Privacy policy

The controller responsible for data processing on cowork-app.de is:

Max R. Streisand
Musterstraße 1
70173 Stuttgart
Deutschland

Email: kontakt@cowork-app.de

We only process personal data as far as it's needed to run the platform: to show spaces, keep accounts, handle bookings and take payments. We use no analytics, tracking or advertising services and don't sell any data.

The website is hosted by Vercel Inc. (USA). On every request, the server automatically processes technical data: IP address, date and time, the page requested, the referrer, and browser and operating system. This is necessary to deliver the website and protect it against attacks (Art. 6(1)(f) GDPR). The logs are deleted automatically after a short time.

Vercel processes the data on our behalf (Art. 28 GDPR). According to Vercel, transfers to the USA are based on the EU-US Data Privacy Framework and the European Commission's standard contractual clauses. More: vercel.com/legal/privacy-policy

Accounts, spaces and bookings are stored in a database run by Supabase Inc. on servers in the EU (Paris, France). Supabase processes the data on our behalf (Art. 28 GDPR). More: supabase.com/privacy

For an account, we store your name, your email address, your password (only as a secure hash, never in plain text) and whether you signed up as a tenant or a landlord. Without an account you can't book desks or list spaces. The legal basis is the performance of a contract (Art. 6(1)(b) GDPR).

The data is kept until you have your account deleted – an email to kontakt@cowork-app.de is enough. Data we have to keep for tax or commercial law reasons is deleted when those periods end.

For a booking, we store the space, the dates, the chosen seats, the price, your optional message to the host and the payment status (Art. 6(1)(b) GDPR).

So that the host can welcome you, they see your name, your email address, the booking details and your message for every paid booking. Hosts are responsible for how they use this data from then on.

If you publish a space as a landlord, its details and your name ("Hosted by …") are visible to all visitors.

Booking and payment records are kept as long as statutory retention periods require (up to ten years, § 147 AO, § 257 HGB).

Payments are handled by Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland. You enter your card details into Stripe's input fields; they go straight to Stripe and never reach our servers. We only receive the payment status from Stripe. Stripe sends the payment receipt to your email address.

On the payment page, your browser loads Stripe.js from Stripe's servers. Stripe collects device information and sets cookies there to prevent fraud. The legal basis is the performance of a contract (Art. 6(1)(b) GDPR) and our legitimate interest in secure payments (Art. 6(1)(f) GDPR). Stripe may transfer data to Stripe, Inc. in the USA, which is certified under the EU-US Data Privacy Framework. More: stripe.com/privacy

We only set cookies that the website technically needs:

• cowork_session – keeps you signed in; deleted when you sign out, otherwise after 7 days.
• NEXT_LOCALE – remembers the language you chose; 1 year.

Stripe sets its own cookies on the payment page (see above). Technically necessary cookies need no consent (§ 25(2) no. 2 TDDDG); the legal basis for the processing is Art. 6(1)(b) or (f) GDPR.

Your browser loads the spaces' photos directly from the servers they're stored on (e.g. Unsplash), which see your IP address (Art. 6(1)(f) GDPR – we want to show the spaces with pictures). Fonts are served from our own server; no data goes to Google or other third parties for them.

When you write to us, we process your details to answer your request (Art. 6(1)(b) or (f) GDPR) and delete them once it's settled, unless we're required to keep them.

You have the right to

• access the data stored about you (Art. 15 GDPR),
• rectification (Art. 16 GDPR) and erasure (Art. 17 GDPR),
• restriction of processing (Art. 18 GDPR),
• data portability (Art. 20 GDPR),
• object to processing based on Art. 6(1)(f) GDPR (Art. 21 GDPR), and
• lodge a complaint with a data protection supervisory authority (Art. 77 GDPR).

An email to kontakt@cowork-app.de is enough.

There is no automated decision-making or profiling within the meaning of Art. 22 GDPR.

November 2026