Version 5.0 · Last updated: September 7, 2026
1. Controller
Smart Deal UG (haftungsbeschränkt)
Jakob-Husmans-Str. 1, 47839 Krefeld, Germany
Email: info@smartdealbusiness.de
2. Data we process
Account and authentication
Name, email address, account status, terms acceptance, profile settings and authentication session data. Base44 provides the authentication system.
Profile
Optional photo, bio, age, interests and hobbies. These details are shown to people who share a circle with you. An invitation email may also show the inviter's name and profile image. Profile images use Base44 public media links and are not private circle transfers; anyone with that image link may open it. Do not use a sensitive image as your profile photo.
Circles and memberships
Circle name, description, theme, owner, member email, role, status and permissions. Access lists restrict ordinary user access to the relevant circle. Authorised administrators and technical providers may have access for the limited purposes explained below.
Messages and circle content
Messages, tasks, events, announcements, notes, modules and related creator information. This content is visible to active members of the same circle and is not end-to-end encrypted.
Invitations
The invited person's name and email, invitation role, inviter, status, expiry time and a single-purpose invitation token. Invitations are sent to the specific email address entered by the inviter and can be accepted only by a signed-in account using that same email.
Notifications
In-app activity notifications, read status and delivery status. The app does not send general activity-digest emails. Email is used only for user-initiated invitations, the Account Plus expiry reminder, transactional confirmations and necessary account or legal administration. Push subscriptions are stored only when enabled.
Files and media
Temporary transfer copy, file name, declared type, size, uploader, upload time, recipient snapshot, download receipts, expiry and shared account allowance usage. Private downloads use short-lived signed links issued only after server-side membership checks.
Account Plus and payments
Account plan, shared allowance counters, checkout consent, Stripe customer, payment, checkout session and price identifiers, paid access periods, reminder status and processed webhook event identifiers. Card and full payment details are entered directly with Stripe and are not stored by Smart Deal UG.
Safety, reports and technical records
Blocks, reports, moderation records and standard technical or security logs such as request time, device or network information processed by the platform infrastructure.
Support, deletion and withdrawal
Information in support messages, account and circle deletion requests, and electronic withdrawal requests. A withdrawal request contains the consumer name, contract identification, confirmation email, receipt time and processing status.
Browser storage
The app and Base44 use necessary browser storage mechanisms for authentication, preferences and checkout consent. Just Our Circle does not use third-party advertising cookies or behavioural advertising.
3. Purposes and legal bases
- Contract, GDPR Art. 6(1)(b): account, membership, circle content, invitations, withdrawal processing and Account Plus entitlement needed to provide the requested service.
- Consent, Art. 6(1)(a), where applicable: optional features for which we separately request consent. Consent can be withdrawn for the future. Accepting the contract or requesting immediate service at checkout is not blanket data-processing consent.
- Legitimate interests, Art. 6(1)(f): platform security, abuse prevention, limited operational logging, moderation and protection of legal claims.
- Legal obligations, Art. 6(1)(c): accounting, tax, consumer-law and other records that must be retained.
4. Processors and recipients
- Base44 (Wix): application hosting, database, authentication, backend functions and configured email delivery.
- Stripe: Checkout, one-time payments, receipts, tax calculation where configured and fraud prevention. Stripe receives payment and billing information directly.
- Temporary transfer provider: the current transfer implementation uses Cloudflare R2 when configured. Transfer uploads and paid checkout are unavailable until private storage and deletion are operational. Existing profile images are hosted by Base44. We will identify a replacement transfer provider here before using it.
- Other circle members: people in the same circle can see the profile details and content shared in that circle. People outside the circle cannot use the app to discover or read it.
- Invitation recipients: a person invited by email receives the circle name and information identifying the inviter.
- Authorities or professional advisers: only information necessary for a verified legal obligation or another applicable legal basis, such as establishing, exercising or defending legal claims. A complaint or an informal request does not authorise blanket disclosure.
5. International transfers
Base44 (Wix), Stripe, Cloudflare and their subprocessors may process data outside Germany or the EEA. Where required, transfers rely on an adequacy decision, standard contractual clauses or another lawful safeguard. We do not claim that data always remains in Germany or the EEA.
6. Access and security
- Direct database reads are restricted to administrators. Normal app reads pass through server checks for current circle membership, account restrictions and accepted terms.
- Circle changes pass through server-side membership and role checks. Guests are read-only.
- Temporary transfers are private and opened or downloaded through time-limited signed links after membership verification.
- Download receipts are recorded so the remote copy can be deleted after every snapshotted recipient receives it.
- We do not claim end-to-end encryption, anonymity from the operator or absolute security. Base44's platform protections do not automatically certify this app or remove our responsibility for its configuration. See Base44's published security overview.
- Our administrators can access data technically. Operational access must be limited to support, security, a specific report or a lawful request. The in-app moderation console records report access and account actions. We do not claim it logs every possible infrastructure or provider access.
- Short-lived signed links act as access credentials and may be reused or shared until they expire. They are not single-use links. Circle membership checks prevent unauthorised issuance; do not forward private links.
- A restriction or allegation does not make your information public. We verify authority requests and disclose only what an applicable legal basis permits or requires. Where legally permitted and appropriate, we tell affected users.
- We do not perform malware scanning. File size and declared type are validated and known dangerous extensions are blocked, but files are not guaranteed to be malware-free.
7. Retention and deletion
- Active account and circle data is retained while needed to provide the service.
- Circle content other than temporary file and media transfers is retained until it is deleted, the circle is deleted, or another applicable retention rule ends.
- Transfers expire for new online access after 7 days. Physical deletion is scheduled after every recorded recipient successfully saves a copy, with a one-hour delivery delay, or on expiry. An hourly job processes due objects and retries failures. Transfer metadata and limited receipts may remain where needed for security, entitlement or disputes. Deleting a database entry alone is not treated as deletion of the file.
- A circle deletion request has a 7-day window before permanent deletion. Account Plus does not block deletion of an individual circle.
- Account deletion requests remove circle access and anonymise profile and authorship details as described in the request flow. Temporary object deletion depends on successful storage-provider deletion, and incomplete operations must be retried. Solo-owned circles enter the 7-day deletion window. Copies already saved by other members remain on their devices.
- The Base44 authentication record requires a final administrator action. The in-app request is recorded and queued for that completion.
- Billing, tax, withdrawal and legal-claim records are retained only as long as required by applicable law or necessary to handle and document the request.
- Processed Stripe event identifiers are retained in a limited list to prevent duplicate entitlement changes.
- Opening a downloadable transfer attempts to save it in account-scoped browser storage on that device. Saved copies can be removed using Saved on this device. Clearing browser data or uninstalling the app may remove them. Save important files separately; browser storage is not guaranteed permanent storage.
- Specific information may need to be preserved for a verified legal requirement or a necessary legal claim. Such retention is limited in scope and duration and access is restricted. This does not mean we retain every file for law enforcement, or can recover files already deleted.
8. Your rights
Subject to the conditions in applicable law, you may request access, rectification, erasure, restriction, portability, or object to processing. You may withdraw consent for future processing.
Send requests to info@smartdealbusiness.de. You may also lodge a complaint with a supervisory authority.
9. Supervisory authority
State Commissioner for Data Protection and Freedom of Information North Rhine-Westphalia (LDI NRW): www.ldi.nrw.de
10. Data Protection Officer and changes
No Data Protection Officer has been appointed. Direct privacy enquiries to the controller above. This policy may be updated when the service, providers or legal requirements change. The current version and date are shown at the top.