Privacy Policy

Last updated: January 2026

Introduction

The protection of your personal data is important to us. This privacy policy informs you about the processing of personal data when using lokilo.ai.

Data Controller

Responsible for data processing: lokilo.ai UG (haftungsbeschränkt) Winterstraße 4-8 22765 Hamburg Germany Email: support@lokilo.ai

Data Processed

Cadastral Data

The ALKIS data used does not contain any direct personal references (owner data is excluded). Parcel numbers, areas and building data are primarily factual data.

User Data

The following personal data is processed:

  • Email address (on registration)
  • Name (on registration)
  • Password (stored hashed)
  • Payment data (at Stripe, our payment service provider)
  • Search queries (temporarily or when saved by the user)
  • IP address (stored only as an HMAC hash, for rate limiting and abuse protection)
  • Local browser storage (cookie preferences, map session, search form input)

Browser extension: the extension only acts on your explicit request. When you capture a property listing, the address (URL), title, full page content (HTML) and up to five images of the currently open page are sent to our server. Search parameters (e.g. postcode, area, price) are first extracted with rules; for Pro and Business accounts the page is otherwise analysed with Anthropic. To improve recognition we keep a copy of the transmitted page content together with your account ID and the HMAC hash of your IP address for 30 days, after which it is deleted automatically. The extension does not read other tabs, your browsing history or your input, and loads no third-party resources. The login token is stored locally in your browser only.

Legal Basis

  • Contract performance (Art. 6(1)(b) GDPR): For providing our services
  • Consent (Art. 6(1)(a) GDPR): For newsletter and marketing
  • Legitimate interest (Art. 6(1)(f) GDPR): For security and operations

Your Rights

You have the following rights regarding your personal data:

  • Right of access (Art. 15 GDPR)
  • Right to rectification (Art. 16 GDPR)
  • Right to erasure (Art. 17 GDPR)
  • Right to restriction (Art. 18 GDPR)
  • Right to data portability (Art. 20 GDPR)
  • Right to object (Art. 21 GDPR)

To exercise your rights, contact us at support@lokilo.ai

External Services

We use the following third-party providers (processors under Art. 28 GDPR):

  • Cloudflare (Hosting, USA) - EU-US Data Privacy Framework. We additionally record server-side usage events (e.g. searches, plan, user ID) in Cloudflare Analytics Engine for operational monitoring.
  • Cloudflare Web Analytics (Website Analytics, USA) - Privacy-friendly, no cookies, no personal data
  • Cloudflare Turnstile (bot protection on login, search and map, USA) - EU-US Data Privacy Framework. Loads a script from challenges.cloudflare.com.
  • Sentry (Functional Software Inc., error and performance monitoring, USA) - EU-US Data Privacy Framework. Active in the browser only after you consent to the "Analytics" category; IP and email addresses are stripped before transmission.
  • Anthropic (AI Analysis, USA) - EU-US Data Privacy Framework
  • Mapbox (Satellite Images, USA) - EU-US Data Privacy Framework
  • Google Maps Platform (Maps, Geocoding, Address Search; Google Ireland Ltd., Ireland) - EU-US Data Privacy Framework
  • Google (Street View, Google Places address autocomplete and "Sign in with Google"; Google Ireland Ltd., Ireland) - EU-US Data Privacy Framework
  • Apple (Sign in with Apple, USA) - EU-US Data Privacy Framework. Only when you sign in via Apple.
  • OpenStreetMap Foundation (Nominatim geocoding and Overpass API for address and surroundings data, UK). On region pages Nominatim is called directly from your browser.
  • Esri (ArcGIS Online World Imagery, satellite tiles on region pages, USA) - EU-US Data Privacy Framework
  • flagcdn.com (country flag images, loaded directly by your browser)
  • Stripe (Payments, USA) - EU-US Data Privacy Framework
  • Resend (Email Service, USA) - EU-US Data Privacy Framework
  • Modal Labs (GPU image analysis for Business tier, USA) - Standard Contractual Clauses. Used only when the image-matching feature is active.

Cookies and Web Analytics

We use essential cookies for login and security. For website analytics, we use Cloudflare Web Analytics - a privacy-friendly solution that does not use cookies, does not collect personal data, and does not track users across websites. With your consent to the "Analytics" category we additionally enable Sentry for error monitoring. Besides cookies we use your browser's local storage (localStorage) for your cookie preferences, the map session and search form input. Marketing cookies are only set with your consent. You can adjust your settings at any time via the cookie banner.

Data Retention

Personal data is only stored for as long as necessary for the respective purposes or as required by law. When you delete your account, your data will be deleted immediately.

Notification of Data Breaches (Art. 33/34 GDPR)

We commit to investigating data breaches without delay once they become known, to notifying the competent supervisory authority (Der Hamburgische Beauftragte für Datenschutz und Informationsfreiheit) within 72 hours where a notification obligation exists, and to informing affected users without undue delay if a high risk to their rights and freedoms is to be expected. Please report suspected incidents to security@lokilo.ai.

Contact

For privacy questions, contact us at support@lokilo.ai