Privacy Policy

Last updated: October 23, 2026

1. Controller

Oscar Rojas
Alt-Mariendorf 50
12107 Berlin, Germany
Email: contact@klarbuild.de

2. What we collect and why

When you send our request form, we process the data you provide: your description of what you want done, any photos you upload, your answers to our questions, the practical details you choose to give (such as your postcode, street and house number, when you need the work done, whether you rent or own, and your flat's size and floor), and your name, email address and mobile number. We use this data to get you quotes from suitable English-speaking tradespeople (Art. 6(1)(b) GDPR — steps prior to entering into a contract, taken at your request).

With your request we also store how you reached our form: the page you submitted it from, the name of the website that linked there (for example a search engine, but never the full address you came from), and any campaign label in our own link. This uses no cookies. After you confirm your email we may also ask how you found us; answering is optional, and we store your answer with your request. The same applies to tradespeople who apply through our page for tradespeople. We use this only in aggregate, to see which channels bring people to us (Art. 6(1)(f) GDPR — our legitimate interest in understanding and improving how people find the service).

Your description and photos may reveal sensitive information — for example details about your health. We process such details only because you choose to share them with us for the purpose of getting you quotes (Art. 9(2)(a) GDPR — explicit consent expressed by submitting them). Share only what you're comfortable with; a rough idea of your situation is enough.

3. Email and phone verification

After you submit the form, we email you a 6-digit verification code, which you enter on the page where you submitted. We only begin processing your request once your email address is confirmed this way. This protects you from someone submitting a request in your name, and us from processing data of people who never asked (Art. 6(1)(f) GDPR — legitimate interest in verified requests).

The contact step also requires a mobile number from Germany, the EU or EEA, the UK or Switzerland. Once your email is confirmed, we text a 6-digit code to that number, which you enter on the same page; your request opens for quotes only after both codes. This shows tradespeople that a real person is behind each request and keeps out spam and automated requests (Art. 6(1)(b) GDPR — steps prior to entering into a contract, taken at your request; Art. 6(1)(f) GDPR — our legitimate interest in preventing abuse of the service and of our text messages). Tradespeople see only that your number was confirmed, never the number itself unless you invite or choose them (section 4a). If we can't send the text through no fault of yours, you can send your request without it.

The text is sent by seven communications GmbH & Co. KG (seven.io), Kiel, Germany, as our processor under a data processing agreement (Art. 28 GDPR). It receives your mobile number and the text of the message, which holds only the code. To stop misuse, we count the codes we send per number, per connection and per browser session. These counts keep only keyed fingerprints, never your number or IP address itself, and are deleted after 7 days.

3a. An AI service reads your description

When you send the first screen of our form, an AI system (Claude, run on Amazon Bedrock by Amazon Web Services, which we call in Frankfurt; your text is processed within the European Union) reads your description, text only, to split it into jobs for the right tradespeople and suggest a few questions (Art. 6(1)(b) GDPR). We send it nothing else: not your photos, name, email address, phone number or street. Your data is not used to train AI models. It decides nothing: you see what it suggests and can change or remove it, and if it fails, your request goes in anyway and a person reads it.

4. Who we share it with

Tradespeople who could do the work see your request without your name: your description, photos, answers and practical details, and your postcode. Your first name is shown to the tradespeople who quoted once you choose to see who they are; your email address, phone number and street go only to the tradespeople you invite or choose. We do not sell your data, and we do not share it with anyone else except our technical service providers (hosting by Hetzner in Germany; email delivery and our mailbox, which receives replies to our emails, by mailbox.org in Germany; the text message with your code by seven.io in Germany, section 3; the AI service in section 3a) bound by data processing agreements (Art. 28 GDPR).

4a. Quotes, questions and chat

Once you confirm your request (section 3), tradespeople whose trades and districts match it see it without your name, email, phone or street: they see your postcode, what you wrote (with phone numbers, email and web addresses hidden), your photos and your answers, and whether your mobile number was confirmed by text. They can send a quote or ask a question; we show you how many quotes there are and their range, and every bidder sees your answers to questions, without seeing who asked.

When you choose to see who quoted, each bidder learns your first name and can chat with you on Klarbuild; we store those messages with your request. Your phone, email and street go only to tradespeople you invite or choose. From then on that tradesperson is responsible for what they do with them to arrange and carry out the job. All of this is part of the service you ask us for (Art. 6(1)(b) GDPR).

5. Hosting and log files

Our website, application database and uploaded photos are hosted by Hetzner Online GmbH in Germany, within the European Union, under a data processing agreement (Art. 28 GDPR). We back them up daily; no backup is kept for longer than 30 days, so data we delete is gone from the backups within 30 days.

Our web server processes technical data (IP address, timestamps, requested pages, browser information) in server logs to provide the site securely and detect abuse (Art. 6(1)(f) GDPR). Log files are retained for a maximum of 30 days unless needed as evidence of an attack.

6. Cookies and analytics

We use only functional cookies that the site needs to work, such as protecting forms against misuse and keeping you signed in to your case page. We use no advertising or tracking cookies, so no consent banner is required.

We use no analytics service. If we add one, we will name it here first.

6a. Marketing emails (only if you ask)

If you opt in, we email you occasional general tips on taxes and running a business in Germany, and offers from Klarbuild. Klarbuild has no partners and sends no partner offers. You can unsubscribe at any time.

7. How long we keep your data

If you never confirm your request (the emailed code and the texted one, section 3), it is deleted after 30 days. The counts of texted codes are deleted after 7 days. Confirmed requests, including their photos, quotes, questions and messages, are kept while you are looking for tradespeople and deleted 12 months after your request is closed, unless statutory retention duties (§ 147 AO, § 257 HGB) require longer storage of individual records. A request closes when you close it, or six months after the last activity on it. You can request earlier deletion at any time.

8. Your rights

You have the right to access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20), and to object to processing based on legitimate interests (Art. 21). Where processing is based on consent, you may withdraw it at any time with effect for the future. To exercise any right, email contact@klarbuild.de. You also have the right to lodge a complaint with a supervisory authority — for Berlin: Berliner Beauftragte für Datenschutz und Informationsfreiheit.

9. Tradespeople on Klarbuild

If you apply to or take part in Klarbuild as a tradesperson, we process:

• Your application and profile: name, email, phone, business name, website, your trades, the Berlin districts you cover, your languages, the photos and text you add to your profile, and how you found us (for example the campaign link you came through).
• Our checks: your business registration, your entry in the Handwerksrolle where your trade requires one, your liability insurer and how long the cover runs, your VAT status, and what we noted when we checked them.
• Your account and contract: your login (the password only as a secure hash) and those of your team, when you accepted which version of the participation terms, your plan (basic or premium, founder status, start and end dates), and the name and address for your invoices.
• Invoices and payments: the invoices we issue to you and whether they have been paid.
• Your activity on requests: which requests we showed you, your quotes, your questions, your messages with customers, and whether a customer invited or chose you.

We use this to run your participation: to check that you may do the work you offer, to show you matching requests, to pass your quotes and messages to customers, to invoice the plan, and to keep the service reliable for customers, as the participation terms describe (Art. 6(1)(b) GDPR). Price insight compares your quote with others on the same job without showing anyone's amounts. We keep invoices because tax law requires it (Art. 6(1)(c) GDPR). We note how you found us, and check that our emails reach you, in our legitimate interest in running and improving the platform (Art. 6(1)(f) GDPR).

Your data is hosted by Hetzner in Germany; our emails are sent through mailbox.org in Germany, where our mailbox is too. Both work for us under data processing agreements (Art. 28 GDPR). When a customer chooses to see who quoted, they see your business profile, your name, your business phone, email and website, and your quote. We pass invoice data to our own tax advisor or to authorities only where the law requires it.

Your activity on a request is deleted together with that request (see section 7). Invoices are kept for as long as tax law requires, currently eight years (§ 147 AO, § 14b UStG). Everything else is deleted when your participation has ended and it is no longer needed for claims under the contract: at the latest three years after the end of the year in which your participation ended. Your rights under section 8 apply in full. Customers' data in requests is covered by the participation terms, not by this section.

10. Changes

We will update this policy when our processing changes and indicate the date of the latest revision above.