Privacy Policy
Last updated: October 2026 — Datenschutzerklärung auf Deutsch
1. Controller
The data controller responsible for processing your personal data is:
Hendrik Dreesmann
c/o COCENTER, Koppoldstr. 1, 86551 Aichach, Germany
Email: [email protected]
2. Data We Collect
Data you provide directly:
- Email address (required for account creation and transactional emails)
- Name (optional, for personalisation)
- Financial planning inputs (court counts, budgets, timelines), stored in your scenarios
- Feedback messages submitted via the site feedback form, and the address you leave with one if you choose to
When you request quotes or an estimate:
- Your name, email address and phone number, and your company if you give one
- Your project: courts, facility, town, country and postcode, timeline, budget, financing, the services you need, and anything you write in the free-text field
- The model you built in the planner, if you came from it, and the site you pinned on that project
- The record of your consent: when you gave it, which version of the wording you agreed to, and your IP address shortened to /24 (IPv4) or /48 (IPv6)
- The language you filled in the form in, so that we write to you in it
In your projects: the site you pin and its address, the plan's details, the documents you upload and the share links you create.
Email: we keep a copy of the emails we send you and of the emails you send to our addresses, with the delivery events our email provider reports (delivered, opened, clicked, bounced).
Data collected automatically:
- Aggregated, anonymised page-view data via Umami (no IP address stored, no cross-site tracking)
- Anonymised interaction data (clicks, scroll depth, session recordings) via Microsoft Clarity, only with your consent
- Session cookie to keep you signed in
- Server access logs: for every request our web server records the time, the page requested, the response status, the referring page, your browser's user agent, your IP address and the country Cloudflare derives from it. The full IP address is kept only in the server's system log, for at most 30 days. The traffic statistics we keep longer store the IP address shortened (the last block removed: IPv4 to /24, IPv6 to /48), so it no longer identifies a single connection.
Data collected at checkout (by Stripe, our payment processor):
- Payment card details and billing address (processed exclusively by Stripe; we never see raw card data)
3. Legal Basis for Processing
- Contract performance (Art. 6(1)(b) GDPR): account management, delivering the Service, processing payments
- Legitimate interests (Art. 6(1)(f) GDPR): fraud prevention, service security (including detecting scraping and attacks through the server access logs), aggregate analytics to improve the platform
- Legal obligation (Art. 6(1)(c) GDPR): retaining transaction records for tax purposes
- Consent (Art. 6(1)(a) GDPR): functional/A-B test cookies (where opted in); marketing communications (where opted in); passing your quote request to builders or financing providers. You give that consent with the box in the quote form, or by phone or email when we take a request for you, and we record which. You can withdraw it at any time by writing to us or by deleting your account; what a company already received stays with it (section 4).
- Steps you ask for before a contract (Art. 6(1)(b) GDPR): handling your quote request or estimate, and the emails about it
4. Who Receives Your Data
Builders and financing providers who receive a quote request. If you choose supplier quotes, we offer your request to companies listed on Padelnomics whose services, area and project sizes fit it: court builders, and financing providers if you asked for financing. Before a company takes it, it sees a summary without your name or contact details (town, size, budget range, timeline, services). Up to three companies can take it, and each then receives your name, email address, phone number, company and the full request on a project page. The email we send it carries only the link to that page, not your details. From then on each is a separate controller of what it received, under its own privacy policy, and keeps it even if you later delete your account with us. If you named one builder and asked for the request to go only to them, no other company sees it. A request for an estimate only goes to no company.
Service providers who process data for us:
- Hetzner Online GmbH (Gunzenhausen, Germany): hosting of our servers and databases, in data centres in the EU.
- Cloudflare (Cloudflare, Inc., USA): content delivery network and protection against attacks. Every request to padelnomics.io passes through Cloudflare, which processes your IP address to deliver it. Data is transferred under the EU–US Data Privacy Framework and Standard Contractual Clauses. See Cloudflare's Privacy Policy.
- Umami (self-hosted on our own infrastructure): cookieless, privacy-first analytics. No personal data transferred to third parties.
- Stripe (Stripe Payments Europe Limited, Dublin, Ireland; Stripe, Inc., USA): payment processing, subscription management and invoices. Stripe receives card details and billing address directly at checkout; we never see raw card data. See Stripe's Privacy Policy.
- Cloudflare R2 (Cloudflare, Inc., USA): storage for the continuous backup of our application database (accounts, quote requests, projects, emails), kept for up to 12 months so that we can restore it after a failure. Transferred on the same basis as Cloudflare above.
- Resend (resend.com, USA): sending our emails (magic links, receipts, the emails about your request) and receiving the emails sent to our addresses. Data is transferred under Standard Contractual Clauses. See Resend's Privacy Policy.
- Microsoft Clarity (clarity.microsoft.com, USA): heatmaps and session recordings for UX improvement. Only active with your consent (functional cookies). Data is transferred under Standard Contractual Clauses. See Microsoft Privacy Statement.
- Anthropic (Anthropic, PBC, USA): we use Anthropic's AI assistant Claude to read incoming emails and quote requests and to draft replies and analyses. It reads them through our own management interface, and a person checks every draft before anything is sent. Data is transferred under Standard Contractual Clauses. See Anthropic's Privacy Policy.
5. Data Retention
- Account data: retained while your account is active and deleted when you delete it. The account record stays only as the anonymous link that keeps retained invoices attributable.
- Financial scenarios and projects, with their pinned site, documents and share links: deleted with your account; share links stop working at once
- Quote requests: your contact details, place, postcode, free text, planner model and shortened IP address are deleted when you delete your account, and otherwise two years after the request. The figures of the project (size, country, budget range, timeline) are kept without anything that identifies you, for our statistics. A company that took your request keeps what it received (section 4).
- Emails we send you: the content for 1 year, the record that we sent it and its delivery events for 3 years. The IP address and browser our email provider reports for a click are deleted after 30 days. A record of a bounce or complaint is kept so that we do not write to that address again.
- Emails you send us: the content for 2 years, the message itself for 3 years
- The results of the website check we run when a company claims a listing: 180 days
- Records of payment problems (a duplicate or refused payment, a refund): 10 years, like other transaction records
- Backups of the application database: up to 12 months. Data deleted from the service disappears from the backups as they age out.
- Transaction records: retained for 10 years to meet German commercial and tax law obligations (§ 257 HGB, § 147 AO)
- Feedback: retained for up to 2 years for product improvement purposes
- Server access logs with the full IP address: at most 30 days, then deleted automatically
- Traffic statistics with the shortened IP address: kept for as long as they are useful for security and capacity planning
7. Your Rights (GDPR)
Under the GDPR, you have the following rights:
- Access: request a copy of your personal data (Art. 15)
- Rectification: correct inaccurate or incomplete data (Art. 16)
- Erasure: request deletion of your data, subject to legal retention obligations (Art. 17)
- Restriction: restrict processing in certain circumstances (Art. 18)
- Portability: receive your data in a machine-readable format (Art. 20)
- Objection: object to processing based on legitimate interests (Art. 21)
- Withdraw consent: where processing is based on consent, withdraw it at any time without affecting prior lawful processing
To exercise any of these rights, contact us at [email protected]. We will respond within 30 days.
You also have the right to lodge a complaint with your national supervisory authority. In Germany, the competent authority is the Bundesbeauftragte für den Datenschutz und die Informationsfreiheit (BfDI).
8. International Transfers
Stripe is contracted via Stripe Payments Europe Limited (Dublin, Ireland); some Stripe processing occurs at Stripe, Inc. in the USA. Cloudflare (including the R2 backups), Resend, Microsoft Clarity and Anthropic also process data in the USA. All US transfers are protected by Standard Contractual Clauses (SCCs) approved by the European Commission. Umami runs on our own EU-based infrastructure, so no data leaves the EU.
9. Changes to This Policy
We may update this policy periodically. We will notify you of significant changes via email or a prominent notice within the Service. The date at the top of this page reflects the most recent revision.
10. Contact
For privacy inquiries: [email protected]