Privacy Policy

Draft for legal review, not final.

Last updated: 27 September 2026

1. Who is responsible
2. Visiting the site
3. Your request
4. Health details
5. The AI summary
6. Who sees your request
7. After an introduction
8. Your account
9. Emails
10. Advisers
11. Advisers we write to by post
12. The notary directory
13. Our service providers
14. How long we keep data
15. Your rights
16. Changes

1. Who is responsible

Oscar Rojas, Alt-Mariendorf 50, 12107 Berlin, Germany, who runs Plain Finance (Imprint).
Email: contact@plainfinance.de

2. Visiting the site

Server logs. To deliver the site and spot attacks, our server records your IP address, the time, the page asked for and your browser (Art. 6(1)(f) GDPR). We delete the logs after 30 days, unless one is needed as evidence of an attack. To stop abuse of our forms, we also count what's sent from each IP address and email address, for an hour, in memory.

Cookies. We set only the two cookies the site needs to work, so there's nothing to consent to (§ 25 Abs. 2 Nr. 2 TDDDG). No advertising or tracking cookies.

Your browser tab. Without an account, the figures you work out in the buying-a-home steps or the mortgage calculator, and a home you type in on step 2, stay in your browser tab (its session storage, which is not a cookie: your browser never sends it to us by itself), so the request form can fill them in for you. They reach us only if you send a request, and then only your own rough figures go with it: the home's price, town and state, your own funds and your household income as a range, which you see before you send. Sending the request, pressing "Clear it" or closing the tab deletes them. What the tab keeps: step 1's figures, as worked out (pf-numbers); a home typed on step 2 (pf-home); a flat to let typed on step 2 (pf-let-home).

Calculators. The figures you enter are sent with the form, never in the web address, and kept with your session on our server: for 24 hours at most, or until you press "Start again" (Art. 6(1)(b)). Saving them to an account is a separate choice (section 8), and a request form may start with them, for you to check. The private health insurance check never asks about your health, and its answers go to no one unless you send a request from its result: then the result and your answers on work, pay against the threshold, family and current cover go with it, never your pay or your age.

Visitor statistics. We may count visits with Plausible Analytics, an EU service that sets no cookies and stores no personal data: it uses your IP address and browser only to work out your country and a code that changes every day, then discards them (Art. 6(1)(f)). It never runs on the pages for your request, your account or the adviser portal. From the private health insurance check it gets only the result's category and your work situation.

3. Your request

When you send a request, we process what you give us: your name, email, phone number and town; what you want help with and how soon, with any date you're working to; your residence status and work situation; whether you're a US citizen or green-card holder; your own rough figures, if you give them; your description; and when and how you'd like to be reached. From a step-by-step page we ask less, and your rough figures come from what you worked out or saved, shown to you before you send. For a mortgage we ask where you are, your rough figures and your household's net income as a range; for a pension or investing request, one or two answers such as your age as a range. A mortgage request at an early stage is saved and goes to nobody until you tell us you're ready. We add our own notes as we handle it.

We use it to understand your request and introduce you to a professional who works in English: steps before a contract, taken at your request (Art. 6(1)(b)). What you want help with decides which kind of professional sees it (section 6). You don't have to give us any of it, but without it we can't introduce you.

The email code. Nothing goes to anyone until you type the 6-digit code we email you, so every request we pass on comes from a real address (Art. 6(1)(f)).

How you found us. With your request we store the page you sent it from, the name of the website that linked there (never the full address), and any campaign label in our own links. No cookies. We use it only in aggregate, to see which channels bring people to us (Art. 6(1)(f)).

No documents. We don't accept documents with a request.

4. Health details

We never ask for health details, and the boxes where you describe your situation say "Please leave out health details". A professional who needs them, for health or disability insurance for example, asks you directly, under their own duties.

If your request contains some anyway, we use them only to find and remove them: the AI summary flags them (section 5), and a person takes them out before your request goes to anyone. In your request's file, what you write goes to the professional who took it on as you wrote it.

5. The AI summary

After you confirm your email, an AI model reads your request: Claude, made by Anthropic, run for us by Amazon Web Services (Bedrock) within the EU. It never receives your name, email or phone number; we take them out of your description too. It:

• writes a short, neutral summary for the professionals, with where you stand if you said;
• scores how clear the request is, from 1 to 5;
• flags a request that doesn't look like a genuine money question, and any health details;
• may note a second money area the request fits, so a professional in that area can be matched too.

A flag, or a score of 2 or less, holds your request for a person, who decides what happens next. The AI never rejects a request, and no decision about you is made by automated means alone (Art. 22 GDPR). The professionals who see your request see the summary and the score. Legal basis: Art. 6(1)(b) for the summary, and Art. 6(1)(f) for screening out spam and abuse. Your request isn't used to train AI models, Amazon Web Services doesn't store it, and Anthropic receives nothing. The results are deleted with your request.

6. Who sees your request, and what they may pay us

You pay us nothing. Who your request goes to depends on what you ask about, and the page says so before you send it. It reaches them in one of two ways:

• Financing experts and insurance experts. We offer it to a financing expert or insurance expert who fits it, one at a time where we can, and never to more than two. If neither takes it on, we ask you before anyone else sees it. Financing experts and insurance experts may pay us a fee when they take on a client we introduce. What they pay never decides who we pick.
• Fee-only advisers and pension advisers. Up to two fee-only advisers or pension advisers who fit it see a summary, without your name or contact details. The first to take it on gets them, and gets in touch. If neither does, we ask you before anyone else sees it. Advisers may pay us a flat fee to be on Plain Finance, the same whichever requests they take.

Before anyone takes it on, those it's offered or shown to see a summary: what you want help with, how soon and any date, the town or state, your residence and work situation, whether you're a US person, your rough figures (marked as yours, and unchecked), the AI summary and score, and your description with your name, email and phone taken out.

The one who takes it on gets your name, email, phone number, when you can be reached, and your full description. From then on they handle your data under their own responsibility, as a controller in their own right. You share a file with them on Plain Finance: messages, contact attempts and updates, and, with a fee-only or pension adviser, documents you choose to add. Besides us, only the two of you see it.

If you choose to send a new request first to the adviser you already work with, they see it first, for a working day. Apart from these professionals, your request goes only to the service providers who run the site for us (section 13).

7. After an introduction: check-ins and the 24-month rule

About 60 and 120 days after an adviser takes on your request, we email you two short questions: what you did, and whether they helped with anything else. Answering is optional. It helps us check the introduction was worth it, and that advisers pay us what they agreed to. Each check-in email has a link that stops them with one click, and you can also write to us. We don't send them to addresses on our do-not-email list. Your answers are kept with your request and deleted with it, and the adviser never sees them. Legal basis: Art. 6(1)(f), our interest in checking our introductions and what advisers owe us.

For 24 months after we introduce you, an adviser who also helps you with something else may pay us for that too. You still pay us nothing, and they may never add what they pay us to your bill. To recognise you for those 24 months, even once your request is deleted, we keep with each fee an adviser owes us a keyed fingerprint of your email address, which can't be turned back into the address. We blank it 24 months after the fee (Art. 6(1)(f)). The record of the fee itself is bookkeeping we must keep (Art. 6(1)(c) GDPR, § 147 AO). Our monthly check that what advisers pay never decides who gets a request uses counts only.

8. Your account, and help we arrange by hand

You can use every guide, video and calculator without an account. We open one for your email address once you type the code we send to it: when you save something, and when you send a request, so you can follow it there. There's no password.

About you is your net household income, your age and your other loan payments, and your residence status and work situation: you give them once, and the calculators and requests then start with them. We use About you only to fill in forms for you: not to profile you, not for marketing, and not to contact you. Any other use would need your separate consent first. You can change or clear each figure on your account page.

Each topic keeps its own data. For buying a home: what you save from the calculator; the homes on your shortlist, with their details and where you are with each; your notes, viewing checklists and price checks; and the help you ask us for. For buying to let: what you save from its calculator, your tax rate included if you gave it. A request you send from your account also starts with the name, phone number, town, residence status and work situation from your latest request, for as long as that request is kept.

We keep all this to show it back to you and, when you choose to send a request, to fill it in (Art. 6(1)(b)). Nobody else sees your account. A request sent from it carries only your own rough figures (for a home: its price, town and state, your own funds and the loan they imply; for a flat to let, also the rent you expect; for a mortgage, your household's net income as a range; for a pension, your age as a range), which you see before you send. Your exact income, age and other loan payments stay in your account. Please keep health details out of your notes.

Deleting your account deletes it at once, with everything in it, and every request sent with its email address, with their messages, check-ins and answers. If a professional holds one of them, we tell them it's gone. What stays is the record of any fee an adviser owes us for introducing you, with the fingerprint instead of your address (section 7). An account nobody signs in to for two years is deleted.

Help we arrange by hand. If you ask us to find a surveyor or valuer, an interpreter or a tax adviser, we read your request ourselves. When we approach professionals, we describe what you need and where, without your name or contact details, and pass those on only once you've agreed to the introduction by email. They then handle your data under their own responsibility. If you hire a surveyor or an interpreter, they may pay us a fee for the introduction; we tell you before. A tax adviser pays us nothing. Notaries are in our directory (section 12). For a lawyer, we pass your request, once you agree, to Klarlaw, our sister service, run by the same operator.

9. Emails

About your request. Your code, confirmations, progress, who took it on, and the check-ins (section 7) (Art. 6(1)(b)). We keep no copies; our email provider keeps delivery logs (section 13).

Marketing emails (only if you ask)

If you opt in, we email you occasional tips on other money questions in Germany, and offers from our partners. You can unsubscribe at any time.

10. Advisers: applying, taking part, invoices

Applying. We process what you give us: your name, firm, business address, email, phone, website and the link to its privacy policy; your licences with their register numbers; your indemnity insurance (insurer, policy number, expiry); how you're paid, your languages, areas and monthly capacity; anything else you tell us; and which versions of our acceptance policy and terms you accepted, and when. We add a log of our checks: your entries in the public registers (the DIHK Vermittlerregister, the Rechtsdienstleistungsregister), your insurance and your website. Legal basis: steps before a contract you asked for (Art. 6(1)(b)), and our interest in introducing clients only to licensed, insured professionals (Art. 6(1)(f)). A rejected or withdrawn application is deleted 183 days after the decision, so we can answer any claim about it (Art. 6(1)(f)). An approved one becomes your profile.

Taking part. Your profile, limits and login; what you do with requests (offers, takes, passes and why, contact attempts); your charges and statements (Art. 6(1)(b)). A monthly check that what advisers pay never decides who gets a request uses counts only (Art. 6(1)(f)). Clients see your name, and what you write in their file. Once you stop taking part, we keep your profile until 3 years after your last activity, then cut it to your name, firm and bookkeeping records.

Invoices. Once we charge, we invoice you monthly, as a PDF by email, by post, or both, as you choose. An invoice carries your invoice address, our details and the month's lines, each naming the request by its case number, never the client. LetterXpress prints and posts the ones sent by post. We keep invoices for 8 years from the end of the year of issue (§ 14b UStG, § 147 AO), and our record of charges for 10 years (Art. 6(1)(b) and (c)).

11. Advisers we write to by post

To invite advisers to join, we write to some of them once, by post. For this we use an adviser's name and title, firm, business address, area of work, register number, and where they say they work in English, taken from public sources such as the legal notice (Impressum) on their website; the letter names the source. We use them only for that one letter, based on our interest in direct marketing (Art. 6(1)(f)), and don't email or call advisers for it. LetterXpress (A&O Fischer GmbH & Co. KG, Winsen (Luhe), Germany) prints and posts the letter for us.

We delete these details 6 months after the letter, or at once if the adviser objects. So that nobody gets a second letter, and an objection holds, we keep only a one-way hash of the name and postcode, and of the firm and postcode. Advisers can object at any time by writing to contact@plainfinance.de (Art. 21(2)).

12. The notary directory

Our notary directory lists notaries who work with English-speaking clients, city by city. Any notary can join, on the same terms, and we check that each one is a notary before listing them. They're shown in alphabetical order by surname: we don't rank, recommend or choose a notary for you.

Writing to a notary. When you send a notary a request from the directory, we email it to them, with your email address for their reply, and send you a copy. The notary replies to you directly, and whether you go ahead is up to you. We process your name, email address, what it's about, when, and your message, and link it to your account if you're signed in, to pass it on as you asked (Art. 6(1)(b)). The notary you chose handles it under their own responsibility, as a controller in their own right. We keep our copy for 90 days, then delete it; deleting your account deletes it at once, and "Download my data" includes it. To stop misuse of the form, we count what's sent from each IP address and email address, for an hour, in memory.

Notaries in the directory. When a notary joins, we process their name and title, office name and address, office email and phone, website, whether they work with English-speaking clients and can notarise in English, which version of the directory terms they accepted and when, and our note on how we checked, in the Bundesnotarkammer's official notary search, that they're a notary. Their city's page shows their name, office, address, website and those facts. Their phone number is only for our check; their email address is where requests go. Legal basis: the directory they joined (Art. 6(1)(b)), and our interest in listing only notaries (Art. 6(1)(f)). An entry stays until the notary asks us to take it down; a rejected or taken-down entry is deleted 90 days after the decision, with any requests still addressed to it.

13. Our service providers

These process data for us, only on our instructions and under a data processing agreement (Art. 28 GDPR):

Amazon Web Services and Sentry belong to US companies. Their agreements include the EU's standard contractual clauses, and Amazon is certified under the EU-US Data Privacy Framework.

Backups. Our server takes a snapshot every day and keeps the last 7, so something we delete can stay in a backup for up to 7 more days.

Error reports. If we switch on error reporting (Sentry, in its EU data region), a report of a fault goes there stripped of personal data: no form contents, cookies, IP addresses or user details, and email addresses, phone numbers and bank details are taken out of its messages. We use it only to find and fix faults, and it's deleted after 30 days (Art. 6(1)(f) GDPR).

14. How long we keep data

15. Your rights

• Anything else by email to contact@plainfinance.de: access, correction, deletion without an account, restriction and portability (Art. 15 to 20). We answer within a month.
• Withdraw a consent at any time, for the future.

You can also complain to a supervisory authority. Ours is the Berliner Beauftragte für Datenschutz und Informationsfreiheit.

16. Changes

We update this policy when what we do changes, and change the date at the top.