Privacy Policy

1. Controller

The controller responsible for data processing on this website is: Pixelbaum - Michael Tannenbaum Owner: Michael Tannenbaum Bergstraße 40 53332 Bornheim Germany Email: michael@carculated.com

2. Website Access and Hosting via Vercel

Carculated is hosted by Vercel Inc., 340 S Lemon Ave #4133, Walnut, CA 91789, USA. When you access the website, Vercel processes technically necessary access data so that the website, static files, serverless functions and security features can be delivered.

This access data may include, in particular, IP address, date and time of access, requested URL or file, referrer URL, browser and operating system information, transferred data volume, status codes and technical runtime data. The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest is the reliable, secure and error-free operation of the website.

Vercel may also process data outside the European Union, in particular in the United States, and may use subprocessors. Where required, third-country transfers are protected by appropriate safeguards, in particular standard contractual clauses.

3. Calculator, Comparisons and Local Settings

Calculations generally run in your browser. To make the app usable, Carculated stores certain information locally on your device, in particular the cookie/consent decision, selected language, selected region, calculator mode and calculator parameters, dismissed notices as well as scenarios and settings for comparison mode.

The selected language is stored in the functional carculated_language cookie for up to one year and sent to Carculated with page requests so that the main domain can direct you to the matching language version. The cookie is not used for analytics or advertising. The other locally stored data is not automatically transmitted to us. If you create a result or share link, calculator parameters may be included as URL parameters in that link. Anyone who receives the link or processes it through an external service can see these parameters.

The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest is to reliably provide the calculator, saved settings and comparison features. Where consent is required for individual storage access, processing is based on your consent under Section 25(1) TDDDG and Art. 6(1)(a) GDPR.

4. Server-Side Access Counts and Vercel Web Analytics

We maintain an aggregated server statistic to broadly classify technical requests. It counts document requests by date and path together with aggregated browser, operating system, device type, country and referrer-domain data. URL parameters, raw IP addresses, raw user agents and cookies are not stored. To roughly estimate repeat requests, IP address, user agent and calendar day are converted into a daily technical request signature that is used only in a non-readable estimation counter. It cannot be linked across days and is not proof of a human visitor.

Separately, we count an engaged page view only after a page has been visible for at least ten seconds and a scroll, pointer or keyboard interaction has occurred. Only date, path, country and the external referrer domain are aggregated. This counter uses no visitor identifier, IP/user-agent signature, cookies, local storage or fingerprinting.

Vercel Web Analytics is used without cookies and independently of the selection for external content. According to Vercel, it uses no cookies or permanently recognizable identifiers; a technical visitor hash is renewed daily. Data processed may include the page view, referrer, browser and device information, and country or region. URL parameters and fragments are removed before transmission. Our own product events contain only broad feature categories and no entered vehicle models, prices, mileage or financial amounts.

These measurements are not used for personalized advertising. They are used to improve, secure and economically assess the service. The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest is data-minimizing reach and quality measurement. The measurement does not set or read analytics cookies or persistent user identifiers and is therefore not controlled by the consent setting for external comparison tools. You may object to processing based on this legal basis in accordance with Art. 21 GDPR.

5. Service Worker and Browser Cache

Carculated may register a service worker to store app files locally and deliver the website faster or more reliably. This does not create additional user profiles. You can delete the cache and service worker through your browser settings.

6. Sharing Features and External Platforms

If you use sharing features, Carculated initially only generates a link in your browser. Only when you open an external service such as WhatsApp, X/Twitter, LinkedIn or your email client do you leave Carculated and the respective provider processes data under its own rules.

For dynamic previews, URL parameters and result data may be processed by Vercel Functions to generate a title, description and preview image.

7. Affiliate Links and Partner Programs (Tarifcheck24 and durchblicker.at)

For users whose region is Germany, Carculated offers comparison calculators for car loans and car insurance. These services are provided in cooperation with TARIFCHECK24 GmbH, Zollstraße 11b, 21465 Wentorf bei Hamburg, Germany (Data Controller under GDPR).

If you consent to the use of these external comparison calculators, we embed so-called iFrames (embedded web pages) of TARIFCHECK24 GmbH on our site. For technical reasons, data such as your IP address, browser information, and access time are transmitted to servers of TARIFCHECK24 GmbH or their partners.

Should you enter data into the comparison calculators (e.g. vehicle data or personal details for insurance or loans), this data is stored and processed directly by TARIFCHECK24 GmbH or their partner companies.

We have concluded a Data Processing Agreement (DPA) with TARIFCHECK24 GmbH in accordance with Art. 28 GDPR. This contract ensures that TARIFCHECK24 GmbH processes the data on our behalf and in compliance with the strict requirements of German and European data protection law.

The integration of the Tarifcheck iFrames and the associated data processing takes place exclusively after your prior, explicit consent via our cookie banner or directly before loading the calculator. The legal basis for this processing is Art. 6(1)(a) GDPR.

For users whose region is Austria, Carculated displays labelled partner links to credit and car-insurance comparisons offered by durchblicker GmbH, Salzgries 15, 1010 Vienna, Austria. Carculated loads no banners, images, tracking pixels, scripts or iFrames from durchblicker.at for these links. Calculator values are not added to the partner link. Only when you click the link do you leave Carculated and send the partner and campaign parameters contained in the link to durchblicker.at.

On the website that then opens, durchblicker.at processes data under its own privacy policy and may set an affiliate-tracking cookie. According to its published cookie overview, the DB_PAP_Affiliate_data1 cookie may be stored for up to 365 days. Durchblicker.at is responsible for that processing and for any consent that may be required there.

8. User Accounts and Authentication (Supabase)

If you create a user account on Carculated, we process your email address and a secure password hash to grant you access to your profile and allow for server-side saving of your scenarios and negotiation cases. We also record the date of your registration.

To provide the user accounts and store the associated database records, we use the Backend-as-a-Service provider Supabase (Supabase, Inc., 972 E. California Avenue, Sunnyvale, CA 94086, USA). Supabase operates primarily on AWS cloud infrastructure. Insofar as a data transfer to the USA takes place, it is legally safeguarded by the EU Commission's Standard Contractual Clauses (SCCs).

The legal basis for this processing is Art. 6(1)(b) GDPR, as the data processing is necessary for the performance of the user contract (providing the account). You can irrevocably delete your account at any time in your dashboard. Upon account deletion, all your linked saved scenarios and negotiation cases will be permanently removed from the database.

9. AI-Assisted Offer Analysis

If you use the automatic analysis for a lease, finance or purchase offer, you can upload a PDF or images. For signed-in users, the file is stored briefly in Supabase Storage and then sent once to the paid Google Gemini API (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). Google processes the content to extract offer figures, contract clauses and short evidence snippets in a structured form. According to the terms for paid Gemini API services, this content is not used to train Google's models. Google may, however, retain limited logs for abuse and security monitoring.

The uploaded original is deleted from Carculated storage after the analysis attempt. Personal, contact, address and banking data is removed from extracted free text before display and storage. At most, normalised vehicle and offer facts and redacted evidence snippets limited to 180 characters are retained; no document copy is kept. Technical usage statistics are stored only in aggregate and contain no document text, offer values, IP address or user identifier. Personal-fit details are evaluated locally in the browser and do not trigger another AI request.

Signed-in users can voluntarily save the redacted offer data as a private negotiation case and add revised dealer offers as further versions. We store the confirmed vehicle and contract figures, short redacted evidence snippets, selected negotiation points and calculated differences between versions, but still no original file. The complete case can be deleted from the account at any time.

When another offer version is saved to a negotiation case, we additionally process only coded change types and numeric values to create aggregated negotiation statistics. This statistics dataset contains no document text, dealer name, offer number, contact, address or banking details. Results are published only in aggregate and are not used to make decisions about individuals. You can object to this processing and disable the statistics contribution in the negotiation case at any time; the statistics facts stored for that case are then deleted. The private version history is unaffected and remains until you delete the case or your account.

The legal basis for the offer analysis and the private negotiation case you request is Art. 6(1)(b) GDPR. We process the minimised change data for aggregated negotiation statistics on the basis of our legitimate interests under Art. 6(1)(f) GDPR in providing reliable insights into negotiable offer components and improving our offer review.

10. Forwarding Offers by Email

If you forward a vehicle offer to the Carculated address provided for this purpose, we process the sender address, technical delivery data, subject and message text as well as attached PDF or image files to create the requested report and send you its result link. We prefer the plain-text part of the message; for HTML-only email we reduce the content to visible text. The text is limited and direct links, email addresses, IBANs and international phone numbers are removed before analysis. Links contained in the message are not opened.

The redacted message text and any attachments are sent together once to the Google Gemini API described in section 9, which extracts only structured offer figures and clauses. We use mailbox.org and Resend, Inc. to receive the message and send the transactional reply. Under its published standard retention, Resend retains received email data for up to 30 days. Carculated does not place an additional copy of the original email, its message text or its attachments in the report store. Once the result message has been sent, we remove the sender address from our report store; only a non-reversible hash remains for abuse protection and rate limiting.

The redacted report contains normalised vehicle and contract figures, derived findings and the market position, but no document copy, evidence snippets, dealer, contact, address or banking data. It is available through an opaque, unlisted link for 30 days and can be deleted earlier through that link. Expired reports are removed from the report store by the next daily deletion run. Anyone who receives the link or the result graphic's QR code can view the redacted report. The legal bases are your consent through the active forwarding under Art. 6(1)(a) GDPR and performance of the requested report service under Art. 6(1)(b) GDPR.

11. Model Deal Alerts by Email (Resend)

Signed-in users can activate a deal alert for a specific vehicle model and customer segment. We process the account email address, selected model and segment, consent and confirmation status and timestamps, and the delivery records technically required to prevent duplicate messages. An alert is sent only when our deal assessment finds a significantly better offer for the selected model and segment.

Before activation, we send a time-limited confirmation link (double opt-in). Unconfirmed registrations are deleted after seven days. Every deal email includes an unsubscribe link, and the alert can also be removed from the account. Unsubscribing deletes the alert and its associated local delivery record.

We use Resend, Inc. to deliver these emails. The email address, message content, and required delivery information are transmitted to Resend. We do not add our own open- or click-tracking pixels to deal emails. The legal basis is your consent under Art. 6(1)(a) GDPR; you can withdraw it at any time with future effect.

12. Contact by Email

If you contact us by email, we process the data you provide in order to handle your request and clarify follow-up questions. This may include your email address, the content of your message and communication timestamps. The legal basis is Art. 6(1)(b) GDPR where your request relates to pre-contractual or contractual matters, and otherwise Art. 6(1)(f) GDPR.

13. Your Rights

Subject to the GDPR, you have in particular the right of access, rectification, erasure, restriction of processing, data portability and objection to processing based on Art. 6(1)(f) GDPR. Where processing is based on consent, you can withdraw that consent at any time with effect for the future.

You also have the right to lodge a complaint with a data protection supervisory authority. The competent authority for Pixelbaum - Michael Tannenbaum in North Rhine-Westphalia is the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia.

External content

This choice exclusively controls whether optional Tarifcheck comparison tools are embedded. Ordinary external partner links load no partner content before you click. Cookieless reach measurement uses no persistent visitor identifier and runs independently.

Current selection: No decision yet