Last updated: September 30, 2026
The controller for your data is Steffen Giebler, 52N34S Group, Schwedter Str. 25, 10119 Berlin, Germany. For any question about your data or to exercise your rights, write to support@52n34s.com.
The website runs on Vercel. To deliver pages, Vercel processes technical request data such as your IP address, browser and the page requested, and keeps short term server logs for operation and security. Legal basis: our legitimate interest in running a secure, working website (Art. 6(1)(f) GDPR).
We count page views to understand how the website is used. For each page view we store the page, the referring website, the browser family and device type (for example “Chrome / mobile”), and a visitor code. To calculate the visitor code, we process your IP address and your browser’s full user agent for a moment: together with a random value (a “salt”) that is created each day, they are turned into a one way hash (SHA-256). Only this hash is stored, never your IP address or the full user agent. The salt is deleted after its day at the latest, so the hash can no longer be traced back to you, and visits can only be grouped within a single day, never linked across days. We use it to count unique visitors per day and to count the same visit only once if a page is reloaded within a few seconds. We do not use cookies or local storage for this. If you arrive through a link from a partner tool such as Find My Stack, we also record that tool as the source and count the answers carried over in the link as anonymous daily totals. Page view records are deleted automatically after 90 days. Legal basis: our legitimate interest in understanding how the website is used (Art. 6(1)(f) GDPR).
When you join the waitlist, we store your name, email address and country, plus what you tell us about your plans: as a client, your app idea; as a developer, the technologies you work with and a link to your portfolio. If you came to us through a link from Find My Stack, we also store that origin and the answers carried over in the link (for example the recommended technologies, platform and features). After you sign up, we send a confirmation email to your address through Resend, and your spot is only secured once you open the link in it and press “Confirm my spot” (double opt-in). We record when you gave your consent and when you confirmed your address.
We use this data only to let you know when ErdiBuilds opens and to invite you. It is stored with Supabase in its EU region (Frankfurt, Germany). Legal basis: your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time by writing to support@52n34s.com. If you don’t confirm your address within 30 days, your entry is deleted automatically. This doesn’t apply to entries made before we introduced the confirmation email. We delete your entry once you withdraw your consent, and at the latest 12 months after launch if you haven’t created an account by then.
Creating an account needs an email address and a password. Once you have an account, you can also log in with a one time magic link sent to your email. We use Supabase to handle authentication and to store your account and session on our behalf, in its EU region (Frankfurt, Germany). Legal basis: performance of our contract with you (Art. 6(1)(b) GDPR).
If you came to us through a link from Find My Stack, we store that origin as part of your account when it is created (for the waitlist, see above). It is taken only from the link itself, without cookies or local storage, and cannot be changed later. Legal basis: our legitimate interest in knowing which partners bring people to ErdiBuilds (Art. 6(1)(f) GDPR).
Your profile stores your display name, avatar, country and time zone. Developers additionally provide business details (legal name, address, and tax or VAT information where the law requires it) for verification and, where applicable, tax reporting duties, plus a portfolio of apps they have shipped, including descriptions, links, screenshots, and any download, user or revenue figures they choose to share. A revenue figure can be backed up with supporting proof, which only our admin team ever reviews. Legal basis: performance of our contract with you and, for business and tax details, compliance with our legal obligations (Art. 6(1)(b) and (c) GDPR).
When you post a project, we store its description, budget, and the technology and feature answers you gave, including any carried over from a tool like Find My Stack, so we can match your project with developers and, if you make it public, show it to developers who might be a good fit. Legal basis: performance of our contract with you (Art. 6(1)(b) GDPR).
A developer can send a proposal for your project: a cover letter, a price broken into milestones, and an estimated timeline. Accepting a proposal creates a contract between you and that developer, carrying those milestones over. Legal basis: performance of our contract with you (Art. 6(1)(b) GDPR).
Messages between a client and a developer are stored so both sides can look back on them. Before a contract exists between them, we automatically detect and mask email addresses, phone numbers and messenger links in a message, and flag it for a quick admin review, to keep early conversations safe for both sides. Legal basis: performance of our contract with you and our legitimate interest in keeping deals on the platform (Art. 6(1)(b) and (f) GDPR).
Avatars, portfolio images, and message attachments you upload are stored with Supabase Storage. Proof documents you upload to back up a revenue figure are stored privately and are only ever reviewed by our admin team, never shown publicly. Legal basis: performance of our contract with you (Art. 6(1)(b) GDPR).
A developer can optionally connect their GitHub account to show verified public activity (repositories, languages, contribution history) on their profile, and can connect a project’s repository so its commits, pull requests and releases show up in that project’s build log. We only ever request access to public data for this. Legal basis: your consent, given when you choose to connect (Art. 6(1)(a) GDPR).
We send emails about your account and your projects (for example when you receive a proposal, a new message or a reminder) through Resend, which processes your email address and the content of the email on our behalf. You can turn off optional reminder emails in your settings. Legal basis: performance of our contract with you (Art. 6(1)(b) GDPR).
Our forms are protected by Cloudflare Turnstile, a privacy friendly check that confirms you are a real person rather than an automated script. It runs automatically in the background in almost every case, without asking you to solve a puzzle. See Cloudflare’s privacy policy for details on how it works. To limit repeated attempts (for example no more than three confirmation emails per address and day), we briefly store the email address entered in a form and a keyed hash of your IP address, and delete both after 24 hours.
We only use cookies that are strictly necessary for the site to work, so we don’t ask for consent (Section 25(2) no. 2 TDDDG): the login session cookie set by Supabase while you are logged in, a short lived cookie that protects the GitHub connection step, and, only if you open a preview link, a cookie that remembers the preview. The project form keeps your unsaved answers in your browser’s session storage until you save them or close the tab. We use no tracking or advertising cookies.
We keep your data while your account exists. When you delete your account, we delete your profile details, your portfolio and the messages you sent that were never part of a contract. Contracts, milestones, invoices and the business and tax details that belong to them are kept locked for the retention periods required by German commercial and tax law (up to 10 years), then deleted.
Vercel, Resend, Cloudflare and GitHub are companies based in the United States, and Supabase’s parent company is too, so personal data may be processed there.
You have the right to access your data, to have it corrected or deleted, to restrict its processing, to receive it in a portable format, and to object to processing based on our legitimate interest (Art. 15 to 21 GDPR). Where processing is based on your consent, you can withdraw it at any time. You can download all your data, correct your profile and delete your account yourself in your settings, or write to us at support@52n34s.com. You also have the right to lodge a complaint with a data protection supervisory authority, for example the Berlin Commissioner for Data Protection and Freedom of Information.