Privacy Policy

• Legal basis: Art. 6 (1) (f) GDPR (secure, efficient provision).
• Third country: a transfer to the USA is possible; it is safeguarded primarily by the EU-US Data Privacy Framework (DPF) and alternatively by Standard Contractual Clauses (SCC).
• Your account and booking master data, by contrast, is stored in the EU (Supabase, see 4.).

• your cookie/notice choice,
• whether you have closed the notice about the English version of the website, so that it is not shown again,
• your remembered consent for loading external content (e.g. Google Maps), if given,
• a login token, if you log into your customer account – until its technical validity expires, until logout, or until it is cleared by your browser,
• if you request a link via “Forgot password?”, only for the duration of this request (usually a few seconds), a technical verification value without any details about you (PKCE security procedure); if it is left behind, for example because you close the tab beforehand, we delete it the next time one of our pages is opened,
• in session storage, a marker without any details about you if you open an outdated link from an earlier account email, so that we can show you the appropriate notice (it is deleted once the notice has been shown),
• in session storage, a marker without any details about you if part of a page cannot be loaded (for example right after an update of the website); it prevents the page from reloading automatically more than once.

Legal basis: § 25 (2) TDDDG (strictly necessary) or Art. 6 (1) (f) GDPR. As only technically necessary storage takes place and non-essential external embeds such as Google Maps are loaded only after your active click (see 9.), a consent banner is not mandatory. The Smoobu booking widget is embedded on the property pages to process bookings (details under 8.). The existing notice can be re-opened via the link in the footer.

We only link bookings that exist under your email address to your customer account once you have saved a password of your own via a link from our email, thereby confirming that you use this address.

If you do not save a password of your own, we automatically delete the account, together with its profile and settings, 7 days after your first request (daily clean-up run, i.e. after 8 days at the latest), even if you have already opened the link; requesting again does not extend this period. As anyone can enter any email address, you do not need to do anything if you receive such an email without having requested an account.

You cannot change the email address of your customer account yourself; an attempt via the interface of our login service has no effect and only triggers one notification email each, without a link, to the current and to the new address. If you would like the address to be changed (rectification, Art. 16 GDPR), please write to support@sternkopf.design. We only change it after verifying your authorisation, in particular by checking with the current and the new address; if the current address can no longer be reached, the only possible alternative is your reply to our message in the message thread of a booking that you made yourself via your booking-platform account or directly with us and that is already linked to your customer account. We record each change in an internal log without email addresses and message texts (date, customer account, method and result of the check, where applicable booking and booking channel, person who checked), so that we can demonstrate it and detect misuse; retention see 13.

Legal basis: Art. 6 (1) (b) GDPR; for the check before an address change and its log additionally Art. 6 (1) (f) GDPR (protection of customer accounts against misuse, demonstrating the check). Erasure: upon deletion of the account; associated bookings are pseudonymized (see 8. and 13.). If you delete your customer account, we usually also delete newsletter entries under the same email address; sending the newsletter to this address then stops (see 11.). We send account emails (link to set or reset your password, notification of a requested change of email address) via the SMTP server of our email hosting provider futris (FUTRIS Inh. Fabian Eschrich; server location Germany).

• In our customer account we show an overview of your stays (minimal mirror: property, period, status, email for matching). No payment instruments or invoice details are stored; only the booking amount and currency are shown.
• Data retained at Smoobu: even if we delete or de-personalise data in your website account, the underlying booking and invoice data remains at Smoobu insofar as contractual or tax retention obligations apply there.
• Incoming booking events are received via a secured interface (webhook); the raw record is reduced to what is necessary after processing (see 13.).
• Payment: depending on your choice via Smoobu's payment providers (e.g. Stripe/PayPal) or by advance transfer to us. For online payment, payment data is processed directly by the respective payment provider.

Legal basis: Art. 6 (1) (b) or (f) GDPR.

• Special registration form (Federal Registration Act, all properties): The special registration and identification duty under §§ 29, 30 of the German Federal Registration Act (BMG) applies only to foreign guests. They must sign the registration form by hand on the day of arrival and identify themselves with a valid identity document (§ 29 (2) and (3) BMG). The details under § 30 (2) BMG are collected: dates of arrival and departure, surname, first names, date of birth, nationalities, address, number and nationality of accompanying foreign persons and the serial number of the passport or passport substitute. Legal basis: Art. 6 (1) (c) GDPR in conjunction with §§ 29, 30 BMG. Retention: one year from the day of departure, thereafter destruction within three months (§ 30 (4) BMG); we present the registration form to the competent authorities on request.
• Tourist tax and guest card (only our property in Hennersdorf, town of Augustusburg): Under the tourist tax statute of the town of Augustusburg (§ 8, based on § 34 of the Saxon Municipal Charges Act – SächsKAG) we collect for all guests their nationalities, dates of arrival and departure, surnames, first names, the address of the main guest and the guest category (§ 8 (7) of the statute); the guest category depends on age, purpose of travel and the degree of any severe disability. For the age brackets we also ask for dates of birth. Legal basis: Art. 6 (1) (c) GDPR in conjunction with § 8 of the statute and § 34 SächsKAG. If you tell us about a severe disability for a reduction or exemption, Art. 9 (2) (g) GDPR in conjunction with § 22 (1) no. 1 (d) of the German Federal Data Protection Act (BDSG) also applies. Retention of the tourist tax form: one year from the day of arrival, thereafter destruction within three months (§ 8 (2) of the statute).
• Collection: In Hennersdorf, for the municipal tourist-tax and guest-card procedure we use the application of AVS Abrechnungs- und Verwaltungs-Systeme GmbH, Josephsplatz 8, 95444 Bayreuth, provided by the Augustusburg tourist information office. The required guest data is entered by us into AVS via an access-protected user account set up by the tourist information office or – where an interface released for this purpose is used – transmitted to AVS from our booking or reservation system. There, the data is processed to calculate and settle the tourist tax and to produce guest cards. In Hennersdorf we also create the special registration form for foreign guests in the same application; it is printed and signed by hand in accordance with the procedure currently provided by the town of Augustusburg. At our other properties we keep the special registration form on paper. Insofar as an electronic procedure under § 29 (5) BMG confirmed by the relevant municipality is used in the future, identification takes place in accordance with its statutory requirements.

To create a reply, we transmit the previous message history of your booking or enquiry (your messages as well as our replies and automated messages), together with the property reference and minimal stay data (arrival/departure, number of persons, booking channel), via an interface to our processor Anthropic (Anthropic PBC, USA), which generates the reply. We receive reply drafts by email in our mailbox. The system takes the stay data from a copy of our booking data from Smoobu (including name, period, number of persons, property, booking channel and booking notes), which is held in the system's own database at Supabase in the EU data region and deleted one year after departure.

• Data minimisation: name, email address, telephone number and payment data are not passed on as separate data fields. However, details contained in the message history – for example because guests write them themselves or because we address you by name in a reply – may form part of the transmitted data.
• Before transmission to the AI service and in our internal email notifications, we automatically replace access codes for a key box, safe or door (since 18 October 2026) and health information (since 19 October 2026) – for example on allergies, illnesses, medication, pregnancy, a disability, aids such as a wheelchair, or injuries – with placeholders. The detection works with fixed patterns in German and English; information it does not recognise may be transmitted. The message itself remains unchanged in Smoobu. The AI assistant does not ask for health information; regarding a reduction of or exemption from the tourist tax, it only asks whether a stay is work-related.
• Payment data: please do not send us card or bank account details via the messaging systems; the system does not remove such details. Replies about the surcharge for a pet may contain our bank details or PayPal address.
• No automated decision with legal or similarly significant effect (Art. 22 GDPR) takes place.
• Your data is not used to train AI models (contractually excluded).
• Further services involved: Cloudflare (operation of the system and backup), Supabase (the system's own database with the processing log without message texts and the copy of the booking data mentioned above, EU data region), Resend (delivery of the drafts by email) and FUTRIS (our email mailbox, Germany); overview under 14.

Legal basis: Art. 6 (1) (b) GDPR (performance or initiation of the accommodation relationship) or (f) GDPR (legitimate interest in efficient handling of enquiries). Third country: Anthropic, Cloudflare and Resend are US providers. The transfer is safeguarded by Standard Contractual Clauses (SCC) for Anthropic, by the EU-US Data Privacy Framework (DPF) or Standard Contractual Clauses for Resend, and for Cloudflare primarily by the EU-US Data Privacy Framework and alternatively by Standard Contractual Clauses. Retention: see 13.

• Data: the histories are pseudonymized when retrieved: guests' names, email addresses, telephone numbers, IBANs, passwords and street addresses are replaced; other details in the free text, such as names of other persons or health details, may remain. We store the histories, the test cases derived from them and the results locally on a work computer.
• Transfer to Anthropic: for a comparison, the system creates drafts for test cases, which are then assessed by a further call to the AI model; for this purpose we transmit the test cases to Anthropic. From the histories stored so far, we transmitted test cases to Anthropic in two test rounds in October 2026: in the first, cases from the histories pseudonymized as described above; in the second, only an additionally, automatically cleaned test set. For it, a tool removed names of other persons and other identifying free text, codes, payment and health details insofar as it recognised them, and excluded cases with a recognisable remnant; the booking numbers are replaced and the cases are limited to the excerpts needed for the test. Property, booking channel and travel dates remained; this test set, too, is pseudonymized, not anonymous. In addition, we test with invented example cases that contain no information about guests.
• Legal basis: Art. 6 (1) (f) GDPR. Our legitimate interest is to detect errors in new versions before they affect replies to guests; this also protects you from incorrect replies. In doing so, we use the messages for a purpose that is compatible with answering them (Art. 6 (4) GDPR).
• Right to object: you may object to this processing at any time in accordance with Art. 21 GDPR – informally, e.g. by email to support@sternkopf.design or with a short message in the message thread of your booking. We will then no longer use histories of your booking for the test bench and will remove them from existing test data insofar as they can be attributed. We keep a record of your objection.
• Recipients: Anthropic (drafts and evaluation for the test cases). Third country: USA, safeguarded by Standard Contractual Clauses (SCC) as under 10b.
• Retention: histories, test cases and results 12 months from the respective retrieval; we then delete them or replace them with a new retrieval, for which 12 months apply again. The same period applies to the cleaned test set. At Anthropic, the period under 13 applies.

• Publicly visible are: your chosen display name, the month of your stay (month granularity only), the star ratings (overall as well as cleanliness, amenities, communication and location), your free text including its automatic translation and – where available – our public reply. If you do not provide a display name, the review appears as “Verified guest”. No account or booking reference is shown publicly.
• Automatic translation: so the review can be shown bilingually, your free text is translated automatically (German ↔ English). The translation is carried out by our processor Anthropic (Anthropic PBC, USA). This involves a transfer to the USA, safeguarded by Standard Contractual Clauses (SCC). Your data is not used to train AI models.
• Please do not include personal data of third parties (e.g. names, telephone numbers) in the free text or display name. As it is free text, it may nonetheless contain personal data; complete data minimisation cannot be technically guaranteed.
• Review reminder: we currently do not send emails asking you to leave a review. For bookings for which we sent such a reminder in the past, a record of the dispatch remains stored (see 13.).

Legal basis: Art. 6 (1) (b) GDPR for providing the review function in the customer account and for verifying that only actual guests can leave reviews; Art. 6 (1) (f) GDPR for the public display of genuine guest reviews, their translation and the display of our public reply. Submitting a review is voluntary. Storage/erasure: as long as your customer account exists, you can edit your review for up to 90 days after departure and delete it yourself at any time. After deletion of your customer account, you can contact us to have your review reviewed or erased. If you delete your customer account, the review is pseudonymized: the display name and the link to your account are removed (the review is then shown as “Verified guest”), while the review text remains. An internal reference to the underlying booking may persist; this is therefore pseudonymization, not full anonymization. Insofar as processing is based on Art. 6 (1) (f) GDPR, you may object to it in accordance with Art. 21 GDPR. Affected third parties may contact us to have such details reviewed or erased.

Website and customer account (website database, see 4.):

• Booking overview with account: as long as the account exists. Upon deletion of the account, the booking data in our account is pseudonymized (email and account reference removed). As a technical reference to Smoobu remains, this is pseudonymization, not full anonymization.
• Booking without account: erasure 180 days after departure.
• Raw data of incoming booking events: reduced after processing, at the latest after 14 days.
• Contact enquiries: 12 months. Security logs: 12 months. Newsletter consent records (time and text version of consent, withdrawal and, where applicable, deletion of the entry, without email address) and the record of the welcome email: until the end of the third calendar year after the last withdrawal or deletion of the entry, never while a consent is ongoing; they are deleted by the daily clean-up run at the start of the following year (see 11.).
• Incomplete registrations (no password of your own saved): erasure 7 days after the first request, after 8 days at the latest (daily clean-up run; details see 7.).
• Newsletter sign-ups never confirmed: erasure 30 days after signing up, after 31 days at the latest (daily clean-up run, see 11.).
• Newsletter entry with email address: until you unsubscribe; it is deleted when you unsubscribe (see 11.).
• Choice of topics in the newsletter settings of the customer account (see 11.): as long as the account exists; the log of each saved choice: until the end of the third calendar year after you deselected all topics or deleted your customer account.
• Identifiers for abuse prevention (values derived from IP or email addresses using a secret key): after 48 hours at the latest (see 15.).
• Newsletter dispatch records (subject, content, number of recipients, time of dispatch – no recipient list): retained to document newsletters sent, deleted at the latest after 24 months.
• Support requests in the customer account: until deletion of the customer account. Support notifications transmitted by email in the operator mailbox: at the latest 12 months after completion.
• Log of a change of the email address of your customer account (without email addresses, see 7.): until the end of the third calendar year after the change.
• Reviews: until deleted by the guest or upon a legitimate erasure or review request. If the customer account is deleted, the review is pseudonymized; the display name and account link are removed and the review text remains as a review by a “Verified guest”. An internal reference to the underlying booking may persist.
• Record of a review reminder sent in the past (we currently do not send any, see 12a): until deletion or pseudonymization of the associated booking record in accordance with the aforementioned periods.
• Backups of the website database: after an erasure, data may persist in these backups for usually up to 7 days and is permanently deleted upon their expiry.

System for AI-assisted replies (own database, 10b) and test bench (10c):

• Processing log of the system (message and booking number, property, time, status – no message texts): 12 months.
• Copy of the booking data: until one year after departure.
• Emails containing reply drafts and notifications about guest messages in our mailbox: 90 days.
• Test bench: histories, test cases and results 12 months from the respective retrieval (stored locally, see 10c).
• Backups of the system's database: after an erasure, data may persist in these backups for up to 35 days and is permanently deleted upon their expiry.
• At our service providers: according to its own information, Anthropic deletes inputs and outputs as a rule within 30 days, longer only if a violation of its usage policies is suspected (up to two years) or due to legal obligations; according to its own information, Resend stores emails for 30 days.

Registration form and tourist tax (8a):

• Special registration form: one year from the day of departure, thereafter destruction within three months (§ 30 (4) BMG).
• Tourist tax form (Hennersdorf only): one year from the day of arrival, thereafter destruction within three months (§ 8 (2) of the tourist tax statute of the town of Augustusburg).

Stripe, PayPal and hCaptcha are not loaded by us directly but within the Smoobu booking widget. hCaptcha is embedded not by Smoobu but by Stripe as an integrated security / fraud-prevention function (Intuition Machines acting as Stripe's sub-processor in this respect). Depending on the integration, the payment providers may act as Smoobu's sub-processors or as independent controllers/payment service providers; details follow from the respective provider's privacy information and the contract with Smoobu. Data is disclosed to further third parties only insofar as this is legally permissible or required.

The town of Augustusburg is responsible for the municipal tourist-tax and guest-card procedure. AVS Abrechnungs- und Verwaltungs-Systeme GmbH operates the system provided for this purpose as a processor of the town. We collect the required guest data in connection with the accommodation relationship and enter it into the system provided by the town or transmit it via an approved interface. In Hennersdorf we create the special registration form for foreign guests (8a) in the same application.

• to limit the frequency of requests, identifiers derived from your IP address;
• to limit emails to the same address, identifiers derived from the email address entered. This applies to registration (no more than three emails per address and day), the acknowledgement of the contact form (no more than two, see 10.) and the newsletter confirmation email (no more than three, see 11.). Once the limit is reached, we send no further email and do not give separate notice. If our database is disrupted, these limits may exceptionally not apply.

The identifiers are formed using a secret key known only to us (keyed hash procedure), separately for each function of the website (for example the contact form or registration), so that entries of different functions cannot be linked with each other via the identifier; we do not store IP or email addresses in plain text for this purpose. Apart from the identifier we only store the occasion, the time window and the number of requests. The identifiers are cleaned up daily and deleted after 48 hours at the latest.

Legal basis: Art. 6 (1) (f) GDPR (protection of our forms and our email dispatch against misuse).