Privacy Notice

Controller

The controller for the processing described here is Thomas Mueller, Oettingenstraße 51, 80538 Munich, Germany.

For privacy questions you can reach us by email. contact@worthswitch.com is WorthSwitch’s public contact address. Incoming messages are forwarded through Cloudflare Email Routing to the operator’s email mailbox.

Technical operation and security

When you open WorthSwitch or send a request to our backend, we process the technical data required to operate the service, investigate faults and prevent abuse:

• —IP address
• —browser identification (user agent)
• —date and time of the request
• —requested route or endpoint
• —request ID
• —HTTP status code
• —error information in case of technical faults
• —a salted, pseudonymous fingerprint that is hashed server-side

Legal basis for technical processing

We process this data on the basis of our legitimate interest in secure, stable and abuse-free operation, in particular for security, abuse prevention and rate limiting (Article 6(1)(f) GDPR). The fingerprint is only ever stored in hashed form and is not used for advertising.

Product search and product requests

When you search for a product or request a missing product, we process:

• —the product name you entered
• —a product URL you provided
• —the normalized search term
• —the region of the request
• —the result status of the search
• —the resolved product identifier, where a product was found
• —the number of equivalent searches
• —timestamps of the first and most recent request

How submitted URLs are handled

A product request consists of a single free-text field. Your entry is transmitted exactly as you type it — a URL is not required. If you paste a URL containing query parameters or a fragment, they are part of your entry and are transmitted with it. For catalog maintenance we only evaluate origin and path. The legal basis is our legitimate interest in providing and improving the product catalog (Article 6(1)(f) GDPR).

Comparisons and decisions

To produce a comparison we process product and candidate identifiers, price and currency information you voluntarily provide, and the scores and recommendations the backend derives from them. Recommendations are shopping decision support and have no legal effect for you (Article 6(1)(f) GDPR).

Pseudonymous usage events

To understand which steps work, we record pseudonymous usage events: the event type, the path, the product and candidate identifiers involved, the API version, plus a pseudonymous session identifier and the hashed fingerprint. This is not advertising tracking: no cross-site profile is created and the data is not used for advertising (Article 6(1)(f) GDPR).

Skin Fit preview

The “Find suitable skincare” questionnaire is currently a preview. Your answers and the preview summary derived from them stay only in the memory of the page or browser tab you have open.

In concrete terms:

• —Answers are not transmitted to Cloudflare or Supabase.
• —No skin profile is stored and no profile about you is created.
• —Answers, selected options, questionnaire steps and summary fields are never added to any usage event.
• —Reloading or closing the page discards the answers.
• —No account is created, no email address is collected, and there is no follow-up contact.

No medical advice in the Skin Fit preview

The preview provides no medical advice, no diagnosis and no treatment recommendation. It works only with what you observe yourself.

Voluntary switch feedback

If you voluntarily tell us how a switch went, we process the product and candidate identifiers, the associated recommendation, match and savings values, the differences reported, how long you used the product, your satisfaction and the property that was preserved for you, each linked to pseudonymous identifiers.

Clicking a retailer link alone does not submit any feedback. Feedback is only created when you actively submit it (Article 6(1)(a) and (f) GDPR).

Contact by email

If you write to contact@worthswitch.com, your email is forwarded via Cloudflare Email Routing to an iCloud mailbox. This involves the email addresses concerned, the content of your message, any attachments and the technical metadata of the email.

The legal bases are handling your enquiry or pre-contractual communication (Article 6(1)(b) GDPR), our legitimate interest in communicating with you (Article 6(1)(f) GDPR) and, where statutory obligations apply, Article 6(1)(c) GDPR.

Hosting and service providers

WorthSwitch is operated with the following providers:

• —Lovable Labs Incorporated / Lovable Labs AB, Regeringsgatan 25, 111 53 Stockholm, Sweden — application hosting — Privacy information
• —Supabase, Inc. — database and backend/API infrastructure, current project region eu-west-1 in Ireland — Privacy information
• —Cloudflare, Inc. — domain/DNS services, security infrastructure and Email Routing — Privacy information
• —Apple/iCloud Mail — operator mailbox and email storage — Privacy information

Transfers to third countries

Where processing by these providers may take place outside the EU or EEA, it is based on the European Commission's Standard Contractual Clauses or another permitted transfer mechanism.

Retention periods

We do not store data longer than necessary:

• —operational API audit, security and rate-limit data and pseudonymous first-party usage data: up to 90 days, unless longer retention is necessary to investigate abuse or security incidents
• —raw search terms and product requests: 12 months; aggregated product-demand counts may subsequently be retained without the raw search query where they no longer identify or single out a user
• —comparison and decision data: 90 days
• —voluntary switch feedback: 24 months
• —email correspondence: until your enquiry is resolved, plus the time required for documentation or statutory retention obligations

Deletion and anonymization

Data is deleted or anonymized when its purpose no longer applies, subject to statutory retention requirements.

Cookies and tracking

WorthSwitch uses no advertising cookies, no tracking pixels and no third-party analytics services. No advertising profile is created, and no consent technology is currently in use that would need to be introduced.

If consent-requiring technology is used in future, this privacy notice will be updated beforehand.

Your language choice is stored locally in your browser only and is not transmitted to us.

Retailer and affiliate links

Links to retailers currently contain no tracking parameters. This privacy notice will be updated before any affiliate tracking is activated.

Recipients and disclosure

Data is disclosed only to the providers named above, and only as far as operation requires it. We do not sell data.

Your rights

You have the right of access, rectification, erasure, restriction of processing, data portability and objection to processing based on legitimate interests. Where consent is obtained in future, you can withdraw it at any time.

An email to the address above is enough to exercise your rights.

You can also lodge a complaint with a supervisory authority, for example the Bayerisches Landesamt für Datenschutzaufsicht, Promenade 18, 91522 Ansbach, https://www.lda.bayern.de/.

No automated individual decision-making

There is no automated individual decision-making within the meaning of Article 22 GDPR. Match Scores and recommendations are shopping decision support and have no legal effect for you.