Privacy Policy

Ben Fiege CSM UG (haftungsbeschränkt) Ingeborg-Feustel-Str. 7 12629 Berlin Germany Represented by Benjamin Fiege, Managing Director Email: support@onlyhomes.io

This policy explains the processing of personal data when using onlyhomes.io, the OnlyHomes agent web app, public property and share pages, inquiry forms, login and payment features, and related technical services. Personal data is any information relating to an identified or identifiable person.

Depending on how OnlyHomes is used, we process: - Agent account data such as name, company, email address, authentication data, role, and administrator status. - Agent profile data such as logo, website, phone number, contact email, contact person, address, and contact hours. - Property data such as title, type, location, measurements, rooms, year, price, description, links, images, and generated videos. - Usage and billing data such as credits, packages, render jobs, credit usage, Stripe customer and session IDs, payment status, and invoice information. - Communication data such as recipient addresses and delivery information for transactional emails. - Inquiry data such as name, email, phone number, message, property and agent assignment, privacy confirmation, and time of submission. - Share-page performance data such as views, CTA clicks, time, and referring host. Our first-party analytics does not store IP addresses, full referrer URLs, user agents, or device profiles. - Technical data such as server logs, security events, errors, session cookies, and authentication data.

We process data to provide and secure the website and app; register and authenticate accounts; manage property projects; upload and process images; create, store, download, and publish videos and share pages; manage credits, render jobs, payments, invoices, and purchase confirmations; receive and forward inquiries; measure share-page performance; provide support; prevent misuse and fraud; diagnose errors; and comply with legal obligations.

Depending on the operation, processing is based on Article 6(1)(b) GDPR for contracts and pre-contractual steps, Article 6(1)(a) GDPR where consent is requested, Article 6(1)(c) GDPR for legal obligations, and Article 6(1)(f) GDPR for legitimate interests such as secure operation, misuse prevention, troubleshooting, product improvement, and share-page performance measurement. Consent may be withdrawn at any time for the future.

We use the following principal providers: - Vercel Inc. for hosting, delivery, server functions, and technical logs. - Supabase Inc. for authentication, database, storage, and server-side processing. The primary production region is West EU (Ireland), eu-west-1. - Railway Corporation for the video worker and video generation. - Stripe Payments Europe, Limited and affiliated Stripe entities for payments, invoices, payment status, and the customer portal. - Plus Five Five, Inc. (Resend) for transactional email. - Better Stack, Inc. for uptime and operational monitoring. - Photoroom SAS for optional, user-triggered background removal from selected property images. - Cloudflare, Inc. for bot and abuse detection during new registrations through Cloudflare Turnstile. Where required, we conclude data processing agreements under Article 28 GDPR. Transfers outside the EEA rely on an adequacy decision, EU Standard Contractual Clauses, or another lawful safeguard as applicable.

Agents may register with email and password or use an optional Google login. Google may provide the account ID, email address, name, and profile image made available for authentication. OnlyHomes does not receive the Google password. Supabase provides authentication and session management, including strictly necessary session storage. Processing is based on Article 6(1)(b) GDPR and, for security, Article 6(1)(f) GDPR. Google login is optional. Google's privacy policy is available at https://policies.google.com/privacy.

For new registrations, we use Cloudflare Turnstile to distinguish legitimate users from automated access and prevent abusive account creation. Cloudflare may process the IP address, browser and device characteristics, time and duration of the interaction, the requested page, technical security signals, and the verification result. OnlyHomes receives a short-lived verification result, not a user score for advertising. Processing is based on Article 6(1)(f) GDPR and our legitimate interest in secure operation, protecting user accounts and infrastructure, and preventing automated fake registrations. Turnstile is used exclusively for security. Cloudflare privacy information is available at https://www.cloudflare.com/privacypolicy/.

OnlyHomes sells video packages and enabled add-ons as one-time purchases. Stripe directly processes payment details; OnlyHomes does not store complete card or bank data. We receive information needed for the contract and accounting, including customer and checkout session IDs, payment status, product or add-on type, price ID, invoice information, and payment events. We use it to add credits, provide invoices, reconcile payments, and meet retention duties.

Resend delivers transactional messages such as account, invitation, and purchase confirmation emails. It processes the recipient address, subject, message content, sending time, and technical delivery or error data. The bases are Article 6(1)(b), Article 6(1)(c), and Article 6(1)(f) GDPR.

The Railway-hosted video worker processes the images, property and design data, and job data required for a render. Temporary video files and technical logs may be created during processing. The finished video is transferred to our storage and temporary render files are removed after completion. The bases are Article 6(1)(b) and Article 6(1)(f) GDPR.

Only when an agent expressly selects the studio or background-removal feature is the selected image, together with necessary API metadata, sent to Photoroom SAS. Other projects, images, or account data are not required for this operation. Processing is based on Article 6(1)(b) GDPR. No property image is sent to Photoroom when the feature is not used.

Better Stack checks a protected status endpoint to monitor availability and operational health. The endpoint is intended to return only availability, aggregate queue and error states, and worker heartbeats, not customer, inquiry, property, image, video, or payment content. Connection data such as IP address, time, URL, response status, and response time may also be processed. The basis is our legitimate interest in stable and secure operation under Article 6(1)(f) GDPR.

Agents may upload property data and images and use them to generate, store, download, and publish videos and share pages. Share pages may display company, logo, website, phone, contact email, contact person, address, and property information. Agents must have the necessary rights and must not upload unlawfully processed third-party personal data.

When a person submits an inquiry on a share page, we process the entered name, email address, phone number, and message, assign the inquiry to the property and agent, store it, and display it in the agent area. We record the privacy confirmation, time, and wording. The bases may be Article 6(1)(a), Article 6(1)(b), and Article 6(1)(f) GDPR. The named agent receives the inquiry and generally processes it under its own responsibility for subsequent contact; the agent's privacy information also applies to that later use. OnlyHomes processes the inquiry within the platform for technical delivery, security, and evidence.

Our cookie-free first-party analytics records share-page views and CTA clicks using the time, the OnlyHomes path, and the referring host. It does not store the IP address, full referrer URL, user agent, or a device profile. Separate provider security logs are described below. Processing is based on Article 6(1)(f) GDPR for meaningful agent performance information, abuse prevention, and reliable operation.

OnlyHomes uses strictly necessary cookies and similar storage for login sessions, authentication, language settings, security, and core app functions. Storage or access on the user's device that is strictly necessary for a requested service is based on Section 25(2)(2) TDDDG; subsequent personal data processing is governed by the GDPR bases described here. Optional analytics, marketing, or tracking storage will be used only with separate consent where required.

OnlyHomes may connect to TikTok, YouTube, Facebook, and Instagram and publish a selected completed video. Data is sent only after the user has expressly connected an account, selected the destination and settings, and confirmed the individual publication. Depending on the platform, we process account and platform IDs, public profile or channel data, encrypted access and refresh tokens, scopes and expiry, destination, title, description, visibility, advertising and AI labels, provider post or upload IDs, status, errors, and timestamps. We do not receive platform passwords. Processing is based on Article 6(1)(b) GDPR; security and evidence data may additionally be based on Article 6(1)(f) GDPR. For YouTube, OnlyHomes currently requests youtube.readonly and youtube.upload to identify the connected channel and upload user-selected videos. Google API data is not used for advertising, profiling, or sale. OnlyHomes' use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use Requirements: https://developers.google.com/terms/api-services-user-data-policy. The YouTube Terms are at https://www.youtube.com/t/terms and Google's privacy policy at https://policies.google.com/privacy. Connections may be removed in OnlyHomes and revoked with the provider. Google/YouTube access can also be revoked at https://myaccount.google.com/connections. We then delete locally stored authorization tokens unless a mandatory reason prevents this. Existing provider posts remain and must be managed with that provider. Connection data is retained until disconnection, account deletion, or loss of purpose. Publication and status records are retained only as needed for evidence, support, security, or legal duties. TikTok developer terms are at https://www.tiktok.com/legal/page/global/tik-tok-developer-terms-of-service/en; TikTok privacy information at https://www.tiktok.com/legal/page/eea/privacy-policy/en; Meta privacy information at https://www.facebook.com/privacy/policy/.

When the website or app is accessed, providers may process technical access data such as IP address, date and time, requested URL, referrer, browser, operating system, and status code. This is used for delivery, troubleshooting, attack prevention, misuse prevention, and stability under Article 6(1)(f) GDPR.

Recipients may include providers for hosting, database, storage, authentication, payments, email, monitoring, rendering, and optional image processing; the relevant agent when an inquiry is submitted; tax advisers and public authorities where legally required; and authorized internal administrators and support personnel where necessary for operation, security, support, or troubleshooting.

Some providers are established or operate infrastructure outside the EEA, particularly in the United States. Transfers rely on an adequacy decision such as the EU-U.S. Data Privacy Framework where applicable, EU Standard Contractual Clauses, or another lawful safeguard. Depending on the service and configuration, Vercel, Supabase, Railway, Stripe, Resend, Better Stack, Cloudflare, Google/YouTube, TikTok, or Meta may process data outside the EEA. Primary production Supabase data is stored in Ireland, while limited further provider processing may occur elsewhere under the applicable safeguards.

We retain personal data only for as long as required for its purpose or a legal duty. Account, profile, property, image, and video data is generally kept for the duration of the account unless deleted earlier or retention is required. Payment, contract, and invoice records are generally kept for six, eight, or ten years depending on the record type under commercial and tax law. Inquiries are kept while needed for handling, evidence, communication, or legitimate interests. Technical logs are kept only as long as required for security, diagnostics, and operation. Data is deleted or restricted when the purpose ends and no legal or legitimate reason remains.

An email address and authentication data are required for an agent account. Property data and images are required to create property media. Payment data is required for paid packages or add-ons. Contact details are required to submit a useful inquiry. Without the relevant data, the corresponding function cannot be supplied.

OnlyHomes does not currently use automated decision-making within Article 22 GDPR. Technical validation, security checks, inquiry duplicate detection, rendering, and credit processes do not make legally significant decisions about individuals.

Subject to statutory requirements, you have rights of access (Article 15 GDPR), rectification (Article 16), erasure (Article 17), restriction (Article 18), data portability (Article 20), objection to processing based on Article 6(1)(e) or (f) (Article 21), and withdrawal of consent for the future. Contact support@onlyhomes.io. We may request proof of identity to protect your data.

You may complain to a data protection supervisory authority, including the authority for your residence, workplace, or our registered office. The authority for our registered office is: Berlin Commissioner for Data Protection and Freedom of Information Alt-Moabit 59-61 10555 Berlin Germany Email: mailbox@datenschutz-berlin.de Phone: +49 30 13889-0 https://www.datenschutz-berlin.de/

Send questions about privacy, data subject rights, or personal data processing to support@onlyhomes.io.

We may update this policy when legal requirements, technical features, or providers change. The current version is available at https://www.onlyhomes.io/datenschutz.

October 2026