Privacy policy

As of 5 October 2026

This is an English translation for convenience. Only the German version is legally binding: Datenschutzerklärung (Deutsch).

This page explains which personal data RegiLens processes, why, on what legal basis, for how long and what rights you have. It concerns two groups: visitors and users of the website and people entered in registers (for example managing directors or shareholders). There is a separate page for the second group: Personal data.

• 1. Controller
• 2. Register data on companies and people
• 3. Visiting the website
• 4. Account and sign-in · Payment (Pro)
• 5. Emails
• 6. AI features
• 7. Maps
• 8. Statistics with Google Analytics
• 9. Objection and correction
• 10. Cookies and browser storage
• 11. Recipients and third countries
• 12. Your rights
• 13. No automated decisions

1. Controller

schantastic e.U. (owner Julian Schanta), Mattersburger Straße 26, 7000 Eisenstadt, Austria, email contact@schantastic.com. We have not appointed a data protection officer, as we are not required to. Please send questions about data protection to the same address.

2. Register data on companies and people

RegiLens shows information from official registers and open data (for example Firmenbuch, Handelsregister, Companies House, Brønnøysundregistrene, GLEIF). For companies, this includes information about people: name, role (for example management, power of attorney (Prokura), shareholder), start and end of the role, shareholding, and depending on the register also date of birth and place of residence.

• Purpose: transparency in business – who represents a company, who owns it, how it is doing financially. This is exactly why the registers make this information public.
• Legal basis: legitimate interest (Art. 6(1)(f) of the General Data Protection Regulation (GDPR, German: DSGVO)) – our interest and that of our users in verifiable information about business partners. We have documented the balancing of interests; the main safeguards are described under Personal data.
• Source: the registers and open data sources named next to every value and under Sources & licences.
• What we do not show publicly: date of birth only as month and year, place of residence only where the register itself publishes it (Germany), no private addresses. Person pages are blocked for search engines (noindex). For sole traders, we show no score, no signals and no revenue estimate.
• Retention: as long as the information is published in the register and needed for the purpose. People who have not held an active role in any register for more than 10 years are hidden from public view: company profiles then only show their name and role.
• Compliance screening (signed in only): names are compared with sanctions lists (EU, UN, USA) and publicly known politically exposed persons (Wikidata). A match indicates identical names, not a finding.

3. Visiting the website

Hosting and server logs

The website is hosted by Vercel (Vercel Inc., USA); the server functions run in Frankfurt am Main. When a page is requested, Vercel processes technically necessary data: IP address, time, requested address, browser identifier. This serves to deliver the pages and to ensure security (Art. 6(1)(f) GDPR). Vercel stores these logs only briefly in line with its own rules.

Database

Register data, accounts and the entries described here are stored in a database at Neon (Neon Inc., USA) in the Frankfurt am Main region (AWS eu-central-1).

Error log

In the event of an unexpected error, we store the error ID, time, endpoint (without parameters) and the error message, cleaned of email addresses and keys. Signed-in users appear there only as a hash (pseudonym). Purpose: finding and fixing errors (Art. 6(1)(f) GDPR). Retention: 30 days.

Rate limits

To prevent anyone from extracting the data in bulk, we count requests per IP address or per account. For this, we only store a hash of the IP address or account identifier with a counter and time (Art. 6(1)(f) GDPR). At sign-in, the sign-in function additionally counts attempts per IP address. We delete these entries after 2 days at the latest.

4. Account and sign-in

You only need an account for account features (watching, alerts, folders, notes, export, AI). We store your email address, the date the account was created, your working data (watched companies and people, notes, folders, settings) and, for each sign-in, a session with IP address and browser identifier. Legal basis: contract of use (Art. 6(1)(b) GDPR). Sessions end after 30 days at the latest. In your account you can download all your data and delete the account; we then delete everything linked to it.

Sign-in with Google or with email and password (Firebase Authentication)

For sign-in with Google or with email and password we use Firebase Authentication (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; parent company Google LLC, USA). Firebase processes email address, password (only as a hash at Google, never at our end), a user identifier, IP address and device data to sign you in. Legal basis: Art. 6(1)(b) GDPR. Data may be transferred to the USA (section 11). When you delete your account, we also delete your access at Firebase.

Passkeys and sign-in link

Alternatively, you can sign in with a passkey (we only store the public key) or with a link sent by email.

Plan and usage

For the limits of your plan, we count per account how often you use certain features (for example AI analyses per month, exports per day) – only type, period and number, no content. Legal basis: Art. 6(1)(b) GDPR. We delete the counters after 13 months, and immediately together with the account.

Payment with Stripe (Pro plan)

If you subscribe to Pro, payment is handled by Stripe Payments Europe, Limited, 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland. We redirect you to Stripe’s payment page, where you enter your payment details, name and billing address. We never see card details. We transmit your email address and an internal account identifier to Stripe; from Stripe we receive the customer number, subscription status (plan, term, cancellation, payment problems) and invoices. Legal basis: Art. 6(1)(b) GDPR (contract) and (c) (retention obligations). For payment processing, fraud prevention and its own legal obligations, Stripe is itself the controller (Stripe’s privacy policy). Stripe may transfer data to Stripe, Inc. in the USA (section 11).

Before redirecting you, we store your declaration on the immediate start of performance (wording and time) as evidence under the Austrian Distance and Off-Premises Contracts Act (Fern- und Auswärtsgeschäfte-Gesetz, FAGG) (Art. 6(1)(c) and (f) GDPR); it is kept for up to 7 years, even after the account is deleted, without any link to your account. Stripe keeps invoices and accounting records for us for 7 years (§ 132 Austrian Federal Fiscal Code (BAO)). If you delete your account, we end any running subscription immediately and delete your customer record at Stripe; the invoices remain stored for the statutory period.

5. Emails

We send emails (sign-in links, alerts about watched companies if you switch them on, confirmations of requests) via Resend (USA). The recipient address and the content of the email are processed. Legal basis: Art. 6(1)(b) GDPR, for requests under section 9 Art. 6(1)(c) GDPR.

6. AI features

Only when signed in and only when you click: for the AI summary and the chat about a company, we send the public version of the company profile (date of birth only as month and year, without blocked people) and your questions to Anthropic (USA), the provider of the AI model Claude. Legal basis: Art. 6(1)(b) GDPR. We store the summary until the profile changes and show it to everyone, marked as AI text. Please do not enter any personal data in the chat that is not necessary.

7. Maps

Your browser draws maps from map data provided by OpenFreeMap (openfreemap.org, based on OpenStreetMap and OpenMapTiles): it loads the map style, tiles, fonts and symbols directly from there. If your browser cannot display vector maps, it loads tiles from OpenStreetMap instead (OpenStreetMap Foundation, United Kingdom). In doing so, the provider receives your IP address and browser identifier. Legal basis: Art. 6(1)(f) GDPR (displaying company locations). An adequacy decision of the European Commission applies to the United Kingdom. We geocode addresses on the server (Nominatim from OpenStreetMap); only the company address is sent to OpenStreetMap, not your IP address.

8. Statistics with Google Analytics

Only if you allow “Statistics” in the cookie banner do we use Google Analytics 4 (Google Ireland Limited, Ireland; Google LLC, USA). This lets us see which pages are used and how often. For this, Google sets cookies (_ga, _ga_…) and processes IP address, device and browser information and the pages visited. We do not send people, search terms or parameters: company pages appear with their register identifier, person pages only as “/person”.

• Legal basis: your consent (Art. 6(1)(a) GDPR, § 165 (3) Austrian Telecommunications Act 2021 (TKG 2021)).
• Settings: Consent Mode v2, advertising features and Google signals off, event data retention 2 months, cookies at most 180 days.
• Withdrawal: at any time via “Cookie settings” at the bottom of every page. We then delete the _ga cookies and no longer load Google Analytics.
• Without consent, the page loads nothing from Google Analytics.

9. Objection, correction, erasure, access

Via the objection and correction form, we process the information you provide (type of request, name, company or person concerned, reasons, email address) and a log of how it was handled. Purpose: handling your request and proving that we did so (Art. 6(1)(c) GDPR in conjunction with Art. 12 to 21 GDPR). We delete unconfirmed requests after 7 days and completed ones after 3 years.

10. Cookies and browser storage

Necessary cookies and storage do not require consent (§ 165 (3) TKG 2021), because the feature you are using does not work without them.

11. Recipients and third countries

The following work for us as processors: Vercel (hosting), Neon (database), Resend (email), Google (Firebase Authentication, Google Analytics), Anthropic (AI) and Stripe (payment and invoices; itself the controller for payment processing). They process data only on our instructions. Your browser loads the map data directly from OpenFreeMap (or OpenStreetMap as a fallback). Register data is visible to everyone on the website; we do not pass on other data unless we are legally obliged to do so.

Some providers are based in the USA or access data from there. The transfer is based on the European Commission’s adequacy decision on the EU-US Data Privacy Framework (10 July 2023), where the provider is certified under it (for example Google LLC, Stripe, Inc.), and additionally on the European Commission’s standard contractual clauses (Art. 46(2)(c) GDPR).

12. Your rights

You have the right to

• access your data (Art. 15 GDPR),
• rectification (Art. 16), erasure (Art. 17) and restriction of processing (Art. 18),
• data portability (Art. 20) – for account data directly in your account under “Download data”,
• object to processing based on legitimate interests, on grounds relating to your particular situation (Art. 21 GDPR),
• withdraw consent with effect for the future (Art. 7(3) GDPR).

The easiest way is the objection and correction form or an email to contact@schantastic.com. We reply within one month.

You can lodge a complaint with the supervisory authority: Austrian Data Protection Authority (Österreichische Datenschutzbehörde), Barichgasse 40–42, 1030 Vienna, www.dsb.gv.at – or with the supervisory authority in your country of residence.

13. No automated decisions

We do not make automated decisions and we do not rate people (no profiling within the meaning of Art. 22 GDPR). Score and signals relate only to companies, are calculated from register data and are marked as calculated; we do not show them for sole traders. They are not a credit report.