Privacy Policy

Maksim Grachev, Gleisstraße 20, 04229 Leipzig, Germany. Contact: help@stipendium.berlin.

When you visit the site, the hosting infrastructure may process technical request data such as IP address, timestamp, requested URL, browser information and error logs. This is necessary to deliver and secure the service and to diagnose faults. The legal basis is Article 6(1)(f) GDPR (our legitimate interest in operating a secure service).

Payments are processed by Stripe. Stripe receives the payment and contact information you enter at checkout. We use the checkout session identifier, payment status and email address to verify your purchase, grant access and provide customer support. The legal bases are Article 6(1)(b) GDPR (performance of the purchase contract) and Article 6(1)(c) GDPR where transaction records must be retained by law.

Learn more in the Stripe Privacy Policy.

If you request an access link, your purchase email is sent to Resend solely to deliver the transactional message. We do not use access emails for marketing. Learn more in the Resend Privacy Policy.

If you separately request funding alerts, we send a confirmation email and add your email address to the BSS Navigator funding-alert list only after you confirm it. The legal basis is Article 6(1)(a) GDPR (consent). Resend stores the contact and delivers these updates. You can withdraw consent at any time using the unsubscribe link in an alert or by emailing help@stipendium.berlin. Withdrawing consent does not affect earlier lawful processing.

If you send a draft for an application review on the Funding Co-pilot page, we receive your email address, the program you chose, your intended timing, your draft (or the link you paste), the optional note you write, your interface language and a short profile summary (stage, base cities, team size and what the money should cover). Your full Co-pilot answers stay in your browser, or in your account if you signed in. To write a first review on the spot, the draft, the note and the program facts are sent to an AI model through Lovable AI Gateway; the model provider processes them only to answer. Resend delivers the request and the first review to our inbox and a confirmation to you. We keep the request in our email only to answer it and delete it on request. The legal basis is Article 6(1)(a) GDPR (consent); you can withdraw it any time by emailing help@stipendium.berlin.

When you ask a question in the chat on a program card, your question, the last few turns of that chat and a short project summary (your one-line description, stage, base cities, team size, whether you are registered and full-time, and your fields; never your name, website or contact details) are sent to an AI model through Lovable AI Gateway to write the answer. We don't store the conversation; it disappears when you close the page. Only a daily count of your questions is kept in your browser. Please don't type personal data into the chat. The legal basis is Article 6(1)(f) GDPR (answering the question you ask).

If you buy the Founding Pass, you pay in Stripe Checkout; Stripe (Stripe Payments Europe, Ltd.) processes your card or other payment details, and we never see them. We store your account, email address, the Checkout session, the amount and where you opened the offer in our database (Lovable Cloud) to keep the pass on your account, and send you one confirmation email. Emails you left on the earlier Founding Pass waitlist stay there until you ask us to remove them. The legal basis is Article 6(1)(b) GDPR (the purchase) and Article 6(1)(c) GDPR for records we must keep for tax purposes. Ask us anything at help@stipendium.berlin.

You can use the Funding Co-pilot without an account; your answers then stay in your browser. If you choose to sign in with Google, Apple or an email link, we store your email address, the name and profile picture your provider shares, and your Co-pilot data (profile answers, saved and set-aside programs and ticked to-dos, and your beta tester code if you have one) so you can open them on other devices. Sign-in and storage run on Lovable Cloud (Supabase). Signing in moves the answers from this browser into your account. Signing out removes the copy from that browser. The legal basis is Article 6(1)(b) GDPR (providing the service you asked for). To delete your account and its data, email help@stipendium.berlin.

Signed-in founders can get a forwarding address for a project. Letters you forward there are received by Resend and stored in your account on Lovable Cloud (Supabase): sender, subject, the text of the letter and the names of attachments (not the attachments themselves), so we can file them under the matching application. We never read your mailbox; only letters you choose to forward reach us. You can delete each letter in the Co-pilot, and all of them go with your account. The legal basis is Article 6(1)(b) GDPR.

After a verified purchase, BSS Navigator stores a signed, HttpOnly access cookie for up to 180 days. It is strictly necessary to remember that your browser has access to the paid database. It is not used for advertising or cross-site tracking. You can delete it in your browser and restore access using the email from your purchase.

We use PostHog Cloud EU to understand which pages and acquisition channels are useful and whether visitors start checkout or use Personal Match. PostHog is configured in cookieless mode: it does not store cookies, local storage or session storage, and we have disabled session replay, automatic interaction capture and user profiles. We send only page views and a small set of explicitly named product events; email addresses and questionnaire answers are not included. Query strings are removed from URLs before analytics events are sent.

If you use the Feedback button in the Funding Co-pilot, your choice and the note you type are sent to PostHog as one event; please do not include personal data. Beta testers may get a personal link with a short tester code, which is kept on the device and attached to analytics events so we can see which parts of the beta each tester used. Feedback sent with a tester code is also stored, with that code, in our database (Lovable Cloud) so we can read each tester's notes together; ask us to delete it at any time. Testers can also fill in a final survey; its answers are stored with the tester code in the same database and used only to improve the product. We also store which steps of the beta each tester reached and when (for example "opened a program" or "sent feedback"), with the tester code.

To count unique visitors without cookies we also keep a simple visit counter in our database (Lovable Cloud): for each day it stores whether you saw the site, the Funding Co-pilot or finished a Co-pilot profile, which pages you opened (the path only, without query parameters), the site that referred you (for example Google), whether you used a phone or a computer and your country, under a one-way hash of your IP address and browser that changes every day. Nothing is stored on your device, the IP address itself is not stored, and the hash cannot be linked across days.

PostHog may process technical request data to produce privacy-preserving aggregate analytics. The legal basis is Article 6(1)(f) GDPR (our legitimate interest in measuring and improving the service). We also respect supported browser Do Not Track signals. Learn more in the PostHog Privacy Policy.

We use Lovable for hosting and deployment, Stripe for payment processing, Resend for transactional and consented funding-alert email, and PostHog Cloud EU for cookieless analytics. These providers may process data in countries outside the EEA subject to the safeguards described in their respective privacy documentation.

Purchase records are retained for the period required by applicable tax and commercial law. Funding-alert emails are retained until you unsubscribe or request deletion. Application help requests are kept in our inbox only until the request is answered or you ask us to delete them. Support correspondence is retained only as long as needed to resolve the request and document relevant transactions. Technical logs are retained according to the hosting provider's operational and security settings.

Subject to the conditions of the GDPR, you may request access, correction, deletion, restriction, portability or object to processing. You may also lodge a complaint with a competent data protection authority. Contact us at help@stipendium.berlin to exercise your rights.