Privacy Policy
How we process personal data
Data controller (Art. 4 No. 7 GDPR)
Musa Cof
LeaseCards
Austraße 29, 63065 Offenbach, Deutschland
For questions about data protection and to exercise your rights, contact us at: privacy@leasecards.com
What data we process and why
We only process data we need to run the platform. The legal bases are: performance of a contract (Art. 6(1)(b) GDPR), legal obligations (point c), legitimate interests (point f) and consent (point a).
Account & profile
- Data
- Username, email address, password (stored with us only as a hash) or the ID of your Google account when using Google login, avatar, role, referral code. Username, avatar and reviews are visible to other users.
- Purpose
- Registration, login, providing the usage contract.
- Legal basis
- Art. 6(1)(b) GDPR
- Retention
- Until your account is deleted.
Binder, card requests, requests, offers, deals, chat & reviews
- Data
- Cards in your binder (card, number of copies, card value, paused status), the kind of rental you choose per event (friends & family or with a deposit), card requests for events and whether they were confirmed or declined, requests, offers, event and period of the rental, handover and return confirmations (QR code), photos of the cards at handover and return (visible only to the two sides of the deal and our support), disputes, messages, reviews, search alerts, notifications.
- Purpose
- Brokering and carrying out contracts between Borrower and Vendor, resolving disputes.
- Legal basis
- Art. 6(1)(b) GDPR; for records we must keep, point c
- Retention
- Until your account is deleted; deal and accounting data beyond that for up to 10 years (commercial and tax retention).
Payments & payouts
- Data
- Amounts, status, transaction IDs from Stripe; for rentals with a deposit the ID of the payment card saved at Stripe and of the reservation. Card numbers and bank details are processed only by Stripe, not by us.
- Purpose
- Payment processing, deposit refunds, payouts to lenders, bookkeeping.
- Legal basis
- Art. 6(1)(b) and (c) GDPR
- Retention
- Up to 10 years (accounting records).
Sales & tax details (DAC7)
- Data
- For a direct purchase: card, price, pickup appointment, payment and refund status, payout to the seller, failed handovers. From sellers, voluntarily or on request from the reporting threshold on: name, address, date of birth and tax identification number (private persons) or name, address, VAT ID or tax number and legal notice (business sellers). Where Stripe provides these details from the verification, we use them to fill in the form. Buyers see the legal notice of business sellers when buying.
- Purpose
- Handling the purchase, refund and payout; report to the German Federal Central Tax Office under the Platform Tax Transparency Act (PStTG/DAC7) once a seller reaches the reporting thresholds (30 sales or €2,000 a year).
- Legal basis
- Art. 6(1)(b) GDPR (purchase); Art. 6(1)(c) GDPR with sections 13 et seq. PStTG (tax details and report)
- Retention
- Tax details and report data 10 years after the end of the reporting period (section 22 PStTG); purchase records up to 10 years.
Vendor verification (KYC)
- Data
- Stripe performs the identity and bank checks. We only receive the status, the Stripe account ID and whether payouts are enabled.
- Purpose
- Admission as a Vendor; Stripe meets money-laundering and fraud-prevention duties.
- Legal basis
- Art. 6(1)(b) GDPR (for the status data we store)
- Retention
- For the duration of the Vendor relationship.
Location & addresses
- Data
- Addresses of stores and venues (publicly visible) and the coordinates derived from them; vacation mode with the return date (publicly visible); on request, your browser location for the events map. Without it, the map starts at your approximate town, which our hosting provider derives from your IP address; we do not store it. The location is rounded to about 100 metres and sent to our server as part of the page address.
- Purpose
- Showing stores and events, calculating distances and the radius search.
- Legal basis
- Art. 6(1)(b) GDPR; for the browser location point a (requested by your browser, revocable at any time)
- Retention
- Addresses for the life of the entry. Your browser location is only used for the search in question and not stored in your profile; it may briefly appear in the hosting provider's technical logs.
Appointments, places, "I'm going" & store claims
- Data
- Your appointments (when you are at which place; public with your username, together with the free cards of your binder), places you added or reported, your attendance at events ("I'm going" or "Every week"; the number of people going is public; if your binder is not paused and holds cards for the event's game, these cards are shown publicly with your username on the event page and in the card search), events and places you suggest. When claiming a store profile: the email address on the store's domain and the confirmation code, or the evidence you submit; for trust rentals the wording, version and time of your confirmation.
- Purpose
- Booking pickup and return appointments, avoiding duplicate places, showing events and the cards available there, reviewing event suggestions and store claims, proof of confirmations.
- Legal basis
- Art. 6(1)(b) GDPR; for proof point f (prevention of misuse)
- Retention
- Attendance until shortly after the event or until you withdraw; claim evidence until the decision and up to 3 years after; confirmations for rentals as long as the deal data.
Emails & notifications
- Data
- Email address and content of the notification (for example new offer, deal secured).
- Purpose
- Sending transactional messages about your wishes and deals.
- Legal basis
- Art. 6(1)(b) GDPR
- Retention
- According to the email provider's deletion periods; in-app notifications until the account is deleted.
Support
- Data
- Content of your requests and support tickets, contact details.
- Purpose
- Answering requests, resolving disputes.
- Legal basis
- Art. 6(1)(b) and (f) GDPR
- Retention
- Up to 3 years after the case is closed (limitation period); for disputes until resolved.
Technical logs & security
- Data
- IP address, time, page requested, browser and device type.
- Purpose
- Delivering the website, fixing errors, preventing abuse and fraud.
- Legal basis
- Art. 6(1)(f) GDPR (security and stable operation)
- Retention
- Short term, according to the hosting providers' settings.
Referral programme
- Data
- The referral code used and the related deals, as far as needed for the commission.
- Purpose
- Assigning and paying referral commissions.
- Legal basis
- Art. 6(1)(b) GDPR
- Retention
- Up to 10 years (accounting records).
Anonymous audience measurement
- Data
- Page viewed, referring page, country or region, browser, operating system and device type. No cookies are set and nobody is tracked across visits or websites; the data is evaluated anonymously.
- Purpose
- To understand which pages are used and to improve the platform (Vercel Web Analytics).
- Legal basis
- Art. 6(1)(f) GDPR (legitimate interest in anonymous audience measurement)
- Retention
- Aggregated reports; we do not store personal data.
Cookies & local storage
We use only technically necessary cookies and local storage. We do not use tracking, analytics or advertising cookies; the anonymous audience measurement (see above) works without cookies. The legal basis is section 25(2) no. 2 TDDDG and Art. 6(1)(f) GDPR.
| Name | Purpose | Duration |
|---|---|---|
| sb-…-auth-token (Supabase) | Keeps you signed in. | Until sign-out or the session expires |
| NEXT_LOCALE | Remembers your language choice. | 1 year |
| lyc_operator_briefing_closed, lyc_vendor_briefing_closed (Local Storage) | Hides notices you have already read. | Until you delete them |
When you pay, the page loads Stripe.js. Stripe may use its own cookies and similar technologies for fraud prevention, which are necessary for secure payment.
Recipients and service providers
We share data only as far as needed for the purposes above. Where required, we have contracts under Art. 28 GDPR with processors.
Supabase Inc.
Database, login, file storage, server functions
Processor
Vercel Inc.
Hosting of the web application and anonymous audience measurement (Vercel Web Analytics)
Processor
Stripe Payments Europe, Ltd. (Ireland)
Payment processing, payouts to lenders, identity checks, fraud and money-laundering prevention
Where Stripe meets its own legal duties, it is an independent controller. Privacy policy: stripe.com/privacy
Resend, Inc.
Sending emails
Processor
Google Ireland Limited
Sign in with Google, only if you choose this option
Google's privacy policy also applies
OpenStreetMap Foundation (Nominatim)
Maps and address search: when a map is shown your browser loads map tiles from tile.openstreetmap.org, and for the address search the addresses and search terms you enter are sent to nominatim.openstreetmap.org, each with your IP address; addresses of stores and venues are also converted into coordinates on our server (without your IP address)
Art. 6(1)(b) and (f) GDPR
External image servers
Card images and placeholders are partly loaded from the data providers' servers; your IP address is transmitted for technical reasons
Art. 6(1)(f) GDPR
Other users see your username, avatar, your reviews, the data of a shared deal and, at events you are going to, the cards from your binder available there including the kind of rental and, for rentals with a deposit, the amount of the deposit. We do not pass on real names or addresses of players; stores are publicly visible with their address. We pass data to authorities where we are legally obliged to, for example reports under the Platform Tax Transparency Act (PStTG).
Transfers to third countries
Some providers are based in the USA or process data there. The transfer relies on an adequacy decision of the EU Commission (for example the EU-US Data Privacy Framework for certified companies) or on EU standard contractual clauses under Art. 46 GDPR. You can request a copy of the safeguards at privacy@leasecards.com.
Your rights
Access (Art. 15)
You receive information about the data we store.
Rectification (Art. 16)
We correct inaccurate data.
Erasure (Art. 17)
We delete your data unless a retention duty applies.
Restriction (Art. 18)
You can ask us to restrict processing.
Portability (Art. 20)
You receive your data in a structured, common format.
Objection (Art. 21)
You can object at any time, on grounds relating to your particular situation, to processing based on legitimate interests.
You can withdraw a given consent at any time with effect for the future (Art. 7(3) GDPR).
Complaint to a supervisory authority
You can complain to a data protection supervisory authority. The authority responsible for us is: Der Hessische Beauftragte für Datenschutz und Informationsfreiheit, Gustav-Stresemann-Ring 1, 65189 Wiesbaden, Germany.
Providing data & automated processes
Without account and contract data we cannot perform the usage contract. Providing further data is voluntary.
There is no solely automated decision with legal effect within the meaning of Art. 22 GDPR and no profiling. Agreed deadlines, for example lease-to-own on a late return, are carried out under fixed rules of the Terms; on request a person reviews the case.
Notice for users in the USA
We do not sell personal data to data brokers or advertising networks and do not share it for advertising. Sharing is limited to the providers named above and legal obligations.
We update this policy when our processing or the law changes. The current version applies. © 2026 LeaseCards.