Privacy Policy

1. Scope

This Privacy Policy applies to personal information we process as the operator of the Platform. It does not cover:

• how Providers handle the information you share with them when you send an inquiry or enter into a rental contract. Providers are independent businesses and are responsible for their own privacy practices;
• how partner websites or apps that display HOPS24 listings through our Partner API collect information on their own sites; their privacy policies apply;
• third-party services you choose to use, such as video platforms or Google sign-in, which have their own privacy policies.

Terms such as "Customer," "Provider," and "Partner API" have the meanings given in our Terms of Service.

2. Personal Information We Collect

Depending on how you use the Platform, we collect the following categories of personal information (the category names follow the CCPA):

• Identifiers: name, email address, phone number (optional), display name, account ID, IP address, and, if you use Google sign-in, your Google account identifier.
• Customer records: ZIP code, city, state or country, company name (if any), and for API customers, billing name and address.
• Commercial information: inquiries, requested event dates and locations, search requests including optional budget, messages, review invitations and reviews, bookings and payment notes that Providers record for their own organization, and for API customers, plan, subscription status, and billing history.
• Internet or other electronic network activity: server log data (IP address, date and time, requested URL, status code, referrer, browser user agent), activity log entries (for example logins and submitted forms in shortened form, without passwords or security tokens), and anonymous product events such as searches.
• Geolocation data: approximate location derived from a ZIP code or city you enter. If you allow your browser to share your location on our home page, your browser's precise location is used to show nearby listings (see Section 4).
• Audio, electronic, or visual information: photos and videos uploaded by Providers for listings, and photos uploaded to shared checklists (for example of a setup location). We remove technical metadata such as location data from uploaded photos and videos.
• Professional or employment-related information (Providers only): business name, contact person, business contact details, delivery area, and documents a Provider voluntarily uploads for verification, such as proof of insurance, a permit or inspection record, or a business license.
• Sensitive personal information: account login credentials (your password is stored only in hashed form) and, if you allow it, precise geolocation. We use sensitive personal information only to provide the services you request, for security, and for other purposes permitted by law, and not to infer characteristics about you.
• Inferences: we do not create personal profiles or inferences about individual users for advertising or similar purposes.

3. Sources of Personal Information

• Directly from you, for example when you register, send an inquiry, post a search request, write a review, or contact us.
• Automatically, from your browser or device when you use the Platform (log data, cookies, and similar technologies; see our Cookie Notice).
• From Providers, for example when a Provider marks your inquiry as a booking or invites you to a shared checklist.
• From Partner API customers, when you submit an inquiry through a partner website or app that displays HOPS24 listings, or through a Provider's website widget or WordPress plugin.
• From Google, if you choose to sign in with Google (name, email address, and account identifier; we request only the "openid," "email," and "profile" scopes).
• From Stripe, for API subscriptions (subscription, invoice, and payment status).
• From publicly available sources, for business contact information of rental companies we contact to invite them to list on HOPS24.

4. How We Use Personal Information

• Accounts: to create and manage your account, authenticate you (including Google sign-in), and provide account features.
• Inquiries and messages: to forward your inquiry and contact details to the Provider you choose, and send you a confirmation. Any further communication takes place directly between you and the Provider by email or phone; it does not run through the Platform and we do not store it. Support staff may view your inquiries only when necessary to handle a complaint, resolve a dispute, or investigate suspected abuse; each access is logged.
• Search requests: to notify Providers whose delivery area matches your ZIP code. Providers see your city, date, budget, and message, but not your name or email address. If no Provider responds within five days, we notify you once.
• Reviews: if you agree when submitting an inquiry, we send you one review invitation by email after the event (only if the Provider marked the inquiry as a booking). We publish your star rating, text, chosen display name, and the event month. Your email address is never published. We do not send reminders, and you can decline using the link in the email.
• Shared checklists: to let you and a Provider coordinate event details. Only you, the Provider, and, if needed for support, our team can see the checklist. You can turn off the reminder sent the day before the event.
• Provider features: to publish listings, show calendars and availability, manage inquiries, and display verification badges after our team reviews uploaded documents. The documents themselves are never made public; we display only the type of document and, where applicable, its expiration date.
• Videos: uploaded videos are converted on our own server, metadata is removed, and the original file is deleted. Videos from YouTube, TikTok, Instagram, or Facebook are embedded only as a placeholder; your browser connects to the video platform only when you click to load the video (YouTube is loaded in privacy-enhanced mode).
• Maps and location search: to convert a ZIP code or place name into coordinates, our server sends only the search term (not your IP address) to the OpenStreetMap Nominatim service. In the Provider area, map tiles are loaded by your browser directly from OpenStreetMap servers. If you allow browser location on our home page, the coordinates are stored in your browser and sent with the request for nearby listings; they may appear in our server and activity logs for the retention periods listed in Section 11.
• Website widgets and WordPress plugin: to deliver listings embedded on Providers' websites and forward inquiries submitted through them. Widgets do not set cookies or use tracking.
• Partner API: to forward inquiries submitted through partner sites and record which partner the inquiry came from; the partner does not learn whether or how the Provider replies. For API customers, to provide, secure, and bill the API, and to send notices about plan activation, failed payments, restrictions, and quota usage (at 80% and 100%).
• Product improvement and market insights: to record limited product events, such as searches (normalized search term or category, country, a two-digit regional area, event month, and number of results). Search events are not linked to your account, session ID, or IP address, and inputs that look like email addresses, phone numbers, or web addresses are discarded. We publish or license only aggregated market information covering groups of at least five searches.
• Provider outreach: to contact rental businesses using business contact information from public sources or conversations, and, with their agreement, to prepare an inactive Provider account that they can activate. If we track which marketing campaign led to a Provider registration, we store only campaign parameters (no click IDs, raw referrers, or IP addresses), and only after successful registration.
• Security and abuse prevention: to protect the Platform and Provider data against scraping, spam, fraud, and password guessing, including rate limiting based on hashed IP addresses and network ranges, and to verify that crawlers claiming to be search engines are genuine.
• Communications: to send transactional and service emails.
• Legal and compliance: to comply with legal obligations, enforce our terms, and protect the rights, property, and safety of our users and others.
• Analytics and advertising: only if you consent (see Section 7).

5. How We Disclose Personal Information

We disclose personal information only as described below:

• Providers: when you send an inquiry, we share your name, email address, phone number (if provided), event details, and message with the Provider you contacted, at your direction. Reviews are visible to the Provider and the public.
• Partner API customers: we share only public listing data of Providers (such as title, description, photos, category, prices, approximate location, availability, average rating, and business display name). We do not share Customers' personal information with partners. Providers who connect their own software, or a service provider they authorize, receive inquiries for their own listings.
• Service providers (processors): companies that process information on our behalf under contract, such as hosting, email delivery, Stripe (API billing), and the other providers listed in Section 15.
• Third parties you interact with: video platforms if you click to load an embedded video, OpenStreetMap when your browser loads map tiles, Google if you use Google sign-in, and, if you consent, Google analytics and advertising services.
• Legal requirements and protection: when we believe disclosure is required by law, subpoena, or court order, or necessary to protect the rights, property, or safety of HOPS24, our users, or others.
• Business transfers: in connection with a merger, acquisition, financing, reorganization, or sale of all or part of our business, subject to this Privacy Policy.
• Aggregated or de-identified information: aggregated market statistics (each group covering at least five searches) that cannot reasonably be linked to you. We may publish or license such information.

In the 12 months preceding the effective date of this Privacy Policy (or, if shorter, since we began offering the Platform in the United States), we have disclosed identifiers, customer records, commercial information, internet activity, geolocation data, and visual information to the categories of recipients above for business purposes.

6. Cookies and Similar Technologies

We use cookies and local storage that are necessary for the Platform to work, such as a session cookie, security tokens, your language choice, your cookie choice, and a saved list of listings stored only in your browser. Optional analytics and advertising technologies are used only with your consent. Details are in our Cookie Notice. The Platform does not load web fonts from third-party services.

7. Analytics and Advertising (Only With Your Consent)

Google Tag Manager and Google analytics or advertising services (for example to measure the performance of our ads) are loaded only if you select "Accept all" in our cookie banner. If you select "Necessary only," or if your browser sends a Global Privacy Control signal, these services are not loaded. When loaded, Google may set cookies and receive information such as your IP address, device information, and pages visited, and may use it for its own purposes under its privacy policy. You can change your choice at any time using the "Cookie settings" link in the footer.

8. Your Privacy Choices: Opt Out of Sale or Sharing

We do not sell personal information for money, and we do not knowingly sell or share the personal information of consumers under 16.

However, if you consent to advertising cookies, information collected by Google advertising tools (such as identifiers and internet activity) may be considered a "sale" or "sharing" for cross-context behavioral advertising, or "targeted advertising," under some state laws. You can opt out at any time:

• Cookie settings: click "Cookie settings" in the footer and choose "Necessary only." This stops the sale or sharing described above in that browser.
• Global Privacy Control (GPC): we treat a GPC signal from your browser as a valid request to opt out of the sale or sharing of your personal information and of targeted advertising for that browser. When we detect GPC, advertising and analytics tags are not loaded, and we do not record product search events. If you are logged in, we will also apply the opt-out to your account where technically feasible.
• Email: send an opt-out request to [privacy email to be announced].

Opting out does not require you to create an account. We will not ask you to reconfirm your choice for at least 12 months unless you change it.

9. Your California Privacy Rights

If you are a California resident, you have the following rights under the CCPA, subject to certain exceptions:

• Right to know and access: to request the categories and specific pieces of personal information we have collected about you, the categories of sources, the business or commercial purposes, and the categories of third parties to whom we disclosed it.
• Right to delete: to request deletion of personal information we collected from you.
• Right to correct: to request correction of inaccurate personal information.
• Right to opt out of sale or sharing: see Your Privacy Choices.
• Right to limit the use of sensitive personal information: we use sensitive personal information (account login credentials and, if you allow it, precise geolocation) only for purposes permitted by the CCPA regulations, such as providing the services you request and ensuring security, and not to infer characteristics about you. We therefore do not offer a separate right to limit.
• Right to non-discrimination: we will not discriminate against you for exercising your rights, for example by denying services or charging different prices. We do not offer financial incentives in exchange for personal information.

How to submit a request: email [privacy email to be announced] or use our contact page. Logged-in users can also edit or delete much of their information directly in their account.

Verification: to protect your information, we will verify your identity before fulfilling a request to know, delete, or correct, usually by confirming control of the email address associated with your account or inquiry. We may ask for additional information if needed, and we will use it only for verification.

Authorized agents: you may use an authorized agent to submit a request. We may require the agent to provide signed written permission from you, and may ask you to verify your identity directly with us, unless the agent holds a valid power of attorney under California law.

Response timelines: we will confirm receipt of a request to know, delete, or correct within 10 business days and respond within 45 calendar days. If we need more time (up to an additional 45 days), we will tell you why. We will act on opt-out requests as soon as feasible and no later than 15 business days.

Retention: the periods for which we keep each category of information are described in Section 11.

Shine the Light: we do not disclose personal information to third parties for their own direct marketing purposes (California Civil Code § 1798.83).

10. Privacy Rights in Other States

Residents of states with comprehensive privacy laws, including Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Iowa, Delaware, Nebraska, New Hampshire, New Jersey, Tennessee, Minnesota, Maryland, Indiana, Kentucky, and Rhode Island, may have some or all of the following rights, depending on their state's law:

• to confirm whether we process their personal information and to access it;
• to correct inaccuracies;
• to delete personal information;
• to obtain a copy in a portable and, where technically feasible, readily usable format (portability);
• to opt out of targeted advertising, the sale of personal information, and profiling in furtherance of decisions that produce legal or similarly significant effects (we do not engage in such profiling);
• in some states, to obtain a list of specific third parties to which we have disclosed personal information.

To exercise these rights, email [privacy email to be announced]. We will respond within the time required by applicable law, generally 45 days, which may be extended where permitted. We do not process sensitive data as defined in these laws except as necessary to provide the services you request and with any consent required by law.

Appeals: if we decline to take action on your request, you may appeal by replying to our decision or emailing [privacy email to be announced] with the subject "Privacy Appeal" within a reasonable time. We will respond to your appeal in writing within the period required by law (generally 45 to 60 days) and explain our decision. If your appeal is denied, you may contact the Attorney General of your state.

11. Data Retention

We keep personal information only as long as necessary for the purposes described in this Privacy Policy, unless a longer period is required or permitted by law. Specific periods include:

• Account data: as long as your account exists, then deleted unless we must retain it by law.
• Inquiries, messages, and booking records: as long as necessary to provide the Platform to the Customer and the Provider, and longer where legal retention obligations apply.
• Server log files: up to 15 days.
• Activity log: page views, searches, and widget and anti-scraping events: 90 days; other entries (such as logins, account changes, and team access): 1 year.
• Login attempts (email address, IP address, time): 90 days.
• Anti-abuse counters (hashed IP address, network range, or email address): 2 days; search engine verification results: up to 2 days.
• Search requests and Provider responses: deleted automatically no later than 6 months after the requested event date; logged-in users can delete them earlier.
• Shared checklists including photos: deleted automatically 6 months after the event date.
• Product search events: raw events up to 13 months; aggregated market statistics up to 25 months.
• Campaign attribution for Provider registrations: up to 13 months after registration.
• Reviews: until you ask us to delete your review or the listing is deleted. Review invitation links expire after 60 days.
• Provider verification documents: until the Provider removes them or the account is deleted.
• Uploaded videos: until the Provider removes the video or the listing; original files are deleted after conversion.
• Partner API: account data, keys (stored only as hashes), domains, webhooks, and usage statistics until the API account is deleted; inquiry deduplication logs and webhook delivery logs: 30 days.
• Invoices and accounting records: as required by German tax and commercial law: invoices and other accounting records for eight years, books and annual financial statements for ten years.

12. Security

We use reasonable administrative, technical, and organizational measures designed to protect personal information, including encrypted connections (TLS), hashed passwords, API keys stored only as cryptographic hashes, access restrictions for staff, and logging of support access to inquiries. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If you believe your account has been compromised, contact info@hops24.de immediately.

13. Children's Privacy

The Platform is intended for adults (18 and older) and is not directed to children under 13. We do not knowingly collect personal information from children under 13, consistent with the Children's Online Privacy Protection Act (COPPA). If we learn that we have collected personal information from a child under 13, we will delete it. If you believe a child has provided us with personal information, contact [privacy email to be announced]. Please do not include children's names or other identifying details about children in inquiries, checklists, photos, or reviews.

14. International Data Transfers

HOPS24 is operated by a company established in Germany, from servers located in Germany (European Union). When you use the Platform from the United States, your personal information is transferred to, stored, and processed in Germany. Some of our service providers may also process information in the United States or other countries. Because we are established in the EU, the EU General Data Protection Regulation and German data protection law also apply to our processing. By using the Platform, you understand that your information will be processed outside your state and country of residence.

15. Service Providers and Third-Party Services

• Hosting provider (servers in Germany) – operates our servers on our behalf.
• Email service provider – sends and receives emails on our behalf.
• Stripe – checkout, subscriptions, invoices, sales tax calculation (Stripe Tax where applicable), and the customer portal for paid Partner API plans. Stripe also processes payment data as an independent business for payment processing, fraud prevention, and its own legal obligations. HOPS24 does not store card numbers or bank account details.
• OpenStreetMap Foundation – Nominatim geocoding (our server sends only the search term) and map tiles in the Provider area (loaded directly by your browser).
• Google – Google sign-in if you choose to use it; Google Tag Manager and analytics or advertising services only with your consent; YouTube embeds only when you click to load a video.
• TikTok and Meta (Instagram, Facebook) – embedded videos only when you click to load them.

Our hosting and email providers act as processors under written contracts that restrict their use of personal information to providing services to us. Each third party's privacy policy applies to its own processing.

16. Do Not Track

Some browsers send a "Do Not Track" (DNT) signal. There is no common industry standard for responding to DNT. When your browser sends a DNT signal, we do not record product search events for our market statistics. We honor Global Privacy Control as described in Section 8. Optional analytics and advertising tools are loaded only with your consent regardless of these signals.

17. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you by email or through the Platform before the changes take effect and will update the effective date. We will obtain your consent where required by law before using personal information in a materially different way than described when it was collected.

18. Contact Us

If you have questions about this Privacy Policy or want to exercise your rights, contact:

Immobackup UG
Immobackup UG, Dönhoffstraße 11, 10318 Berlin, Germany
Privacy email: [privacy email to be announced]

You can also use our contact page.