LEGAL
Privacy notice
This notice explains how DimeTrace handles information when you browse, contribute costs, ask for an email or report content.
Controller
The person responsible for your personal data is Ing. Tobias Américo-Schmidradler, Linzer Straße 17, 4100 Ottensheim, Austria. Contact us by email for any privacy question or request.
Browsing and trying a comparison
You can browse without an account. Your connection necessarily sends technical information, including your IP address, to the systems delivering the site. Requests include the page address and browser information. We use this to deliver pages and protect the service, based on our legitimate interest in a working, secure website (Article 6(1)(f) GDPR, the EU General Data Protection Regulation).
Amounts and household sizes entered in the discovery calculator stay in the page while you use it. City searches go to our server to find matching places; the application does not save those searches. Public filters and shared links may contain the place, category and selected comparison settings. Do not add personal information to links.
Our product statistics are daily totals, grouped by event, language and place. They contain no IP address, browser details, referrer, visitor identifier or tracking cookie. These totals cannot tell us who visited. This is separate from the technical information processed to deliver the website and sign you in.
Accounts and contributions
Signing in requires an email address. We process it together with your account identifier, language, sign-in and session records to create and secure your account, send your sign-in link or code and provide account controls. This is necessary to provide the account service you request (Article 6(1)(b) GDPR); preventing misuse also serves our legitimate interest in account security (Article 6(1)(f)).
When you submit a cost, we store your account identifier, city, optional selected district, amount, original currency, payment frequency and date, household size and number of children under 14, circumstances that gave you access to that price, broad residency situation, category-specific answers and any optional note. We also store the monthly equivalent, submission and update times, review status, review reasons and the date after which the figure stops counting. We use these to provide your contribution, comparison, correction and deletion features (Article 6(1)(b)).
An email address and the required contribution fields are needed for those features; you can use the public site without providing them. Do not enter names, home addresses, coordinates, building identifiers, contact details of other people, diagnoses or documents. Health contributions are currently closed pending Austrian legal advice. Other categories must not be used to submit medical information.
Who can see a contribution
Your individual cost record is private. You can see your own records. Authorized reviewers can see the cost and context needed to check submissions in their assigned places; their review screen does not show your email address or account identity. The operator and technical administrators can access personal data where needed to run the service, handle requests and protect it.
Public cost statistics require approved, current contributions from at least five different people. Every displayed subgroup has the same minimum. Your private comparison requires at least five other people and explains when it must use a broader comparison. No public contributor profiles or raw cost records are provided. Official statistics are displayed separately.
Reviewers make publication decisions. Automated checks validate fields and highlight possible duplicates or implausible figures. Comparisons are informational; we do not make solely automated decisions with legal or similarly significant effects on you.
Emails you receive
If you ask to hear when a place has enough contributions, we store your email, chosen place and category, language, request time and confirmation record separately from accounts. We send a confirmation request and, after you confirm, one availability notice. This uses your consent (Article 6(1)(a) GDPR). You can withdraw it using the cancellation link in the confirmation email or by contacting us; withdrawal does not affect earlier lawful processing.
For an approved contribution, we may send one reminder in the 21 days before that figure stops counting, asking whether it is still current. This serves our legitimate interest in keeping reported costs current (Article 6(1)(f)). You may object by email without deleting your account; we keep that choice with your account so later edits do not restart reminders. There is no promotional newsletter. Messages already handed to the email delivery service may still arrive after cancellation or deletion.
Reports, support and reviewer access
For a content report we store the page link, your explanation, optional email, submission time and handling status. If signed in, the report may also be linked to your account. Email correspondence additionally contains your sender details and anything you send. We use these to answer you, correct errors, protect people and handle complaints (Article 6(1)(f)); where a legal duty requires action, Article 6(1)(c) applies, including applicable duties under the EU Digital Services Act.
For reviewers we also process invited email addresses, assigned places, access status and records of who granted, revoked or used review access. The invitation may come from the operator before the reviewer creates an account. This serves our legitimate interest in restricting access and being able to check decisions (Article 6(1)(f)).
Service providers and international processing
We use Vercel Inc. (United States) to deliver the website and run its server functions, Supabase Pte. Ltd. (Singapore) for the database and accounts, and Zoho Corporation GmbH (Germany) for the office mailbox (Zoho Mail) and automated messages (Zoho Transactional Emails, also called ZeptoMail). These providers receive the information needed for their respective tasks. Personal data may also be disclosed to competent authorities where legally required. We do not sell individual contributions or email addresses.
The providers or their support companies may process data outside the European Economic Area. Vercel and Supabase include the European Commission's standard contractual clauses in their data-processing agreements for transfers that require them. Zoho states that staff in India may access data stored in its EU data centre for technical support under contractual safeguards. You can obtain the applicable safeguards through the provider links below or ask us for a copy. We do not claim that every processing step stays in the EU.
How long information is kept
Accounts and contributions remain until you delete them or request erasure. A contribution becoming too old to count does not delete it from your account. Deleting a contribution removes its associated review decisions; deleting an account removes its contributions. Previously downloaded public statistics cannot be recalled and cached pages may take time to update.
Closed website reports are deleted by the nightly cleanup once 180 days have passed since submission; an open report remains until handled. Review decisions and reviewer-access audit records are deleted after 730 days, unless a related contribution was deleted sooner. Daily product totals are also retained for 730 days. Reviewer invitations and access records have no automatic expiry; they are kept while needed to manage permissions and record revocations, and require a separate review when access is no longer needed.
Unconfirmed availability requests are deleted after seven days. Confirmed requests remain until cancellation or until the notice is queued; at that point they leave the waiting list. The separate outgoing-message record, including its recipient and message data, is kept while delivery is pending and deleted 30 days after its last update once sent or abandoned. Deleting an account does not automatically delete a separately requested alert or an already queued email.
Support correspondence and privacy requests are kept while needed to answer the request and resolve any related dispute or legal obligation; contact us for the retention assessment for your case. Provider technical logs are kept for security and troubleshooting according to the active service plan; backup copies remain until the configured recovery period expires. Both may remain after a live record is deleted. Ask us about the period that applies to a particular request.
Your rights and how to use them
You can request access and a copy, correction, erasure, restriction of processing and portability where the legal conditions apply. You can object to processing based on legitimate interests for reasons relating to your situation, and withdraw consent at any time. We will explain any legal reason that prevents us from granting a request.
Your account lets you edit or delete individual contributions, download your submitted cost records and delete the account with its contributions. The download contains contributions, not all account, email or report records. Ask us for a full personal-data access request or for help if an account control fails. Separate alerts, reports and correspondence can be addressed in the same request.
Email us, preferably from the address concerned. We may ask for proportionate information to verify that the request is yours; do not send identity documents unless we explain why they are necessary. We respond without undue delay, normally within one month. If the law permits an extension of up to two further months for a complex request, we explain it within the first month. Requests are normally free.
Complain to a data protection authority
You can complain to the Austrian Data Protection Authority (Datenschutzbehörde), Barichgasse 40–42, 1030 Vienna, Austria, email dsb@dsb.gv.at. You may also complain to the authority where you normally live or work, or where you believe an infringement occurred. You do not have to contact us first.
Browser storage and changes to this notice
The browser-storage page explains sign-in cookies, temporary contribution drafts and the optional remembered place, including their durations and removal. Fonts and map outlines are delivered with the site; no advertising tracker or third-party analytics script is installed.
We update this notice when the processing changes and show the revision date. A privacy notice is information, not blanket consent to new purposes. If a new use requires consent, we will ask separately before it starts.