Privacy policy

Protecting your personal data is important to us. This statement tells you which data we process when operating the Anwalts-Bürger-App, for what purpose and on what legal basis. The General Data Protection Regulation (GDPR) and the German Federal Data Protection Act (BDSG) apply.

1. Controller

Controller within the meaning of Art. 4 No. 7 GDPR is:
Sebastian Niehues, Aalweg 11, 45721 Haltern am See, Germany
Email: hallobustn@gmail.com

2. Principles

We process as little data as possible (data minimisation, Art. 5 GDPR). Large parts of the app can be used without an account. We do not sell data and do not run tracking through advertising networks. There is no facial recognition and no searching for other people.

3. Accessing the website (server logs)

When you access the site, our hosting provider processes technically necessary data (for example IP address, date and time, the address accessed, the amount of data transferred, browser/device type). This serves the secure and stable provision of the service.

Legal basis: Art. 6 (1) (f) GDPR (legitimate interest in a functional, secure website).

4. Account & sign-in

If you create a (free) account, we process your email addressand, depending on the sign-in method, a password (stored encrypted) or the profile data transmitted by Google (name, profile picture, email). Sign-in is possible by email code (passwordless), email/password or via Google. Your sign-in status is stored locally in your browser for session management (see the section „Cookies & local storage“).

Legal basis: Art. 6 (1) (b) GDPR (performance of the usage contract / provision of the account).

5. Your cases („My cases“), deletion requests & evidence

As a signed-in person you can save cases and deletion requests to follow their status. We store the details you enter, for example your description of the problem, company/recipient, amount, deadline, your own notes and the letters prepared in the app (first and follow-up letters). If you upload receipts to the evidence folder, we store these files for you. If a company replies by email to a letter you sent, we assign this reply to your case (see section 6).

All this data is protected by access rules (row level security), so that only you can view it. You can mark cases as done or delete them at any time.

Legal basis: Art. 6 (1) (b) GDPR (performance of the contract).

6. Email: sending in your name & return channel

At your express request we send letters (for example complaints, demands, GDPR requests, follow-up letters) in your name by email to the recipient address you provide. Sending takes place via our domain authenticated for sending; your name appears as the sender, and a copy goes to your own mailbox (as a record). Before each sending you confirm the action individually (consent).

So that the company's reply can be assigned, we set a unique, case-related address on the subdomain antwort.anwalts-buerger-app.deas the „reply-to“ address. If the company replies there, the incoming message (sender, subject, text) is stored assigned to your case, so that you can read it in the app and, if you wish, respond to it. These replies may contain data of the responding body (for example the name/email of a case handler); we process them solely to handle your matter.

Legal basis: Art. 6 (1) (a) GDPR (your consent per sending, revocable at any time for the future) as well as Art. 6 (1) (b) and (f) GDPR (performance of the contract or your legitimate interest in tracking your correspondence in one place).

7. Scam check & letter function

Texts you enter into the scam check or the letter function are processed for evaluation. Where no AI is involved (see section 8), this takes place on our server without passing it to third parties.

Legal basis: Art. 6 (1) (b) GDPR or (a) GDPR.

8. AI-supported functions

Several functions of the app use an AI service to help you faster. This concerns in particular: the reading of photos/letters (text recognition), the classification of the problem you describe and suggesting the right path, the creation of letter and follow-up letter drafts, the evaluation of company replies including a response draft, and the structuring of recognized key data (for example company, amount, deadline). For this, the respective content (your text or the text recognized from a photo) is transmitted for processing to our AI provider Anthropic. The results are always only suggestions and drafts that you check yourself; no binding legal advice takes place.

Legal basis: Art. 6 (1) (b) GDPR (provision of the function you use) or (a) GDPR. Information on transfer to third countries can be found in section 12.

9. Sharing experiences (case library)

You can voluntarily share your experience with a case so that it helps other people. Publication takes place only with your express consent, anonymised and only after an editorial review. We ask you not to provide any names, user identifiers or addresses, and we review the submission before publishing. You can revoke your consent at any time for the future; we will then take the contribution offline.

Legal basis: Art. 6 (1) (a) GDPR (consent).

10. Cookies & local storage

We use no tracking or advertising cookies. For sign-in, a technically necessary entry in the local browser storage (local storage) is used to maintain your session. Without it, signing in is technically not possible.

Legal basis: § 25 (2) TDDDG (strictly necessary) in conjunction with Art. 6 (1) (b) GDPR.

11. Recipients & processors

To provide the service we use carefully selected providers with whom, where necessary, data processing agreements (Art. 28 GDPR) exist:

• Vercel Inc. (340 S Lemon Ave #4133, Walnut, CA 91789, USA), hosting and delivery of the website.
• Supabase, Inc. (USA), sign-in/authentication and database. The data is stored in a data centre in the EU (Frankfurt am Main, Germany).
• Sendinblue GmbH (Brevo) (Köthener Str. 2-3, 10963 Berlin, Germany), sending the emails (system, request and letters sent in your name) as well as receiving the company replies arriving at the case-related reply address.
• Google Ireland Limited(Gordon House, Barrow Street, Dublin 4, Ireland), sign-in via „Sign in with Google“ (only if you use this method).
• Anthropic PBC (San Francisco, USA), AI-supported processing of the content named in section 8 (text recognition, classification, drafts, evaluation).
• Have I Been Pwned (operator: Superlative Enterprises Pty Ltd, Australia), only if you use the optional data-leak check: your previously confirmed email address is transmitted to this service to check whether it has appeared in known data leaks. The check is only carried out for your own address confirmed by code; no results are stored permanently with us.

12. Transfer to third countries

Where providers based outside the EU/EEA (in particular the USA) are used, a transfer only takes place on the basis of suitable safeguards, such as the EU standard contractual clauses (Art. 46 GDPR) and/or a certification under the EU-US Data Privacy Framework (Art. 45 GDPR). Where possible, data is stored within the EU (see database location Frankfurt).

13. Storage period

We store personal data only as long as necessary for the stated purposes or as required by statutory retention periods. Account, case and request data (including stored letters and received replies) is stored until you delete your account or the individual case. Published experience reports remain online anonymised until revoked or removed. Server logs are automatically deleted after a short time.

14. Your rights

Under the GDPR you have in particular the following rights:

• Access to the data stored about you (Art. 15 GDPR)
• Rectification of inaccurate data (Art. 16 GDPR)
• Erasure (Art. 17 GDPR) and restriction of processing (Art. 18 GDPR)
• Data portability (Art. 20 GDPR)
• Objection to processing based on legitimate interests (Art. 21 GDPR)
• Revocation of consent given, with effect for the future (Art. 7 (3) GDPR)

To exercise them, an informal message to the contact address above is sufficient.

15. Right to complain to the supervisory authority

You have the right to complain to a data protection supervisory authority (Art. 77 GDPR). The competent authority for the controller is:

State Commissioner for Data Protection and Freedom of Information North Rhine-Westphalia (LDI NRW), Kavalleriestraße 2-4, 40213 Düsseldorf, www.ldi.nrw.de.

16. No automated decision in individual cases

Solely automated decision-making with legal effect within the meaning of Art. 22 GDPR does not take place. The app creates, partly automatically (for example a prepared follow-up letter when a deadline has expired), only suggestions and drafts. The decision on sending and content is always made by you yourself.

17. Changes to this statement

We adapt this privacy policy when the data processing changes (for example when new functions are introduced). The version published here applies in each case.

As of: 24 June 2026