CHEPERT

Check first. Trust better.

Assess places faster.

CHEQPERT combines publicly available information about restaurants, cafés, hotels and other places from multiple sources and turns it into concise guidance.

Open CHEQPERTPrivacy policy

What CHEQPERT offers

Discover places

CHEQPERT helps you find restaurants, cafés, hotels and other places nearby and brings the available information together in a clear format.

Assess across sources

A Q-Check considers publicly available signals from multiple sources. Instead of simply copying a single star rating, it makes data confidence, consistency, recency and identified risks visible separately.

Decide with context

The Q-Score is a concise guide. Underlying sources and notes remain visible where available so you can understand the assessment yourself.

How CHEQPERT works

CHEQPERT helps you assess places: find suitable places nearby and use a Q-Check to combine publicly available information from multiple sources into a concise guide.

Q-Check & AI transparency

CHEQPERT uses artificial intelligence to research and combine publicly available information about a place and prepare it as an assessment. If a clearly bounded source gap remains after the first research pass, CHEQPERT may selectively check additional public sources. Sources, data confidence and identified risks are shown separately in each Q-Check where available.

AI can make mistakes, overlook information or interpret relationships incorrectly. Publicly available sources can also be incomplete, outdated or contradictory.

A Q-Check therefore provides guidance and is not a guarantee or binding verification. For important decisions, also consider the cited sources, data confidence and current information.

The Q-Score is not an average star rating, an official inspection result or a guarantee. CHEQPERT calculates it deterministically using versioned scoring logic across multiple quality, source, consistency, recency and risk signals; AI researches and structures evidence but does not directly set the final Q-Score.

When scoring or source logic changes, CHEQPERT may technically reevaluate a stored Q-Check result with the current policy without researching the web again; the original check date is preserved. A true fresh check, by contrast, is a new Q-Check with current research and a new check date. The analysis version used is shown in the result details.

Data sources

Place and address data primarily comes from OpenStreetMap-based services. The map view uses OpenFreeMap as its primary basemap and OpenStreetMap raster tiles as a technical fallback.

Q-Checks may also consider publicly accessible information from websites, review platforms, editorial sources and community contributions.

The sources used for a specific Q-Check are shown directly with the result where available. CHEQPERT is not affiliated with the third-party providers mentioned.

Place & address data © OpenStreetMap contributors.

Legal notice & disclosure

Service provider and media owner: Markus Pehaim

Address: Stuttgarter Straße 40, 2380 Perchtoldsdorf, Austria

Contact: cheqpert@schmeggspert.com

Activity: Development and operation of CHEQPERT as a digital service for finding and AI-assisted assessment of places and offerings.

Editorial policy: Information and guidance about places and offerings based on publicly available sources and AI-assisted and algorithmic evaluation.

CHEQPERT is operated independently. Unless explicitly stated otherwise, there is no economic or corporate affiliation with listed or assessed places, platforms or other named third parties.

Purchases & payments

Where purchase products are enabled, they are currently one-time purchases rather than subscriptions. Product scope, the total price and, for time-limited products, the duration are shown before payment and supplied server-side from the central product configuration. VAT exempt under the Austrian small-business exemption (§ 6 para. 1 no. 27 UStG).

Payment is processed through the payment provider configured server-side for CHEQPERT (Stripe Checkout or SumUp Hosted Checkout). The separate return page does not confirm a purchase and does not need access to your private CHEQPERT session. After you return, CHEQPERT rechecks the order status in the signed-in app; credit or a Travel Pass is unlocked only after server-side verification with the payment provider. Full card details are not stored in CHEQPERT.

If a purchased digital service is to begin before the withdrawal period has ended, CHEQPERT requires two separate active confirmations before checkout: the express request for immediate performance and acknowledgment of the loss of the right of withdrawal once the contract has been fully performed. These statements are not preselected and are recorded server-side with the order in a versioned form.

After a server-confirmed purchase, CHEQPERT sends a purchase confirmation to the verified account email address. Purchases eligible for withdrawal are available under My Account → Buy Q-Checks → Purchase history → open purchase, where the “Withdraw contract” function and the server-calculated estimated refund are shown. For Q-Check packs, it reflects the unused portion of that specific purchase. For a Travel Pass, the higher usage share of elapsed time and newly used Q-Checks is taken into account. The withdrawal declaration and receipt time are stored before the affected entitlement is blocked from further use and the refund is initiated. Confirmation of receipt is sent via the Resend transactional email service. CHEQPERT sends a refund confirmation only after the calculated target amount has been verified as refunded by the payment provider stored for that order; payment processing and refunds are handled through Stripe or SumUp depending on the order.

Questions about purchases, refunds or withdrawal can be sent to the contact address shown in the legal notice.

Privacy

CHEQPERT processes data for operation, security and the features you use. Access to your device location only takes place after you grant permission. Alternatively, you can choose a search location manually.

If you use an account, account data and places you save, visit or rate, as well as personal notes, may be stored server-side. Even without an account, CHEQPERT may associate a Q-Check you start server-side with your signed anonymous session scope so that you can reopen that result in the same browser while the session remains valid; the Q-Check result itself is not stored in browser storage. For internal usage statistics, CHEQPERT may count app opens or resumptions server-side in 30-minute activity windows. The technical session/account reference used for this is purpose-bound and pseudonymized before storage and retained for at most 35 days. After the initial location step, CHEQPERT may ask you once whether you want to enable push. Notification permission is requested only after you explicitly choose to enable it. CHEQPERT stores server-side whether this one-time prompt has already been answered or dismissed with “Later”. If you enable push, the device-specific Web Push subscription required for delivery is also stored. Technically necessary session and language settings may be stored in cookies; CHEQPERT does not use additional advertising or analytics cookies or browser storage for these usage statistics.

Privacy policy

Information pursuant to Articles 13 and 14 GDPR

Last updated: 3 October 2026

1. Controller

Markus Pehaim

Stuttgarter Straße 40, 2380 Perchtoldsdorf, Austria

Email: cheqpert@schmeggspert.com

2. Data processed by CHEQPERT

Depending on how you use the service, CHEQPERT processes technical connection and security data, session and language settings, search locations or location coordinates, account and login data, and personal place data such as saved or visited places, ratings and notes.

If purchase products are enabled and you start a purchase, CHEQPERT also processes server-side order and payment-status data such as the internal order identifier, selected product, price and currency, status, provider references, and information about refunds or disputes. Full card details are not stored in CHEQPERT; payment data required for processing is handled directly by the server-selected payment provider, Stripe Checkout or SumUp Hosted Checkout.

If you use the online withdrawal function, CHEQPERT additionally processes the name you provide, the relevant order identifier, the email address specified for confirmation of receipt, the content and version of the withdrawal declaration, the recorded receipt time, and delivery and refund status. To calculate a proportional refund server-side, CHEQPERT also processes the unused or used Q-Checks attributable to that specific purchase and, for a Travel Pass, the elapsed duration; this is stored with the order as a refund snapshot. The withdrawal declaration is stored server-side before the affected entitlement is blocked and external delivery or refund attempts are made.

CHEQPERT is not designed to collect special categories of personal data within the meaning of Article 9 GDPR. Please do not enter such data in personal notes.

Which data must be provided depends on the feature used: technically necessary connection, security and session data is required for secure operation; a place to be checked must be provided for a Q-Check. Account and login data is required only for account and synchronization features. Device location and push notifications are optional. If data required for a feature is not provided, only that feature may be unavailable or limited; other available features remain unaffected.

3. App delivery and security

When the app is accessed, technically necessary connection data is generated. This may include IP address, time, requested resource, browser and device information, and technical error and security information. CHEQPERT also processes pseudonymized or hashed identifiers and usage counters to detect abuse, duplicate requests, quotas and technical failures.

Purpose and legal basis: secure and stable operation of the app and protection against abuse based on Article 6(1)(f) GDPR. The legitimate interest is the security, availability and economically controlled operation of the service.

4. Location and place search

Access to your current device location only occurs if you grant location permission in your device or browser. Coordinates are used to find nearby places, calculate distances and position the map. You can instead enter a search location or address manually at any time.

Location permission can be withdrawn at any time in your browser or operating system settings. Manual place searches remain available without location permission.

For Nearby searches, CHEQPERT stores discovered public place data server-side in the shared place catalog so known places can be available immediately in later searches. For individual search scopes, CHEQPERT stores only a technical hashed search-scope key together with search mode, radius and refresh status; raw search coordinates are not persisted for this purpose. For fully imported public OpenStreetMap regions, CHEQPERT may additionally store the public boundary geometry of the imported region and the timestamp of the underlying OSM data snapshot. This geometry describes the imported data region, not a user's location or location history. Coverage metadata contains no user, account, device or IP identifier.

Legal basis: Article 6(1)(a) GDPR for access to the current device location; Article 6(1)(b) GDPR for manually selected search locations and providing the requested search function. Reuse of public place data and non-user-specific technical refresh metadata is based on Article 6(1)(f) GDPR; the legitimate interest is a reliable, fast and resource-efficient place search.

5. Account, login and personal place data

An account is not required for every use. If you sign in, CHEQPERT processes the data required for authentication and account assignment. With the currently offered Google login, this may include your email address, display name and a technical provider identifier.

CHEQPERT is not specifically directed at children under 14. Where Austrian law requires consent for a consent-based feature, persons under 14 should use that feature only with the required consent of their legal representative. Manual place search remains available without location permission.

For installed Home Screen web apps or native app shells, Google sign-in may take place in a separate browser context. CHEQPERT therefore uses a one-time technical login handoff that is valid for no more than five minutes. The login request first switches through a separate CHEQPERT delivery address into the external browser; at the canonical CHEQPERT origin, a short-lived signed technical HttpOnly cookie is then set to securely correlate the provider return. The cookie contains neither access tokens nor the app proof. Provider session data is kept encrypted server-side and is transferred into secure HttpOnly cookies only by the original app context. CHEQPERT additionally uses a short-lived technical context binding that is kept only in the running app's volatile memory and is not stored in browser or native storage. After the provider return, the external browser shows only a completion page and does not take over the app session. The handoff is deleted immediately after successful transfer. Access and refresh tokens are not stored in URLs, JavaScript, browser storage or native storage.

With an account, saved and visited places, visit times, personal ratings, notes and the required place information may be stored server-side and synchronized across devices.

After the initial location step, CHEQPERT may ask signed-in users once whether push notifications should be enabled. Browser or operating-system notification permission is requested only after you explicitly choose to enable push. CHEQPERT stores server-side, in the existing push preference record, the time when this one-time activation prompt was answered or dismissed with “Later” so it is not repeated on every start. If you enable push, CHEQPERT additionally stores the Web Push subscription required for delivery to the relevant device. This includes a technical push endpoint and cryptographic delivery keys. This data is used solely for CHEQPERT notifications you have enabled. You can disable push again in your account; registered push devices are then removed server-side.

For operations and product observation, CHEQPERT may show authorized operators pseudonymized usage statistics and activity events. These include app opens or resumptions, active, new and returning visitors, new accounts, repeat sign-ins, started or failed Q-Checks, and actionable technical operational incidents. App opens are counted server-side at most once per 30-minute activity window; the technical session/account reference is purpose-bound and HMAC-pseudonymized before storage, is not exposed to operators, and is retained for at most 35 days. Account-linked pseudonyms are additionally removed through the account-deletion path. Terminal processing, push, provider/budget, and server-side sign-in failures may appear as operator notices; temporary retries are not stored as persistent notices. Operator push notifications do not contain a full email address; received event types are configurable server-side and visible only to centrally authorized operators.

Legal basis: Article 6(1)(b) GDPR for providing account and synchronization features; Article 6(1)(a) GDPR for voluntarily enabled push notifications; Article 6(1)(f) GDPR for the technical state of the one-time activation prompt and for pseudonymized operational, security and failure monitoring. The legitimate interest is to avoid repeated activation prompts and to ensure service stability, abuse prevention, troubleshooting, incident response and secure service improvement.

6. Q-Checks and publicly available sources

For a newly started Q-Check, place-related information such as name, address, category and coordinates, together with publicly available information about the selected place, is processed. This information may be sent to an AI service to perform web research, summarization and structured assessment. Account email addresses or personal notes are not required for the research request and are not intended to be sent to the AI service.

Publicly available place-related information may come in particular from websites, review platforms, editorial sources and community contributions. CHEQPERT does not aim to build profiles about individual reviewers or other natural persons. Personal references from third-party sources are processed only where they are technically or contextually unavoidable within the publicly available source.

Even without an account, CHEQPERT may associate a Q-Check you start server-side with a signed anonymous session scope. While that scope remains valid and the centrally resolved plan permits owner access, the same browser can retrieve the previously unlocked snapshot assigned to that scope. This does not grant access to other users' or global snapshots. The Q-Check result itself is not stored in persistent browser or device storage; only the technically necessary HttpOnly session identifier remains in the browser.

Completed general Q-Check results and their history are shared product knowledge and may also be shown to other users. Internal account associations are used only for technical purposes such as quotas, job control and provenance; when an account is deleted, the personal association with Q-Checks is removed.

Legal basis: Article 6(1)(b) GDPR for the requested Q-Check; Article 6(1)(f) GDPR for quotas, deduplication, cost control and abuse prevention.

7. Cookies and local storage

CHEQPERT uses technically necessary cookies for session, login and language settings. The selected language may be stored for up to twelve months. The signed anonymous guest session may remain valid for up to 30 days and is used, among other things, for quota control and to reopen the guest’s own previously unlocked Q-Checks. Authentication cookies apply for the respective session or until logout or account deletion.

CHEQPERT currently does not use advertising, marketing or analytics cookies. Personal product data is not stored in persistent browser storage. The PWA cache contains only the app shell and static files, not personal API responses.

8. Recipients and service providers

CHEQPERT currently uses the following categories of service providers for operation and functionality:

  • Vercel – hosting and delivery of the web application
  • Supabase – database, server-side storage and authentication infrastructure
  • OpenAI – AI-assisted research, summarization, structuring and translation
  • Google – optional login via Google OAuth
  • Stripe – payment processing for enabled one-time purchases through Stripe Checkout; payment and transaction data required for payment, fraud prevention, tax determination, refunds and payment disputes is processed for this purpose
  • SumUp – alternative payment provider for enabled one-time purchases through SumUp Hosted Checkout; payment and transaction data required for payment, fraud prevention, refunds and payment disputes is processed for this purpose
  • Resend – delivery of transactional purchase, withdrawal and refund confirmations; depending on the message, this involves transmitting in particular the verified account email address or the confirmation email address you provide, your name, order and product data, amount and status, and for withdrawals the content and receipt time of the withdrawal declaration
  • OpenFreeMap and OpenStreetMap-based services – place, address, map and nearby data; the map view primarily loads vector tiles and style resources from OpenFreeMap and uses OpenStreetMap raster tiles as a fallback on technical failure. Browser connection data may therefore be transmitted directly to the map service currently in use
  • Web Push infrastructure – when push is voluntarily enabled, technical delivery through the push service used by the relevant browser or operating system, for example Apple, Google/Firebase, Mozilla or Microsoft

For processing steps technically classified as share-safe and limited to place-related product data, CHEQPERT may use a separate OpenAI project. If optional OpenAI data sharing is enabled for that project, the API inputs and outputs sent through it may be used by OpenAI to evaluate and improve its services and models. CHEQPERT does not send account identities, email addresses, IP or session data, personal notes, ratings or scores, or the user's location coordinates through this route. The comprehensive internal research methodology is processed through a separate project without this sharing enabled.

In addition, publicly accessible websites may be accessed as information sources during AI web research. The sources used for a specific Q-Check are shown with the result where available.

9. International data transfers

Some service providers operate internationally or use group companies or subprocessors outside the European Economic Area. Where personal data is transferred to third countries, this is based on safeguards permitted by the GDPR, in particular adequacy decisions of the European Commission — including the EU-U.S. Data Privacy Framework where applicable — or Standard Contractual Clauses under Article 46 GDPR.

For Stripe services in the European Economic Area, the current Stripe contract involves in particular Stripe Payments Europe, Limited in Ireland. Depending on the processing, Stripe may act as a processor and/or as a separate or joint controller. Where Stripe transfers personal data to the United States or other third countries, Stripe identifies in particular the EU-U.S. Data Privacy Framework and Standard Contractual Clauses as transfer mechanisms.

For SumUp payment services, SumUp Limited in Ireland is involved and is regulated by the Central Bank of Ireland. Any additional recipients or international transfers involved in a specific payment depend on SumUp's then-current privacy information and the payment method used.

You can request information about the safeguards used for a specific third-country transfer, as well as a copy or information on where they are available, at cheqpert@schmeggspert.com.

10. Retention

Personal data is stored only for as long as required for the relevant purpose or as long as legal obligations require longer retention. Account and personal place data are generally stored until you delete them or delete your account. Pseudonymized app-usage events are retained for at most 35 days; account-linked pseudonyms are additionally removed when the account is deleted. Push subscriptions are removed when push is disabled, when the relevant device is detached, or when the account is deleted; invalid push subscriptions are also cleaned up during delivery. Technical security, quota and job data is limited according to operational requirements and deleted or anonymized once it is no longer needed for security, billing, troubleshooting or legal defense.

Order and payment-status data is retained for as long as required for contract performance, accounting, refunds, abuse and replay prevention, payment-dispute handling, legal defense, and applicable statutory retention obligations. Technical webhook evidence is limited to metadata and fingerprints required for idempotency, security and auditability; complete provider payloads are not persistently stored.

Withdrawal declarations, recorded receipt times, and evidence relating to confirmation of receipt and refunds are retained for as long as required to process the withdrawal, for accounting and refunds, to meet statutory evidence and retention obligations, and for legal defense.

General Q-Check results and Q-Check histories may be retained for longer as place-related product knowledge. Any existing personal provenance is detached when an account is deleted.

11. Your rights

Under the GDPR, subject to the applicable conditions, you have in particular the following rights:

  • access to your personal data
  • rectification of inaccurate data
  • erasure and restriction of processing
  • data portability
  • objection to processing based on legitimate interests
  • withdrawal of consent with effect for the future

Where available, the account includes functions for data export and account deletion. You can also contact the address listed above at any time.

12. Right to lodge a complaint

You have the right to lodge a complaint with a data protection supervisory authority. In Austria, this is the Austrian Data Protection Authority, Barichgasse 40–42, 1030 Vienna, email: dsb@dsb.gv.at.

13. Automated decision-making

CHEQPERT assesses places and offerings, not people. No solely automated decision is made about you that produces legal effects concerning you or similarly significantly affects you (Article 22 GDPR).

14. Changes to this privacy policy

This privacy policy will be updated if features, service providers or legal requirements change materially. The current version is available through CHEQPERT.