Privacy Policy (Datenschutz)

1. Controller

Controller: intruct.com
Contact: ijusseen@gmail.com
Website: https://studiwohnkarte.intruct.com

2. What we process

• Account data — email, display name, auth provider (email/password or Google), stored in Supabase when you register or log in.
• Saved listings — listing IDs, titles, prices, addresses you choose to save (Supabase).
• Plus billing — subscription status via Lemon Squeezy (payment details are processed by Lemon Squeezy, not on our servers).
• Technical data — IP address, browser type, pages visited (Vercel Analytics, aggregated; error events in Sentry).
• Functional cookies — session, locale preference, short-lived OAuth state (see section 6).

We do not sell personal data. We do not use advertising trackers or cross-site profiling cookies.

3. Purposes and legal bases

• Provide the map and account features — Art. 6(1)(b) GDPR (contract / pre-contractual steps).
• Plus subscriptions — Art. 6(1)(b) GDPR; payment via Lemon Squeezy as processor.
• Security, abuse prevention, error monitoring — Art. 6(1)(f) GDPR (legitimate interest).
• Aggregated analytics to improve the product — Art. 6(1)(f) GDPR (legitimate interest; privacy-oriented, no marketing profiles).

4. Processors & third parties

• Vercel — hosting (https://studiwohnkarte.intruct.com)
• Supabase— database & authentication (EU/US region per your project settings)
• Google — optional OAuth login (Google Ireland Ltd.)
• Lemon Squeezy— payments & invoices for Plus
• Sentry — error monitoring (may include IP, browser, stack traces)
• Vercel Analytics — privacy-friendly page view statistics

Listing data is fetched from third-party housing sites (willhaben, wg-gesucht, dorm operators). When you open a listing, you leave StudiWohnkarte and their privacy policies apply.

5. Retention

• Account & favourites — until you delete your account.
• Server logs — typically up to 30 days (Vercel).
• Sentry events — per Sentry project retention (default 90 days).
• Lemon Squeezy records — per their policies and tax obligations.

6. Cookies

We use only functional / strictly necessary cookies:

• campus_map_session — keeps you logged in (session).
• locale — remembers EN/DE UI preference (~1 year).
• google_oauth_state — short-lived CSRF protection during Google login.

Vercel Analytics does not use cross-site tracking cookies. If we add optional analytics later, we will ask for consent first.

7. Your rights

You have the right to access, rectify, erase, restrict processing, data portability, and to object (Art. 15–21 GDPR). You may lodge a complaint with the Austrian Data Protection Authority (dsb.gv.at).

Contact ijusseen@gmail.com for any request. We respond within one month.

8. Children

StudiWohnkarte is aimed at university students (typically 18+). We do not knowingly collect data from children under 16.

9. Changes

We may update this policy. Material changes will be noted on this page with a new "Last updated" date.