Privacy notice

Controller and contact

The controller is Maximilian Steinmetz, Haldenstraße 54, 73730 Esslingen am Neckar, Germany. Phone: +49 151 17806973, email: kontakt@cardguided.com.

This privacy notice explains which personal data ("data") we process, for which purposes and to what extent. It covers the website cardguided.com, your account, our AI assistant Alfred and our emails. is the name of this service. A data protection officer is not legally required and has not been appointed. This English version is a courtesy translation; the German version is authoritative.

Overview of processing

Types of data processed:

• Master data (e.g. first and last name, date of birth, email address)
• Content data (e.g. comparison criteria, saved comparisons, wishlist, questions to Alfred)
• Contact data (e.g. email address when you contact us)
• Usage data (e.g. pages viewed, features used)
• Meta, communication and process data (e.g. IP addresses, timestamps)
• Log data (e.g. server log files)

Data subjects: website visitors, registered users, newsletter subscribers and people who contact us.

Purposes: providing the website and its usability, comparing financial products, account and sign-in, the AI assistant, communication, the newsletter (only with consent), audience measurement and security.

Legal bases

We process data on the basis of the GDPR. The legal basis that applies is stated with each processing activity:

• Consent (Art. 6(1)(a) GDPR): you have consented to the processing for one or more specific purposes.
• Performance of a contract and pre-contractual requests (Art. 6(1)(b) GDPR): the processing is necessary for the user agreement or at your request.
• Legal obligation (Art. 6(1)(c) GDPR): the processing is necessary to comply with a legal obligation.
• Legitimate interests (Art. 6(1)(f) GDPR): the processing is necessary for our legitimate interests or those of a third party, unless your interests, fundamental rights and freedoms override them.

National data protection rules also apply, in particular the German Federal Data Protection Act (BDSG) and, for storing and reading information on your device, the Telecommunications Digital Services Data Protection Act (TDDDG).

Security measures

In line with the law, and taking into account the state of the art, implementation costs, the nature, scope, context and purposes of processing and the risks to your rights and freedoms, we take appropriate technical and organisational measures to ensure a level of security appropriate to the risk. These include controlling physical and electronic access to the data, input, disclosure, availability and separation, as well as procedures for exercising data subject rights, deleting data and responding to threats.

All connections to are encrypted with TLS (HTTPS). Passwords are stored only as a cryptographic hash, and administrative access additionally requires a second factor.

International data transfers

Some of our service providers are based in the USA or may process data there. We primarily base transfers to the USA on the EU-US Data Privacy Framework (DPF), which the European Commission recognised in its adequacy decision of 10 July 2023. In addition, we have agreed the European Commission's standard contractual clauses with the providers concerned; they serve as a fallback should the DPF change. The basis for each service is stated with that service. The list of certified companies is available at https://www.dataprivacyframework.gov/ (in English). Transfers to other third countries are protected by equivalent safeguards, in particular standard contractual clauses.

Website delivery and hosting (Cloudflare)

The website is delivered via Cloudflare (Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA). Each request processes technical connection data: IP address, date and time, requested page and file, amount of data transferred, success status, browser type and version, operating system and the previously visited page (referrer). This is necessary to deliver the website to your browser, keep it stable and defend against attacks such as overload (DDoS). The approximate country of a request is determined at the network edge to show the right market notice; no visitor profile is created.

Log file information is stored for no more than 30 days and then deleted or anonymised. Data needed as evidence is exempt from deletion until the incident concerned has been resolved.

Legal basis: legitimate interests (Art. 6(1)(f) GDPR). Cloudflare is our processor; basis for third-country transfers: Data Privacy Framework (DPF) and standard contractual clauses. Privacy policy: https://www.cloudflare.com/privacypolicy/

Storage in your browser (no cookies)

does not use cookies for advertising or analytics. In your browser's local storage (localStorage or sessionStorage) we only keep what is strictly necessary for the features you request:

• language and light or dark mode
• your sign-in session if you sign in
• temporarily, a comparison draft so you can continue after signing in
• for the browser session, whether you chose "Continue without signing in" and whether one-time notices (e.g. the greeting or the results animation) have already been shown

Session entries are removed when you close the browser; language, display mode and sign-in remain until you sign out or clear the site data. Legal basis is § 25(2) no. 2 TDDDG; no consent is required. The subsequent processing serves the user agreement or our legitimate interest in a user-friendly website (Art. 6(1)(b) and (f) GDPR).

Audience measurement (Cloudflare Web Analytics)

To understand how the website is used, we use Cloudflare Web Analytics. The service works without cookies or storage on your device and does not build user profiles; we only see aggregated figures such as page views, referring pages, countries and device types. Account, administration and sign-in pages are excluded. In addition, we count without reference to any person how often per day comparisons are started, results are shown and provider links are opened.

Legal basis: our legitimate interest in improving the website (Art. 6(1)(f) GDPR). Provider: Cloudflare, Inc. as our processor; basis for third-country transfers: Data Privacy Framework (DPF) and standard contractual clauses.

Account, registration and profile (Supabase)

An account is optional: you can view results without signing in. With an account you can save comparisons, keep a wishlist and manage your profile. Accounts are managed with Supabase (Supabase, Inc., USA); our database is located in Frankfurt am Main. Required account details are first name, last name, date of birth and email address: the date of birth confirms that you are of age, because the results include credit products only available to adults; your name identifies the account and is used to address you personally. We also store which version of the terms of use you accepted. We never ask for online banking credentials, card numbers or copies of ID documents.

Legal basis: performance of the user agreement (Art. 6(1)(b) GDPR). Supabase is our processor; basis for possible third-country transfers: standard contractual clauses. Privacy policy: https://supabase.com/privacy

Sign-in with Google (single sign-on)

Instead of email and password you can sign in with your Google account. Authentication takes place directly at Google; we receive a user ID and the information that you are signed in to Google under this ID, as well as your name and email address. We can neither see nor store your Google password. Any missing required details such as your date of birth can be added in your profile afterwards.

If you no longer want to use the link, you can remove it in your Google account; to delete your data with us, delete your account.

Legal bases: performance of the user agreement (Art. 6(1)(b) GDPR) and our legitimate interest in an effective and secure sign-in system (Art. 6(1)(f) GDPR). Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Privacy policy: https://business.safety.google/privacy/ Basis for third-country transfers: Data Privacy Framework (DPF).

Comparisons and wishlist

When you start a comparison, your criteria (e.g. country, personal or business use, employment, preferred card type and priorities) are sent to our comparison service and matched against the reviewed offers. Without an account they are only used to calculate the results and are not stored. With an account, comparisons are stored only if you save them; a saved comparison contains the results and criteria at that time. The wishlist stores the offers you mark.

Legal basis: performance of the user agreement (Art. 6(1)(b) GDPR).

Alfred, our AI assistant (OpenAI)

Alfred is an AI system: answers marked "AI" are generated automatically and may contain errors. Prepared answers are marked separately. When you send a question to the AI, your question, a short conversation history and the comparison criteria needed for the answer are sent via our server to OpenAI. Your last name and date of birth are never transmitted. Please do not enter personal data, credentials or documents in the chat. OpenAI processes the data as our processor and does not use it to train models; a transfer to the USA may take place on the basis of the EU-US Data Privacy Framework and standard contractual clauses. For cost control and abuse prevention we store pseudonymous usage data without message content.

Legal bases: performance of the user agreement (Art. 6(1)(b) GDPR) and our legitimate interest in preventing abuse (Art. 6(1)(f) GDPR).

Contact by email or phone

When you contact us by email or phone, we process your details (e.g. name, email address or phone number and the content of your message) to the extent necessary to answer your enquiry and any requested action. Emails to kontakt@cardguided.com are forwarded via Cloudflare Email Routing to a Google Gmail mailbox (Google Ireland Limited).

Please note that emails are usually encrypted in transit but not end to end.

Legal bases: performance of a contract and pre-contractual requests (Art. 6(1)(b) GDPR) and our legitimate interest in answering enquiries (Art. 6(1)(f) GDPR). Basis for third-country transfers: Data Privacy Framework (DPF) and standard contractual clauses. Deletion as described under "Storage period and deletion".

Account emails and newsletter (Resend)

We send account emails such as confirmations and password resets via Resend (Resend, Inc., USA) as our processor.

The newsletter is optional and is only sent after a separate sign-up and confirmation by email (double opt-in). We process your email address, your first name for a personal greeting, the interests you chose, proof of consent (time of sign-up and confirmation) and delivery and unsubscribe status. If you enable personalisation, we also remember the criteria of your latest comparison (e.g. area, card type and priorities) to send you relevant content. We do not measure open or click rates.

You can withdraw your consent at any time via the unsubscribe link in every newsletter, in your profile or by email. After you unsubscribe, we may keep the email address for up to three years on the basis of our legitimate interests in order to prove that consent was given; this processing is limited to defending against claims. You can request individual deletion at any time, provided you also confirm that consent was given in the past.

Legal bases: consent for the newsletter (Art. 6(1)(a) GDPR), performance of the user agreement for account emails (Art. 6(1)(b) GDPR) and legitimate interests for logging the sign-up process and the proof of consent (Art. 6(1)(f) GDPR). Basis for third-country transfers: standard contractual clauses.

Provider links

When you open a provider link, you leave and visit the provider's website, which has its own privacy notice. We do not pass your criteria or profile data to the provider. currently does not use affiliate links; before we use partner links, we will update this privacy notice and label such links.

Storage period and deletion

We delete data as soon as the purpose no longer applies or consent is withdrawn, unless a legal obligation or a legitimate interest (e.g. pursuing legal claims) requires longer retention. Where several periods apply to the same data, the longest applies.

We keep account data, saved comparisons and the wishlist until you change or delete them or delete your account. They are then removed; backups are overwritten in the regular cycle. We keep pseudonymous usage and security data only as long as necessary for cost control and abuse prevention.

Where statutory retention obligations apply, these are in particular:

• 10 years for books, records, annual financial statements and the documents needed to understand them (§ 147(1) no. 1 with (3) AO, § 257(1) no. 1 with (4) HGB)
• 8 years for accounting vouchers such as invoices and expense receipts (§ 147(1) nos. 4 and 4a with (3) sentence 1 AO, § 14b(1) UStG, § 257(1) no. 4 with (4) HGB)
• 6 years for business letters received and sent and other documents relevant for tax purposes (§ 147(1) nos. 2, 3, 5 with (3) AO, § 257(1) nos. 2 and 3 with (4) HGB)
• 3 years for data needed to assess possible warranty, damages or similar claims (standard limitation period, §§ 195, 199 BGB)

Periods of at least one year start at the end of the calendar year in which the triggering event occurred; for ongoing contractual relationships, when they end.

Your rights

Under the GDPR you have in particular the following rights under Art. 15 to 21 GDPR:

• Right to object: You have the right to object at any time, on grounds relating to your particular situation, to the processing of your data based on Art. 6(1)(e) or (f) GDPR; this also applies to profiling based on these provisions. Where your data is processed for direct marketing, you have the right to object at any time to processing for such marketing; this also applies to profiling to the extent that it is related to such direct marketing.
• Right to withdraw consent: you can withdraw any consent at any time with effect for the future.
• Right of access: you can request confirmation as to whether your data is processed, and access to this data, further information and a copy in accordance with the law.
• Right to rectification: you can request that your data be completed or that inaccurate data be corrected.
• Right to erasure and restriction of processing: in accordance with the law, you can request that your data be erased without undue delay or, alternatively, that its processing be restricted.
• Right to data portability: you can receive the data you have provided to us in a structured, commonly used and machine-readable format or request its transfer to another controller.
• Right to lodge a complaint with a supervisory authority: without prejudice to any other remedy, you can complain to a data protection supervisory authority, in particular in the member state of your habitual residence, your place of work or the place of the alleged infringement. Our competent authority is the State Commissioner for Data Protection and Freedom of Information of Baden-Württemberg: https://www.baden-wuerttemberg.datenschutz.de/beschwerde/

You can export your data and delete your account directly in your profile. For everything else, an email to kontakt@cardguided.com is enough.

No automated credit decision

ranks comparison results based on your criteria. does not decide on creditworthiness, opening an account, issuing a card or accepting an application. A result or an Alfred answer is not a commitment by the provider.

Changes to this notice

We update this privacy notice as soon as changes to our data processing require it, and we inform you if your involvement (e.g. consent) or an individual notification becomes necessary. Please check its content regularly. Addresses and contact details of other companies may change over time; please check them before contacting them.

Version: 11 October 2026.