
• Town/city or postcode of the construction project
• Property type and project type
• Details of renovation scope, rooms, areas, trades, specification and construction year (renovation calculator)
• Additional details about the construction project
• Uploaded PDF documents (construction quotes, bills of quantities, construction plans) — only for Quickcheck and quote review

For the renovation calculator and specialist company referrals, we process the data provided for the following purposes: sending the cost breakdown by email, renovation advice by telephone and referring suitable construction companies from our partner network to the customer or forwarding the enquiry to the selected construction companies.

Processing is based on Art. 6(1)(b) GDPR for performance of the contract or steps prior to entering into a contract.

Note on third-party content: Uploaded documents (particularly bills of quantities, floor plans and drawings) may contain third parties' personal data — such as names and contact details of trade businesses, architects, designers or contact persons. All uploaded documents are processed exclusively for quote analysis and are not used for other purposes. As the customer, you are responsible for ensuring that you are authorised to share these documents with us.

3.4 UTM tracking parameters

When you visit our website, we may collect UTM parameters from the URL (utm_source, utm_medium, utm_campaign, utm_term, utm_content). These are stored temporarily in your browser's session storage and transmitted to us when you place an order or submit a Quickcheck request. Processing serves analysis of our marketing channels on the basis of Art. 6(1)(f) GDPR (legitimate interest).

3.5 Newsletter

We operate a promotional newsletter with tips and information about building and renovation. Registration takes place exclusively through the double opt-in procedure: after entering your email address in one of our registration forms (Quickcheck form, specialist company search wizard or renovation cost calculator), you receive a confirmation email with a confirmation link. You are only added to the mailing list once you click this link. Until confirmation, your email address is not used to send newsletters.

The legal basis is your express consent under Art. 6(1)(a) GDPR in conjunction with § 7(2) no. 3 UWG. We use Brevo (Sendinblue SAS) for technical delivery (see section 5.2). You can withdraw consent at any time by an informal email to info@cleverbauen24.de or through the unsubscribe link in every newsletter email; your data will then be removed from the mailing list without delay.

We send three separate thematic newsletters:

• Mailing list A (registration through the specialist company wizard): tips for ongoing renovation and construction projects.
• Mailing list B (registration through the Quickcheck form): tips for reviewing construction quotes and contracts.
• Mailing list C (registration through the renovation cost calculator): cost calculations, funding and best practice for renovation budgets.

All mailing lists follow the same double opt-in procedure and right of withdrawal.

3.6 Referral and voucher codes

We offer a referral programme: existing customers can invite other customers to the platform using a personal referral code. When such a code is redeemed, we process the code and the new customer's order details to allocate the discount and reward the referring customer (usually through an email notification with a voucher). The new customer does not learn which referring customer owns the code; the referring customer only learns that their code has been redeemed, not the new customer's identity. The legal basis is Art. 6(1)(b) GDPR (performance of a contract) for allocation and redemption and Art. 6(1)(f) GDPR (legitimate interest in administering the referral programme) for notification.

Voucher codes are stored in our database with validity status, redemption history and any partner allocation. This data is not shared with third parties except the payment provider Stripe for technical application of the discount.

4. Use of data

We use collected data for the following purposes:

• Providing our service (AI-assisted analysis of construction quotes)
• Preparing and delivering the review report
• Communicating with you (email support, status notifications)
• Payment processing
• Improving and developing our services
• Meeting statutory retention obligations

The legal basis for processing is Art. 6(1)(b) GDPR (performance of a contract) and Art. 6(1)(f) GDPR (legitimate interest in improving our offering).

5. Sharing with third parties

Your personal data is only transferred to third parties in the cases described below:

5.1 Stripe Inc. (payment processing)

We use Stripe Inc., 354 Oyster Point Blvd, South San Francisco, CA 94080, USA, to process payments. During a purchase, your payment details (e. g. credit card details) are transmitted directly to Stripe. We do not store complete payment details ourselves. Stripe is certified under the EU-US Data Privacy Framework. We have also entered into standard contractual clauses (SCCs) with Stripe under Art. 46(2)(c) GDPR. Stripe privacy information: stripe.com/de/privacy

5.2 Brevo GmbH (email delivery)

We use the service of Brevo GmbH, Köpenicker Str. 126, 10179 Berlin, Germany, to send transactional emails (review report delivery, order confirmations, support emails). Brevo processes your email address and name for email delivery. Data is processed within the EU. The legal basis is Art. 6(1)(b) GDPR (performance of a contract) and Art. 28 GDPR (processing on our behalf). Brevo privacy information: brevo.com/de/legal/privacypolicy

5.3 Supabase Inc. (database hosting)

Our application data is hosted by Supabase Inc. The database is located in the EU Frankfurt region (AWS eu-central-1). Supabase processes data exclusively on our behalf. No data is transferred to third countries outside the EU. The legal basis is Art. 28 GDPR (processing on our behalf). Supabase privacy information: supabase.com/privacy

5.4 Anthropic (AI-assisted document analysis)

We use AI models from Anthropic PBC, 548 Market St, San Francisco, CA 94104, USA, to analyse your uploaded construction quotes. The contents of your uploaded documents (construction quotes, bills of quantities) are transmitted to the Anthropic API for processing. Transmission is encrypted via HTTPS.

Important: Anthropic does not use data submitted through the API to train its AI models. Data is processed exclusively to provide the requested analysis service and is not permanently stored by Anthropic after processing is complete.

Because Anthropic is based in the USA, we have entered into standard contractual clauses (SCCs) under Art. 46(2)(c) GDPR as the basis for data transfer. The legal basis for processing is Art. 6(1)(b) GDPR (performance of a contract). Anthropic privacy information: anthropic.com/privacy

5.5 Google Analytics (web analytics)

This website uses Google Analytics 4, a web analytics service from Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google Analytics uses cookies that enable analysis of website use.

Google Analytics is used exclusively with your consent under Art. 6(1)(a) GDPR. You can withdraw your consent at any time through our cookie banner.

We use Google Analytics with IP address anonymisation. Google truncates your IP address within European Union member states. Data transmitted through Google Analytics is not combined with other Google data. Google privacy information: policies.google.com/privacy

5.6 Google Ads conversion tracking and enhanced conversions

We use Google Ads, a service from Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, to measure advertising performance. This lets us measure whether a click on one of our ads led to an order or enquiry.

Enhanced conversions: When a purchase is completed, your email address is additionally hashed in your browser using SHA-256 and transmitted to Google exclusively in this hashed form. The sole purpose is to attribute your order to an earlier ad click. Please note that hashed email addresses remain personal data within the meaning of the GDPR.

The sole legal basis is your consent under Art. 6(1)(a) GDPR, given through the "Marketing" category of our cookie banner. Without this consent, no transfer to Google Ads occurs; until consent is given, advertising cookies are set to "denied" through Google Consent Mode v2. You can withdraw consent at any time through cookie settings with future effect.

Data is transferred to the USA; this is safeguarded under Art. 46 GDPR (see section 5.14 "Third-country transfers — general information"). Google privacy information: policies.google.com/privacy

5.7 OpenAI Inc. (AI-assisted quality control)

We use models from OpenAI Inc., 3180 18th Street, San Francisco, CA 94110, USA, to ensure the quality of analysis results. Analysis results previously generated by Anthropic and extracts from document content are transmitted to the OpenAI API for plausibility and consistency checks. Contact details (name, email) are not shared with OpenAI. OpenAI does not use data submitted through the API to train its models. Because OpenAI is based in the USA, we rely on the EU-U.S. Data Privacy Framework (Art. 45 GDPR) or standard contractual clauses (SCCs) under Art. 46(2)(c) GDPR. The legal basis is Art. 6(1)(b) GDPR. OpenAI privacy information: openai.com/policies/privacy-policy

5.8 Consent management (our own consent tool)

We use a consent management tool operated by the provider itself to manage your consent to analytics and marketing scripts. On your first website visit, a consent banner allows you to accept or reject the "Analytics" and "Marketing" categories individually. We store your selection exclusively locally in your browser (Local Storage, key cleverbauen24-cookie-consent).

No server-side or third-party processing: The consent status does not leave your device. We transmit it neither to ourselves nor to third parties. No transfer to third countries occurs. No personal data (e. g. IP address, cookie ID) is transmitted to us through the consent tool.

You can withdraw your consent at any time, either through the "Cookie settings" link in the footer or by deleting your browser's Local Storage. Withdrawal has future effect and does not affect the lawfulness of processing carried out up to that point.

The legal basis for locally storing consent status is § 25(2) no. 2 TDDDG (strictly necessary to implement your choice on future visits) in conjunction with Art. 7(1) GDPR (obligation to demonstrate consent).

5.9 Hotjar Ltd. (usage analysis, heatmaps)

We use Hotjar Ltd., Level 2, St Julian's Business Centre, 3 Elia Zammit Street, St Julian's STJ 1000, Malta, to analyse user behaviour on our website. Hotjar creates heatmaps and anonymised session recordings to improve user navigation. It processes IP addresses (anonymised), device/browser information, screen resolution and click and mouse movement data. Use occurs exclusively after your consent under Art. 6(1)(a) GDPR and can be revoked at any time through our cookie banner. Hotjar privacy information: hotjar.com/legal/policies/privacy

5.10 Microsoft Corporation (Microsoft Clarity, usage analysis)

We use Microsoft Clarity, a web analytics tool from Microsoft Corporation, One Microsoft Way, Redmond, WA 98052, USA. Clarity creates heatmaps and anonymised session recordings to assess clicking, scrolling and mouse movement on our website and improve user navigation. Sensitive input fields (e.g. email address, telephone number, passwords) are automatically masked and not stored in recordings. It processes IP addresses (truncated), device and browser information, screen resolution and interaction data. Data is transferred to the USA on the basis of the EU-U.S. Data Privacy Framework and standard contractual clauses under Art. 46(2)(c) GDPR. Use occurs exclusively after your consent under Art. 6(1)(a) GDPR and can be revoked at any time through our cookie banner. Microsoft privacy information: privacy.microsoft.com/de-de/privacystatement

5.11 Meta Platforms Ireland Ltd. (Facebook Pixel)

We use the "Facebook Pixel" from Meta Platforms Ireland Ltd., 4 Grand Canal Square, Dublin 2, Ireland, to measure conversions and analyse the reach of our advertising campaigns. IP addresses, device information and usage behaviour are transmitted to Meta. Transfer to Meta Platforms Inc. in the USA cannot be ruled out; the basis is the EU-U.S. Data Privacy Framework and standard contractual clauses under Art. 46(2)(c) GDPR. Use occurs exclusively after your consent under Art. 6(1)(a) GDPR and can be revoked at any time through our cookie banner. Meta privacy information: facebook.com/privacy/policy

5.12 OpenAI Ireland Limited (OpenAI Ads Measurement Pixel)

With your consent, we use the OpenAI Ads Measurement Pixel from OpenAI Ireland Limited, 1st Floor, The Liffey Trust Centre, 117–126 Sheriff Street Upper, Dublin 1, D01 YC43, Ireland, to measure the effectiveness of our ads in ChatGPT. This processes conversion events such as a confirmed purchase or successfully submitted contact enquiry, the referring page accessed, browser information and an OpenAI click reference. Where an email address is used for matching, it is first normalised and hashed with SHA-256 in the browser; the raw email address is not transmitted to OpenAI through the pixel.

Processing is based exclusively on your consent under Art. 6(1)(a) GDPR in conjunction with § 25(1) TDDDG. You can withdraw consent at any time through the cookie banner with future effect. Information about OpenAI conversion measurement: help.openai.com

5.13 Cloudflare Turnstile (bot and spam protection)

To protect our forms against automated access, we use Cloudflare Turnstile, a service from Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA, represented in the European Union by Cloudflare Germany GmbH. Turnstile processes your IP address and browser and device characteristics to check whether a form entry comes from a person or an automated program.

The legal basis is Art. 6(1)(f) GDPR (legitimate interest in preventing spam and automated attacks on our forms). Data is transferred to the USA; this is safeguarded by standard contractual clauses (SCCs) under Art. 46(2)(c) GDPR (see section 5.14). Cloudflare privacy information: cloudflare.com/de-de/privacypolicy

5.14 Third-country transfers — general information

Where personal data is transmitted to providers based in the USA (Anthropic, OpenAI, Meta, Cloudflare, potentially Google), we rely on the EU-U.S. Data Privacy Framework under Art. 45 GDPR (where certified) or European Commission standard contractual clauses (SCCs) under Art. 46(2)(c) GDPR. Data processing agreements under Art. 28 GDPR exist with all processors.

6. Cookies and tracking technologies

Our websites use cookies and similar technologies. These are small text files stored on your device. We distinguish between technically necessary cookies and cookies for analytics and marketing purposes.

6.1 Technically necessary cookies

These cookies are required to operate the platform and are set without consent. They include, in particular, session cookies for authentication (Supabase), cookies from payment provider Stripe during checkout and Cloudflare Turnstile entries for bot and spam protection on our forms (see section 5.13). The legal basis is Art. 6(1)(f) GDPR or § 25(2) no. 2 TDDDG (strictly necessary).

6.2 Analytics and marketing cookies

The following cookies and technologies are only set after your express consent through our cookie consent manager:

• Google Analytics 4 – Analysis of usage behaviour to improve the platform
• Google Ads – Conversion tracking and enhanced conversions (transmission of an email address hashed in the browser) to measure advertising performance
• Hotjar – Heatmaps and anonymised session recordings to improve user navigation
• Microsoft Clarity – Heatmaps and anonymised session recordings to improve user navigation
• Facebook Pixel (Meta) – Conversion tracking and remarketing
• OpenAI Ads Measurement Pixel – Conversion tracking for ads in ChatGPT, including hashed email address following marketing consent

You can withdraw consent at any time through the cookie widget with future effect. The legal basis is Art. 6(1)(a) GDPR in conjunction with § 25(1) TDDDG.

Detailed information about the cookies used, their purposes and storage periods is available in our Cookie policy.

7. AI-assisted analysis of construction quotes

AI-assisted analysis of construction quotes is a core part of our service. Below, we explain the associated data processing in detail.

7.1 AI systems used

We use the following AI systems to analyse quotes:

• Anthropic Claude – Extraction of quote items and rules-based quote analysis
• OpenAI GPT – Quality assurance and plausibility checks of analysis results

Only text content from uploaded documents and analysis results are transmitted to the AI systems. Contact details (name, email) are not shared with the AI systems. Details of the respective processors are in sections 5.4 and 5.7.

7.2 Data processed

The following data is processed during analysis:

• Contents of uploaded PDF documents (construction quotes, bills of quantities, construction plans)
• Project details you provide (city, property type, project)
• Extracted quote items (specifications, quantities, unit rates, total prices)

7.3 Purpose and legal basis

AI analysis checks your construction quote for contract risks, completeness, price plausibility and technical correctness. The legal basis is Art. 6(1)(b) GDPR (performance of a contract). You expressly commission us to analyse your construction quote, and AI-assisted processing is necessary for this.

7.4 No automated individual decision-making

The AI analysis does not constitute automated individual decision-making within the meaning of Art. 22 GDPR. Our team reviews and approves the analysis results before delivery to you. AI acts as a support tool; people make the final assessment.

7.5 EU AI Act / AI Regulation

In our assessment, the AI systems we use do not fall into the high-risk category under Art. 6 of Regulation (EU) 2024/1689 on artificial intelligence (EU AI Act). We meet our transparency obligation under Art. 50 of the Regulation by expressly informing you here of our use of AI systems as part of our service.

7.6 Storage of analysis results

Analysis results (identified issues, assessments, review report) are stored in our database. Retention periods follow section 9 of this privacy policy.

8. Data security

During your website visit, we use the widely adopted SSL (Secure Socket Layer) protocol with the highest encryption level your browser supports. All data you transmit to us, including uploaded documents, is transmitted encrypted.

We also protect our systems through the following measures:

• Encrypted database communication
• Role-based access controls (Row Level Security)
• Regular security updates
• No storage of complete payment details on our servers
• Hardened API endpoints with authentication and rate limiting

9. Retention periods

We only store your personal data for as long as necessary to provide our service or as required by statutory retention obligations.

After these periods expire, your data is automatically and irreversibly deleted or further processed in anonymised, aggregated form for statistical purposes (e. g. market price analyses). Once anonymised, it can no longer be traced to individuals. Automatic deletion takes place through a regularly executed GDPR-compliant cleanup process. Uploaded documents (PDFs) are removed from our storage at the same time.

10. Your rights as a data subject

Under the GDPR, you have the following rights:

• Right of access (Art. 15 GDPR): You can request information about your personal data processed by us.
• Right to rectification (Art. 16 GDPR): You can request correction of inaccurate personal data or completion of your personal data stored by us.
• Right to erasure (Art. 17 GDPR): You can request erasure of your personal data stored by us, unless statutory retention obligations prevent this.
• Right to restriction of processing (Art. 18 GDPR): You can request restriction of processing of your personal data.
• Right to data portability (Art. 20 GDPR): You can request that we provide your personal data in a structured, commonly used, machine-readable format.
• Right to object (Art. 21 GDPR): You can object at any time to processing of your personal data where processing is based on Art. 6(1)(f) GDPR.
• Withdrawal of consent (Art. 7(3) GDPR): You can withdraw consent previously given (e. g. for cookies, tracking or marketing emails) at any time with future effect.

To exercise your rights, an informal message to the following is sufficient: info@cleverbauen24.de. You also have the right to lodge a complaint with a data protection supervisory authority. Our competent supervisory authority is:

11. Objection to promotional emails

We hereby object to the use of contact details published under legal notice requirements for sending unsolicited advertising and information materials. The website operators expressly reserve the right to take legal action in the event of unsolicited advertising, such as spam emails.

12. Changes to this privacy policy

We reserve the right to amend this privacy policy to keep it compliant with current legal requirements or to reflect changes in our services. The new privacy policy will then apply to your next visit. We recommend reading this privacy policy regularly to stay informed about the protection of the personal data we collect.