Kein Abo, keine Grundgebühr. Testen ohne Zahlungsdaten.
No subscription, no base fee. Free trial without payment details.
Legal
Last updated: 31 October 2026 · This is a translation of the German privacy policy (Datenschutzerklärung). In case of doubt, the German version prevails.
This privacy policy applies to the website www.optinavo.de, the customer portal app.optinavo.de, the documentation docs.optinavo.de and the application programming interface (API) at api-live.optinavo.de and api-test.optinavo.de.
Platform7 mediadesign, owner Samuel Schmidt
Im Grund 8, 35043 Marburg, Germany
Email: info@optinavo.de
We have not appointed a data protection officer, as there is no legal obligation to do so. If you have any questions about data protection, please write to us at the email address above.
All parts of optinavo are operated by Host Europe GmbH, Hansestraße 111, 51149 Köln, Germany, in a data centre in Strasbourg (France). We have concluded a data processing agreement with the provider.
With every request, the web server automatically records: IP address, date and time, requested address, amount of data transferred, status code, referring page and browser identification. We need this data to deliver the services, to ensure their security and to find errors. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in secure and stable operation). The log files are deleted after 30 days at the latest, unless they are needed longer to investigate a security incident.
Neither area sets cookies or embeds third-party services. Only the server log files described in section 3 are processed.
In the API reference of the documentation you can try out requests to the API ("Test Request"). Your browser sends these requests directly to our API; section 6 applies to the API key used and the data transmitted.
To register, we need your email address and a password. We store the password only as a cryptographic hash. We send you an email to confirm your address. We store your acceptance of the Terms and Conditions with the time and version.
The legal basis is Art. 6(1)(b) GDPR (contract or pre-contractual measures). We store the data until the account is deleted.
After you log in, we set a session cookie that keeps you logged in while you use the portal and protects forms against misuse. For each session we store your IP address, the browser identification and the time of the last activity. The session ends after 120 minutes of inactivity or when you log out.
The cookie is strictly necessary for the service you have requested (§ 25(2) no. 2 TDDDG); the legal basis for further processing is Art. 6(1)(b) and (f) GDPR.
With your first purchase we record your company details: company name, address, country and, where applicable, VAT identification number. We have the VAT ID confirmed via the European Commission's VAT Information Exchange System (VIES). We create invoices electronically and send them by email.
Payment by credit card: Payments are processed by Stripe Payments Europe, Limited, 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland. You enter your card details directly on Stripe's payment page; we do not receive them. We transmit the amount, your email address and a reference of the top-up to Stripe and store the payment identifier. Stripe also processes data in the USA; the transfer is safeguarded by the EU-US Data Privacy Framework or EU Standard Contractual Clauses. Stripe's privacy notice: stripe.com/privacy
Payment by bank transfer: We match incoming payments using the payment reference.
The legal basis is Art. 6(1)(b) GDPR (contract) and Art. 6(1)(c) GDPR (tax and commercial law obligations). We retain invoices and accounting records for the period required by law (§ 147 AO, § 257 HGB, § 14b UStG).
You can view the results of optimisations on a map in the portal. For this, your browser loads the Google Maps JavaScript API from Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. In particular, your IP address and the map sections displayed are transmitted to Google; Google may also process data in the USA (EU-US Data Privacy Framework). The map is loaded only when a page with a map is displayed; Google Maps is not loaded on any other page.
The legal basis is Art. 6(1)(b) GDPR, as the map view is part of the service you use. Google's privacy policy: policies.google.com/privacy
We send you the emails required for using the service: confirmation of your email address, password reset, payment information, invoices and important changes to the service. They are sent by our own mail server at our hosting provider (section 3). We do not send advertising emails.
For requests to the API we process the API key (only its hash is stored), the time of last use, an identifier for each request for troubleshooting and, for write requests with an idempotency key, the result of the request for 24 hours so that a repeated request is not executed twice. The legal basis is Art. 6(1)(b) GDPR.
We process delivery addresses and other stop details submitted by our customers as a processor on behalf of the respective customer. The customer is the controller; we forward enquiries from delivery recipients to the customer.
To check addresses and calculate routes, we transmit addresses or coordinates to the Google Maps Platform (Google Cloud EMEA Limited, Dublin, Ireland). Tours, stops and results are deleted 30 days after the tour date.
If you write to us by email, we process your details to answer your enquiry (Art. 6(1)(b) or (f) GDPR). We delete the messages when they are no longer needed and no retention obligations apply.
After the contract ends, we delete the data of your account. We retain invoices and accounting records until the statutory retention periods have expired. Backups are overwritten as part of the usual rotation.
You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on Art. 6(1)(f) GDPR (Art. 21). To exercise these rights, write to info@optinavo.de.
You also have the right to lodge a complaint with a data protection supervisory authority. The authority responsible for us is: Der Hessische Beauftragte für Datenschutz und Informationsfreiheit (Hessian Commissioner for Data Protection and Freedom of Information), Gustav-Stresemann-Ring 1, 65189 Wiesbaden, Germany, datenschutz.hessen.de
We update this privacy policy when our services or the legal situation change. The version published here applies.
A service of Platform7 mediadesign, Marburg, Germany · For businesses based in the EU only · All prices exclude VAT
