Log in
This English version is a convenience translation. The German version is legally binding. Zur deutschen Fassung

Privacy Policy

Last updated: October 2026

1. Privacy at a Glance

General Information

The following notes provide a simple overview of what happens to your personal data when you visit this website. Personal data is any data that can be used to identify you personally.

2. Data Collection on This Website

Who is responsible for data collection on this website?

Data processing on this website is carried out by the website operator:

Agnello Ventures
Rosenstrasse 11
76456 Kuppenheim

How do we collect your data?

Some of your data is collected when you provide it to us. This may, for example, be data you enter into a contact form or the ice cream planner.

Other data is collected automatically, or after your consent, by our IT systems when you visit the website. This is mainly technical data (e.g. browser, operating system, IP address or time of the page visit).

IP addresses: For security reasons (protection against misuse and fraud, rate limiting for forms and logins), we store the IP address for a limited period. The legal basis is our legitimate interest in a secure and functioning platform (Art. 6(1)(f) DSGVO).

Cookies, Tracking & Local Storage

We use technically necessary cookies and local storage to provide our services. Non-essential analytics and tracking services (see section 3) are only activated once you have given your explicit consent in the cookie banner.

  • Session cookies: For logging in commercial vendors (Better-Auth) and for securing the administrative dashboard (admin_token, JWT with a 2-hour expiry).
  • Cookie consent: To store the decision you made in the cookie banner (local storage key cookie-consent).
  • Language choice: The NEXT_LOCALE cookie stores the language you have chosen for the website (only the value "de" or "en", no personal data, no tracking). It is set when you open an English page or switch the language, and for signed-in users it is synchronised with the language saved in their account. Duration: 1 year; scope: the whole website, sent only with requests from this website (SameSite=Lax). It is technically necessary to display the site in the chosen language and is set without consent.

You can withdraw or change your cookie decision at any time via the "Change cookie settings" link in the footer of every page.

Registration and Sign-in with Google (OAuth)

We offer you the option of registering and signing in to our platform using your Google account (Google Sign-In). If you use this option, Google forwards certain profile information to us after you approve it (e.g. name, email address, profile picture). This data is used exclusively to create and manage your customer or vendor account.

The provider of this authentication service is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Further information can be found in Google's privacy policy.

3. Hosting and Third-Party Providers

We host the content of our website with the following providers and integrate the following third-party services:

Vercel & Neon:Hosting of the app and database. Provider: Vercel Inc., 340 S Lemon Ave #4133, Walnut, CA 91789, USA.

Stripe:Processing of subscription payments for commercial vendors (partners) and of the service fee paid by end customers (ice cream bookers) on binding acceptance of a quote. The data required for payment (e.g. name, email address, payment data, billing address where applicable) is transmitted to Stripe; payment data such as card numbers is processed exclusively by Stripe and is not stored on our servers. Provider: Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland.

Stripe Connect (payouts to vendors):So that commercial vendors can receive deposits from customers, we set up – at their request – a payout account with Stripe Connect for them. In doing so, we transmit the vendor's email address and company name to Stripe. The information required to open the account (in particular about identity and bank account) is entered by the vendor directly in the form hosted by Stripe; it is collected and processed by Stripe and is not stored on our servers. When a deposit is paid out, we process the payout amount and an internal booking number for this purpose. The purpose is the handling of the deposit and its payout to the vendor; the legal basis is performance of the contract with the vendor (Art. 6(1)(b) DSGVO). The provider here, too, is Stripe Payments Europe, Ltd., Dublin, Ireland.

Google Gemini (AI review and suggested text in the chat):We use Google's Gemini interface (API) for two functions in the message chat between customers and vendors:

  • Review of chat messages: Before a message is sent, its text is automatically checked to see whether it asks to handle the booking outside the platform. It is also automatically checked whether a customer message expects a reply from the vendor (so that reminders are only sent where they make sense) and whether, after a quote, it contains an objection to the price (as a hint for the vendor). In each case only the text of the individual message is transmitted, without names, contact details or booking numbers as separate items of information. The check for attempts to circumvent the platform only runs before the binding booking. If it detects such a request, the message is not delivered; the sender receives a notice and can send the message again without the objectionable part. To control misuse, we then log a short excerpt (the first 120 characters) of the message. If the check fails, the message is delivered as normal.
  • Suggested text for vendors: If a vendor clicks “Suggest text” or “Improve”, we transmit to Google the text the vendor has already written, the chat history so far and key details of the request (the customer's first name, the vendor's name, occasion, date, location, number of guests, selected scope and any note entered by the customer). Before transmission, telephone numbers, email addresses, internet addresses, user names and street details in the text are automatically redacted; we transmit the customer's name only as a first name and the location only with its postcode. Because this redaction works automatically, it cannot recognise every spelling; if someone mentions, for example, a surname or an address in an unusual form in free text, it may end up in the transmitted text. The suggestion is only a draft; it is only sent once the vendor sends it themselves.

Legal basis: Our legitimate interest in a platform that is functional and low in misuse, and in timely, helpful communication (Art. 6(1)(f) DSGVO). You can object to this processing at any time on grounds relating to your particular situation (Art. 21 DSGVO, see section 7).

Recipients and transfer to third countries: The recipient is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, or its affiliated company Google LLC, USA. According to Google, there is no option to restrict processing for the Gemini API to the EU; the data may be processed in any country in which Google or its contractors maintain facilities, in particular in the USA. We use the paid version of the interface (Paid Services); the terms of data processing that Google offers together with the terms of use of the Gemini API apply to it. For transfers to third countries, Google relies on the safeguards provided for there under Art. 44 et seq. DSGVO.

Retention period and use by Google:According to Google's terms of use, for paid use Google does not use the transmitted texts and the responses to improve its products. However, Google stores the requests and responses for a limited period (55 days according to Google), solely to detect and prevent violations of its prohibited use policy and to comply with statutory disclosure obligations. We ourselves do not store the transmitted texts additionally for this purpose; the chat messages themselves remain in our system in accordance with section 3 (retention period).

Sentry:Error monitoring of the website and the platform. When an error occurs, technical error reports are transmitted to Sentry so that we can detect and fix faults. A report contains the error message, the technical sequence (stack trace), the page or address (URL) that was called, details of the browser, device and operating system, and the time. For logged-in users, an internal, pseudonymous user identifier (ID) is also sent, but not their name or email address. In addition, the load time is recorded for a share of page views (about 10 %) (performance monitoring). Recordings of your session (session replay) do not take place. The Sentry SDK option for transmitting default personal data (sendDefaultPii) is not enabled; as a result, the SDK does not itself derive the IP address and does not add it to the reports. For technical reasons, Sentry receives the IP address of the sending connection when it receives the data. The reports are stored in Sentry's EU region (Frankfurt am Main); account and access data of Sentry itself are located in the USA according to Sentry. The legal basis is our legitimate interest in the stable and secure operation of the platform (Art. 6(1)(f) DSGVO). The reports are automatically deleted after the retention period set at Sentry in each case (30 to 90 days depending on the plan, according to Sentry). The provider is Functional Software, Inc. d/b/a Sentry, 45 Fremont Street, 8th Floor, San Francisco, CA 94105, USA. A data processing agreement including EU standard contractual clauses is in place with Sentry; Sentry is also self-certified under the EU-U.S. Data Privacy Framework.

Resend:Sending of system emails. Provider: Resend Labs Inc., 2261 Market St #4038, San Francisco, CA 94114.

Cloudflare R2:Secure cloud storage for hosting and serving uploaded images (e.g. profile pictures and gallery photos of ice cream vendors). Provider: Cloudflare Inc., 101 Townsend St., San Francisco, CA 94107, USA.

Hetzner:Domain registrar and DNS management. Provider: Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany.

Google Analytics:Web analytics service for anonymised evaluation of website usage. Collection only starts once you have explicitly consented in the cookie banner (legal basis: Art. 6(1)(a) DSGVO). Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

Microsoft Clarity:Analytics service for evaluating user behaviour (including anonymised session recordings, heatmaps) to make our site more user-friendly. Collection only starts after your consent in the cookie banner (legal basis: Art. 6(1)(a) DSGVO). Provider: Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland.

Ahrefs Analytics:Privacy-friendly, cookieless web analytics service for aggregated evaluation of page views. Collection only starts after your consent in the cookie banner (legal basis: Art. 6(1)(a) DSGVO). Provider: Ahrefs Pte. Ltd., 143 Cecil Street, #10-01, GB Building, Singapore.

Vercel Analytics & Speed Insights:Aggregated, privacy-friendly evaluation of page views and load times for the technical optimisation of the platform. Collection only starts after your consent in the cookie banner (legal basis: Art. 6(1)(a) DSGVO). Provider: Vercel Inc., 340 S Lemon Ave #4133, Walnut, CA 91789, USA.

Mapbox:Map display in the planner and on vendor profiles for selecting and showing locations. Your IP address is transmitted to Mapbox when the map loads. The legal basis is our legitimate interest in a functioning location search (Art. 6(1)(f) DSGVO). Provider: Mapbox, Inc., 740 15th Street NW, 5th Floor, Washington, DC 20005, USA.

Retention period: Personal data from booking requests and messages is stored for as long as necessary to process the request and to meet statutory retention obligations; analytics and tracking data is processed according to the respective provider's standard retention periods. On request, we will tell you the specific retention period for your data at hallo@eisbuchen.de.

4. Newsletter and Regional Waiting List

Newsletter (Double Opt-in Process)

If you would like to receive the blog newsletter offered on our website, we need an email address from you.

For security and verification, we use what is known as the double opt-in process: after signing up on our website, we send a confirmation email to the address provided. Only once you click the confirmation link contained in it is your email address added to our active mailing list. We use this data exclusively to send the requested information and articles.

The newsletter is sent using the service provider Resend.

Legal basis: The data entered into the newsletter sign-up form is processed exclusively on the basis of your consent (Art. 6(1)(a) DSGVO).

Withdrawal & unsubscribing: You can withdraw your consent to the storage of your data and email address, and to their use for sending the newsletter, at any time – for example via the "Unsubscribe" link in the newsletter, or by an informal email to hallo@eisbuchen.de. The lawfulness of any data processing already carried out remains unaffected by the withdrawal.

Regional Waiting List

If you cannot yet find a suitable ice cream vendor in your region, you can voluntarily add yourself to our regional waiting list. In doing so, we process your name, email address, telephone number, the requested location and – where provided by you – the event date, approximate number of guests, occasion and any voluntary details you give about the planned event.

Purpose: We use this data exclusively to notify you as soon as a suitable vendor is available in your region, and to contact you with any questions about your event. Contact is made by email or by phone on the number you provide. Your data is not shared with third parties for advertising purposes.

Legal basis: Processing is based on the consent you give by submitting the waiting-list form (Art. 6(1)(a) DSGVO).

Withdrawal & deletion: You can withdraw your consent at any time by an informal email to hallo@eisbuchen.de; we will then delete your entry promptly. The lawfulness of processing carried out up to that point remains unaffected.

5. Disclosure of Customer Data to Vendors – Separate Controllership

When an end customer (ice cream booker) submits a booking request via eisbuchen.de, certain personal data of the customer – in particular name, email address, telephone number and details of the event – is passed on to the requested vendor (ice cream van operator) so that they can process the request and submit a quote.

From the moment of this disclosure, the respective vendor becomes an independent controller within the meaning of Art. 4 no. 7 DSGVO for the processing of the customer data received (a so-called controller-to-controller relationship). Agnello Ventures and the vendor are, to that extent, independent controllers of one another; there is no joint controllership under Art. 26 DSGVO.

Each vendor is therefore obliged to process the customer data transmitted to them in a manner that complies with data protection law, under their own responsibility, in particular to use it exclusively to process the specific request and not to pass it on to third parties (see also §6 of the Terms). Agnello Ventures bears no responsibility for the vendor's processing of data after it has been disclosed.

The legal basis for disclosing the data to the vendor is Art. 6(1)(b) DSGVO (steps taken at the request of the data subject prior to entering into a contract).

6. Information for Contacted Businesses (Vendor Acquisition)

To recruit new ice cream vendors for our platform, we process publicly available business contact data (e.g. company name, business email address, telephone number) of commercial ice cream van operators that we have not collected directly from you. The source of the data is your publicly accessible company website and your public Google Maps/Google Business listing.

Purpose and legal basis: Processing takes place exclusively to make business contact with the aim of offering a partnership on eisbuchen.de. The legal basis is our legitimate interest in acquiring new customers in the B2B sector (Art. 6(1)(f) DSGVO).

Data verification for quality assurance: Before sending, we technically check email addresses against an email verification service to avoid invalid addresses and delivery failures. Provider of this service: NeverBounce (ZeroBounce LLC or affiliated companies), USA.

Scope and duration of contact: Contact consists of a sequence, limited from the outset, of no more than six emails over a maximum of twelve months from the first approach. Each of these emails contains an unsubscribe link with which you can end the contact at any time with a single click.

Retention period: If you do not respond to this sequence, the contact attempt is deemed unsuccessful. Your data is then automatically blocked from further marketing outreach and is not used again for advertising. If you object, blocking takes place immediately. Blocked records are reduced to the minimum needed to permanently exclude you from future outreach (a suppression list under Art. 21(3) DSGVO); the remaining details are deleted.

Exception with express consent: In our emails, we offer you the option of continuing to be informed about the development of the platform. If you actively click the relevant link, you thereby give consent under Art. 6(1)(a) DSGVO. In this case, the automatic blocking described above does not apply, and we may continue to contact you. We record the time and circumstances of this consent so that we can demonstrate it (Art. 7(1) DSGVO). You can withdraw your consent at any time with effect for the future – the unsubscribe link in every email is sufficient.

Your rights: You can object to the processing of your data for this purpose at any time under Art. 21 DSGVO, and request access, rectification or erasure under Art. 15–17 DSGVO at hallo@eisbuchen.de. You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 DSGVO).

7. Your Rights

You have the right, at any time and free of charge, to obtain information about the origin, recipients and purpose of your stored personal data (Art. 15 DSGVO). You also have a right to rectification (Art. 16 DSGVO), erasure (Art. 17 DSGVO) or restriction of processing (Art. 18 DSGVO) of this data.

Where processing is based on consent or on a contract, you also have a right to data portability under Art. 20 DSGVO. Where we process data on the basis of a legitimate interest (Art. 6(1)(f) DSGVO), you have the right to object to this processing at any time on grounds relating to your particular situation, under Art. 21 DSGVO.

You can withdraw any consent you have given (e.g. cookie consent, newsletter) at any time with effect for the future (Art. 7(3) DSGVO) – for cookies, via the "Change cookie settings" link in the footer.

Without prejudice to these rights, you also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 DSGVO), in particular the State Commissioner for Data Protection and Freedom of Information of Baden-Württemberg.