This policy describes which personal data we process when you use athaus.ai, app.athaus.ai or an Athaus interface, for what purpose, on what legal basis, who receives it, and what rights you have. The German version is the authoritative one.
Controller
Andrual Technologies UG (haftungsbeschränkt)
Torstrasse 166, 10115 Berlin, Germany
Email: datenschutz@athaus.ai
Phone: +49 163 240 6165
We have not appointed a data protection officer; we are not required to.
Who is responsible for what
- We are responsible for the website, your account, billing, the search and everything we offer ourselves.
- Data that a provider (an agent, a property manager, an owner) keeps in Athaus about other people is processed by us on their behalf (Art. 28 GDPR). The provider is then the controller, not us. What this means for you is set out below under "If a provider keeps your data in Athaus".
- If you release an enquiry to a provider, they are the controller of the data they receive.
When you visit the website and the app
Servers and logs
A visit technically produces: IP address, time, requested address, browser and device. Vercel delivers the website and the app; the data is kept on our server in Berlin (Google Cloud, region europe-west10). The purposes are operation, security, abuse prevention and debugging; the legal basis is our legitimate interest (Art. 6(1)(f) GDPR). We keep logs only briefly.
Analytics
On athaus.ai we use Vercel Web Analytics. It sets no cookies. A visit is recognised by a value Vercel derives from the request and renews daily; after 24 hours the session is discarded. Recorded are the page viewed, the referring page, country and city, operating system, browser and device type, plus anonymous steps of the sign-in flow (such as: dialog opened, code requested), never your email address. Pages with personal links (report, self-disclosure, booking) are excluded. The legal basis is Art. 6(1)(f) GDPR.
Error logs
Your browser and our server report website errors to Sentry(Functional Software, Inc., USA), in its EU region in Frankfurt (ingest.de.sentry.io). Reported are the error message, the place in the program and the page address, without data from your session; Sentry sees your IP address when receiving the report. The legal basis is Art. 6(1)(f) GDPR.
Cookies and browser storage
We only set what the service needs or what stores a choice you make yourself (§ 25(2) TDDDG). We set no advertising or tracking cookies.
- The session cookie keeps you signed in, for up to seven days after last use.
- Preferences, up to one year each: language (
athaus_lang), side of the app (athaus_profile) and the layout of the app, such as sidebar, columns and sort order. - For one hour, to bring you to the right place after signing in: the chosen side (
athaus_seite), your request (athaus_claim) and a search sentence you typed before signing in (athaus_pending_intent). - In the browser storage on athaus.ai, for three days: name, role, email address and picture of your account, so the website shows you as signed in; and whether you have seen the cookie notice. In the app: drafts until you send them.
Maps
Maps on athaus.ai and in the app come from Google Maps (Google Ireland Limited, Ireland; Google LLC, USA). When a map loads, your browser sends your IP address and the page address to Google. The legal basis is our legitimate interest in showing you where a property is (Art. 6(1)(f) GDPR). Google LLC is certified under the EU-US Data Privacy Framework. We serve fonts ourselves; only the map loads a font from Google.
Account and sign-in
For an account we process your email address, your name, your language and your role; with Google also your profile picture. You sign in with a code we email to you, or with Google. The legal basis is performance of the contract (Art. 6(1)(b) GDPR).
Signing in with Google. We request only the openid, email and profile scopes and receive your email address, name and, if present, your profile picture. Google is a controller in its own right here.
Address check. So that a code arrives and accounts are not created with throwaway addresses, we check whether the domain of your address accepts mail: by DNS lookup and with UserCheck (Issoudun Pte. Ltd., Singapore). Only the part after the @ goes to UserCheck, under standard contractual clauses. The legal basis is Art. 6(1)(f) GDPR.
You can delete your account at any time in the settings.
Entries from the time of the waitlist
There is no waitlist any more, and we no longer accept entries. If you joined it earlier, we keep your email address, the side (searching or offering) and your language for the purpose you consented to: writing to you when Athaus is open for you. The legal basis is your consent (Art. 6(1)(a) GDPR). You can withdraw it at any time by emailing datenschutz@athaus.ai; we then delete the entry.
Valuing a property
For a valuation you enter property type, address, areas and year of construction. We compute a range with our own valuation; for this we query location data and land values for the address from public services, without names. The legal basis is your request (Art. 6(1)(b) GDPR).
If you want the result by email, we send it to the address you give once you have confirmed it through a link. If you want an agent from your region who works with Athaus to contact you, we pass your name, your contact details and the property details to that one agent with your consent (Art. 6(1)(a) GDPR). The agent is then the controller of this data. We do not sell your details. You can withdraw the consent at any time by emailing datenschutz@athaus.ai. Requests that are not confirmed are deleted when the link expires.
If you use Athaus as a provider
Office, plan and billing
We process the details of your office, its members and their roles, and your plan (Art. 6(1)(b) GDPR). We keep plans, entitlements and usage ourselves in our own database; nothing about them goes to third parties. Payment runs through Stripe (Stripe Payments Europe, Ltd., Ireland; Stripe, LLC, USA). We do not see your card details. Stripe holds name, billing address, your VAT ID if given, payments and invoices; for fraud prevention Stripe also acts as a controller in its own right. We keep invoices for ten years (Art. 6(1)(c) GDPR, § 147 German Fiscal Code).
We record who agreed to which version of the terms and the data processing agreement and when, and whether they requested an immediate start, as well as cancellations and withdrawals received through our pages, including the confirmation to you. This is our evidence (Art. 6(1)(c) and (f) GDPR); we keep it for as long as claims may arise from it.
The name from your provider profile is shown publicly on each of your listings, as a commercial provider with the designation real estate agent and a link to your legal notice, as a private provider with a note that you offer privately (Art. 6(1)(b) GDPR). Your phone number and email address are not part of it.
Connecting a calendar
If you connect your Google or Microsoft calendar, we read events of your main calendar (start, end, title, location, attendees, status) so that we offer no viewing at a busy time, and we add booked viewings there. For a private event we only store that the time is busy. At Google we request calendar.events and calendar.freebusy, at Microsoft Calendars.ReadWrite, Calendars.Read, offline_access and User.Read. We store the keys encrypted; if you disconnect, we delete them along with the mirrored events. The legal basis is Art. 6(1)(b) GDPR.
Athaus's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We do not use this data for advertising, do not sell it and do not train general AI models with it.
Connecting a mailbox
If you connect your mailbox at Google (Gmail), we read the emails of the last 30 days and every new one: sender, recipients, subject, date and the text. We do not load attachments, only images embedded in an email so that it displays correctly. Our language model sorts every incoming email (such as enquiry, client, promotion), sums it up in one sentence and drafts a reply for enquiries and client mail. A reply only goes out when you send it yourself, and then from your mailbox. What you read, archive, mark as spam or delete in Athaus then applies in Gmail too, and the other way round; a deleted email goes to the Gmail trash, nothing is deleted permanently there. At Google we request gmail.modify and userinfo.email. We store the keys encrypted; if you disconnect, we revoke them at Google and delete the emails we read. The legal basis is Art. 6(1)(b) GDPR; for the people who write to you, we process the emails on your behalf (data processing agreement).
Here too: Athaus's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We read emails only for the features you see, do not use them for advertising, do not sell them and do not train general AI models with them. People at Athaus do not read them unless you ask us to, it is needed for security, or the law requires it.
Connecting Google Drive
If you connect Google Drive, Athaus opens the Google file picker. We only receive the files you choose there yourself and take them over as an image or PDF where you add them, such as to a property or into the chat; a Google document arrives as a PDF. We have no access to any other file in your Drive. At Google we request drive.file and userinfo.email. We store the keys encrypted; if you disconnect, we revoke them at Google. The legal basis is Art. 6(1)(b) GDPR. Here too, the use adheres to the Google API Services User Data Policy, including the Limited Use requirements.
CRM, interfaces and AI applications
If you connect a CRM (such as onOffice or Propstack), we store the credentials encrypted, read properties, contacts with their consents, search profiles and documents, and write back on your instructions. If you connect an AI application (such as Claude or ChatGPT) through our interface, it receives, after your consent, the data the granted rights allow; its operator is the controller for that. We store which application you connected and when, until you revoke the connection.
Setup
During setup we read your office's website to prefill your profile. You book a setup call through Cal.com (Cal.com, Inc., USA); we pass on your name and email address so you do not have to type them again (Art. 6(1)(b) GDPR).
If you are looking for a property
Anyone searching describes in the chat what they are looking for; this becomes a saved search with location, buy or rent, property type, budget, rooms, area and further wishes. With these details your saved search filters the listings of our providers and shows you new ones that fit, by the same rules for everyone searching. We do not search third-party portals. We store what you write in the chat along with the replies so you can continue the conversation. In the chat, an AI system replies.
Where you provide them, we process details about your household (date of birth, household size, employment, net income, move-in date, details such as a credit report, a guarantee or a housing entitlement certificate). They are optional. The legal basis for all of this is Art. 6(1)(b) GDPR.
When you release an enquiry, we send your details to the provider of the listing: your name, your contact details and the details of your search and household, as far as you have provided them. The provider is the controller of this data; their privacy policy applies. An enquiry goes out only with your release: one by one, or, for a search for a property to buy with auto mode switched on, on your instruction for exactly that search. There is no auto mode for a search for a rental.
If the listing comes from a partner portal, the enquiry goes with your name, your contact details and your message to that partner portal, which forwards it to the provider. The partner portal and the provider are then each controllers in their own right, and the provider replies to you by email.
If you book Such-Pro, we process the same details for it as for a provider plan (section Office, plan and billing): Stripe handles the subscription and the payment, and we keep the plan and usage ourselves in our own database. Such-Pro does not change which data goes to a provider.
If a provider keeps your data in Athaus
This section is for you if a provider keeps you as a contact in Athaus: because you sent them an enquiry (also without an account with us), because they took you over from another system or added you, because you filled in a form on their website, replied to their ad or because they write to you through Athaus. We then process your data on their behalf; the controller is the provider, not us. The provider tells you where your data comes from and on what legal basis.
The provider can send you a link where you may voluntarily give a few details and pick a viewing slot. Any field may stay empty, and there is no field for income, creditworthiness or documents. The link carries a random word in its address; without it the page does not open. Emails we send on behalf of the provider are answered directly to them.
Address your rights to the provider. You may also come to us (datenschutz@athaus.ai); we then pass your request on to them.
AI in Athaus
Texts, replies, reading documents, classifying searches and the chat run on language models of Google Vertex AIin its EU multi-region, for which Google commits to processing within the EU. Under its terms Google does not use the data to train models. If Google's abuse filter detects a breach of its usage rules, Google may keep an input for up to 90 days, within the EU. There is no automated decision with legal effect concerning you (Art. 22 GDPR): the provider decides on an application, and you decide whether an enquiry goes out.
Recipients and processors
These providers process data on our behalf (Art. 28 GDPR):
- Google Cloud EMEA Limited (Ireland): servers, database and files in Berlin, language models in the EU multi-region.
- Vercel Inc. (USA): delivery of website and app, analytics.
- Plus Five Five, Inc. (Resend) (USA): sending email.
- Stripe Payments Europe, Ltd. (Ireland) with Stripe, LLC (USA): payments and invoices.
- Functional Software, Inc. (Sentry) (USA, EU region Frankfurt): website error logs.
- Issoudun Pte. Ltd. (UserCheck) (Singapore): checking the domain of an email address.
Controllers in their own right are: Google for signing in with Google, the calendar and maps, Microsoft for the Outlook calendar, Cal.com for booking a call, the operator of an AI application you connect, and providers and partner portals to whom you release an enquiry. We match addresses with public geo services (Nominatim of the OpenStreetMap Foundation, Photon by komoot, OpenPLZ, the land value services of the German states); only the address is sent, without a name.
Transfers outside the EU
Some recipients are located in the USA or in Singapore. For certified companies in the USA the European Commission's adequacy decision on the EU-US Data Privacy Framework applies (Google, Stripe, Vercel, Sentry, Resend, Microsoft); in addition, and for all others, we agree the Commission's standard contractual clauses (Art. 46(2)(c) GDPR). You can obtain a copy on request.
Retention
- Account, saved searches, conversations, enquiries and replies: as long as your account exists. If you delete it, we delete these with it.
- Data a provider keeps in Athaus: until they delete it or close their office.
- Invoicing and accounting records: until the commercial and tax retention periods expire, usually ten years.
- Consents, cancellations and withdrawals: as evidence for as long as claims may arise, usually three years after the end of the year in which the contract ends.
- Database backups: a few days, then overwritten.
- Log data: short-term, for operation and debugging.
Your rights
You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20) and objection to processing based on legitimate interests (Art. 21 GDPR). Any consent given can be withdrawn at any time with effect for the future.
An email to datenschutz@athaus.ai is enough. You can also delete your account yourself in the settings.
You may lodge a complaint with a supervisory authority. The authority responsible for us is the Berlin Commissioner for Data Protection and Freedom of Information, Alt-Moabit 59-61, 10555 Berlin, Germany.
Obligation to provide data
For an account we need your email address, for a plan the payment details; without them there is no account and no plan. All other details are optional.
Changes to this policy
We update this policy when the service changes. The date above states the current version. For material changes we notify registered users by email. Further details about us are in the imprint.