Privacy Policy

The data controller responsible for your personal data is:

Polat GmbH
Gesellschaft mit beschränkter Haftung (GmbH)
Konrad-Wolf-Str. 79
13055 Berlin, Germany
Email: support@dealwise24.com

We have not appointed a formal Data Protection Officer, as this is not required for the scale of our processing. For any privacy question or request, contact us using the details above.

This policy applies to personal data we process through Dealwise24— our website, dashboard, and the property and vehicle report service (the "Service") — regardless of whether you are based in the European Economic Area, the United Kingdom, or elsewhere. Where UK and EU requirements differ, we apply whichever gives you the stronger protection.

We collect the following categories of personal data:

• Account data: name, email address, and a securely hashed password when you register. If you sign in with Google, we receive your name, email address, and profile image from Google instead of a password.
• Report and usage data: the listing URLs you submit, and the property or vehicle details we extract from them (address, price, size, photos, and similar listing attributes), the reports and scores we generate, your saved favorites, and comparisons you create. A listing URL or address you submit may itself be personal data — for example, if it relates to your own home — even though it primarily describes a property or vehicle rather than you.
• Payment and credit data: records of credit purchases (pack purchased, amount, date, status) and your remaining credit balance. We do not receive or store your card number — payments are processed directly by Stripe (see Section 6).
• Communications: emails we send you (e.g. password reset, transactional notices) and any messages you send us for support.
• Technical data: IP address, browser and device information, and session cookies used to keep you signed in and to protect the Service against abuse (see Section 9).
• Audit and security logs: records of security-relevant actions (such as sign-ins and administrative actions) that we keep to protect the Service and investigate misuse.

Under Art. 6 GDPR / UK GDPR, we rely on the following legal bases:

• Performance of a contract (Art. 6(1)(b)): to create your account, generate the reports you request, process credit purchases, and provide customer support.
• Legitimate interests (Art. 6(1)(f)): to keep the Service secure, prevent fraud and abuse (including rate-limiting and bot protection), maintain audit logs, and improve the Service. We balance these interests against your rights and only rely on this basis where our interest is not overridden by your interests or fundamental rights.
• Legal obligation (Art. 6(1)(c)): to keep financial and transaction records for the periods required by German and UK tax and accounting law.
• Consent (Art. 6(1)(a)): where we ask for it separately, for example for optional communications. You may withdraw consent at any time without affecting the lawfulness of processing before withdrawal.

The Service generates automated scores and AI-written recommendations about the property or vehicle listings you submit. This processing is carried out for your own benefit, at your request, to help inform your own decision — it does not produce a legal or similarly significant effect on you as a data subject, and no automated decision is made about you or your eligibility for anything. Article 22 GDPR protections against solely automated decision-making therefore do not apply to this feature, but we explain the scoring methodology within each report and you can request a plain-language explanation of how a given score was produced by contacting us.

We do not sell your personal data. We share it only with service providers who process it on our behalf (processors), or with authorities where the law requires it. Our current processors are:

• Stripe (payment processing) — handles your payment details directly; we never see or store your full card number.
• OpenAI(AI recommendation generation) — receives listing and enrichment data (not your account credentials) to generate the pros, cons, and recommendations in your report. Data sent via OpenAI's API is not used by OpenAI to train their models, per OpenAI's API data usage policy.
• Our email hosting provider (transactional email) — delivers account and password-reset emails from our own mail server on our behalf.
• Cloudinary (image hosting) — stores property and vehicle photos associated with your reports, where applicable.
• BrightData (web-fetching infrastructure) — helps us retrieve listing pages from third-party property and vehicle portals.
• Cloudflare (bot protection) — where enabled, verifies that sign-up and sign-in requests come from a real browser, not a bot.
• Google — only if you choose to sign in with Google.
• Our hosting and database providers, who store the Service's data on our behalf under a data processing agreement.

We may also disclose data where required by law, to enforce our Terms of Service, or to protect the rights, property, or safety of Dealwise24, our users, or the public.

Some of our processors (including OpenAI and, depending on your region, Stripe) are based in or process data in the United States. Where we transfer personal data outside the EEA or UK, we rely on an adequacy decision or on Standard Contractual Clauses (and, for UK transfers, the UK International Data Transfer Addendum) to ensure your data continues to receive an equivalent level of protection. You can request a copy of the relevant safeguard by contacting us.

• Account data: for as long as your account is active, and deleted or anonymized within 30 days of a verified deletion request, unless we must retain it for the periods below.
• Reports and credit-usage data: for as long as your account is active, so you can access your report history.
• Payment and invoicing records: retained for the statutory period required by German and UK tax law (currently up to 10 years for certain accounting records), even after account deletion.
• Audit and security logs: retained for a limited period (typically up to 12 months) to investigate abuse and security incidents.

We use a session cookie to keep you signed in, which is strictly necessary for the Service to function and does not require your consent under Art. 5(3) of the ePrivacy Directive. We do not currently use analytics, advertising, or tracking cookies. If this changes, we will update this policy and request your consent where required before setting any non-essential cookie.

We use industry-standard measures to protect your data, including encryption in transit (HTTPS/TLS), hashed password storage, access controls on our systems, and audit logging of security-relevant actions. No system is completely secure, and we cannot guarantee absolute security; if we become aware of a data breach affecting your personal data, we will notify the relevant supervisory authority and, where required, you, in line with Art. 33–34 GDPR.

Under the GDPR and UK GDPR, you have the right to:

• Access the personal data we hold about you (Art. 15).
• Rectify inaccurate or incomplete data (Art. 16).
• Erase your data in certain circumstances (Art. 17), including by deleting your account.
• Restrict processing in certain circumstances (Art. 18).
• Data portability: receive your data in a structured, machine-readable format (Art. 20).
• Object to processing based on legitimate interests (Art. 21).
• Withdraw consent at any time, where we rely on consent.
• Lodge a complaintwith a supervisory authority — in particular, the data protection authority in your EU member state of residence, or in the UK, the Information Commissioner's Office (ICO, ico.org.uk).

To exercise any of these rights, contact us at support@dealwise24.com. We will respond within one month, as required by Art. 12(3) GDPR.

The Service is not directed at, and is not intended for use by, anyone under 16 years old. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, contact us and we will delete it.

We may update this policy from time to time. If we make material changes, we will notify you by email or through a notice on the Service before the change takes effect. The "Last updated" date at the top of this page always reflects the current version.

For any question about this policy or your personal data, contact us at support@dealwise24.com, or at the postal address in Section 1.