← Back to home

Privacy policy

Convenience translation: only the German version of this document is legally binding. Highlighted passages are still being finalised.

1. Controller

Nick Seidenberg, Friedrich-Miethe-Weg 10, 50259 Pulheim, Germany, email: webmaster@immocockpit.eu (see legal notice).

2. Overview

ImmoCockpit is a web application with which private landlords and investors manage their properties. We only process the data necessary for operation. There is no advertising, no tracking and no analytics tools; no third-party content (fonts, scripts) is loaded.

3. What data we process

a) Account

Email address, password (only as an Argon2 hash), time of registration, of consent to the terms of use and of the last sign-in, optionally a secret for 2-factor sign-in (encrypted). Legal basis: Art. 6 (1) (b) GDPR (contract).

b) Content you record in the tool

Data on properties, tenants, contracts, payments, loans, contacts and uploaded documents. For your own data the legal basis is Art. 6 (1) (b) GDPR. You process third-party data (e.g. of your tenants) as the controller; we process it on your behalf as a processor under Art. 28 GDPR (see terms of use, section “Data processing”).

All content is stored encrypted with a separate key per account (AES-256-GCM). The server can decrypt it to provide the service; we do not look at it unless you explicitly ask us for help or we are legally obliged to.

c) Credentials for services you connect

Optionally your own API key (Claude or ChatGPT) and the credentials of your email mailbox (for sending reminders). Both are stored encrypted and only used for the functions you trigger.

d) Server logs

When the site is accessed, the web server processes technically necessary data (IP address, time, requested address, browser identifier) to provide the service securely and fend off attacks. Access logs are deleted after 7 days; technical application logs are continuously overwritten (at most approx. 30 MB, usually a few days). Legal basis: Art. 6 (1) (f) GDPR (legitimate interest in security). To limit sign-in attempts, IP address or email address is stored for up to 24 hours.

e) Read-only access for advisers

If you set up read-only access for third parties (e.g. bank or tax advisers), we store the name you assign, the expiry date, the selected permissions and the time and number of accesses; the access link itself is only stored as a check value (hash). The authorised person only sees the data you have shared (with anonymised tenants on request). You are responsible for sharing; you can revoke access at any time.

f) AI usage and billing

For the AI credits we store for each request the time, purpose (e.g. “read documents”), model and usage – not the content of the request or answer unless you save the result yourself. This information is kept as long as your account exists.

g) Beta waiting list

If you join the waiting list on the home page, we store your email address, optionally your name and number of units, as well as the times of sign-up, confirmation and invitation. We send you a confirmation email (double opt-in) and – as soon as a place is available – a personal invitation. The legal basis is your consent (Art. 6 (1) (a) GDPR), which you can withdraw at any time by email to webmaster@immocockpit.eu. We delete unconfirmed entries after 7 days, entries 30 days after your registration and all others after 12 months at the latest.

h) Demo without sign-up

If you start the demo, we create a temporary account without an email address and set the session cookie for it. The demo only contains invented sample data; please do not enter real data there. It is deleted completely when you end it, at the latest after 24 hours. To protect against misuse, your IP address is stored for up to 24 hours (limiting demo starts). Legal basis: Art. 6 (1) (f) GDPR.

i) Cookies and browser storage

We only set technically necessary cookies (§ 25 (2) no. 2 TDDDG): a session cookie so that you stay signed in (expires after 30 days at the latest) and – only if you open read-only access via a link – a guest cookie for that access. No consent is required for this.

The app also stores individual display settings in your browser’s storage (localStorage), e.g. your language or which property groups are expanded or collapsed. This information stays on your device, is not transmitted to us and only serves the function you use yourself (§ 25 (2) no. 2 TDDDG). You can delete it at any time in your browser settings. We do not use cookies or similar techniques for statistics, advertising or tracking – which is why there is no cookie banner.

4. Recipients and service providers

5. Retention period

We store your data as long as your account exists. If you delete your account (Account → “Delete account permanently”), all data, documents and backups are deleted immediately; they disappear from the hosting provider’s server backups after 14 days at the latest. Deleted documents remain in the trash for 30 days, daily backups of your data are kept for 30 days.

6. Your rights

You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20) and objection (Art. 21 GDPR). The quickest way to obtain information and take your data with you is yourself under Account → “Export all data”. You can also lodge a complaint with a data protection supervisory authority, e.g. the authority of your federal state.

7. Security

The connection is encrypted throughout via TLS. Passwords are hashed with Argon2, content is stored encrypted per account, sign-in attempts are limited. Please use your own strong password and 2-factor sign-in.

As of: October 2026