Skip to content
wohnıo
  • How it works
  • Pricing
  • FAQ
DEEN
Log inStartGet started

Privacy policy

Draft, legal review required before launch

This text describes what Wohnio does today and plans for launch. It has not been legally reviewed yet. Marked parts [like this] are still open. The German version is legally binding.

Status: draft of 12 November 2026

Contents

  1. The essentials
  2. Who is responsible
  3. When you visit the website
  4. Getting started and your account
  5. Login and confirmation via email code
  6. Applications through our application service
  7. Map in the dashboard
  8. Referrals
  9. Cancellation
  10. Partner programme
  11. Analytics with Plausible
  12. A/B test without cookies
  13. Cookies and browser storage
  14. Emails
  15. Payment (planned)
  16. Our service providers
  17. Data outside the EU
  18. How long we keep data
  19. No automated decisions
  20. Your rights
  21. Changes

1. The essentials

  • We only process what we need for your flat search: name, email, search, application message and the history of your applications.
  • You only enter your ImmoScout24 password on the ImmoScout24 login page. It is not stored.
  • Your application documents stay in your ImmoScout24 profile. The portal attaches them, we don't store them.
  • No ad trackers, no selling of data. Analytics and A/B test work without cookies.
  • That's why there is no cookie banner: your browser only stores what the features you use need.
  • You can disconnect ImmoScout24 at any time and delete your account with one click.

2. Who is responsible

Responsible for processing your data on this website and in the dashboard:

[Company name and legal form] [Street and number] [Postcode and city] Represented by: [authorised representative] Email: hallo@getwohnio.com

As things stand, we are not required to appoint a data protection officer [check]. Send any privacy questions to the address above.

3. When you visit the website

Product

Help

  • Contact

Partners

Account

Legal

wohnıo
DEEN

Wohnio applies to new rental flats for you, before others even see the listing.

Start your search

Wohnio is hosted by Vercel. Pages and server functions run in the Frankfurt region (fra1). To deliver a page, Vercel processes technical data on every request: IP address, time, requested address, referrer, browser and operating system. This data is kept briefly in logs so errors and attacks can be spotted [check Vercel log retention].

The legal basis is our legitimate interest in a secure, working website (Art. 6(1)(f) GDPR).

We don't load fonts from Google, they are on our own server. Links to press articles are plain links: you only leave Wohnio when you click them.

4. Getting started and your account

When you set up a search via “Get started”, we create an account for you at the end. For this we store:

  • Account: first name, last name, email address, language, sign-up time, your referral code and, if any, the code you came through.
  • Search: city and districts, rooms, maximum total rent, features (for example balcony, pets, step-free), move-in date, flatshare, furnished, fixed-term, renovation, housing entitlement certificate (WBS) and, optionally, your own ImmoScout24 search link.
  • Settings: your application message, whether the search is running, whether ImmoScout24 is connected and which notifications you want.
  • Extra questions: your current situation, your goal, how fast you want to be, how many applications you send per week and how you heard about us. Only we use these answers, to improve Wohnio. Our application service does not get them.

Without name and email we cannot run an account or send applications in your name. The legal basis is our contract with you (Art. 6(1)(b) GDPR), and for the extra questions our legitimate interest in improving Wohnio (Art. 6(1)(f) GDPR).

The data is stored in our database at Supabase in Frankfurt. You can change your search and message in the dashboard at any time. If you delete your account, we delete account, search, settings and application history immediately [check deletion from backups].

5. Login and confirmation via email code

Wohnio doesn't use passwords. After you create your account and every time you log in, we email you a 6-digit code. It confirms that the address belongs to you. The code is valid for 10 minutes and works once. We only store a checksum (hash) of the code, its expiry time, the number of attempts (at most 5) and whether your email is confirmed. When you log in, we don't reveal whether an address has an account.

After login we set the cookie “wohnio_session”. It only contains your account number and the expiry date, is signed and lasts 30 days. We delete it when you log out.

The legal basis is our contract with you (Art. 6(1)(b) GDPR). The cookie is strictly necessary for login (Section 25(2) No. 2 TDDDG), so no consent is needed.

6. Applications through our application service

Applications are sent by our own application service. The website only talks to it server to server through a protected interface. Once your search is running, it receives:

  • a random internal ID of your account, not your name or email address,
  • your search: city or the area you drew on the map (shape or radius), rooms, maximum total rent and your other filters (for example living space, floor, year built, flat type, features, pets, new build, housing entitlement certificate). If you entered your own ImmoScout24 search link, the service gets that instead,
  • your application message. We insert your first and last name beforehand, because the service sends the message word for word.

We don't pass on districts, move-in date, flatshare, furnished, fixed-term or renovation unless they are part of your own search link.

Connecting ImmoScout24

To connect, our application service opens a browser window with the ImmoScout24 login page. Only you see the link to it. You log in there as usual. The service then stores your ImmoScout24 login (session data) so it can send enquiries in your name. It does not store your password [confirm with tech]. The website only learns whether ImmoScout24 is connected.

If you disconnect ImmoScout24 in the dashboard, the service deletes the stored login. If you delete your account, the service deletes everything about you: searches, login, history and events.

What happens next

The service checks new listings for your search and sends your message to the provider through your ImmoScout24 account. The provider sees your message and whatever ImmoScout24 attaches from your profile, such as your application documents. ImmoScout24 itself is responsible for everything that happens on ImmoScout24. Their privacy policy applies there.

After every application and when there are problems, the service reports to us (signed message to our server): which listing (title, address, price, size, rooms, link, provider), when, and whether it worked or why not. We show this in your dashboard and keep the latest 300 events in your account. We don't store providers' contact details (name, phone) that the service sends along.

If you pause the search, cancel or delete your account, we delete the search at the service. It then stops checking listings and sending enquiries.

The legal basis is our contract with you (Art. 6(1)(b) GDPR). The service runs on servers in [server location of the application service]. It is operated by [operator: ourselves or a processor]. Retention at the service: search and message until you pause the search, cancel or delete your account; events 30 days; which listings were reported to you and which providers were contacted, until you delete your account.

7. Map in the dashboard

In the dashboard you can draw your search area on a map or pick a radius around a point. We store the drawn area, or the centre and radius, with your search and pass them on to our application service so it only searches there.

Your browser loads the map images (tiles) directly from [choose map provider, in this draft: OpenStreetMap Foundation, United Kingdom]. The provider receives technically necessary data such as your IP address, browser details and the map section you are viewing. The map only loads once you choose “Draw on map” or “Radius”.

The legal basis for the search area is the performance of our contract (Art. 6(1)(b) GDPR); for loading the tiles it is our legitimate interest in a usable map (Art. 6(1)(f) GDPR) [pick a provider with a processing agreement and EU servers, or self-host the tiles].

8. Referrals

Every account gets its own referral code and link. If someone creates an account through your link, we store your code with that person. You only see how many people came through your link, not who.

Your browser remembers the code from the link until you create an account or close the tab (see Cookies and browser storage). Discounts and credits will later be settled through our payment provider.

The legal basis is the contract (Art. 6(1)(b) GDPR) and our legitimate interest in attributing referrals correctly (Art. 6(1)(f) GDPR).

9. Cancellation

You can cancel in the dashboard or without logging in via the cancellation button. We store first name, last name, email address, type of cancellation, your reason for an extraordinary cancellation, the requested date and when it arrived. If you are logged in, we take name and email from your account and pause your search.

You get a confirmation by email right away. The legal basis is our legal obligation (Section 312k BGB, Art. 6(1)(c) GDPR) and our contract with you (point b).

Voluntarily, you can tell us why you are leaving (choice) and what we could do better (free text, max. 1,000 characters). Without it, your cancellation works just the same. We use this to improve Wohnio (Art. 6(1)(f) GDPR). Our analytics only count the chosen reason, without any link to you.

We keep the cancellation as proof, even if you delete your account, then without a link to the account: [retention period, e.g. 3 years].

10. Partner programme

Creators can sign up on the partner page. We store email address, social media handle (if given), language, the sign-up page, a referral code and campaign data from the link (utm_source, utm_medium, utm_campaign). Afterwards you can voluntarily add your city and how you heard about us.

We send you a confirmation email. The sign-up only counts once you click the link (double opt-in). We delete unconfirmed entries after 30 days. After that we keep you informed about the partner programme and the launch of Wohnio until you unsubscribe.

The legal basis is your consent (Art. 6(1)(a) GDPR). You can withdraw it at any time, a short email to hallo@getwohnio.com is enough.

11. Analytics with Plausible

We measure reach with Plausible Analytics. Plausible sets no cookies, stores nothing in your browser and builds no profiles. We load the script through our own domain.

From IP address and browser, Plausible creates an identifier that changes every day. The IP address itself is not stored. Plausible counts page views, source (referrer, campaign link), country, device type and browser, plus these events:

  • clicks on “Get started” and other start buttons
  • steps in the sign-up flow and the sign-up itself (with the chosen city)
  • the variant shown in the A/B test
  • sign-up and confirmation in the partner programme, with optional extra details
  • referral link copied or shared
  • cancellation (with the chosen reason)

We only see totals, never individual people. The provider is Plausible Insights OÜ, Estonia. The data stays in the EU [check server location in DPA]. The legal basis is our legitimate interest in improving Wohnio (Art. 6(1)(f) GDPR). You can object at any time, for example with an ad blocker.

12. A/B test without cookies

On the homepage we test different versions, for example of the headline, a key figure or the position of the prices. Our server works out which one you see on every request: from a secret value, the date, your IP address and your browser identifier (user agent) it builds a checksum (hash) and picks the variant from it. That way you see the same one for a day. The checksum is built separately for each test.

Nothing is stored, neither on the server nor in your browser. There is no cookie. When you start the questionnaire, the server works out the variants again the same way. We count them in Plausible together with the questionnaire steps and the sign-up to see which version works better.

The legal basis is our legitimate interest in improving the website (Art. 6(1)(f) GDPR).

13. Cookies and browser storage

We don't use cookies for advertising or analytics. Your browser only stores what the feature you are using needs (Section 25(2) No. 2 TDDDG). That's why we don't need consent and show no cookie banner.

Name
wohnio_session
Type
Cookie
Purpose
Keeps you logged in. Only contains account number and expiry date.
How long
30 days or until you log out
Name
NEXT_LOCALE
Type
Cookie
Purpose
Remembers the language when you use Wohnio in a different language than your browser's.
How long
Until you close the browser
Name
wohnio.onboarding.v1
Type
Local storage
Purpose
Your answers in the sign-up flow (without name and email) so you can continue later.
How long
Until you delete it in your browser
Name
wohnio.account
Type
Session storage
Purpose
First name and email after sign-up, to greet you when choosing a plan.
How long
Until you close the tab
Name
wohnio.plan
Type
Session storage
Purpose
Plan from a link, so it is preselected.
How long
Until you close the tab
Name
wohnio.tour.v1
Type
Local storage
Purpose
Only “tour seen”, so the introduction doesn't show every time.
How long
Until you delete it in your browser
Name
wohnio_attribution
Type
Session storage
Purpose
Referral code and campaign data from the link you came through.
How long
Until you close the tab
NameTypePurposeHow long
wohnio_sessionCookieKeeps you logged in. Only contains account number and expiry date.30 days or until you log out
NEXT_LOCALECookieRemembers the language when you use Wohnio in a different language than your browser's.Until you close the browser
wohnio.onboarding.v1Local storageYour answers in the sign-up flow (without name and email) so you can continue later.Until you delete it in your browser
wohnio.accountSession storageFirst name and email after sign-up, to greet you when choosing a plan.Until you close the tab
wohnio.planSession storagePlan from a link, so it is preselected.Until you close the tab
wohnio.tour.v1Local storageOnly “tour seen”, so the introduction doesn't show every time.Until you delete it in your browser
wohnio_attributionSession storageReferral code and campaign data from the link you came through.

Whatever is in local and session storage stays in your browser. It only reaches us when you submit a form, for example when creating your account. You can delete everything in your browser settings.

14. Emails

We send codes for login and email confirmation, cancellation confirmations and partner programme confirmation emails through Resend. Resend processes your email address and the content of the email. Provider: [Resend contracting entity], USA. We use the EU region [check]. The legal basis is that of the email itself: contract, legal obligation or consent.

15. Payment (planned)

You can't pay for anything on Wohnio yet. When subscriptions start, we will use Stripe (Stripe Payments Europe, Ltd., Ireland). PayPal, Apple Pay, SEPA direct debit and card are planned [check: all via Stripe?]. You enter your payment details directly with Stripe. We only receive what we need for the subscription and accounting, such as plan, amount and payment status [specify].

The legal basis is the contract (Art. 6(1)(b) GDPR). We keep billing data as long as commercial and tax law require (Art. 6(1)(c) GDPR). We will complete this section before payments start.

16. Our service providers

These providers process data on our behalf. We sign a data processing agreement with each of them (Art. 28 GDPR) [check agreements and contracting entities].

Provider
Vercel Inc., USA
Purpose
Hosting of the website and server functions
Where
Frankfurt (fra1)
Provider
Supabase Inc., USA
Purpose
Database: accounts, searches, cancellations, partner programme
Where
Frankfurt
Provider
Resend, USA
Purpose
Sending emails
Where
[check EU region]
Provider
Plausible Insights OÜ, Estonia
Purpose
Analytics without cookies
Where
EU
Provider
Stripe Payments Europe, Ltd., Ireland
Purpose
Payment (planned)
Where
EU [check]
Provider
Our application service
Purpose
Search and applications on ImmoScout24
Where
[server location]
ProviderPurposeWhere
Vercel Inc., USAHosting of the website and server functionsFrankfurt (fra1)
Supabase Inc., USADatabase: accounts, searches, cancellations, partner programmeFrankfurt
Resend, USASending emails[check EU region]
Plausible Insights OÜ, EstoniaAnalytics without cookiesEU
Stripe Payments Europe, Ltd., IrelandPayment (planned)EU [check]
Our application serviceSearch and applications on ImmoScout24[server location]

Beyond that, we don't share your data and we don't sell it.

17. Data outside the EU

We store your data in the EU. However, Vercel, Supabase and Resend are US companies, so access from the USA, for example during maintenance, cannot be ruled out completely. This is covered by [EU-US Data Privacy Framework or standard contractual clauses, check per provider].

18. How long we keep data

  • Account, search, message, settings and application history: until you delete your account. We keep at most the latest 300 events of the history.
  • Email code: 10 minutes, invalid as soon as it is used or after 5 wrong attempts. Login cookie: 30 days.
  • ImmoScout24 login at the application service: until you disconnect or delete your account.
  • Cancellations: [retention period].
  • Partner programme: unconfirmed 30 days, confirmed until you withdraw consent.
  • A/B test: not at all.
  • Billing data, once subscriptions exist: according to statutory periods.
  • Accounts not used for a long time: [define deletion period for inactive accounts].

19. No automated decisions

Wohnio applies on your behalf and according to your instructions. We make no decisions about you that have legal effects or affect you in a similarly significant way (Art. 22 GDPR). Whether you get a flat is up to the landlord.

20. Your rights

You have the right at any time to:

  • access your data (Art. 15 GDPR)
  • rectification (Art. 16 GDPR)
  • erasure (Art. 17 GDPR). You can delete your account yourself in the dashboard under “Account”.
  • restriction of processing (Art. 18 GDPR)
  • data portability (Art. 20 GDPR)
  • withdraw consent with effect for the future (Art. 7(3) GDPR)

Objection: where we process data based on our legitimate interest (Art. 6(1)(f) GDPR), you can object at any time on grounds relating to your particular situation (Art. 21 GDPR).

Just write to hallo@getwohnio.com. You can also lodge a complaint with a data protection supervisory authority, for example the one responsible for us: [competent state data protection authority with address].

21. Changes

When Wohnio gets new features, we update this policy. You will always find the current version here.

Wohnio is not a letting agent and doesn't guarantee a tenancy. The landlord always makes the decision.

ImmoScout24, Immowelt, Immonet, WG-Gesucht and Kleinanzeigen are trademarks of their respective owners. Wohnio is not affiliated with these companies.

© Wohnio. All rights reserved.

Back to homepage
How it works
Pricing
FAQ
Partner program
Log in
Cancel
Imprint
Privacy
Terms
Sources
Until you close the tab