Privacy Policy

The controller responsible for data processing on this platform is:
Frey Systems
Jonas Frey
Ludwig Bauer Straße 5
64367 Mühltal
Germany
Email for privacy-related questions: privacy@frey-one.com

Frey Systems operates a platform that brokers services between customers and independent providers. Where the processing of data differs between customers and providers, this is explicitly pointed out in the following sections.

We process personal data at all times in accordance with the GDPR. For every processing step, we rely on one of the following legal bases:
* Performance of a contract or pre-contractual measures (Art. 6(1)(b) GDPR) – necessary to provide your user account or to process bookings.
* Your explicit consent (Art. 6(1)(a) GDPR) – for example for optional analytics cookies. You may withdraw consent you have given at any time with effect for the future.
* Compliance with a legal obligation (Art. 6(1)(c) GDPR) – for example for the retention of invoice data required under tax law.
* Legitimate interests (Art. 6(1)(f) GDPR) – to ensure platform security and to prevent fraud. In these cases you have a right to object.

Transmission security: To protect your data as effectively as possible, we encrypt all data traffic throughout using SSL/TLS. Our security infrastructure is configured so that all connections up to our systems are fully encrypted and verified.

Recipients of your data: To perform the contract, the customer data strictly necessary to process a booking (e.g. name, contact details and service details) is passed on to the independent provider with whom the service was booked. FreyOne and the respective provider each act as independent controllers for their own area. Where FreyOne issues the invoice for the booked service on behalf of the provider, FreyOne acts in that respect as the provider's processor (Art. 28 GDPR). For providers, the business name, business address, profile texts, images, services, reviews and the legally required information (imprint, e.g. the owner's name, tax or register numbers) are visible to anyone on the public provider profile without logging in; the profile address can also be shared as a QR code.

To operate the platform, we use specialised infrastructure service providers:
* Central hosting & database: Our core systems (application programming interface/API, PostgreSQL database, virus scanning, generation of PDF documents such as invoices, processing of uploaded files and our internal support system) run on servers of Hetzner Online GmbH in a data centre in Germany.
* Website and login (Vercel): The website is delivered via Vercel Inc. (USA). Vercel also runs server-side functions for us through which login, registration and the renewal of your session are handled; in doing so, Vercel processes the data transmitted in each case and your IP address. The transfer to the USA is safeguarded by the EU-US Data Privacy Framework or EU Standard Contractual Clauses.
* Network, security and incoming email (Cloudflare): All requests to our website and our API pass through the network of Cloudflare Inc. (USA). Cloudflare forwards the requests, protects against attacks (firewall, bot protection) and processes your IP address and technical connection data for this purpose. Cloudflare (Email Routing) receives emails sent to our @frey-one.com addresses on our behalf.
* File and cloud storage (Cloudflare R2): Profile and service images, documents (e.g. verification documents, chat attachments, evidence relating to claims), system backups and archived server logs are kept in storage areas with contractually and technically specified EU jurisdiction. Public images (e.g. profile and service images) are delivered via Cloudflare's global network and cached in the process.
* Error monitoring (GlitchTip, self-hosted): If a technical error occurs on our website or in our API, your browser or our server sends an error report to our own error monitoring system "GlitchTip". It runs on our own server of Hetzner Online GmbH in Germany; the connection runs via Cloudflare's network. A report contains the error message, the affected place in the program code, the page accessed without URL parameters, the browser and operating system type, the time and the program version. We do not transmit form entries, cookies, login data or user identifiers; email addresses and IBANs are masked before sending. Your IP address is processed only for the transmission and is not stored in the report. No cookies are set and no information is stored on your device. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in error-free and secure operation).

Server logs: Our servers log technical events so that we can monitor operations, detect attacks and fix errors. These logs may contain your IP address, the time of an access and technical information about your browser and device. We do not write content such as chat messages or payment data to logs. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in secure, stable operation and in error analysis). The logs are deleted automatically:

If we need an entry for longer, for example to investigate a security incident, we keep only that entry until the incident has been resolved.

What we do: When you create a user account, we collect your name, your email address, your password (only as an irreversible hash), your date of birth (age check, at least 18 years), your country and your language. We need your address for invoicing; you provide it at the latest with your first booking. A profile picture is optional. For independent providers, this additionally includes company details, business address, contact details and the owner's date of birth.
Proof of your consent: When you accept the Terms and Conditions and the Privacy Policy, we store the time, version, IP address and browser identifier (user agent). We keep this proof even after an account has been deleted (Art. 7(1) GDPR, Art. 6(1)(c) and (f) GDPR).
Login and account security: For each login session, we store the IP address, browser identifier and expiry time (up to 30 days, or 90 days with "Stay signed in"); we delete expired sessions one day after they expire. We count failed login attempts under an encrypted check value of your email address and delete the counter 24 hours after the last failed attempt. If you use two-factor login, we store the secret required for it or one-time email codes (for at most one day). We keep requests to change your login email address for 90 days as a security record.
Legal basis: Art. 6(1)(b) GDPR (performance of a contract); for account security, Art. 6(1)(f) GDPR.
Retention period: until you delete your user account, unless stated otherwise above and unless statutory retention periods require longer storage.

Our cookie banner has two categories: "Necessary" and "Analytics". "Accept all" and "Necessary only" are given equal weight. You can change or withdraw your choice at any time via the "Change cookie settings" link in the footer.
* Necessary (always active): These cookies and stored values are strictly necessary for the secure operation of the platform:
* `cookie-consent` (1 year): your cookie choice with version, time and a random consent ID, additionally stored as a copy in your browser's local storage;
* `access_token` (15 minutes) and `refresh_token` (30 days, 90 days with "Stay signed in"): your login and its renewal;
* `has_session` (as long as `refresh_token`): a content-free indicator that a login exists, so that pages only renew the session in that case;
* `login_device` (up to 400 days): remembers a device on which you have already logged in successfully, so that you can still log in even if strangers slow down logins to your account by entering wrong passwords;
* `2fa_pending`, `2fa_session` (10 minutes) and `team_2fa_required` (session): secure the login with two-factor authentication;
* `web_theme` (1 year): your design preference; `NEXT_LOCALE` (session): the language you have chosen, once you switch it;
* `cf_clearance` (30 minutes, set by Cloudflare): only after a security check by our network service provider; confirms that you have passed the check.

In your browser's local storage, we additionally store technical helper values that serve operation only: a draft while you create a service (`service-draft`), the waiting time before the confirmation email can be resent (`verify_email_sent_at`) and the calendar view you last chose (`freyone:calendar-view`). In session storage (sessionStorage), which is deleted when you close the tab, we keep your name, your profile picture, your account type, the status of your provider onboarding and the area you last opened, for faster display; while you accept a team or accountant invitation, we also remember the invitation link there, including across signing in (`freyone_invite_token`). The legal basis is § 25(2) no. 2 TDDDG in conjunction with Art. 6(1)(b) or (f) GDPR.
* Analytics (only with consent): If you consent, we use PostHog (PostHog Inc., USA; processing via PostHog's EU region) to analyse how the platform is used – for example at which points bookings or registrations are abandoned – and to improve the platform accordingly. The analysis uses a pseudonymous visitor ID; there is no session recording and no automatic click capture. PostHog stores a visitor ID and your consent status (`ph_…_posthog`, `__ph_opt_in_out_…`, in a cookie and in local storage, 1 year). Likewise only after consent, we load Vercel Web Analytics (without cookies, using an anonymous identifier that changes daily) and Vercel Speed Insights (measurement of loading times). None of these tools is loaded before you consent. If you withdraw your consent, nothing more is recorded and the PostHog values are deleted. The legal basis is your consent (§ 25(1) TDDDG, Art. 6(1)(a) GDPR).
* Record of your cookie consent: So that we can prove that and how you consented, we store every choice made in the banner or in the cookie settings on our server: a random consent ID from your `cookie-consent` cookie, the categories chosen, the banner version, the time, the language and whether the choice was made in the banner or in the settings. We do not store your IP address, browser identifier or user account for this; we therefore cannot assign the entry to an account. The legal basis is Art. 6(1)(c) GDPR in conjunction with Art. 7(1) GDPR (obligation to provide proof). The entries are deleted automatically after 3 years.
* Cloudflare Turnstile (bot protection): To protect our forms for registration, login and password reset against automated abuse, spam and hacking attacks, we use Cloudflare's Turnstile service. Turnstile evaluates purely server-side technical signals from your browser to distinguish humans from bots. No tracking cookies are set and no form inputs are read. The legal basis is our legitimate interest in platform security (Art. 6(1)(f) GDPR).
* Stripe (payment processing and fraud protection): On the pages where you pay or save a payment method, our payment service provider Stripe (see Section 8) embeds its payment form. In doing so, Stripe sets technically necessary cookies (`__stripe_mid`, `__stripe_sid`) to process payments securely and to prevent fraud. These cookies are only set on these pages and are not used for advertising. The legal basis is § 25(2) no. 2 TDDDG and Art. 6(1)(b) and (f) GDPR (performance of a contract and fraud prevention).

What we do: When you contact us by email (e.g. at info@, support@, privacy@ or career@frey-one.com) or via the support function in your account, we store your details in order to process your request and in case of follow-up questions. Cloudflare (Email Routing) receives emails sent to our addresses; our system automatically confirms receipt and forwards the message to the mailbox in which we process it. A request via the support function creates a support ticket with a ticket number ("#S-…") in our internal support system, which runs on our own servers at Hetzner in Germany. You receive our replies in the support chat in your account; there you see the first name of the member of staff who replies to you. If you ask support to join a booking chat, Section 22 applies.
Legal basis: Art. 6(1)(b) GDPR (for contractual enquiries) or Art. 6(1)(f) GDPR (legitimate interest in handling user enquiries).
Retention period: We store your request and the support ticket for as long as is necessary for processing and as proof, and as long as no statutory retention obligations prevent deletion. The support chat in your account remains until your account is deleted (Section 18).

For sending emails, we use two separate, specialised procedures and service providers:
* Transactional emails: System-relevant messages (e.g. booking confirmations, invoices and security notifications) are sent via the Resend service (Resend Labs Inc., USA). The legal basis is performance of a contract (Art. 6(1)(b) GDPR). The transfer is safeguarded by EU Standard Contractual Clauses; Resend carries out the sending via its EU region (Ireland). For every email sent, we log the delivery status (sent, delivered, bounced, spam complaint) with an encrypted check value and a shortened form of your address; we delete this log after 90 days. If an email could not be sent, we automatically retry sending it and delete the job no later than 30 days afterwards. If your address is permanently undeliverable or you have reported an email as spam, we put it on a suppression list so that we do not write to it again; we keep this entry even after an account has been deleted (Art. 6(1)(f), Art. 17(3)(b) GDPR).
* Marketing emails: Where you have actively consented to receiving marketing and informational emails in your account settings, these are sent via the Mailjet service (operated by Sinch Germany GmbH, Germany). The legal basis is your consent (Art. 6(1)(a) GDPR). You may withdraw this consent at any time directly in your profile settings or via the unsubscribe link included in every email. If you unsubscribe via the link, your consent is automatically and immediately deactivated in our system database, so that sending stops. The same applies to promotional messages within the app (notifications), to which you can consent separately.

What we do: Payments are processed via the payment service provider Stripe (Stripe Payments Europe Ltd., Ireland). To ensure the highest level of security, your complete payment data (such as credit card numbers, CVV or IBAN) is entered directly at Stripe via a secure interface. Our own servers never store complete payment data. We only record a reference ID assigned by Stripe as well as masked display data (for cards, the card type, last four digits and expiry date; for SEPA Direct Debit, the last four digits of the IBAN and the bank code). If the appointment of a booking is more than 14 days in the future, your payment method is saved at Stripe for a later charge (mandate or authorisation for a merchant-initiated payment) and is only charged shortly before the appointment. For this purpose, we store the Stripe reference of the payment method, the scheduled charge date and the status and any error messages of the charge attempts. The legal basis is Art. 6(1)(b) GDPR (performance of a contract); like the other booking and payment data, the data is deleted in accordance with the statutory retention periods (§ 147 AO, § 257 HGB).
Deposit: If a service provides for a deposit, nothing is reserved for it. For the deposit, we store the Stripe reference of your payment method (card, Link or SEPA Direct Debit); if you paid for the booking with a payment method that cannot be charged again later (e.g. Klarna), you save a card or a SEPA mandate for this purpose. This payment method is only charged if a damage claim by the provider is deemed approved (clause 4.3 of the User Terms and Conditions), and at most up to the amount of the deposit.
Other payment methods: Depending on the booking, Stripe offers further payment methods, e.g. Apple Pay, Google Pay, Link or Klarna. If you choose such a payment method, the respective provider (e.g. Apple, Google, Stripe for Link, Klarna Bank AB, Sweden) additionally processes your data under its own responsibility in accordance with its own privacy policy; Klarna may check your identity and creditworthiness in the process.
Third-country transfer: The parent company Stripe Inc. is based in the USA; the data exchange is governed by a data processing agreement including EU Standard Contractual Clauses.

*(Applies exclusively to independent providers)*
What we do: Payouts to providers are processed via the Stripe Connect system. Onboarding, the legally required identity verification (KYC) and the management of the bank details take place entirely on systems hosted by Stripe. FreyOne never has access to the provider's IBAN or bank details at any time and does not store them. We only receive an account-linking ID from Stripe as well as status notifications regarding the release of payouts. So that you do not have to enter your details at Stripe twice, when your Stripe account is created we transmit the details already stored with us (name or company name, legal form, address, date of birth of the owner or representative, business email address and telephone number, for companies the tax and register numbers, a short description of your offering and the link to your public profile) to Stripe; Stripe asks you to confirm them in its own onboarding.
Legal basis: Art. 6(1)(b) GDPR (performance of a contract).

What we do: To show you suitable providers near you in a radius search, we process location data:
* Device-based location: When you use the "Current location" feature, we request your device's GPS location via the browser with your express permission. This request is handled purely locally; no data is transmitted to external map services in the process.
* HERE Technologies (geocoding): To convert addresses into map coordinates, we use the service of HERE Global B.V. (Netherlands). For this purpose, our server transmits the address, but not your IP address, to HERE and receives coordinates and the federal state in return. This concerns:
* the business address of providers when it is saved during registration as a provider or later in the profile. We need the coordinates for the radius search and for the location shown in the profile.
* the address in your user profile when you save it and no coordinates exist yet.

We do not transmit the service address that you enter for a booking with travel to HERE: providers charge travel as a fixed flat fee, without a distance. We do not currently use automatic address completion while you type. We store the coordinates together with the address. The legal basis is Art. 6(1)(b) GDPR (provision of the radius search), and for providers' business addresses additionally Art. 6(1)(f) GDPR (discoverability on the platform). Where HERE processes data outside the EU, this is safeguarded by EU Standard Contractual Clauses.
* Map displays: External map services (such as Google Maps or Apple Maps) are not currently actively integrated.
Legal basis: Art. 6(1)(b) GDPR (performance of a contract to carry out the provider search).

What we do: To offer a multilingual platform, we use the automated translation technology of DeepL SE (Germany). Only the public content created by providers (service titles and descriptions, variants, add-ons, profile texts) is transmitted to DeepL in order to translate it between German and English.
Important protection of your privacy: At no time are personal profile or account data of customers or personal chat messages transmitted via this interface. We currently use DeepL's free interface (DeepL API Free). For this interface there is no contractual commitment that the transmitted texts are deleted immediately after translation and are not used to improve the translation models; DeepL processes the texts in accordance with its own terms. For this reason, we only transmit texts that are publicly shown on the platform anyway.
Legal basis: Art. 6(1)(f) GDPR (legitimate interest in providing a multilingual platform). To provide its services, DeepL uses, among other things, European cloud infrastructure (AWS).

*(Applies exclusively to independent providers, entirely voluntary)*
What we do: Providers can connect their Google, Microsoft or Apple iCloud calendar with the platform to avoid scheduling conflicts. Confirmed platform bookings are automatically entered as appointments in the external calendar. The following are transmitted: the title of the booked service, date, time or period, the customer's name, the booked items (e.g. variant, quantity, add-ons), the type of service location including the place (for services at the customer's premises or delivery, the address provided by the customer) and the customer's notes on the booking – no payment data and no chat histories. Providers can also subscribe to their bookings via a personal, secret calendar link (iCal); anyone who knows this link can read the appointments. We store the access credentials for the connected calendars in encrypted form. An optional availability check examines external calendars purely on a binary basis for blocked times (free/busy); the content or titles of your private third-party appointments are never read or stored by our systems. When the iCloud calendar synchronisation is used, data is transmitted to Apple Inc. (One Apple Park Way, Cupertino, CA 95014, USA). Apple's privacy policy applies.
Legal basis: Art. 6(1)(b) GDPR (performance of a contract at the provider's express request).

*(Applies exclusively to independent providers)*
What we do: To verify the trade-law legitimacy of providers on our marketplace, we require proof of a business registration or comparable documents before activation; if providers later change verified details such as the company name, address or register number, we require one supporting document per changed detail. These documents are stored in a specially secured, encrypted storage area.
Retention period & deletion:
* If a verification application is rejected, the uploaded documents are deleted immediately and completely.
* If verification is successful, the documents remain in the system for as long as the provider status is active. If the account is deleted completely, they are deleted promptly. If only the business profile is closed, we continue to keep the documents securely for as long as the user account exists.

What we do: Every file uploaded to our platform (e.g. profile pictures, service photos, verification documents or chat attachments) undergoes an automated check for viruses and malware before it is finally stored.
Infrastructure: This security scan is carried out entirely locally on our own server infrastructure. The files are never transmitted to external security or cloud scanning services for this purpose.
Legal basis: Art. 6(1)(f) GDPR (legitimate interest in ensuring platform security and protecting all users' devices from malware).

*(Applies exclusively to independent providers)*
What we do: Providers can grant access to their business account to employees (from the Pro plan, up to 5 team members with full access or read-only access) or to an external tax adviser or accountant (Enterprise plan, read-only access to invoices, payouts and tax exports). For this purpose, we process the email address of the invited person, an optional display name and the assigned role. To document legal compliance, we also log the timestamp and IP address when the invited user accepts the platform terms.
Activity log: Changes that a team member makes to bookings and calendar blocked times on behalf of the business, as well as the inviting, changing, deactivating and resetting of access, are recorded in the business's activity log; we do not log logins there. On the Enterprise plan, the owner can view the log. We delete all entries after 2 years.
Management and deactivation: Access is managed exclusively by the owner: they can require and reset two-factor login and deactivate access. Deactivation deletes the team access; messages that the member wrote on behalf of the business are kept as messages of the business. The login is only deleted if it was created with the invitation; a pre-existing own account remains. If a member with a login created via invitation has their own open bookings as a customer, it remains as a customer-only account until these have been completed. The member and the owner are informed by email.
Legal basis: Art. 6(1)(b) GDPR (performance of a contract) and Art. 6(1)(c) GDPR (compliance with statutory documentation obligations).

Inviting team members and tax advisers
If a provider invites a person to their team or as their tax adviser, we process the email address entered by the provider and the displayed name (alias) of the invited person. We use them to send that person an invitation email with a personal link. The link is valid for 48 hours. We only store a check value (hash), not the link itself.
The legal basis is the provider's legitimate interest and our legitimate interest in collaboration within the team (Art. 6(1)(f) GDPR). If the person accepts the invitation, the legal basis is the performance of the user agreement (Art. 6(1)(b) GDPR).
If the invitation is not accepted, we delete the data as soon as the provider withdraws it, but no later than 30 days after the link has expired.
Sending, resending and withdrawing an invitation are recorded in the team's activity log, including the email address. We also delete these entries after 2 years. If a tax adviser record is kept as proof after an account has been deleted, we delete it after 2 years.

What we do: For quality assurance and to help customers make decisions, we publish reviews. Only customers whose booking has been completed can submit a review. You choose yourself how you are displayed: first name with the initial of your surname and profile picture (e.g. "Max M."), first name only, or "Anonymous". To protect providers' privacy, no real-time online status is recorded. Instead, our systems calculate a purely retrospective, aggregated and rounded response time (e.g. "usually responds within 2 hrs") from past conversations.
Legal basis: Art. 6(1)(f) GDPR (legitimate interest in the marketplace's quality assurance).
Behaviour on account deletion: If you delete your user account, the reviews you have submitted are fully anonymised. The link to your personal account is irrevocably removed; only the review text remains and is shown as "Anonymous", as the reviews can no longer be traced back to you.

What we do: To protect the integrity of the marketplace and to prevent the re-registration of persons who have already been permanently banned, our server generates an irreversible cryptographic check value (SHA-256 hash) at registration. This is based exclusively on metadata that is transmitted server-side in any case: the characteristics of your browser and operating system, your language setting and the first three blocks of your IP address (the full IP address is truncated and not used).
Use and storage: The check value is stored together with your account and deleted with it. Only if an account is permanently banned do we transfer its check value to an internal security list for the duration of the ban. When a new registration takes place, we compare the check value against this list. A match does not automatically lead to rejection: the account is flagged and reviewed manually by our staff; for providers, activation only takes place after this review. No persistent tracking cookies are set on your device for this purpose and no behavioural profiles are created.
Legal basis: Art. 6(1)(f) GDPR (legitimate interest in fraud prevention and platform security).

When you initiate the deletion of your account, our systems carry out an automated clean-up:
* Your profile and access data are completely and permanently deleted.
* All uploaded media (profile pictures, gallery photos, verification documents) are removed entirely from cloud storage.
* Your reviews are fully anonymised (see Section 16).
* Your private chat messages are anonymised (the link to the sender is deleted and the text content is overwritten with a standardised placeholder). Messages that you wrote as a team member on behalf of a business are kept as the business's commercial correspondence (§ 257 HGB); your personal name is removed and replaced with the name of the business.

Exception for statutory retention obligations: Due to statutory requirements (§ 147 of the German Fiscal Code, Abgabenordnung), we must retain invoices, tax-relevant accounting records and booking records for 10 years. Contracts and business correspondence are retained for 6 years (§ 257 of the German Commercial Code, HGB). During these periods, the data is blocked for any other use and deleted once the period has expired.

Booking records: For your bookings, we retain the information required as proof (booked service, appointment, price, service location, payments) for the duration of the statutory periods. The link to your account, your name and your contact details in the booking, as well as your own free texts (notes, answers to the provider's questions), are removed. Invoices remain unchanged – that is, with name and billing address – because they may not be altered afterwards; only your email address is removed from them.

What is also kept: the proof of your consent to the Terms and Conditions and the Privacy Policy (Section 4), an entry on the suppression list for undeliverable email addresses (Section 7), the log of support access to chats (Section 22), cases concerning chargebacks and outstanding membership fees including the letters sent (Section 23), and moderation cases without your name (Section 24). If your provider account was banned, the check value under Section 17 remains on the security list for the duration of the ban.

You can request a complete export of the personal data stored about you at any time in your account settings. The system then automatically generates a readable report as a PDF and a machine-readable JSON file containing all data (compressed for large amounts of data), plus any verification documents on file, and sends everything to you by email. To prevent abusive overloading of the system, this feature is limited to a maximum of one request within 30 days.

* Consumer consent: For services that are performed immediately at your request, we log a legally required timestamp as proof that you expressly agreed to the early commencement of performance and the associated expiry of the statutory right of withdrawal (§ 356(4) BGB).
* Business declaration: If, when making a booking, you declare that you are acting as a business user (B2B), we store this declaration together with your company name as proof that the consumer right of withdrawal does not apply.
Legal basis: Art. 6(1)(c) GDPR (compliance with a statutory documentation obligation).

What we do: If you apply for vacancies with us (currently by email to career@frey-one.com), we process your application documents exclusively to carry out the selection process.
Legal basis: Art. 6(1)(b) GDPR (pre-contractual measures).
Retention period: In the event of a rejection, your documents are deleted in compliance with data protection law within a maximum of 6 months, unless you have expressly consented to longer storage for inclusion in our talent pool. Section 6 applies to the receipt of emails.

What we do: For a booking, we process the booked service (including variant, quantity, add-ons), the appointment or preferred date, for services without an appointment the delivery period and the time at which the provider marks the delivery as delivered, the service location or delivery address (your address only if you choose "Come to my home" or "Have it delivered", or if the provider only provides the service in this way), the price, your billing address, your notes and your answers to the provider's questions. The provider's questions and your answers appear in the booking chat. You receive your booking confirmation together with the Terms and Conditions and the withdrawal notice or the information on the right of withdrawal as a PDF by email, and your invoice likewise as a PDF by email; both are also available in your account. We remind you and the provider by email or in the app of appointments (about 24 hours and 1 hour beforehand), outstanding payments and deadlines; for services without an appointment, we remind the provider on the last day of the delivery period and inform you when the provider has marked the delivery as delivered.
Chat: We store messages between you and the provider in encrypted form. The chat can be written in while a booking is ongoing; afterwards it is read-only. If one party asks FreyOne support into the chat, it becomes a three-way chat with "FreyOne Support" until the support ticket is closed; support then leaves the chat and no longer has access. Our support only reads a chat if there is a reason to do so – a support ticket, a request by a party for support in the chat, an ongoing chargeback case concerning the booking or a reported review – and logs every such access. This log contains no message content and is part of your data export.
Legal basis: Art. 6(1)(b) GDPR (performance of a contract); support access and the log, Art. 6(1)(f) GDPR (resolution of disputes, proof).
Retention period: Booking and invoice data in accordance with the statutory periods, chat messages until the account is deleted (in each case Section 18).

What we do: If a payment for a booking is reversed (card chargeback or returned direct debit), we open a case. For this purpose, we process the booking, amounts and evidence submitted by the provider or by you; in the case of a card chargeback, we transmit the evidence to Stripe and, via Stripe, to the bank or card company. FreyOne does not send dunning notices for claims arising from bookings; the provider contacts you directly about them. If a provider reverses a membership fee (card chargeback or returned direct debit), we additionally process the name, address and email address, the amounts and the history of payment reminders and dunning notices; we send these as a PDF by email with a personal payment link. If such a claim remains outstanding after the final dunning notice, it may be passed to a debt collection agency or enforced in court; a member of staff decides this on a case-by-case basis.
Legal basis: Art. 6(1)(b) and (f) GDPR (handling of payment disputes and enforcement of claims).
Retention period: We retain these cases and the letters sent as business letters or accounting records for 6 or 10 years respectively (§ 257 HGB, § 147 AO), even after an account has been deleted.

What we do: You can report a provider profile (e.g. because of unlawful content); providers can report a customer in relation to a booking and reviews about themselves. For this purpose, we process your account, the reported content or the reported account, the reason, your description and – when a provider profile is reported – your confirmation that the report is accurate and complete. A member of staff reviews the report; to do so, they may view the booking and – for reviews – the chat (Section 22). When you report a provider profile, you receive an acknowledgement of receipt. We inform the reporting person of the outcome, with a statement of reasons. The person whose content is removed or whose account is restricted also receives the statement of reasons.
Legal basis: Art. 6(1)(c) GDPR in conjunction with Art. 16 and 17 of Regulation (EU) 2022/2065 (Digital Services Act), and Art. 6(1)(f) GDPR (security of the marketplace).
Retention period: The moderation case is kept as proof of the decision; if an account is deleted, your name is separated from it.

You have the right at any time to access (Art. 15 GDPR), rectification (Art. 16 GDPR), erasure (Art. 17 GDPR), restriction of processing (Art. 18 GDPR) and data portability (Art. 20 GDPR). Where processing is based on legitimate interests, you have a right to object (Art. 21 GDPR). You may withdraw any consent you have given at any time with effect for the future (Art. 7(3) GDPR). You also have the right to lodge a complaint with a data protection supervisory authority.

As our business falls well below the statutory minimum size of at least 20 persons permanently engaged in the automated processing of data (§ 38(1) BDSG, German Federal Data Protection Act) and does not carry out extensive processing of special categories of data as a core activity (Art. 37(1) GDPR), we are not legally required to appoint a data protection officer. Please send data protection enquiries directly to `privacy@frey-one.com`.

*(Status of the data processing agreements: 2026-10-05)*