ئەم دەقە یاساییە تەنها بە ئەڵمانی و ئینگلیزی بەردەستە. لەبەر ئەوەی ڕێککەوتنەکەمان بە یاسای ئەڵمانی بەندە، تەنها دەقی ئەڵمانی کاریگەرە، ئینگلیزییەکە وەرگێڕانێکە بۆ ئاسانکاری.

Privacy Policy

Pursuant to Art. 13, 14 GDPR · Last updated: July 2026

1. Data Controller

OA IT Solution · Owner: Omid Amini
Emil-Nohl-Straße 38, 42897 Remscheid, Germany
Email: itsolutionoa@gmail.com

2. Types of Data Processed

  • Master data (name, email address upon registration)
  • Usage data (pages visited, device data, IP address)
  • Content data (texts, photos uploaded by users)
  • Communication data (contact requests by email)

3. Purpose of Processing

  • Provision of the platform and its functions (Art. 6(1)(b) GDPR)
  • Security and abuse prevention (Art. 6(1)(f) GDPR)
  • Improvement of our services (Art. 6(1)(f) GDPR)
  • Legal obligations (Art. 6(1)(c) GDPR)

4. Hosting and Infrastructure

This website is hosted on servers of Hetzner Online GmbH (Germany) and Vercel Inc. (USA). A data processing agreement (DPA) pursuant to Art. 28 GDPR exists with both providers. Hetzner processes data exclusively within the EU. For transfers to Vercel (USA), the EU Commission's Standard Contractual Clauses apply (Art. 46(2)(c) GDPR).

When you access this website, server log files are automatically recorded (IP address, date/time, browser type, operating system, referrer URL). This data is stored for a maximum of 7 days and is not merged with other data sources.

5. Cloudflare

We use Cloudflare, Inc. (USA) as a CDN and for DDoS protection, based on our legitimate interest in secure and uninterrupted provision (Art. 6(1)(f) GDPR). Cloudflare is certified under the EU-US Data Privacy Framework and has concluded a DPA with us.

6. Cookies and Storage

This website stores only technically necessary settings in your browser's local storage: your language preference (rebar-lang) and your cookie choice (rebar-consent). This storage is permitted without consent under § 25(2) TDDDG, as it is strictly necessary to operate the website. No tracking, analytics or advertising cookies are used, and no data is shared with third parties for advertising purposes.

This website is purely presentational — there is no customer sign-in here. We only set a strictly necessary language cookie (rebar-lang) and store your cookie choice. Both areSameSite=Lax, are not used for analytics, and share no data with third parties. Sign-in and account management happen exclusively in theRebar app; the security tokens used there are stored on the device, not via the website. Legal basis: § 25(2) TDDDG (strictly necessary) and Art. 6(1)(b) GDPR.

Via the cookie notice you can choose between “Only necessary” and“Accept all”. As only strictly necessary storage is currently in use, this choice has no effect on data sharing today; however, your decision is stored and will bindingly apply to any future non-essential services (e.g. analytics). You can change your choice at any time by clearing your browser's local storage.

7. Payment Processing (In-App Purchases via Apple & Google)

Paid subscriptions are purchased exclusively as an in-app purchase through the Apple App Store or the Google Play Store. Depending on the platform, the Merchant of Record and contracting party for the checkout is Apple Distribution International Ltd., Hollyhill Industrial Estate, Hollyhill, Cork, Ireland, or Google Commerce Limited, Gordon House, Barrow Street, Dublin 4, Ireland. The respective store processes your payment and billing data (name, email address, chosen payment method) as a controller in its own right, issues the invoice/receipt and remits VAT. We do not receive or store full payment data (e.g. credit card numbers) ourselves; we only learn that a subscription is active. The legal basis is performance of a contract (Art. 6(1)(b) GDPR). Apple and Google are established in Ireland (EU); their privacy policies additionally apply: apple.com/legal/privacy and policies.google.com/privacy.

7a. Error & Stability Monitoring (Sentry)

To detect and fix technical errors we use Sentry(Functional Software, Inc., USA). When an error occurs, technical diagnostic data is transmitted (error message, device type, operating system, app/browser version and, where applicable, a truncated IP address). The legal basis is our legitimate interest in stable and secure operation (Art. 6(1)(f) GDPR). A DPA exists with Sentry; transfers to the USA are based on the EU Commission's Standard Contractual Clauses (Art. 46 GDPR).

7b. AI Assistant “Rebar AI” (Anthropic)

Within the app we offer the optional AI assistant “Rebar AI” that helps you find businesses. When you ask Rebar AI a question, your input together with matching directory content is transmitted to Anthropic PBC (USA) and processed via the Claude API to generate a response. The legal basis is the performance of the contract and our legitimate interest in a useful assistant (Art. 6(1)(b) and (f) GDPR). A data processing agreement (DPA) exists with Anthropic; transfers to the USA are based on the EU Commission's Standard Contractual Clauses (Art. 46 GDPR). Anthropic does not use data submitted via the API to train AI models and retains it only for a limited time for abuse detection. Please do not enter sensitive personal data into the chat. AI answers may contain errors and do not replace professional advice.

7c. Push Notifications

If you consent to push notifications, an anonymous device token is generated and transmitted via Expo (Expo Push, 650 Industries, Inc., USA) and the platforms' push services, Apple Push Notification Service (Apple Inc.) on iOS and Firebase Cloud Messaging (Google Ireland Ltd.) on Android, to deliver relevant notices (e.g. a new review, a reply to a request). The legal basis is your consent (Art. 6(1)(a) GDPR), granted via your device's permission prompt. You can disable push at any time in your device settings; the token is deleted on sign-out.

8. Email Delivery

For transactional email delivery (registration, password reset) we use Resend, Inc. (USA) under a DPA.

8a. Waitlist (Launch Notification)

If you sign up for our waitlist, we process your email address solely to notify you once, when Rebar launches. The legal basis is your explicit consent (Art. 6(1)(a) GDPR), given via the checkbox in the signup form. Contacts are stored with Resend, Inc. (USA) under a DPA. You may withdraw your consent at any time with effect for the future by contacting us at itsolutionoa@gmail.com; we will then delete your address without delay. At the latest, waitlist data is deleted after launch and notification.

9. Registration and User Account

Upon registration we collect your email address and password (stored as a bcrypt hash). Optionally, you may authenticate via Google or Apple Sign-In; these providers transmit only your email address to us. Data is stored for as long as the account exists and is permanently removed within 30 days of deletion.

9a. Mobile App (Additional Processing)

In our mobile app (iOS/Android) we process additional data when you use certain features, in each case only after your explicit permission via the operating system:

  • Location & address: To show businesses on the map and to convert addresses into map coordinates (geocoding) we use your device's map and location services (on iOS, Apple Maps / Apple services). Location access is optional and can be revoked at any time in your system settings.
  • Camera & photos: When you upload photos to your listing, we access your camera or photo library after your permission. Images are stored on our server (Hetzner, Germany) and delivered via Cloudflare.
  • Secure storage: Login tokens are stored encrypted on the device (Expo SecureStore, iOS Keychain / Android Keystore).

The legal basis is performance of a contract or your consent (Art. 6(1)(b) and (a) GDPR). The app contains no advertising trackers and no cross-app tracking. No advertising identifiers (IDFA/AAID) are read; an App Tracking Transparency (ATT) prompt is therefore not required. The only diagnostic component used is Sentry for error analysis (see section 7a) — a first-party service with no advertising purpose.

9b. Overview of Processors Engaged (Art. 28 GDPR)

A data processing agreement (DPA) under Art. 28 GDPR exists with all processors listed below where required. Transfers to third countries (USA) are safeguarded by an adequacy decision (EU-US Data Privacy Framework, Art. 45 GDPR) or Standard Contractual Clauses (Art. 46 GDPR).

ProcessorPurposeLocationThird-country safeguard
Hetzner Online GmbHHosting / servers / databaseGermany (EU)n/a (EU)
Cloudflare, Inc.CDN, DDoS protection, image deliveryUSAEU-US DPF
Apple Distribution International Ltd.App Store payment processing (Merchant of Record)Ireland (EU)—
Google Commerce LimitedGoogle Play payment processing (Merchant of Record)Ireland (EU)—
Functional Software, Inc. (Sentry)Error & stability monitoringUSADPA + SCC
Anthropic PBCAI assistant “Rebar AI”USADPA + SCC
Resend, Inc.Email deliveryUSADPA + SCC
Apple Inc.App Store delivery, “Sign in with Apple”, push (APNs), maps/location (iOS)USAEU-US DPF / SCC
Google LLCPlay Store delivery, Google Sign-In, push (FCM)USAEU-US DPF

We provide a current version of this list and copies of the DPAs on request at itsolutionoa@gmail.com.

10. Storage Period

  • User accounts: until account deletion + 30 days
  • Reviews, comments and listings: until deleted by the user or until account deletion
  • Uploaded media (photos/videos): until the associated content is deleted
  • Block lists: until removed by the user or until account deletion
  • Content reports (moderation): until final processing; thereafter for evidentiary purposes where required
  • Push tokens: until notifications are disabled or until account deletion
  • Error logs (Sentry): max. 90 days
  • Server logs: 7 days
  • Tax-relevant data: 10 years (§ 147 AO)
  • Contact requests: 3 years (limitation period)

11. Your Rights (Art. 15–21 GDPR)

  • Access (Art. 15): Which of your data is being processed?
  • Rectification (Art. 16): Correction of inaccurate data
  • Erasure (Art. 17): "Right to be forgotten"
  • Restriction (Art. 18): Restriction of processing
  • Data portability (Art. 20): Data in a machine-readable format
  • Objection (Art. 21): Against legitimate interests

Please direct requests to: itsolutionoa@gmail.com

12. Right to Lodge a Complaint

You have the right to lodge a complaint with a data protection supervisory authority. The authority responsible for the controller is the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia (LDI NRW), Kavalleriestraße 2–4, 40213 Düsseldorf (www.ldi.nrw.de). You may also contact the authority of your state of residence; an overview is available at www.bfdi.bund.de.

12a. No Automated Decision-Making

No automated decision-making, including profiling, that produces legal effects or similarly significantly affects you within the meaning of Art. 22 GDPR takes place. The AI assistant “Rebar AI” merely supports your search and does not make any legally binding decisions about you.

13. Data Security

All data transmissions are encrypted exclusively via HTTPS/TLS 1.3. Passwords are stored as bcrypt hashes (cost factor 12). Tokens are transmitted in secure, httpOnly cookies or via Expo SecureStore (app).

14. Changes to this Privacy Policy

We reserve the right to amend this privacy policy in the event of changes to the legal situation or our services. The current version is always available at myrebar.app/datenschutz.

Last updated: July 2026