Controller
The controller within the meaning of the GDPR is the operator named in the Legal Notice. Data protection enquiries should be addressed to datenschutz@sclaro.app.
Overview of processing
We process personal data to the extent necessary to provide a functional platform, handle booking enquiries, fulfil legal obligations and on the basis of legitimate interests or consent given. Legal bases are in particular Art. 6(1) lit. a, b, c and f GDPR.
Registration & login
On registration we process email address, chosen password (hashed), display name and account type (guest/provider). Legal basis: Art. 6(1) lit. b GDPR. Authentication is handled via Supabase Auth.
Google & Apple Sign-In
When signing in via Google or Apple, the respective provider transmits to us name, email address and a unique token. Providers are Google Ireland Ltd. and Apple Distribution International Ltd. Legal basis: Art. 6(1) lit. a (consent) or lit. b GDPR.
Reach measurement
Where enabled, we measure aggregated access figures to improve the platform. No personalised evaluation of surfing behaviour takes place. Legal basis: consent (Art. 6(1) lit. a GDPR).
Push notifications
On request we send push notifications via OneSignal (OneSignal Inc., USA). We transmit a pseudonymous device/browser ID and, if applicable, role/language as tag. You can disable push notifications at any time under /benachrichtigungen or in the browser. Legal basis: consent.
Contact form
When using the contact form we process name, email address, subject and message to handle the enquiry. Legal basis: Art. 6(1) lit. b/f GDPR.
Stripe payment processing
Memberships are processed via Stripe Payments Europe Ltd. Stripe processes payment data (e.g. card details) under its own responsibility. For online payments on booked services, providers use their own Stripe account; Sclaro is not the payee in this respect. Details: stripe.com/privacy.
Maps (Google Maps)
To display places we use Google Maps by Google Ireland Ltd. When map pages are called up, connection data (in particular the IP address) is transmitted to Google. Legal basis: consent or legitimate interest.
Hosting & infrastructure
The platform is operated on Lovable Cloud (Supabase as database, Cloudflare as edge layer). Server logs (IP address, timestamp, URL called up, User-Agent) are processed for security and error diagnostics.
Email delivery (Resend)
Transactional emails (confirmations, booking and newsletter mails) are sent via Resend (Resend Inc., USA, standard contractual clauses). Transmitted are email address, name, language preference and content of the respective email.
Retention periods
- Account data: until deletion of the account.
- Booking and invoice data: up to 10 years (commercial/tax retention).
- Contact enquiries: 24 months.
- Server logs: 14 days.
- Newsletter data: until revocation.
Rights of data subjects
You have the right at any time to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection (Art. 21 GDPR). Consents given may be revoked at any time with effect for the future.
Right to complain & changes
You have the right to lodge a complaint with a data protection supervisory authority. This privacy policy may be adjusted if statutory requirements or platform functions change.