Privacy policy

We help people remove their personal data from data brokers, so we hold ourselves to the standard we ask of others: we collect as little as we can, encrypt what we keep, never sell it, and delete it when you ask.

This policy explains what personal data we process when you visit stopbrokers.app, create an account or use our removal service, why we do it, and what rights you have under the EU General Data Protection Regulation (GDPR).

1. Who is responsible

The controller under Art. 4(7) GDPR is:

Jan Lennard Klein
Am Mergelgarten 4
61440 Oberursel (Taunus)
Germany
Email: mail@lennard-klein.com

StopBrokers is operated by a sole proprietor based in Germany. We are not required to appoint a data protection officer. For any privacy question or request, email mail@lennard-klein.com.

2. Summary

• Website visits: our hosting provider processes technical data (such as your IP address) to deliver the site and keep it secure. We do not use advertising or analytics cookies and do not track you across sites.
• Account: you sign in with your email address and a one-time link. We set only the cookies needed to keep you signed in.
• Removal service: with your authorization, we send removal requests to data brokers in your name. We share only the details a broker needs to find and delete your records.
• Security: personal details are encrypted in our application before they are stored, in a database in Frankfurt, Germany.
• No sale, no ads profiles: we never sell your data or use it to build advertising profiles.

3. What we process and why

3.1 Visiting the website

When you open our website, your browser sends technical data to our hosting provider: IP address, date and time, requested page, referrer, browser type and operating system. This is needed to deliver the pages, detect abuse and fix errors.

• Legal basis: Art. 6(1)(f) GDPR (our legitimate interest in a secure, working website).
• Retention: server logs are kept short term by the hosting provider and deleted automatically, at the latest after 30 days, unless needed to investigate a specific security incident.

Fonts are served from our own domain, so your browser does not contact a font provider. Company logos in our broker directory are fetched by our server, not by your browser.

3.2 Cookies and similar technologies

We only use cookies that are strictly necessary to provide the service you request, namely the session cookies that keep you signed in (set by our authentication provider, Supabase). They are stored under § 25(2) No. 2 of the German Telecommunications Digital Services Data Protection Act (TDDDG) and do not require consent. They expire when you sign out or when the session ends.

We use no analytics, advertising or tracking cookies. If that changes, we will update this policy first and ask for your consent where the law requires it.

Page versions (outside the EU, EEA, UK and Switzerland only). To compare two versions of some landing pages, we store which version you were shown in a first-party cookie (sbx_ followed by the page name, for example sbx_spam-calls). It contains only the version name, no ID or personal data, and expires after 30 days. Visitors in the EU, EEA, UK and Switzerland always see the standard version and get no such cookie.

3.2a Product analytics (PostHog, without cookies)

To understand how people use our website and where sign-ups get stuck, we use PostHog in cookieless mode, hosted in the EU (Frankfurt). PostHog sets no cookies and uses no browser storage. It receives the pages you view, the events we send (for example "sign-up started" or "report requested"), your browser type, device type, country derived from your IP address, and the referring page. Instead of a stored ID, PostHog derives a pseudonymous ID from your IP address and browser that changes every day, so you cannot be followed across days. We do not send your name, email address or any details you enter in forms. The admin area is excluded. Requests go through our own domain.

• Legal basis: Art. 6(1)(f) GDPR (our legitimate interest in improving the website and measuring which pages and campaigns work).
• Retention: events are kept for up to 24 months.
• Objection: you can object at any time (see section 9); blocking JavaScript or using a content blocker also stops it.

3.2b Measuring our ads

When you arrive from one of our Google ads, the address of our page contains a click ID (gclid) and campaign parameters (such as utm_campaign). We do not use Google's tracking tag or advertising cookies. If you start a sign-up on that page, we store the click ID and campaign parameters together with your sign-up, so we can see which ads lead to sign-ups and what a sign-up costs us. To let Google Ads count conversions, we may send the click ID and the time of your sign-up back to Google, never your name or email address.

• Legal basis: Art. 6(1)(f) GDPR (our legitimate interest in measuring and paying only for advertising that works).
• Retention: with your sign-up record; deleted with your account, or after 12 months if you never confirm your email.

3.3 Creating an account and signing in

To create an account or start a free scan, you give us your email address. We send you a one-time sign-in link and service emails about your account (for example, scan results and the status of your requests).

• Data: email address, account ID, sign-in timestamps, the page you signed up from.
• Legal basis: Art. 6(1)(b) GDPR (to provide the account and service you request).
• Retention: until you delete your account. If you only start a free scan and never confirm your email, we delete the sign-up after 12 months.

Your email address is encrypted before it is stored. To find your account without decrypting every record, we store a keyed hash (a one-way fingerprint) of it.

3.4 Scan and removal service

To find and remove your listings, we need details that brokers use to identify you. Depending on what you choose to give us, this can include your name and previous names, current and previous postal addresses, email addresses, phone numbers and year or date of birth. We ask only for what is needed and tell you why for each field.

• Searching: we check data broker and people-search sites for listings that match your details.
• Requests: with your written authorization, we act as your authorized agent and send deletion and opt-out requests to brokers in your name. Each request contains only the details that broker needs.
• Replies: brokers' answers to these requests are stored encrypted so we can follow up, prove what was requested and show you the status.
• Tasks: some brokers require steps we will not automate, such as solving a CAPTCHA, confirming via your own email or proving your identity. We show these as tasks for you. We never store ID documents.
• Legal basis: Art. 6(1)(b) GDPR (performing our contract with you). Where you give us special categories of data, or data about other people (for example, a family member who has agreed), we process it only with the consent you confirm, Art. 6(1)(a) and Art. 9(2)(a) GDPR.
• Retention: for as long as your account is active. When you delete your account, we delete your profile, identifiers and broker replies. We keep a minimal record of which requests were sent and when for up to 3 years (the standard German limitation period) to defend legal claims, Art. 6(1)(f) and Art. 17(3)(e) GDPR.

Removal requests are, by nature, sent to data brokers. Brokers are independent controllers of the data they hold about you; their own privacy policies apply to how they handle your request.

3.5 Payments

When paid plans are available, payments are processed by Stripe. We receive the plan, payment status and the last digits of your card, never your full card number.

• Legal basis: Art. 6(1)(b) GDPR (contract) and Art. 6(1)(c) GDPR (tax and commercial record-keeping).
• Retention: invoices and accounting records for 8 or 10 years as required by German tax and commercial law (§ 147 AO, § 257 HGB).

3.6 Contacting us

If you email us, we process your email address, name and the content of your message to answer you.

• Legal basis: Art. 6(1)(b) GDPR if your message concerns a contract, otherwise Art. 6(1)(f) GDPR (our interest in answering enquiries).
• Retention: we delete the conversation once your enquiry is resolved, unless we must keep it for legal reasons.

3.7 Security and abuse prevention

We keep an append-only log of who accessed, exported or deleted customer data, and when. This lets us detect misuse and prove that your data was handled correctly.

• Legal basis: Art. 6(1)(c) and (f) GDPR (security of processing, Art. 32 GDPR).
• Retention: up to 3 years.

4. Google API services

We use Google APIs (Google Search Console and Google Ads) only to manage our own website and advertising accounts. We do not ask you to sign in with Google and we do not request access to your Google account or any Google user data.

If we ever request access to Google user data, our use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements, and we will update this policy before we do so.

5. Service providers and recipients

We use the following providers, who process personal data on our behalf under a data processing agreement (Art. 28 GDPR):

Provider	Purpose	Location
Vercel Inc.	Website hosting, server functions (region Frankfurt)	USA / EU
Supabase Inc.	Database and sign-in (database in Frankfurt, Germany)	USA / EU
Resend, Inc.	Sending sign-in and service emails	USA
PostHog Inc.	Product analytics without cookies (EU Cloud, Frankfurt)	EU / USA
Stripe Payments Europe, Ltd.	Payment processing (once paid plans launch)	Ireland / USA
Anthropic PBC	Sorting broker replies automatically (once launched); no training on your data	USA
Slack Technologies, LLC	Internal notification to our team when you request a check or report (phone number, email, the name and ZIP code you entered)	USA

Other recipients:

• Google Ireland Limited receives the click ID and time of a sign-up when you came from one of our Google ads (see 3.2b).
• Data brokers receive the removal requests you authorize (see 3.4).
• Authorities and courts where we are legally required to disclose data.
• Professional advisers (such as tax advisers and lawyers), who are bound by confidentiality.

We do not sell personal data and we do not share it with advertisers.

6. Transfers outside the EU

Some providers are based in, or may access data from, the United States. Where a provider is certified under the EU-U.S. Data Privacy Framework, the transfer is based on the European Commission's adequacy decision (Art. 45 GDPR). Otherwise, we rely on the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR) plus additional safeguards such as encryption. You can ask us for a copy of these safeguards.

7. How we protect your data

• All connections use TLS (HTTPS).
• Names, addresses, email addresses and other identifying details are encrypted with AES-256-GCM in our application before they reach the database; the keys are stored separately from the data.
• Access is restricted per customer (row-level security) and every staff access to customer data is logged.
• We do not automate CAPTCHAs, do not use logged-in broker accounts and never store ID documents.

8. Automated decisions

We do not make decisions based solely on automated processing that have legal or similarly significant effects on you (Art. 22 GDPR). Matching listings and sorting broker replies is automated, but you can always ask us to review a result.

9. Your rights

Under the GDPR you have the right to:

• access the personal data we hold about you (Art. 15),
• have inaccurate data corrected (Art. 16),
• have your data deleted (Art. 17),
• restrict processing (Art. 18),
• receive your data in a portable format (data portability, Art. 20),
• withdraw consent at any time, with effect for the future (Art. 7(3)).

Right to object (Art. 21 GDPR): where we process your data based on our legitimate interests (Art. 6(1)(f)), you can object at any time for reasons arising from your particular situation. We will then stop, unless we have compelling legitimate grounds or need the data to establish, exercise or defend legal claims.

To exercise any of these rights, email mail@lennard-klein.com. We may ask you to confirm your identity before acting on a request.

You also have the right to lodge a complaint with a data protection supervisory authority, in particular in the EU member state where you live or work. The authority responsible for us is Der Hessische Beauftragte für Datenschutz und Informationsfreiheit, Wiesbaden, Germany.

10. Do you have to provide data?

You are not required by law to give us personal data. Without an email address we cannot create an account, and without identifying details we cannot find your listings or send removal requests on your behalf.

11. Children

Our service is not directed at children under 16. We do not knowingly collect their data without the consent of a parent or guardian.

12. Changes to this policy

We update this policy when our processing changes, for example before we add a new provider. The date at the top shows the latest version. If a change significantly affects you, we will tell you by email before it takes effect.