DealYield
Privacy and data

Privacy Notice

How personal data is processed when you visit and use the public DealYield website and its browser-only calculators.

Last updated: July 31, 2026

This Privacy Notice explains how personal data is processed when you visit and use DealYield at dealyield.app.

1. Controller

The controller responsible for the processing of personal data through DealYield is:

Cloudwards e.K.
Proprietor: Oliver Sinz
Klostersteige 15
87435 Kempten
Germany

Telephone: +49 160 99687594
General legal contact: info@cloudwards.de
Privacy and website inquiries: info@dealyield.app

Commercial register: Amtsgericht Kempten (Allgäu)
Registration number: HRB 13853

In this Privacy Notice, “DealYield,” “we,” “us,” and “our” refer to Cloudwards e.K.

2. Scope of this Privacy Notice

This Privacy Notice applies to the public DealYield website, its calculators, educational guides, browser-generated reports, and the public contact email address.

It does not apply to third-party websites that may be linked from DealYield. Those third parties are responsible for their own privacy practices.

3. Browser-only calculator data

DealYield is designed to minimize the collection of personal data.

Calculator inputs and results are processed locally in your browser. After a valid edit or an explicit Use example action, DealYield stores canonical inputs and the active property/scenario labels in that browser’s local storage so compatible values can be reused across calculators. Calculated outputs are not stored in the workspace. Merely rendering a page or an example does not create a saved scenario.

This local workspace remains in the browser profile until you reset data, browser/site data is cleared, storage is evicted, or the profile or device becomes unavailable. Resetting the active scenario removes that scenario’s inputs but retains its property record. Browser site-data controls remove the whole workspace. The workspace is not an account, cloud backup, or synchronization service. Browser storage can also be read by scripts running on the same website origin and by people or software with access to that browser profile. Do not use the workspace for sensitive or confidential information.

We do not transmit workspace values to an application database, associate them with a user account, or store them as server-side calculation records. If persistent browser storage is unavailable, the current scenario may remain usable in memory only for the current browser session.

DealYield may create a shareable URL whose URL fragment contains a compressed version of the calculator scenario. URL fragments are normally not transmitted to our web server as part of an ordinary page request. However, anyone who receives the complete URL may be able to open and read the encoded scenario.

Opening a calculator, share page, or browser report from a URL fragment creates an unsaved preview. It does not automatically replace the active local scenario.

Browser reports are generated from the current state of your browser. You may use your browser’s print function to print a report or save it locally as a PDF.

DealYield does not currently provide:

  • User accounts or authentication
  • Server-side saved calculations
  • Server-stored report links
  • Requested-analysis emails
  • Server-generated PDF reports

DealYield provides an explicit Reset this scenario control and can download the active scenario as validated, versioned JSON. Scenario reset leaves the property record intact. DealYield does not currently import JSON or export the whole workspace. You can remove the entire local workspace through your browser’s site-data controls.

Do not enter personal identifiers, complete property addresses, account numbers, confidential business information, or other sensitive information into calculator fields or shared URLs.

4. Hosting and delivery of the website

DealYield is hosted by Vercel Inc.

When you access the website, Vercel may process technical request information needed to deliver and protect the website. This may include:

  • Your IP address
  • The requested page or file
  • The date and time of the request
  • Browser, operating-system, and device information
  • Referrer information, where supplied by the browser
  • HTTP response and diagnostic information
  • Security and abuse-prevention information

This processing is necessary to deliver the website, maintain its availability and security, prevent misuse, and diagnose technical problems.

The legal basis is Article 6(1)(f) GDPR. Our legitimate interests are the secure, reliable, and efficient operation of DealYield.

Vercel may use affiliated companies and subprocessors. Depending on the technical delivery route and Vercel’s infrastructure, information may be processed in the United States or other countries outside the European Economic Area. Where required, such transfers are protected by an applicable adequacy decision, the EU–US Data Privacy Framework, Standard Contractual Clauses, or another legally recognized transfer mechanism.

Technical information is retained only for as long as needed for website delivery, operational security, abuse prevention, troubleshooting, and any applicable legal obligations. Provider-level retention is also governed by the settings and contractual terms of our Vercel account.

5. Optional analytics with PostHog

We use PostHog Cloud EU to understand, on an aggregate basis, how public pages and calculators are used.

PostHog analytics are disabled until you expressly select Allow analytics.

When analytics are enabled, we may collect limited information such as:

  • An anonymous analytics identifier
  • A sanitized page path
  • Page-view events
  • Coarse calculator-workflow and completion events
  • Coarse workspace-availability, scenario-created, and classified storage-error events
  • A scenario-export success or failure event without scenario content
  • General conversion events
  • Browser and device category
  • Approximate viewport category
  • A coarse referrer category
  • Web performance measurements such as Web Vitals
  • Event timestamps

Our current PostHog configuration is intended not to collect:

  • Exact calculator inputs or results
  • Property or scenario names, labels, identifiers, or details
  • URL query strings or URL fragments
  • Email addresses
  • Full external referrer URLs
  • Automatically captured page elements
  • Keystrokes or form contents
  • Heatmaps
  • Session recordings
  • Person profiles
  • Advertising identifiers

PostHog is configured to discard raw client IP addresses. DealYield also respects supported browser Do Not Track settings.

The purposes of this processing are to measure the usefulness of pages and calculators, understand aggregate usage patterns, identify usability problems, and improve website performance.

The legal basis for analytics processing is your consent under Article 6(1)(a) GDPR. The use of non-essential browser storage is based on your consent under Section 25(1) TDDDG.

Analytics browser storage

DealYield stores your analytics choice in your browser’s local storage so that the website can remember and respect your decision.

When you allow analytics, PostHog may additionally use local storage for an anonymous analytics identifier and session state. DealYield does not use this information for advertising or to identify you by name.

You can decline analytics when first asked or change your decision at any time through Analytics choices in the website footer.

When you withdraw consent, DealYield clears the local PostHog identity and stops future analytics collection on that browser and device. Withdrawal does not affect the lawfulness of processing carried out before consent was withdrawn.

PostHog Cloud EU stores primary analytics event data in the European Union, currently in Frankfurt, Germany. Limited access or processing by PostHog, its affiliated companies, or subprocessors may nevertheless involve countries outside the European Economic Area. Where required, PostHog relies on recognized transfer safeguards such as the EU–US Data Privacy Framework or Standard Contractual Clauses.

Analytics information is retained according to the retention period configured in our PostHog project and is deleted or aggregated when it is no longer needed for the purposes described above.

6. Error monitoring with Sentry

We use Sentry, provided by Functional Software, Inc., to identify and diagnose technical errors affecting the production website.

When a technical error occurs, Sentry may receive limited diagnostic information such as:

  • The error type and sanitized technical context
  • A technical stack trace
  • The date and time of the error
  • Browser, device, operating-system, and runtime information
  • The request method and a sanitized page path
  • Limited navigation or network-status breadcrumbs
  • Technical connection information, which may include an IP address

Our application is configured to minimize the information sent to Sentry. Among other measures, it removes user fields, query parameters, URL fragments, email addresses, local variables, additional application context, and other unnecessary event data where technically possible.

The current configuration does not enable:

  • Session replay
  • Performance tracing
  • Browser log collection
  • Automatic session tracking
  • Collection of default personally identifiable information

Sentry is used solely to maintain the security, stability, and reliability of DealYield and to investigate technical failures.

The legal basis is Article 6(1)(f) GDPR. Our legitimate interests are detecting errors, preventing recurring failures, protecting the website, and providing a reliable public service.

Sentry and its subprocessors may process information outside the European Economic Area. Where required, international transfers are protected through an applicable adequacy decision, the EU–US Data Privacy Framework, Standard Contractual Clauses, or another recognized safeguard.

Error reports are retained according to the retention settings of our Sentry account and only for as long as reasonably required to investigate technical problems, maintain service security, and prevent recurring errors.

7. Google Search Console

We use Google Search Console, a service provided by Google, to understand how DealYield’s public pages appear and perform in Google Search.

Search Console may provide reports containing information such as:

  • Search queries associated with DealYield pages
  • Clicks and impressions
  • Click-through rates
  • Average search-result positions
  • Pages appearing in search results
  • General country and device categories
  • Indexing, crawling, and technical search information

Search Console reports are generally aggregated. Google may omit low-volume search queries to protect user privacy. We do not use Search Console information to identify individual visitors.

Using Search Console does not, by itself, require DealYield to place a Google Analytics tracking script or advertising cookie on the website. The relevant information is generated through interactions with Google Search and made available to us through our Search Console account.

The purpose is to monitor indexing, identify technical search problems, understand aggregate search visibility, and improve public content.

The legal basis is Article 6(1)(f) GDPR. Our legitimate interests are maintaining the findability, technical quality, and relevance of our public website.

Google acts under its own privacy terms when operating Google Search and its related services. Google determines the availability and retention of information within Search Console.

8. Email communications

You may contact us at info@dealyield.app. The mailbox is hosted by Fastmail Pty Ltd.

When you send us an email, we may process:

  • Your name, where provided
  • Your email address
  • The subject and contents of your message
  • Any files you attach
  • Message headers and delivery information
  • The date and time of the communication
  • Subsequent correspondence relating to your request

Please do not send passwords, authentication tokens, payment-card information, government identifiers, confidential property documents, private keys, or other sensitive information by email.

We process email correspondence for the following purposes and legal bases:

  • To respond to general questions, feedback, accessibility reports, correction requests, or privacy inquiries on the basis of Article 6(1)(f) GDPR
  • To respond to inquiries relating to a possible or existing contractual relationship on the basis of Article 6(1)(b) GDPR
  • To comply with applicable legal obligations on the basis of Article 6(1)(c) GDPR
  • To establish, exercise, or defend legal claims on the basis of Article 6(1)(f) GDPR

Providing information by email is voluntary. Without a valid return address and enough information to understand your request, we may be unable to respond.

Fastmail is based in Australia and operates email infrastructure that includes servers in the United States. Fastmail and its authorized subprocessors may also process information in other countries. Where required, restricted transfers are protected using Standard Contractual Clauses or another legally recognized safeguard.

We normally retain correspondence until the relevant matter has been resolved. We may retain it for longer where this is necessary for an ongoing business relationship, statutory record-keeping, security documentation, or the establishment, exercise, or defense of legal claims. Messages are deleted when there is no longer a legitimate or legal reason to retain them.

9. Recipients of personal data

We disclose personal data only where necessary for the purposes described in this Privacy Notice.

Recipients may include:

  • Vercel and its hosting and infrastructure subprocessors
  • PostHog and its subprocessors, but only after analytics consent
  • Sentry and its subprocessors
  • Fastmail and its email-service subprocessors
  • Google in connection with Search Console
  • Professional advisers where reasonably necessary
  • Courts, regulators, public authorities, or law-enforcement bodies where disclosure is legally required
  • Parties involved in protecting DealYield against fraud, abuse, security threats, or legal claims

We do not sell personal data.

We do not share personal data for cross-context behavioral advertising, use advertising networks, or use personal data to make automated decisions that produce legal or similarly significant effects.

10. Retention

We retain personal data only for as long as necessary for the purpose for which it was collected, including operational security, troubleshooting, communication, legal compliance, and the establishment or defense of legal claims.

The relevant retention period is determined by:

  • The nature and sensitivity of the information
  • The purpose for which it is processed
  • Whether the information is still needed for that purpose
  • Applicable provider settings
  • Contractual requirements
  • Statutory retention obligations
  • Applicable limitation periods
  • The need to investigate security incidents or legal claims

Calculator inputs and results have no server-side DealYield retention period because DealYield does not receive or store them in an application database. Browser-local scenario inputs remain until that scenario is reset, browser/site data is cleared, storage is evicted, or the profile or device becomes unavailable. A scenario reset retains its property record; browser site-data controls remove the entire workspace.

11. Your data-protection rights

Subject to the conditions and limitations of applicable law, you may have the right to:

  • Request access to your personal data
  • Request correction of inaccurate or incomplete personal data
  • Request deletion of your personal data
  • Request restriction of processing
  • Receive certain personal data in a portable format
  • Object to processing based on legitimate interests
  • Withdraw consent at any time
  • Lodge a complaint with a competent supervisory authority

Where processing is based on legitimate interests, you may object on grounds relating to your particular situation. We will stop the relevant processing unless we demonstrate compelling legitimate grounds that override your interests, rights, and freedoms or the processing is needed for legal claims.

Where processing is based on consent, withdrawal applies to future processing and does not affect the lawfulness of processing performed before withdrawal.

To exercise your rights, contact:

info@dealyield.app

We may request information reasonably necessary to verify your identity and prevent unauthorized disclosure or deletion.

You may also lodge a complaint with a data-protection supervisory authority. The supervisory authority generally responsible for private-sector organizations based in Bavaria is:

Bayerisches Landesamt für Datenschutzaufsicht (BayLDA)
Promenade 18
91522 Ansbach
Germany

12. Security

We use technical and organizational measures intended to protect personal data against unauthorized access, alteration, disclosure, loss, or destruction.

These measures include data minimization, privacy-oriented analytics and error-monitoring configurations, encrypted transport, access controls, and the use of established service providers.

No website or method of electronic communication can guarantee absolute security. You should therefore avoid submitting sensitive or confidential information where it is not necessary.

13. Children

DealYield provides real-estate calculation tools and educational information intended for adults. It is not directed to children, and we do not knowingly request personal data from children.

14. Changes to this Privacy Notice

We may update this Privacy Notice when the website, its providers, its technical configuration, or applicable legal requirements change.

The date shown at the beginning of this notice identifies the latest published version.