Privacy Policy

The data controller responsible for processing your personal data is:

HeimPath
Email: privacy@heimpath.com

For details about our company, please see our Imprint.

We collect and process the following categories of data:

Account data

• Email address, name, and password (hashed) when you create an account
• Profile information you provide (e.g., citizenship, property preferences)

Usage data

• Pages visited, features used, journey progress, and calculator inputs
• Device information (browser type, operating system, screen resolution)
• IP address and approximate location (country/region)

Uploaded documents

• Documents you upload for translation (e.g., purchase agreements, rental contracts)
• These may contain personal data — please redact sensitive information before uploading if you wish

Payment data

• Payment processing is handled by Stripe. We do not store your credit card numbers
• We receive transaction confirmations, subscription status, and billing email from Stripe

We process your data under the following legal bases (GDPR Art. 6):

• Contract performance (Art. 6(1)(b)): Processing necessary to provide our services (account management, journey tracking, calculations, document translation)
• Legitimate interest (Art. 6(1)(f)): Analytics and error monitoring to improve our services, fraud prevention, and security
• Consent (Art. 6(1)(a)): Marketing communications (you can withdraw consent at any time)
• Legal obligation (Art. 6(1)(c)): Retention of billing records as required by German tax law

We share data with the following third-party processors, each bound by data processing agreements (Auftragsverarbeitungsvertrag / AVV):

All processors are located within the EU/EEA or operate under Standard Contractual Clauses (SCCs) approved by the European Commission for data transfers outside the EU.

We use essential cookies required for the platform to function (e.g., authentication tokens, session management). These do not require consent under the ePrivacy Directive.

We do not currently use third-party analytics cookies or advertising trackers. If this changes, we will implement a cookie consent mechanism and update this policy.

• Account data: Retained while your account is active. Deleted within 30 days of account deletion.
• Uploaded documents: Retained while your account is active. Deleted within 30 days of account deletion or upon your request.
• Billing records: Retained for 10 years as required by German tax law (AO §147).
• Error logs: Retained for 90 days, then automatically purged.

Under the General Data Protection Regulation, you have the following rights:

• Right of access (Art. 15): Request a copy of all personal data we hold about you
• Right to rectification (Art. 16): Correct inaccurate personal data
• Right to erasure (Art. 17): Request deletion of your personal data ("right to be forgotten")
• Right to restrict processing (Art. 18): Limit how we use your data
• Right to data portability (Art. 20): Receive your data in a machine-readable format
• Right to object (Art. 21): Object to processing based on legitimate interest
• Right to withdraw consent (Art. 7(3)): Withdraw consent for marketing communications at any time

To exercise any of these rights, contact us at privacy@heimpath.com. We will respond within 30 days.

You have the right to lodge a complaint with a data protection supervisory authority. In Germany, you can contact:

Berliner Beauftragte für Datenschutz und Informationsfreiheit
Friedrichstr. 219, 10969 Berlin
www.datenschutz-berlin.de

We may update this Privacy Policy from time to time. We will notify registered users of material changes via email at least 14 days before the changes take effect. The "Last updated" date at the top of this page indicates the most recent revision.

For privacy-related inquiries, please contact us at privacy@heimpath.com.