Privacy Policy

Controller

David Sterz

Address

Ulmenstr. 5, 86507 Oberottmarshausen

Contact

info@vehilo.de

Authority

Bayerisches Landesamt für Datenschutzaufsicht (BayLDA), Promenade 18, 91522 Ansbach, Germany

• Requests, waitlist, First Look, Listing Audit, Search Support, Guided Purchase, and Concierge: name, email, phone, vehicle/listing data, budget, search profile, messages, and advisory notes; GDPR Article 6(1)(b).
• Contact, support, and scheduling: communication data and message contents; GDPR Article 6(1)(b) and 6(1)(f).
• Payment and accounting: product, amount, payment status, Stripe Checkout or PayPal transaction reference, and business records; GDPR Article 6(1)(b) and 6(1)(c).
• Security and operations: technical server and security logs; GDPR Article 6(1)(f).
• Optional consent, such as survey follow-up or testimonials: GDPR Article 6(1)(a).

• Vercel for hosting, deployment, CDN, functions, and technical logs.
• Supabase for Postgres database, internal CRM records, retention, and admin workflows.
• Cloudflare Turnstile, when enabled, protects forms from automated abuse. Cloudflare processes technical connection and browser signals, including IP address and browser characteristics. It acts on our instructions to protect our website and as a separate controller when improving its bot detection.
• Cal.com/Cal.eu provides booking and an embedded calendar. Loading embedded booking features sends technical connection data to the service. For bookings, it processes the contact and appointment details entered, booking-question answers, and references linking the booking to the requested service.
• Notion, when internal synchronization is enabled, receives appointment, payment and service summaries plus associated customer, order and transaction references for organizing and following up our services.
• Stripe for Checkout, payments, payment status, and fraud/security checks; Vehilo does not store card details.
• PayPal when selected for payment: payment processing, product and transaction information, and payment status and transaction references used by Vehilo for reconciliation. Payment details are entered with PayPal.
• Resend for transactional email, delivery metadata, and message content.
• Proton Mail or the configured mailbox provider for email communication.
• Proton Calendar, when used for booking: email address, appointment time, time zone, booking reference and booking status. Vehilo synchronizes these details with its internal CRM to manage appointments, rescheduling and cancellations.
• External specialists only where requested by the customer or required for the service; no dealer commissions in V1.

Vehilo uses Vercel Web Analytics to measure reach and Vercel Speed Insights to measure anonymous page performance, including Core Web Vitals, without its own marketing cookies. Tokenized pages, admin areas, API routes, query parameters, and fragments are excluded or removed before events are sent. Strictly necessary cookies or redirects may be set by hosting, security features, Stripe Checkout, or PayPal.

• Abandoned checkout intents: 30 days.
• Unrouted chat and non-contact survey PII: 90 days.
• Leads, waitlist, search profiles, and unpaid requests: generally 12 months.
• Completed advisory services and service notes: 3 years before anonymization unless longer legal duties apply.
• Customer identity records for lookup, access requests, and deduplication: generally 6 years before anonymization.
• Payment, invoice, and tax records: retained separately for statutory periods, generally up to 8 years or longer if required.
• Agent-job and internal workflow data: generally 180 days unless moved into customer/service records.

Data subjects may request access, rectification, erasure, restriction, portability, objection, and withdrawal of consent by emailing info@vehilo.de. They may also complain to a competent supervisory authority.

14 May 2026.