Privacy policy

Here you'll learn which personal data we process when you visit eoptima.net and use eOptima, why we need it, and what rights you have (Art. 13 of the General Data Protection Regulation, GDPR).

1. Controller

The controller responsible for processing personal data on eoptima.net and in the eOptima application is:

Maximilian Lutz
c/o flexdienst – #21849
Kurt-Schumacher-Straße 76
67663 Kaiserslautern
Germany
Email: info@eoptima.net

2. Privacy contact

For questions about data protection and to exercise your rights, you can reach us at info@eoptima.net. We have not appointed a data protection officer because we are not required to do so (Art. 37 GDPR; § 38 BDSG, German Federal Data Protection Act).

3. Overview of processing

4. Hosting & server logs

eOptima runs on its own server at IONOS SE, Elgendorfer Straße 57, 56410 Montabaur, in a data center in Germany. The host processes the data on our behalf (Art. 28 GDPR). Cloudflare (Cloudflare, Inc., USA) sits in front of the server as a network and protection service (DNS, defense against attacks); requests to eoptima.net therefore pass through Cloudflare's servers.

With every request, we process technically necessary data: IP address, date and time, requested address, status code, browser identifier (user agent), and a request ID. The purpose is to deliver the pages, ensure stable operation, and defend against attacks. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in secure and stable operation.

We store server logs for no more than 14 days. We keep error messages—without passwords, codes, or tokens and with masked email addresses—for no more than 90 days.

5. Registration & account

For an account, we need your email address and a password. You also state whether you use eOptima as a business or as a private individual. We never store the password in plain text. If you turn on two-factor authentication, we also store the data required for it in protected form. If you buy credits or the Premium subscription, we additionally process your name or company name, billing address, and—for businesses, if provided—the VAT identification number for the invoice.

For each sign-in, we create a session (session ID, timestamps, shortened browser identifier) so that you can see your signed-in devices and sign them out.

The legal basis is Art. 6(1)(b) GDPR (contract for the use of eOptima). Your email address and password are required to conclude the contract; without them, you can't use eOptima. We log sign-in attempts—including failed ones—with IP address and browser identifier to protect accounts from misuse (Art. 6(1)(f) GDPR).

6. eBay connection

When you connect an eBay account, you sign in directly with eBay (OAuth). We don't receive your eBay password. eBay gives us an access key, which we store only in encrypted form. Tokens are never transmitted to your browser. To ensure unambiguous matching, we also store your eBay user ID.

At your request, we use the eBay APIs to load your listings, e.g., title, description, prices, quantity, sales figures, item specifics, shipping data, image links, item number, and SKU. This data may be personal data, for example if you sell as an individual. eOptima only transfers changes when you trigger them. The legal basis is Art. 6(1)(b) GDPR.

eBay is an independent controller for processing on its platform; eBay's privacy policy applies to that processing. You can disconnect at any time in eOptima and additionally revoke access with eBay.

Planned If eBay notifies us that your eBay account has been deleted, we automatically delete the associated connections, tokens, listings, queued changes, and personal data contained in logs.

7. Changes & history

eOptima keeps a change log. It records changed fields with before and after values, transfers to eBay and their results, eBay connections, shipping rates and shipping recommendations, syncs, sign-ins (including failed ones), registration, password resets, and billing transactions. For each entry, we store the account, time, IP address, browser identifier, and a short session ID.

The log can only be appended to, not changed. You can see your entries under “History”; we only show the IP address and browser there for your own actions.

Purposes and legal bases: traceability of your changes (Art. 6(1)(b) GDPR) as well as security, investigating misuse, and proving transfers to eBay (Art. 6(1)(f) GDPR). If you delete your account, we replace your entries with a signed proof of deletion that contains no personal data. This keeps the chain verifiable.

8. Sending emails

We send you emails that are necessary for your account: to confirm your address, to reset your password, security notices (e.g., in case of unusual sign-in attempts), as well as order and payment confirmations, invoices, and notices about your Premium subscription. Links in these emails are valid only for a short time and work only once. Our emails contain no tracking pixels; we currently don't send newsletters or promotional emails.

Emails are sent via the SMTP service of Trafficcamp GmbH (Lima-City), Germany, as a processor. The legal basis is Art. 6(1)(b) GDPR, and additionally Art. 6(1)(f) GDPR for security notices.

9. Protection against abuse (Cloudflare Turnstile)

Only when requests to sign-in, registration, or email sending look suspicious—for example after several failed sign-in attempts—do we embed the Turnstile service of Cloudflare, Inc. It checks whether the request comes from a human. In doing so, Cloudflare processes technical data such as the IP address and browser and device information. If there's no suspicious request, Turnstile isn't loaded.

With the contact form, every message must pass this check. Turnstile is loaded there as soon as you start filling out the form; anyone who only reads the contact page doesn't load it.

With the free Quick Check on the home page, every check must likewise pass Turnstile; it is loaded as soon as you click into the input field. So that each connection and each device uses the check only once, we don't store your IP address, but only non-reversible hash values (HMAC) of your IP address, its address range, and a random device identifier from the cookie eo_qc, as well as a hash value of the entered item number or eBay username. We request the information about the listing or seller from eBay; for this purpose, we transmit the item number or username to eBay. Only our evaluation is stored, no raw data from eBay. If you sign up afterwards, we assign the check to your new account in order to recognize how many sign-ups it generates.

In addition, to protect against abuse, we limit the number of requests based on the IP address and temporarily restrict sign-in after repeated failed attempts.

The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in protection against abuse. Carrying out the Quick Check you requested is based on Art. 6(1)(b) GDPR. Insofar as Turnstile accesses your device for this purpose, this is strictly necessary for the service you requested (§ 25(2) no. 2 TDDDG, German Telecommunications Digital Services Data Protection Act). Cloudflare acts as our processor; for the transfer to the USA, see section 14.

10. Payments via Stripe

We bill credit purchases and the Premium subscription via Stripe. You enter payment data (e.g., card details) directly into Stripe's payment form. This data doesn't reach our servers. For this purpose, a script from Stripe is loaded on the payment pages. From Stripe, we only receive a customer and subscription ID, the payment status, the payment method (without the full card or account number), and the amount and invoice data. We send Stripe your email address, the selected product, and an internal account ID. You manage and cancel your Premium subscription in Stripe's customer portal, which you open from your account.

Provider: Stripe Payments Europe, Limited, 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland. Stripe processes payment data as an independent controller, in particular for payment processing, fraud prevention, and compliance with legal obligations; Stripe's privacy policy applies to this. The legal bases are Art. 6(1)(b) GDPR (performance of the contract) and Art. 6(1)(c) GDPR (statutory retention obligations). Stripe may transfer data to Stripe, Inc. in the USA; Stripe, Inc. is certified under the EU-US Data Privacy Framework, and standard contractual clauses apply in addition.

11. Contact form, feedback & email

If you send us an email, for example to info@eoptima.net, we process your email address and the content of your message in order to respond to your inquiry. The same applies via the contact form to the selected topic (support request, bug report, or feature request), your email address for the reply, and your message; if you're signed in, we add your account's email address. The form sends this information with the date and time as an email to info@eoptima.net (sent via Lima-City, see section 8); we don't store it in eOptima's database. The legal basis is Art. 6(1)(b) GDPR insofar as your contract is concerned, otherwise Art. 6(1)(f) GDPR. We delete the messages once your inquiry has been resolved, at the latest after two years, unless a retention obligation applies.

Through the “Feedback” area in Settings, which only signed-in users can reach, we process the type of report you choose (feedback, bug report, feature request, or security issue), your message, and any images you choose to attach (JPG and PNG only, such as screenshots), along with your account's email address and its confirmation status, your account ID, the interface language, and the date and time. We send this information by email, with the images attached, to info@eoptima.net, and reports about security issues to security@eoptima.net (sent via Lima-City, see section 8); we store neither the message nor the images in eOptima's database. Images can show whatever was on your screen, including other people's data; please black out anything we don't need to see beforehand. The same legal basis and deletion rules apply as above.

If you withdraw or cancel via “Withdraw from contract here” or “Cancel contracts here”, we process your information (name, email address, contract details) and the date and time of receipt in order to process the notice, send you a confirmation of receipt, and be able to prove receipt. The legal basis is Art. 6(1)(c) GDPR (§§ 312k, 356a BGB, German Civil Code). We store this information for three years from the end of the year in which the notice was received (regular limitation period).

12. Cookies & local storage

We don't use tracking, analytics, or advertising cookies. We only use storage that is strictly necessary for the service you requested (§ 25(2) no. 2 TDDDG): a session cookie for sign-in, your chosen color scheme in local storage, review mode filters in session storage, and, after a Quick Check, the cookie eo_qc and a marker in local storage so that you can see your result again. No consent is required for this. You can find the full list under Cookies & storage. Insofar as personal data is processed in this context, the legal basis is Art. 6(1)(b) GDPR.

13. Recipients & processors

• Hosting: IONOS SE, Montabaur, Germany – processor
• Email sending: Trafficcamp GmbH (Lima-City), Germany – processor
• Cloudflare, Inc.: DNS, protection against attacks, Turnstile when needed and for the contact form – processor
• Stripe Payments Europe, Limited: payment processing – independent controller
• eBay: data exchange at your request – independent controller

Beyond that, we only disclose data if we are legally required to do so, for example to authorities. We don't sell data. You can find an overview with registered office and transfer mechanism on the Security & privacy page.

14. Transfers to third countries

With Cloudflare and Stripe, data may be transferred to the USA. The basis is the European Commission's adequacy decision on the EU-US Data Privacy Framework (Art. 45 GDPR), insofar as the recipient is certified—which Cloudflare, Inc. and Stripe, Inc. are—supplemented by standard contractual clauses (Art. 46(2)(c) GDPR). The eBay APIs are operated by eBay; data may also be processed outside the EU in the process. The transfer to eBay takes place at your request in order to perform the contract with you; eBay processes the data as an independent controller and, according to its own information, safeguards transfers within the eBay group by means of binding corporate rules (Art. 47 GDPR).

15. Retention period

We only store data for as long as is necessary for the respective purpose or as required by law.

16. Deleting your account

You can delete your account yourself at any time under “Account” (confirmation with password and email address). Account data, sessions, connected eBay accounts including encrypted tokens, listings, queued changes, shipping rates, and shipping recommendations are deleted immediately and permanently. Entries in the change log that relate to you are replaced by a signed proof of deletion that no longer contains any personal data. We keep billing records only as long as statutory retention obligations require. Data may remain in backups until these are replaced by newer backups (we keep only the 20 most recent); they are not used for any other purpose. You can additionally revoke eOptima's access to your eBay account with eBay.

17. Your rights

Provided the statutory requirements are met, you have the following rights:

• Access to the data stored about you (Art. 15 GDPR)
• Rectification of inaccurate data (Art. 16 GDPR)
• Erasure (Art. 17 GDPR) – you can delete your account yourself at any time
• Restriction of processing (Art. 18 GDPR)
• Data portability in a commonly used, machine-readable format (Art. 20 GDPR)
• Withdrawal of consent with effect for the future (Art. 7(3) GDPR), insofar as we obtain consent in the future

Right to lodge a complaint: You can lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), in particular in the member state of your place of residence, your place of work, or the place of the alleged infringement. The authority responsible for us is Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Rheinland-Pfalz (the State Commissioner for Data Protection and Freedom of Information of Rhineland-Palatinate), Hintere Bleiche 34, 55116 Mainz, www.datenschutz.rlp.de.

18. No automated decision-making

We don't make any decisions based solely on automated processing, including profiling, that produce legal effects concerning you or similarly significantly affect you (Art. 22 GDPR). Recommendations in eOptima, for example on shipping rates or missing item specifics, are suggestions—you decide whether they're implemented.

19. Changes to this privacy policy

We update this policy when eOptima or the legal situation changes. The version published here at any given time applies. Upon request to info@eoptima.net, we'll send you earlier versions.