Privacy Policy

1. Data Controller and Contact

The controller within the meaning of the General Data Protection Regulation (GDPR) is App HUMB UG (haftungsbeschränkt), Parkstraße 9, 31188 Holle, Germany, represented by Marco Pilipovic. This policy applies to the RentalPal app and the website www.rentalpal.de.

For privacy enquiries and to exercise your rights, you can reach us by email at contact@rentalpal.de, via the contact form in the app and on www.rentalpal.de, or by post at the address above.

2. Data We Process

Account: When you register, we process your email address and your password; the password is not stored in plain text. If you sign in with Google, we receive your email address and account name from Google. You can set a display name in Settings, which need not be your real name; it is visible to other users. We also store your settings (e.g. language and notifications), the version of the Terms of Service and of this policy you accepted together with the time of acceptance, and, where applicable, your membership of an organisation.

Offers: When you create an offer, we process the information you enter, in particular title, description, prices, deposit, photos, as well as street, town and the location derived from them. Offers, including their location details and your display name, are publicly visible, also to visitors who are not signed in and to search engines.

Messages: When you use the chat, we store your messages and the images you send, the participants, the time and the read status. Your messages are visible to the respective chat participants. While you have a chat open, this is briefly recorded.

Usage: We store your favourites. Views of offers are counted; for signed-in users the user ID is stored with the view. Your most recent search (search term, radius and starting point) is only stored on your device; the search query itself is transmitted to our search service to answer it (see section 6).

Contact requests and reports: When you write to us via the contact form or report an offer, we process your email address, your message, an optional attached image and, for reports, the reason, your comment and your user ID.

Error reports: If a serious error occurs in the app, an error report may be sent to us automatically. It contains the time, technical error details, the address being viewed, a screenshot of the app view and, if you are signed in, your email address.

Technical data: When you use the app and the website, our servers process technically necessary connection data such as IP address, time and browser or device identifier.

3. Location, Camera and Photos

Location: The app only requests the device location when you trigger it yourself (e.g. for a radius search) and have granted the location permission. The location is used to find offers near you and to determine the corresponding address; for this purpose the coordinates are transmitted to the Google geocoding service. The location is never requested in the background. You can revoke the permission at any time in your device settings and enter a place by hand instead.

Camera and photos: For offer photos, images in the chat and attachments in the contact form, you can take a photo or choose an image from your gallery. The app only accesses images that you take or select yourself; these are uploaded to our servers.

4. Purposes and Legal Bases

Performance of a contract (Art. 6(1)(b) GDPR): We process account, offer and message data to manage your account, sign you in, display offers and make them findable, provide the chat and send you essential account notifications (e.g. email verification, password recovery). Once your email address is verified, we notify you of new chat messages by email; you can switch this off in Settings.

Legitimate interest (Art. 6(1)(f) GDPR): Error reports, technical connection data, view counts and the handling of reports serve a stable, secure service that is free from abuse. Offer texts are also processed automatically (e.g. category, place assignment and short descriptions for search engines) so that offers are easier to find. Displaying advertising serves to fund the service.

Consent (Art. 6(1)(a) GDPR): We use the device location, the camera and your photos only after you have granted permission, and cookies for personalised advertising on the website only after you have agreed in the cookie notice. You can withdraw consent at any time with effect for the future.

5. Advertising

RentalPal may display ads from Google: Google AdSense on the website and Google AdMob in the app. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

Website: Google only sets cookies for personalised advertising if you have agreed in the cookie notice. Without your agreement, non-personalised ads are delivered.

App: To deliver and measure ads, the Google Mobile Ads SDK may process the advertising ID of your device as well as device and usage data (e.g. IP address, device model and interactions with ads). You can reset or delete the advertising ID in your device settings and switch off personalised advertising there.

Further information is available in the Google privacy policy at https://policies.google.com/privacy.

6. Recipients and Service Providers

We do not sell your personal data. We only share it where this is necessary to operate the service, where you have consented, or where we are legally obliged to do so.

Hosting: Database, files and website are operated on servers in Germany (IONOS SE and netcup GmbH).

Search: For the search we transmit offer data, including town and location, and your search queries to the search service Algolia (Algolia, Inc., USA).

Google services: We use the Google Maps Platform to convert addresses and coordinates and to create map previews for offers; Google sign-in if you sign in with your Google account; Google Gemini for the automated processing of offer texts (title, description, prices, category and town of the offer are transmitted, but not your account data); and Google AdSense and AdMob for advertising (see section 5).

Email delivery: We send account notifications and other notifications via our own servers; no external delivery service is used.

Third countries: Algolia and Google may also process data in the USA. For these services, the privacy terms of the respective providers apply in addition.

Other users and the public: Your display name and your offers are publicly visible. Chat messages are only seen by the respective chat participants. RentalPal administrators can view content where this is necessary for support and for handling reports.

7. Retention and Deletion

We store your data for as long as your account exists. You can edit or delete your offers yourself at any time. We keep contact requests, reports and error reports for as long as this is necessary to handle them and to prevent abuse.

You can delete your account at any time in the app via Settings. This deletes your login, your profile, your offers including photos, your favourites and your organisation membership, unless statutory retention obligations require otherwise. Messages you have sent to other users may remain in their chat history.

If you do not have access to the app, you can also request deletion of your account and your data by email at contact@rentalpal.de, via the contact form on www.rentalpal.de or by post.

8. Security

Data is transmitted between the app or website and our servers in encrypted form (TLS). Passwords are not stored in plain text. Only people who need it to operate the service have access to personal data. Nevertheless, data transmission over the internet may have security vulnerabilities; complete protection of data against access by third parties is not possible.

9. Your Rights

Under the GDPR you have the right to access, rectify or erase your personal data, to restrict or object to processing, and to data portability. You can withdraw any consent you have given at any time. To exercise your rights, a message via the contact options named in section 1 is sufficient.

You also have the right to lodge a complaint with the competent supervisory authority. The responsible authority for Lower Saxony is the State Commissioner for Data Protection (LfD Niedersachsen, www.lfd.niedersachsen.de). You may also contact the Federal Commissioner for Data Protection and Freedom of Information (BfDI, www.bfdi.bund.de).

10. Local Storage and Cookies

The app stores settings and caches on your device that are needed for it to work: language, appearance (light or dark), your decision on the location permission, dismissed hints, a copy of your profile, your chats and your most recent search, and identifiers of error reports already sent. On the website we use a technically necessary session cookie for sign-in and store your choice from the cookie notice. Google advertising cookies for personalised advertising are only set on the website with your agreement (see section 5).

11. Changes to This Policy

We update this Privacy Policy when the app or the legal situation changes. The current version, with version number and date, is available in the app and at https://www.rentalpal.de/privacy/. When there is a new version, we ask signed-in users in the app to confirm it.