Privacy Policy

1. Controller

The controller responsible for the processing of personal data within the meaning of the EU General Data Protection Regulation (GDPR):

Daniel Wagner
Georg-Horn-Weg 4c
95463 Bindlach
Germany
E-Mail: [email protected]
Tel.: +49 160 97244239

This privacy policy covers our website intere.io and the Intere service, consisting of the desktop app, the mobile app and the related server services. For questions about data protection and to exercise your rights, contact us at [email protected].

2. Overview: our roles

We process personal data in two roles:

• As controller for data we process for our own purposes: when you visit the website, contact us, hold a customer account, subscribe and pay, and to operate our systems securely.
• As processor (Art. 28 GDPR) for the content our customers process with the service — in particular data from the marketplace and accounting accounts a customer connects to Intere, including data about the customer’s buyers. The customer is the controller of that data; we process it only on the customer’s instructions and to provide the service. Our data processing agreement under Art. 28 GDPR is an annex of our terms (AGB).

We do not sell personal data, do not use data from connected accounts for advertising, and share it only with the recipients named in this policy.

3. Visiting the website

Hosting and connection data

Our website runs on a server operated by Hetzner Online GmbH in Nuremberg, Germany. Requests to the website pass through the network of Cloudflare (Cloudflare, Inc., USA), which delivers the website as reverse proxy, content delivery network and DNS provider and protects it against attacks.

When you open the website, we and Cloudflare process the connection data your browser transmits and that is technically required: IP address, date and time of access, page requested, amount of data transferred, referrer URL, and browser and operating system information. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is delivering the website and keeping it stable and secure. For retention periods, see section “Retention and deletion”.

Audience measurement with Cloudflare Web Analytics

To learn which pages of our website are visited, where visitors come from and how fast the pages load, we use Cloudflare Web Analytics (Cloudflare, Inc., USA). For this, Cloudflare adds a script, loaded from static.cloudflareinsights.com, to the pages it delivers. When a page has finished loading and when you leave it, the script sends measurements to our own domain (path /cdn-cgi/rum), which is served through Cloudflare.

The data collected is the page visited (host and path, without URL parameters), the referring website (referrer), country, device type, browser and operating system, and the page’s load times and performance values (such as the Core Web Vitals). From these, page views and visits are counted; a visit is a page view that came from another website or a direct link. According to Cloudflare, Web Analytics uses neither cookies nor your browser’s local storage (localStorage), and it does not use your IP address, your browser identifier (user agent) or any other characteristic to recognize visitors or track them over time. As with every request through Cloudflare, your connection data is processed for technical reasons (see above).

The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is evaluating how our website is used and improving it. For retention periods, see section “Retention and deletion”.

Encryption

The website is only available over HTTPS (TLS encryption); requests over HTTP are redirected to HTTPS.

4. Cookies and local storage

We only use technically necessary cookies. When you sign in, our website sets cookies for your login session, for protection against cross-site request forgery and for the redirect after sign-in. The session cookie is deleted when you sign out and expires at the latest 30 days after your last activity. If you open the website through a referral link, we store the referral code in your browser’s local storage so that it can be applied when you subscribe.

Storing this information on your device is strictly necessary to provide the service you explicitly requested (Section 25(2) no. 2 of the German TDDDG); the subsequent processing is based on Art. 6(1)(b) GDPR. We do not use analytics, tracking or advertising cookies. Audience measurement with Cloudflare Web Analytics works without cookies (see “Audience measurement with Cloudflare Web Analytics” in section “Visiting the website”).

5. Contacting us

If you contact us by email or phone, we process the details you provide (for example name, email address, phone number and the content of your request) to handle your request. The legal basis is Art. 6(1)(b) GDPR where your request concerns a contract, and Art. 6(1)(f) GDPR otherwise (our legitimate interest in answering enquiries).

Emails to intere.io addresses are received by Cloudflare Email Routing (Cloudflare, Inc., USA) and forwarded to our Gmail mailbox (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland).

We delete your request once it has been fully handled, unless statutory retention obligations require us to keep it.

6. Customer account, sign-in and Discord

Sign-in with Discord

To register and sign in on intere.io and in our apps, we use sign-in with Discord (Discord Inc., USA). Discord sends us your Discord ID, user name, profile picture and email address (scopes “identify” and “email”). We use them to create your customer account and store your Discord ID, user name, profile picture, email address, registration and last sign-in time, as well as your licence key, subscription data and credit balance. The legal basis is Art. 6(1)(b) GDPR.

Our Discord server

With the “guilds.join” scope we add your Discord account to our Discord server, where we offer community and support, and assign you a role matching your plan. Our Discord bot sends you direct messages about your shipments there (for example credits, deadlines and tracking numbers); these messages are copied with your user name into a channel of our team (Art. 6(1)(b) GDPR).

Internal notifications

To monitor operations and billing, we post notifications to channels on our Discord server: for purchases of scan credits (Discord ID, quantity, amount), for referrals (user names and profile pictures of the users involved) and for invoice requests to ASOS (user name, credits and the conversation, which can include your order number, email address and shipping and billing address). The legal basis is Art. 6(1)(f) GDPR. These channels are visible to our team only.

Notifications to your own Discord webhooks

If you add your own Discord webhooks in Intere, we send notifications there, for example about created or printed shipping labels (order number, item, carrier, tracking number and the label as a PDF showing the recipient’s name and address), about ASOS invoice requests or about expired marketplace sessions. These transmissions happen at your request.

Software updates

Where we are legally required to inform you about updates of our software (Section 327f of the German Civil Code, BGB), we use your contact details for this (Art. 6(1)(c) GDPR).

7. Subscriptions and payments

We process subscriptions and credit purchases through Stripe (Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland). To pay, you are redirected to Stripe’s checkout page, where Stripe collects your name, email address, billing address and card details, and — if you choose — your VAT identification number, and calculates the applicable VAT. We only offer card payment.

We do not receive your card details. We store the Stripe customer and subscription identifiers, plan, billing period, renewal amount and payment method type, as well as your licence key and credit balance. The legal basis is Art. 6(1)(b) GDPR; for invoices and accounting records additionally Art. 6(1)(c) GDPR in conjunction with commercial and tax retention obligations. Stripe also processes payment data partly as an independent controller, for example to prevent fraud and to meet its own legal obligations, and may transfer data to the USA (see “Transfers to third countries”).

You can cancel your subscription at any time in the dashboard via Stripe’s customer portal. We then process the data needed to carry out and confirm the cancellation (Art. 6(1)(b) and (c) GDPR).

8. The Intere service

With Intere you connect your accounts with online marketplaces, accounting services and carriers, and optionally your mailbox. In doing so we process:

• account and contract data (sections “Customer account, sign-in and Discord” and “Subscriptions and payments”);
• credentials for the accounts you connect, such as OAuth tokens, API keys, session data or login details;
• business data from connected marketplace accounts: orders and sales (order numbers, items, quantities, prices, status), refunds, fees, payouts and account transactions, and documents such as invoices, credit notes and fee invoices;
• buyer data to the extent the respective marketplace provides it (section “Connected marketplaces and buyer data”);
• shipping data: recipient addresses, tracking numbers and shipping labels when you create labels, book pickups or track shipments through Intere;
• mailbox (optional): if you connect your mailbox via IMAP, our servers regularly retrieve your emails, extract order, invoice and shipping confirmations from online shops, and store relevant emails as PDF or HTML;
• documents you upload, such as purchase invoices or marketplace fee invoices;
• log and security data: requests to our interfaces and security events such as failed sign-ins, denied access and administrative actions.

Purposes and legal bases

• Providing the agreed features — syncing sales, reconciling payouts and fees, creating and delivering invoices, bookkeeping export, shipping labels, shipment tracking, pickups and expense tracking: for your own data Art. 6(1)(b) GDPR; data of third parties (such as your buyers) we process as a processor on your instructions.
• IT security and detection of misuse and errors: Art. 6(1)(f) GDPR.
• Compliance with legal obligations, such as keeping invoices: Art. 6(1)(c) GDPR.

Use of OpenAI

For some features we use OpenAI language models: when requesting invoices from ASOS on your behalf (your order number, email address and shipping and billing address are sent to OpenAI), for invoice and discount requests to Zalando (order numbers), and to read shipping labels you send to our Discord bot (image or PDF of the label, to recognise the carrier and tracking number).

9. Connected marketplaces and buyer data

When you connect a marketplace account, we retrieve the data of your orders, sales, fees and payouts. Where the marketplace provides data about your buyers, we process it as your processor to create invoices, print shipping labels and match payments:

Where a feature requires it, we send data back to the marketplace, for example invoices to buyers through the marketplace’s messaging, by email to the address provided by eBay (sent through our own mail server), or as an upload to Kaufland. Otherwise the marketplaces process data under their own responsibility.

10. Amazon Selling Partner API

We are currently developing an integration for Amazon sellers based on the Amazon Selling Partner API (SP-API). It is not yet available. Once it is, the following applies.

Authorization and revocation

A connection only exists after you, as a seller, authorize Intere in Amazon Seller Central through Amazon’s authorization process. We receive an authorization token for your seller account, never your Amazon password. You can revoke the authorization at any time on the “Manage Your Apps” page in Seller Central; from then on we no longer retrieve data from your seller account.

Data we retrieve

• Identifiers of your seller account and marketplaces, and the authorization token;
• order data: order number, order date, order status, products (SKU and ASIN), quantities and prices;
• financial data of your seller account: transactions such as sales, refunds, fees and payouts.

Intere does not request Amazon’s roles for access to protected personal data (“restricted roles”). We therefore do not receive names, street addresses, email addresses or phone numbers of Amazon buyers.

Purpose and legal basis

We use data received through the SP-API only to provide the service to the seller who authorized Intere: showing the seller’s Amazon orders in the sales overview, reconciling payouts and fees and — on the seller’s instruction — exporting to LexOffice or SevDesk. We process this data as the seller’s processor (Art. 28 GDPR); where personal data of the seller themselves is concerned, the legal basis is Art. 6(1)(b) GDPR.

No sharing

We do not sell Amazon data, do not disclose it to other sellers or any other third parties, do not combine it across sellers, and do not use it for advertising or to contact Amazon customers. We transfer it to LexOffice or SevDesk only on your instruction. Our technical service providers (section “Recipients and processors”) process it solely on our behalf to operate the service.

Storage, security and deletion

We store Amazon data in our platform database, tagged with its origin (sections “Storage location” and “Data security”). It is transmitted over TLS; the authorization token is stored encrypted.

After you revoke the authorization, at your request or at Amazon’s request, we delete data received through the SP-API within 30 days, unless we are legally required to retain it; such data is restricted from further processing until the retention period ends. We keep non-personal Amazon data for no longer than 18 months unless the law requires longer retention.

11. LexOffice and SevDesk

If you connect Intere to your LexOffice or SevDesk account, we transfer documents and booking data there on your instruction: invoices and credit notes as PDF (showing the recipient’s name, address and, where applicable, VAT identification number), booking lines for payouts and fees (amount, date, reference, order number — without buyer names) and contacts for marketplaces and suppliers. For matching, we read existing bookings. To connect to LexOffice, we store the login details you provide.

We act as your processor; for your own data the legal basis is Art. 6(1)(b) GDPR. LexOffice and SevDesk process the data under your own contract with the respective provider.

12. Recipients and processors

We share personal data only where this is necessary for the purposes described. Service providers processing data on our behalf are contractually bound by our instructions. The following recipients receive data:

13. Transfers to third countries

Some recipients are based in the USA or may transfer data there, in particular Cloudflare, Discord, MongoDB, OpenAI, Google and Stripe. Transfers to a third country only take place under the conditions of Art. 44 et seq. GDPR, in particular on the basis of the European Commission’s adequacy decision for the EU-US Data Privacy Framework (for recipients certified under it) or of EU standard contractual clauses.

14. Storage location

We run our servers and platform databases with Hetzner Online GmbH in data centres in Germany: the application and database servers and the website in Nuremberg, the email server in Falkenstein. Customer accounts and credentials of connected accounts are stored in MongoDB Atlas in the AWS data centre in Frankfurt am Main, documents in AWS S3 in Frankfurt am Main. We store backups, shipping labels and fee invoices in Cloudflare R2 (section “Recipients and processors”). For transfers outside the EU, see “Transfers to third countries”.

15. Data security

Among other things, we protect your data with the following measures:

• Connections to our website, our interfaces and our mail server are TLS-encrypted.
• Our databases are not reachable from the internet, only from the services on the same server; the database at MongoDB Atlas only accepts connections from approved IP addresses.
• Administrative interfaces are only reachable through a private network; administrator accounts are protected by multi-factor authentication.
• Our API servers are protected by firewalls, with an intrusion detection and prevention system and regular malware scans in place.
• Part of the credentials for connected accounts is additionally stored encrypted at the application level (AES-256-GCM).
• Security events such as failed sign-ins, denied access and administrative actions are logged.

16. Retention and deletion

• Customer account and data from connected accounts: we keep it for the term of the contract. After your account is deleted or at your request we delete it, unless statutory retention obligations apply (in particular commercial and tax retention periods under Section 257 of the German Commercial Code and Section 147 of the German Fiscal Code); such data is restricted from further processing until the period ends. You can request the deletion of your account by email to [email protected].
• Disconnected accounts: if you disconnect a marketplace or accounting account, we stop retrieving data from it; data already imported is deleted at your request.
• Amazon data: within 30 days after the authorization is revoked or deletion is requested (section “Amazon Selling Partner API”).
• Technical logs of our platform: API requests 1 day; raw data and logs of sync runs and application logs 7 days; security logs 400 days. Access logs of our web servers 14 days; application logs of our other services rotate (at most 7 to 10 files of 10 MB each, usually a few days); server system logs up to a fixed storage limit, after which the oldest entries are overwritten. Cloudflare processes connection data under its own deletion periods; we do not store logs there.
• Audience measurement (Cloudflare Web Analytics): Cloudflare keeps the individual measurements for 7 days and then reduces them to around 10% of their volume for long-term storage; Cloudflare states no deletion period for these. We can view the reports for the past six months.
• Shipping labels: the PDF files are deleted 30 days after they are created.
• Backups: backups are overwritten on a rolling basis; deleted data can remain in them for up to three months.

17. Your rights

With regard to your personal data, you have the following rights against us:

• access (Art. 15 GDPR)
• rectification (Art. 16 GDPR)
• erasure (Art. 17 GDPR)
• restriction of processing (Art. 18 GDPR)
• notification of rectification, erasure or restriction (Art. 19 GDPR)
• data portability (Art. 20 GDPR)
• withdrawal of consent with effect for the future (Art. 7(3) GDPR)
• objection to processing (Art. 21 GDPR, see below)

To exercise your rights, a message to [email protected] is sufficient.

If your request concerns data we process as a processor for one of our customers — for example because you bought from a seller who uses Intere — please contact that seller. If such a request reaches us, we forward it to the seller and support them in answering it.

Right to object

Where we process your personal data on the basis of our legitimate interests (Art. 6(1)(f) GDPR), you may object to this processing at any time on grounds relating to your particular situation. We will then stop processing the data unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims. You may object to processing for direct marketing at any time without giving reasons.

Right to lodge a complaint

You may lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), in particular in the Member State of your habitual residence, place of work or the place of the alleged infringement. The authority responsible for us is the Bavarian Data Protection Authority (Bayerisches Landesamt für Datenschutzaufsicht, BayLDA).

18. Further information and version

Providing the data required for your customer account and contract is necessary to conclude the contract; without it we cannot provide the service. Otherwise you are not obliged to provide data to us.

We do not carry out automated decision-making, including profiling, within the meaning of Art. 22 GDPR.

We update this privacy policy when our processing changes. Version: October 2026.