SmartDeer

Privacy Policy

Privacy Policy of SmartDeer GmbH

Last updated: 30 January 2026

1. Controller and Data Protection Officer

Controller:
SmartDeer GmbH
Liesel-Bach-Str. 30
71034 Böblingen, Germany

Data Protection Officer:
Chenlu Xu
Phone: +49 160 4239000

Contact: exclusively via the in-app form “Contact”.

2. Scope

This privacy policy informs you about the nature, scope, and purposes of the processing of personal data when using our mobile app SmartDeer and the associated web services.

3. Categories of data processed

  • Usage/technical data: device information (e.g., device model, OS version, IP address), app usage events, push token; partly pseudonymized (e.g., SHA-256 hash as device/user identifier for the watchlist).
  • Account data (if an account is used): name, email address, photo URL, language, login metadata.
  • Communication: requests/feedback via the in-app form “Contact”.
  • AI chat content: your chat inputs/prompts (transmitted to the AI service provider to deliver the feature) as well as chat sessions and chatbot memories (for context/personalization). Sessions and memories can be deleted at any time in the app and are also removed upon account deletion.
  • Payment/subscription metadata: processing via the Apple App Store and Google Play (via RevenueCat) or Stripe (web). Payment data is processed there under their own responsibility as separate controllers.

4. Purposes and legal bases

  • Provision of the app/features (incl. watchlist, push):
    Art. 6(1)(b) GDPR (contract/steps prior to entering into a contract) for registered users; Art. 6(1)(f) GDPR (legitimate interest in a stable, secure app) for guests.
  • Operations/security/logs, abuse prevention, error analysis:
    Art. 6(1)(f) GDPR (IT security, product stability).
  • Usage statistics/product improvement (pseudonymous/aggregated):
    Art. 6(1)(f) GDPR; where tracking goes beyond what is necessary: Art. 6(1)(a) GDPR (consent).
  • AI chat feature (transmission of your inputs to the AI provider, response generation, and context storage via sessions/memories):
    Art. 6(1)(b) GDPR (necessary for the feature); additionally Art. 6(1)(a) GDPR insofar as you voluntarily enter personal data.
  • Direct marketing by email (only with separate sign-up):
    Art. 6(1)(a) GDPR (consent); withdrawal possible at any time.
  • Legal enforcement/compliance:
    Art. 6(1)(c) GDPR (legal obligation) and (f) (assertion/defense of claims).

5. Consent workflow (consent)

We use Google Firebase (consent signals/Consent Mode) to obtain and manage consents. Processing within Firebase SDKs is based on your consent status; you can adjust it in the app settings.

6. Recipients / categories of recipients

  • Firebase (Google): Analytics, Crashlytics, Cloud Messaging (push) and possibly Hosting/Remote Config.
  • RevenueCat: subscription management for iOS/Android; billing takes place via the respective store (Apple/Google).
  • Stripe (web only): payment processing as a separate controller.
  • Supabase: logging of some metrics; no plaintext personal data, only pseudonymous user ID (no name).
  • OpenRouter: provision of the AI chat feature (transmission of your inputs/prompts).
  • Data center/hosting providers, support/email infrastructure (if required).
  • Advertising/tracking partners only with prior consent.
  • Authorities/lawyers/courts where required on a case-by-case basis.

We list the specific providers/products and locations in the app/on the website under “Third parties/SDKs”.

7. Transfers to third countries

For certain services, data may be transferred to third countries (in particular the USA), e.g., to OpenRouter, RevenueCat, Stripe, and possibly Firebase services.
The legal basis is EU Standard Contractual Clauses (SCCs) or equivalent safeguards and additional measures. A residual risk of government access cannot be completely ruled out. Please do not enter sensitive data in the AI chat.
Further provider information, including the OpenRouter Privacy Policy: https://openrouter.ai/privacy

8. Storage period

  • Watchlist identifier (hash): until the watchlist is deleted or use ends; then deletion/anonymization.
  • Account data: until account deletion; statutory retention obligations remain unaffected.
  • Server logs/security events: up to 12 months; for Firebase logs/analytics data, the respective Firebase policies apply insofar as shorter standard periods exist there.
  • Support communication (in-app “Contact”): until the case is closed + up to 12 months.
  • Marketing data: until consent is withdrawn.
  • AI chat data (sessions & memories): We store chat sessions and chatbot memories. These can be deleted at any time in the app and are also removed upon account deletion. Processing of the content transmitted to the AI service is handled by OpenRouter according to their policies.

9. Obligation to provide data

Certain information/technical data is required for essential app features (e.g., watchlist storage, push). Without it, use may be limited. There is no legal obligation to provide data.

10. Data subject rights

You have rights to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20), and objection (Art. 21 GDPR).

11. Withdrawal of consent

You can withdraw consents at any time with effect for the future in the app settings. For newsletters/marketing emails, please use the unsubscribe link. The lawfulness of processing carried out up to the withdrawal remains unaffected.

12. Right to object under Art. 21 GDPR

You may object at any time, on grounds relating to your particular situation, to processing based on legitimate interests (Art. 6(1)(f) GDPR). For direct marketing, you have a right to object without providing reasons.

13. Children/minors

Our service is not directed at persons under 16 years of age. For consents of children under 16, the consent of the legal guardian is required (Art. 8 GDPR).

14. Automated decisions/profiling

There is no automated decision-making within the meaning of Art. 22 GDPR. Any personalization (e.g., content/recommendations) has no legal effect.

15. Data security

We implement technical and organizational measures (including encryption, access controls, pseudonymization) to protect data against loss, misuse, and unauthorized access.

16. App stores, billing & policies

Purchases/subscriptions in the apps are processed via the respective stores; their terms/policies also apply:

Subscriptions/payments:

  • RevenueCat (iOS/Android): subscription management; billing via Apple/Google.
  • Stripe (web only): payment processing as a separate controller (Stripe’s own privacy information applies).

17. Third-party services/SDKs (overview)

  • Firebase (Google): Analytics, Crashlytics, Cloud Messaging (push) and possibly Hosting/Remote Config; integrated in accordance with your consent status.
  • RevenueCat: management of app subscriptions (iOS/Android); processes store-related transaction data.
  • Stripe (web): payment processing; separate controllership.
  • Supabase: metric logging without plaintext personal data (only pseudonymous user ID, no name).
  • OpenRouter: provision of the AI chat feature (transmission of your inputs/prompts).

18. Supervisory authority (right to lodge a complaint)

You may lodge a complaint with a data protection supervisory authority, in particular in your place of residence or at the seat of our company. The authority responsible at our company’s seat is:
The State Commissioner for Data Protection and Freedom of Information Baden-Württemberg (LfDI BW),
Lautenschlagerstraße 20, 70173 Stuttgart, Germany, poststelle@lfdi.bwl.de, https://www.baden-wuerttemberg.datenschutz.de/

19. Contact for data protection inquiries

Exclusively via the in-app form “Contact”.
(Postal contact possible: SmartDeer GmbH, Liesel-Bach-Str. 30, 71034 Böblingen, Germany – subject “Data Protection”.)

20. Changes to this privacy policy

We may amend this policy if required due to technical, legal, or organizational changes. The current version is available in the app/on the website.