COOKIE POLICY Last updated: September 2026 Legal basis: Austrian TKG 2021 (§ 165), GDPR, DSG 1. What are cookies and similar technologies? Cookies are small text files stored on your device. In mobile apps, we primarily use LocalStorage and SessionStorage rather than traditional cookies. This policy applies to all storage technologies used on the WoSuch platform (web and app). 2. Categories of Technologies Used 2.1 Technically Necessary Technologies (always active) These are strictly required for basic platform operation and cannot be deactivated (§ 165(3) TKG 2021). • WoSuch Session (Supabase Auth Token) Purpose: Authentication of logged-in users, security (CSRF protection) Retention: Session / up to 30 days ("stay logged in") Legal basis: Art. 6(1)(b) GDPR • Consent Storage Purpose: Storing your cookie and privacy settings Retention: 12 months Legal basis: Art. 6(1)(f) GDPR • Technical App Settings (LocalStorage) Purpose: Language setting, dark/light mode, app state Retention: Until manual deletion / app uninstallation Legal basis: Art. 6(1)(f) GDPR 2.2 Functional Technologies (only with consent) These technologies enable key comfort functions and involve transfers of data to US-based providers. They are only activated after your explicit consent (Art. 49(1)(a) GDPR). • Mapbox Inc. (USA) — Map display Purpose: Display of properties on an interactive map, saving last map view (zoom, position) Data transferred: IP address, map tile requests Retention: Session + 30 days for map settings Third-country transfer: USA (no adequacy decision; SCCs + your explicit consent under Art. 49(1)(a) GDPR) Without consent: Map view is disabled. • Anthropic PBC (USA) — AI Search Assistant Purpose: Processing your text input for AI-powered property search Data transferred: Text content of search query Retention: Chat history on WoSuch servers for 7 days, then deleted; no personalised profiling Third-country transfer: USA (no adequacy decision; SCCs + your explicit consent under Art. 49(1)(a) GDPR) Without consent: AI assistant is disabled. 2.3 Analytical Technologies (only with consent) Help us understand and improve platform usage. All analytics data is anonymised. • Anonymised app usage statistics Purpose: Page views, feature usage, error analysis (aggregated, no individual user tracking) Retention: 30 days, then aggregated/deleted Legal basis: Art. 6(1)(a) GDPR • Firebase Crashlytics (Google LLC, USA) — mobile app only Purpose: Technical error reports (crashes), no user tracking Retention: 90 days Legal basis: Art. 6(1)(a) GDPR; Art. 46 GDPR (SCCs) 2.4 Marketing / Tracking Technologies WoSuch deliberately does not use any tracking technologies for marketing purposes (no Facebook Pixel, no Google Remarketing, no cross-site trackers). Should this change, we will obtain your explicit consent in advance. 3. Push Notifications (mobile app) • Firebase Cloud Messaging (FCM, Google LLC): delivery of push notifications (price changes, search agent matches) — only when function is activated; legal basis: Art. 6(1)(a) GDPR. • Apple Push Notification Service (APNs): technically required for iOS push notifications. 4. Managing and Withdrawing Consent You can change or withdraw your consents at any time in the app under Profile → Privacy → Cookie Preferences. Effect of withdrawal: Withdrawal applies to future processing. The lawfulness of processing carried out prior to withdrawal is not affected (Art. 7(3) GDPR). After withdrawal, Mapbox and the AI assistant are disabled until you consent again. 5. Third-Party Privacy Policies • Mapbox: https://www.mapbox.com/legal/privacy • Anthropic: https://www.anthropic.com/privacy • Google / Firebase: https://policies.google.com/privacy • Apple: https://www.apple.com/privacy 6. Contact Questions about cookie use: kontakt@wosuch.com 7. Updates The current version of this policy is always available in the app and at wosuch.com/at/cookies. Material changes will be notified in the app.