Privacy

Controller

Maximilian Jeschek
Bürgerstraße 30
01127 Dresden
Germany

The easiest way to send us enquiries about data protection is by email to kontakt@waumate.com. We are not required to designate a data protection officer.

Last updated: 7 October 2026.

What data we process

Account: email address, display name, profile picture, language setting and your password. When you sign up, you confirm that you are at least 18 years old and that you agree to the terms of use; this confirmation is not stored. The password is never stored in plain text, only as a hash (Argon2id). For every sign-in we store the time, the browser identifier and the network of your IP address, the last digits of which we cut off (for example 203.0.113.0/24), so that signed-in devices can be identified; you will find them in your data export. The legal basis is Art. 6(1)(b) GDPR (performance of a contract).

Sitter listing: the details from the onboarding, including your address. To determine the coordinates, the address is transmitted to the geocoding service Nominatim when it is saved (see “Recipients”), and the result is cached. If your listing is published, everyone sees in the search and on the town pages (for example “Dog sitters in Dresden”) your first name, your profile picture, town and district, your first photo, the headline, your services and prices, the days of the week on which you have time, and the average of your reviews. The town pages are public and can be picked up by search engines; we exclude your profile page and your photos from this, and the common search engines comply with that. Everything else is visible only to signed-in members with a confirmed email address, and your street and house number to no one. Distances are rounded and the search point is shifted slightly so that your address cannot be narrowed down. Legal basis: Art. 6(1)(b) GDPR.

Messages: the chat history with timestamps as well as read and unread counters. If you have not read a message for more than about ten minutes, we send you an email notification with the display name of the sender, but without the content of the message. Legal basis: Art. 6(1)(b) GDPR.

Reviews: star rating, text, date, your display name and your profile picture, visible to signed-in members on the sitter's profile. The average of all of a sitter's reviews is visible to everyone. Legal basis: Art. 6(1)(b) GDPR.

Pets: the profiles of your pets with photos, including details of character, health, medication and feeding. For each pet you decide who sees it: people you write to see the whole profile; on your published sitter profile, signed-in members with a confirmed email address see the profile without health and care. Guests never see your pets. Legal basis: Art. 6(1)(b) GDPR.

Photos: profile pictures, sitter photos and pet photos are re-encoded on upload, in the course of which metadata such as GPS coordinates is lost, and are kept in non-public storage. They are served only via waumate. Your profile picture and the first photo of a published sitter listing are publicly accessible; all other photos are delivered only to the people who are allowed to see them. Legal basis: Art. 6(1)(b) GDPR.

Reporting and blocking: reports (reason, note, conversation concerned) are stored and can be viewed by the moderators in the protected operator console, together with the message history of the reported conversation, so that the report can be reviewed. For every report the moderators receive an email that contains neither names nor content. Once the report has been reviewed, you are told by email how we decided, without details about the other account. Blocks are stored in order to prevent the chat between the two users. Legal basis: Art. 6(1)(f) GDPR (safety and protection of users against harassment).

Moderation: in the operator console the moderators see the data of an account to the extent that it is necessary for moderation: account details, signed-in browsers with truncated IP address, sitter listing, pets with all photos, reviews, reports and the number of conversations. For requests for information and to investigate violations, they can retrieve a complete export of the data of an account after entering their password again. They can remove content, pause sitter listings, suspend accounts for a limited period or indefinitely, and delete accounts. We inform the account concerned by email, stating the reason, about a suspension, a paused listing, a changed name and removed content. A suspended account is also told about the suspension and its end when signing in; during that time it cannot be reached, and its sitter listing and its pets are hidden. Each of these actions and every reading of a reported message history is logged with the moderator, the time, the account concerned, the reason and, where applicable, a note. Legal basis: Art. 6(1)(f) GDPR (secure operation and protection of users).

Usage statistics: we count page views without cookies. So that returning visitors count only once on any one day, we form a hash from the IP address and the browser identifier with a random value that is held only in memory and is generated anew every night. Neither IP addresses nor these hashes are stored; only totals per hour are stored (page views, visitors, pages viewed, response times, status codes, device type and the domain of a referring page). For signed-in members we additionally store when they were last active; we update this time at most once per hour. Legal basis: Art. 6(1)(f) GDPR (operation and improvement of the service).

Usage events: in the same way we count how the search is used and how visitors find their way to a contact: searches with the chosen filters (such as service, dog size, day, radius, price level and experience level, sorting) and the federal state of the place searched for, but never the text entered, the postcode or an address; also whether a search had results, views of sitter profiles, sign-ups started and completed, and first messages to sitters. How far a visitor gets along fixed paths on one day (such as search, profile, message) we record with the same daily hash in memory only; only totals per hour are stored. Once a day we also store overall figures (accounts, accounts active in the last 1, 7 and 30 days, listings, pets, conversations, messages, reviews) and evaluate our data in totals, for example how many new accounts confirm their email address. These figures contain no information about individual persons. Legal basis: Art. 6(1)(f) GDPR (improvement of the service); you can object under “Objection to the usage statistics”.

Technical operation: server logs contain the time, the function called, the status code, where applicable your account identifier, and the truncated network of your IP address. The web server placed in front logs only errors, with the time, the path requested and the browser identifier, but without your IP address. To guard against abuse we count, among other things, sign-in attempts, emails sent, messages, new conversations, reports and uploads; for this the full IP address is held only in memory, and stored counters carry only an encrypted hash. Legal basis: Art. 6(1)(f) GDPR (security of the service).

Cookies and local storage

We use only what is technically necessary for the service (§ 25(2) no. 2 TDDDG, the German Telecommunications and Digital Services Data Protection Act), which is why we do not ask for consent: the session cookie that keeps you signed in (HttpOnly, Secure, SameSite=Lax, up to 180 days), a short-lived cookie for notices after actions (at most 60 seconds) and, in the browser storage (localStorage), your choice between light and dark appearance. In the operator console a cookie remembers whether the sidebar is collapsed (7 days). If you object to the usage statistics, we remember this in a cookie (stats_optout, 1 year) so that we can observe the objection.

There is no tracking, no advertising and no embedded third-party services; we serve fonts and images ourselves.

Recipients and processors

Hosting: the server, database and file storage are operated for us by Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen. The server with the database is located in a data centre in Helsinki (Finland), the file storage for photos and encrypted backups in Nuremberg (Germany). A data processing agreement under Art. 28 GDPR is in place with Hetzner.

Delivery and protection: all requests to waumate.com run through the network of Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA. Cloudflare accepts the encrypted connection, fends off attacks, answers name resolution (DNS) requests and forwards the request to our server. In doing so, Cloudflare processes your IP address and the transmitted content on our behalf, as a rule in a data centre near you; processing in the USA is possible. If you write to us at kontakt@waumate.com, Cloudflare also receives your email and forwards it to our mailbox. Cloudflare is certified under the EU-US Data Privacy Framework, for which there is an adequacy decision of the European Commission (Art. 45 GDPR); standard contractual clauses apply in addition. A data processing agreement under Art. 28 GDPR is in place with Cloudflare. Legal basis: Art. 6(1)(f) GDPR (secure and reliable delivery).

Sending emails: Scaleway SAS, 8 rue de la Ville l'Evêque, 75008 Paris, France, sends on our behalf, from servers in France, account confirmations, password reset links, notices about your account (for example after a password change), chat notices, notifications of moderation decisions and notices before inactive accounts are deleted. For this purpose Scaleway receives your email address and the content of the respective email. A data processing agreement under Art. 28 GDPR is in place with Scaleway.

Mailbox: emails that you write to us are kept in our mailbox at Google Workspace. The provider is Google Cloud EMEA Limited, 70 Sir John Rogerson's Quay, Dublin 2, Ireland. Processing in the USA is possible; Google is certified under the EU-US Data Privacy Framework, for which there is an adequacy decision of the European Commission (Art. 45 GDPR), and standard contractual clauses apply in addition. A data processing agreement under Art. 28 GDPR is in place with Google. Legal basis: Art. 6(1)(f) GDPR (handling your enquiry).

Geocoding: if you save your address as a sitter, we transmit the street, house number, postcode and town to the Nominatim service of the OpenStreetMap Foundation, St John's Innovation Centre, Cowley Road, Cambridge, CB4 0WS, United Kingdom. There is an adequacy decision of the European Commission for the United Kingdom (Art. 45 GDPR). Nominatim does not receive any other data of yours.

Beyond this we do not pass on any data, and we do not sell any.

Storage period

Account: for as long as it exists. If you do not sign in for almost two years, we write to you; 30 days later, after two years without a sign-in, we delete the account if you have not signed in by then. A suspended account is kept for as long as the suspension runs, so that it cannot be circumvented by signing up again.

Sign-ups whose email address was never confirmed: 7 days.

Signed-in browsers: until sign-out, after 30 days without use, after 180 days at the latest.
Confirmation links: 48 hours. Password reset links: 1 hour.
Counters against abuse: at most 24 hours.

Messages: for as long as your account exists. If you delete it, we empty your messages; the fact that the conversation took place and what the other person wrote remains visible to them. Open reports are kept until they have been reviewed.

Geocoding results: 180 days, without a match 24 hours; those for your saved address are deleted immediately when you change it or delete your account.

Closed reports: 1 year after they were closed. Moderation log: 2 years. Hourly totals of the usage statistics: 400 days; the daily overall figures contain no personal data and remain stored. Server logs: at most 7 days.

Encrypted backups of the database: 14 days. For that long, data that has already been deleted may still be contained in them.

Account deletion

You can delete your account in the settings at any time; the deletion takes place immediately. In the process your record is anonymised: email address, name, profile picture, password and signed-in browsers are removed. Your sitter listing including the address, your pets with their photos, the reviews you have received and those you have written, your blocks and closed reports in which you were involved are deleted.

Your messages are emptied; in their place the other person now sees only “Message deleted”. If there is a report about a conversation that is still open, your messages there are kept until the report has been reviewed, and are then emptied (Art. 17(3)(e) GDPR). In the moderation log the type, time and reason of an action remain; notes and former names are removed.

Your rights

You have the right of access (Art. 15 GDPR) and the rights to rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). In your account, under “Your data”, you can download at any time everything we store about you, together with your photos, as a ZIP archive. For everything else, write to kontakt@waumate.com.

You can also lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), for example with the Sächsische Datenschutz- und Transparenzbeauftragte (Saxon Data Protection and Transparency Commissioner), Maternistraße 17, 01067 Dresden.

Right to object

Where we process data on the basis of legitimate interests (Art. 6(1)(f) GDPR), you can object at any time on grounds relating to your particular situation (Art. 21 GDPR). We then no longer process the data unless we can demonstrate compelling legitimate grounds that override your interests, or the processing serves the establishment, exercise or defence of legal claims. You can object informally by email to kontakt@waumate.com.

Objection to the usage statistics

You can object to the usage statistics without giving reasons, here or in your account. After that we count your browser only in technical totals (requests, status codes, response times) that we need for operation: no hash is formed any more, and neither visits nor events are counted. If your browser sends the “Global Privacy Control” signal, this automatically counts as an objection.

Mandatory information, minimum age and automated decisions

For an account we need an email address, a display name, a password, the confirmation that you are at least 18 years old, and your agreement to the terms of use; without them we cannot create an account. waumate is aimed only at adults. All other information is voluntary, but some of it is necessary for individual features, such as the address for a sitter listing.

There is no automated decision-making, including profiling, under Art. 22 GDPR. The order of the search results is determined only by distance, rating or price.

Data security

Transmission runs over TLS, passwords are hashed with Argon2id, session and email tokens are stored only as a hash, and access is limited by rate limits. The operator console is additionally protected with a second factor, and every action of the moderators is logged. We collect only the data that is necessary to operate waumate.