Privacy Policy

Burolix ("we", "us") is committed to protecting your privacy. This policy explains what data we collect, how we use it, and your rights regarding your personal information. We believe in minimal data collection — we only gather what is necessary to personalize your experience.

The controller responsible for your data under the GDPR is:

Zakriya Azmat Choudry
Am Vogelsang 2, 89079 Ulm, Germany
Email: info@burolix.de

When you use Burolix, we may collect the following information:

• Account data: Email address (when you create an account)
• Profile data: Your city, visa type, situation (student/worker/etc.), and status (arriving/living/leaving) — used solely to personalize your checklist and guides
• Progress data: Which checklist tasks you've completed
• Payment data (Premium): Your card or payment details are entered at Stripe and never reach us. We store your Stripe customer ID, plan, and subscription status.
• Chat usage: How many AI chat messages you sent each month (not the messages themselves)
• Feedback and cancellations: What you send through the Feedback button (with the page it was sent from) or the cancellation form (name, email, reason)
• Technical data: Our host records standard server logs (IP address, time, page requested) to run and secure the service. We do not use analytics or advertising trackers.

Your data is used exclusively to:

• Personalize your checklist and show city-specific guide content
• Save your progress so you can pick up where you left off
• Authenticate your account and secure your session
• Process Premium payments, cancellations, and invoices
• Read your feedback to fix problems and improve Burolix

• Providing Burolix (account, checklist, AI chat, Premium) — performance of our contract with you, Art. 6(1)(b) GDPR
• Invoices and payment records — legal obligations under German tax and commercial law, Art. 6(1)(c) GDPR
• Server logs, security, and feedback — our legitimate interest in running a secure, working service and improving it, Art. 6(1)(f) GDPR

• Account, profile, progress, and chat usage data: until you delete your account (Account settings → Delete account)
• Invoices and payment records: as long as German tax and commercial law requires (up to 10 years), even after account deletion
• Cancellation requests: up to 3 years, to be able to prove the cancellation
• Feedback: until it has been reviewed and is no longer needed
• Data on your device (local storage): until you sign out or clear it

When you use the AI chat feature, your messages are sent to Anthropic's API to generate responses. Important details:

• Chat conversations are not stored permanently by Burolix — they exist only in your browser session. We store only how many messages you sent each month, to apply the monthly limit
• Your profile context (city, visa type) is included in the AI request to provide personalized answers
• Anthropic does not use API inputs to train their models — see Anthropic's privacy policy

Burolix uses the following third-party services:

• Supabase — Authentication and database hosting. Your account and profile data is stored securely on Supabase's infrastructure (EU region).
• Anthropic — Powers the AI chat feature. Your messages and profile context are sent to Anthropic to generate answers. Anthropic does not train on them and keeps them only for a limited period under its privacy policy.
• Stripe — Processes Premium payments. Your payment details go directly to Stripe; we only store your Stripe customer ID and subscription status.
• Vercel — Hosts the web application. Standard web server logs may be collected.
• Resend — Sends account emails (sign-up confirmation, password reset, security notices). It processes your email address to deliver them.

We have data processing agreements with these providers. Anthropic, Stripe, Vercel, and Resend are based in the USA, so data may be transferred there. These transfers rely on the EU–U.S. Data Privacy Framework where the provider is certified, and otherwise on the EU Standard Contractual Clauses (Art. 46 GDPR).

Burolix uses minimal cookies, limited to what is technically necessary:

• Authentication session cookie — Keeps you signed in. Expires when you log out or after your session times out.
• Local storage — Your profile and checklist progress are stored locally in your browser for offline access.

We do not use advertising cookies, tracking pixels, or third-party analytics cookies.

If you are in the European Union, you have the following rights under the General Data Protection Regulation:

• Right to access — Request a copy of all personal data we hold about you
• Right to rectification — Request correction of inaccurate data
• Right to erasure — Request deletion of your account and all associated data
• Right to data portability — Request an export of your data in a machine-readable format
• Right to restrict processing — Request that we limit how we use your data
• Right to object — Object at any time to processing based on our legitimate interests (Art. 21 GDPR)
• Right to complain — Lodge a complaint with a data protection authority, for example the one responsible for us: Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg, Postfach 10 29 32, 70025 Stuttgart, baden-wuerttemberg.datenschutz.de

You can download your data and delete your account yourself in Account settings.

To exercise any of these rights, contact us at info@burolix.de. We will respond within one month.

We take reasonable technical and organizational measures to protect your data. All data is transmitted over HTTPS, passwords are hashed, and database access is restricted. However, no system is 100% secure — we encourage you to use a strong, unique password.

We may update this privacy policy when Burolix or the law changes. We will tell you about material changes in the app or by email.

For privacy-related questions or data requests, reach us at info@burolix.de or via our contact page.