Privacy Policy

Data controller

The data controller is:

  • Weinavenue GmbH & Co. KG
  • Karl-August-Woll-Straße 17
  • 66386 Sankt Ingbert, Germany
  • Email: privacy@priceroom.ai
  • Phone: +49 1514 1819596

Thank you for your interest in Priceroom. The protection of your data, and the data of your business, is important to us. Below we provide detailed information on how we handle personal data in connection with our website and our SaaS platform "Priceroom".

Note: Priceroom is intended exclusively for business customers (B2B). To the extent personal data is nevertheless processed in connection with the Service (e.g. data of the Customer's contact persons, employees, or website visitors), this policy applies accordingly.

1. Access Data and Hosting

You can visit our website without providing any personal information. Each time the website is accessed, our server automatically stores a server log file (including IP address, date and time of access, file requested, amount of data transferred, and requesting provider). This serves our legitimate interest in ensuring the uninterrupted operation and security of our systems pursuant to Art. 6(1)(f) GDPR.

Our infrastructure (hosting, database, background processing) is provided by cloud service providers that may operate servers outside the EU/EEA. Where an adequacy decision of the European Commission exists (e.g. for the United States, provided the relevant provider is certified), we rely on this basis. Otherwise, data transfers are based on the European Commission's Standard Contractual Clauses.

Self-hosted option: Customers who run Priceroom via an on-premises deployment (Docker Compose / Helm chart) within their own infrastructure (VPC) process all data exclusively on their own systems. In that case, the Customer acts as its own controller or processor with respect to that environment; we have no access to data processed there.

2. Data Processed for Contract Performance (Customer Account)

When registering an account ("tenant"), we collect the data necessary to perform the contract, in particular name, business email address, company name, billing address, and payment details. This is done to perform the contract pursuant to Art. 6(1)(b) GDPR.

Sign-up may be completed via single sign-on (Google or Microsoft). In this case, we receive basic authentication data from the relevant provider (e.g. name, business email address). The privacy terms of the respective SSO provider apply in addition.

3. Data Uploaded by the Customer to the Platform

In the course of using the Platform, the Customer uploads its own product, pricing, and business data (e.g. via CSV import or store connection). This processing is carried out on the Customer's instructions within the meaning of Art. 28 GDPR. We enter into a separate Data Processing Agreement with business customers on request.

To the extent personal data is contained within data uploaded by the Customer (which is generally not the case for pure product and pricing data), the Customer is responsible, as data controller, for the lawfulness of that data.

4. Automated Collection of Competitor Data (Web Scraping)

At the Customer's instruction and as configured by the Customer, the Platform automatically collects publicly available pricing and product information from third-party websites selected by the Customer (e.g. Amazon.de, Otto, MediaMarkt, Zalando, Idealo). As a general rule, no personal data relating to competitors' end customers is collected; only product- and price-related information is collected.

Responsibility for the permissibility of data collection vis-à-vis the relevant third-party websites (including with respect to their terms of use) lies with the Customer, who selects and configures the target websites.

5. AI-Assisted Processing (Bring-Your-Own-Key)

Priceroom uses artificial intelligence for features such as product matching and data enrichment. For this purpose, the Customer may provide its own API credentials from the following providers:

  • Anthropic PBC (Claude)
  • OpenAI, L.L.C. (GPT models)
  • Google LLC / Google Ireland Limited (Gemini)

When these features are used, the product data required for processing (e.g. product names, images, pricing information) is transmitted to the AI provider selected by the Customer via that provider's API. This transmission takes place directly on the instruction and under the responsibility of the Customer, who provides the relevant API key; the Customer should independently review the privacy and data processing terms of whichever AI provider it selects.

API keys are stored using end-to-end ("envelope") encryption and are not logged in plain text. We do not operate our own AI models and obtain no economic access to data processed via the Customer's keys, other than the technically necessary transmission.

6. Cookies and Tracking on the Website

On our website, we use technologies that are strictly necessary for operation (e.g. session cookies for login), as well as — only with your consent pursuant to Art. 6(1)(a) GDPR — technologies for web analytics. You may grant, adjust, or withdraw your consent at any time, with future effect, via our cookie consent tool.

Where we use web analytics services (e.g. for traffic measurement), IP address, time of visit, and device and browser information are processed on a pseudonymized basis. This may involve a transfer of data to the United States; we rely on an adequacy decision of the European Commission where the relevant provider is certified, and otherwise on Standard Contractual Clauses.

7. Disclosure to Service Providers (Sub-Processors)

We engage subcontractors to provide our Service, including for hosting/infrastructure, payment processing, email delivery, and support ticketing. Where required, Data Processing Agreements pursuant to Art. 28 GDPR are in place with these providers. We will provide business customers with a current list of our material sub-processors on request.

8. Retention Period

We retain personal data only for as long as necessary for the relevant processing purposes, or for as long as required by statutory retention obligations (in particular under German commercial and tax law). Following termination of the contract, business data uploaded by the Customer is deleted after a 30-day export period, unless statutory retention obligations require otherwise.

9. Your Rights

As a data subject, you have the following rights:

  • The right of access pursuant to Art. 15 GDPR
  • The right to rectification pursuant to Art. 16 GDPR
  • The right to erasure pursuant to Art. 17 GDPR
  • The right to restriction of processing pursuant to Art. 18 GDPR
  • The right to data portability pursuant to Art. 20 GDPR
  • The right to object pursuant to Art. 21 GDPR
  • The right to lodge a complaint with a supervisory authority pursuant to Art. 77 GDPR

To exercise your rights, please contact us using the contact details above.

10. Contact

  • Weinavenue GmbH & Co. KG
  • Karl-August-Woll-Straße 17, 66386 Sankt Ingbert, Germany
  • Email: privacy@priceroom.ai
  • Phone: +49 1514 1819596