Privacy Policy

Last updated: August 22, 2026

1. Controller

The controller responsible for data processing in accordance with the General Data Protection Regulation (GDPR) is:

MoveDeal UG (haftungsbeschränkt)
Breslauerstr. 3, 80809 Munich, Germany

Email: contact@movedeal.app

2. Overview

This Privacy Policy informs you about the nature, scope and purpose of the processing of personal data on our MoveDeal platform. We process personal data in accordance with the GDPR and the German Federal Data Protection Act (BDSG).

3. Data Processing Activities

3.1 Website and App Access Logs

Data Processed: IP addresses, device information, timestamps, browser type, operating system

Purpose: Security, platform operation, fraud prevention, troubleshooting

Legal Basis: Art. 6 para. 1 lit. f GDPR (legitimate interest)

Retention Period: 7-90 days, then anonymized or deleted

3.2 User Accounts

Data Processed: Email address, password (hashed), profile data (name, phone number, address), preferences

Purpose: Account management, authentication, provision of platform services

Legal Basis: Art. 6 para. 1 lit. b GDPR (contract performance)

Retention Period: Until account deletion plus legal retention periods (3 years for potential legal claims)

3.3 Move Requests

Data Processed: Pickup and destination addresses, move date, inventory lists, uploaded photos of furniture and items

Purpose: Service provision, move coordination, quote generation by moving companies

Legal Basis: Art. 6 para. 1 lit. b GDPR (contract performance)

Retention Period: 10 years for business records in accordance with German Commercial Code (HGB) and tax regulations

3.4 AI Photo Processing

Data Processed: Uploaded photos, detection results (furniture identification), volume calculations, weight estimates

Purpose: Move planning, automatic volume and weight estimation, quote generation

Legal Basis: Art. 6 para. 1 lit. b GDPR (contract performance)

Data Processor: Python FastAPI AI service (YOLOv8-based furniture detection). The service may be hosted on servers within or outside the EU/EEA. For data transfers outside the EU/EEA, Standard Contractual Clauses (SCCs) are used.

Retention Period: Until move completion plus 1 year for support purposes

3.5 Chat/Messages

Data Processed: Message content, metadata (sender, recipient, timestamp), conversation history

Purpose: Communication between users and moving companies, move coordination

Legal Basis: Art. 6 para. 1 lit. b GDPR (contract performance)

Retention Period: 2-3 years after move completion

3.6 Company Verification/KYB

Data Processed: Uploaded documents (business registration, commercial register extract, ID documents, insurance certificates), verification status

Purpose: Company verification, fraud prevention, legal compliance, ensuring reliability of moving companies

Legal Basis: Art. 6 para. 1 lit. c GDPR (legal obligation) and Art. 6 para. 1 lit. f GDPR (legitimate interest)

Retention Period: 10 years for business records in accordance with German Commercial Code and tax regulations

3.7 Payments (Stripe)

Data Processed: Payment identifiers, payment status, metadata (no raw card data - this is processed by Stripe)

Purpose: Payment processing, payout coordination, billing

Legal Basis: Art. 6 para. 1 lit. b GDPR (contract performance)

Data Processor: Stripe (EU-based, GDPR compliant). Stripe processes payment data in accordance with PCI-DSS standards.

Retention Period: 7-10 years for tax and accounting purposes in accordance with German Commercial Code and Tax Code

3.8 Support Tickets

Data Processed: Customer communications, issue descriptions, solution details

Purpose: Customer support, problem resolution, quality improvement

Legal Basis: Art. 6 para. 1 lit. b GDPR (contract performance) and Art. 6 para. 1 lit. f GDPR (legitimate interest)

Retention Period: 3-5 years after ticket closure

3.9 Analytics/Telemetry

Data Processed: Usage statistics, page views, feature usage, device information (only with consent)

Purpose: Platform improvement, performance monitoring, user experience optimization

Legal Basis: Art. 6 para. 1 lit. a GDPR (consent) - You can revoke your consent at any time via cookie settings

Data Processor: Google Analytics, Vercel Analytics (if used). For more information, please see our Cookie Policy.

Retention Period: According to the settings of the respective analytics providers (typically 14-26 months)

4. Data Recipients

We only share your personal data with third parties if this is legally required, you have consented, or we are authorized to do so to fulfill our contractual obligations. Data recipients may include:

  • Moving companies (partners) to whom we transmit the data required to prepare an offer and perform the move (name, contact details, addresses, goods to be moved, photos, chat messages)
  • Hosting providers (server hosting)
  • Email service providers (email delivery)
  • Payment processors (Stripe)
  • AI service providers (photo processing)
  • Analytics providers (only with consent)

5. Data Transfers Outside the EU/EEA

Some of our service providers may be located outside the EU/EEA. In such cases, we ensure that adequate safeguards in accordance with Art. 44 ff. GDPR are in place, particularly through Standard Contractual Clauses (SCCs) or adequacy decisions by the European Commission.

6. Your Rights

You have the following rights regarding your personal data:

  • Right of access (Art. 15 GDPR): You have the right to obtain information about your stored personal data.
  • Right to rectification (Art. 16 GDPR): You have the right to request the rectification of inaccurate data.
  • Right to erasure (Art. 17 GDPR): You have the right to request the deletion of your data, provided there are no legal retention obligations.
  • Right to restriction (Art. 18 GDPR): You have the right to request the restriction of processing.
  • Data portability (Art. 20 GDPR): You have the right to receive your data in a structured, commonly used format.
  • Right to object (Art. 21 GDPR): You have the right to object to the processing of your data.
  • Revocation of consent: You can revoke your given consent at any time without affecting the lawfulness of processing carried out until the revocation.

To exercise your rights, please contact us at contact@movedeal.app.

7. Right to Lodge a Complaint

You have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your residence, place of work or the place of the alleged infringement, if you believe that the processing of your personal data violates the GDPR.

Competent supervisory authority for Munich:
Bavarian State Office for Data Protection Supervision (BayLDA)
Promenade 18, 91522 Ansbach
Phone: +49 981 53 1300
Email: poststelle@lda.bayern.de
Website: www.lda.bayern.de

8. Cookies

We use cookies and similar technologies on our platform. Detailed information about the cookies we use, their purpose and how you can manage your cookie settings can be found in our Cookie Policy and on our Cookie Settings page.

9. Changes to This Privacy Policy

We reserve the right to update this Privacy Policy from time to time to reflect changes in our practices or for other operational, legal or regulatory reasons. We will notify you of any material changes by posting the new Privacy Policy on this page and updating the last updated date.

10. Contact

If you have any questions about this Privacy Policy, please contact us at:

MoveDeal UG (haftungsbeschränkt)
Breslauerstr. 3, 80809 Munich, Germany

Email: contact@movedeal.app