Privacy policy
This policy explains which personal data we process when operating DevHero (www.devhero.one), why, and on what basis. It applies under the Swiss Federal Act on Data Protection (FADP) and, where applicable, the EU General Data Protection Regulation (GDPR).
1. Controller
Techfunder World AG
Industriestrasse 9
6302 Zug
Switzerland
E-mail: [email protected] · Phone / WhatsApp: +49 171 1254074
We have not currently appointed a representative in the EU under Art. 27 GDPR. We have not appointed a data protection officer; please send privacy requests to [email protected].
2. Visiting the website
When you open pages, your browser sends technically necessary data (IP address, date and time, address requested, referrer, browser and operating system details). We use it to deliver the website and to protect it against misuse (for example, by limiting sign-in attempts). Where server logs are kept, we delete them after at most 30 days unless they are needed to investigate a security incident. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in secure operation).
We serve fonts and all page components ourselves; no third-party content is loaded when you visit. We use no analytics, tracking or advertising services.
3. Cookies and local storage
We only set cookies and storage entries that are strictly necessary for the functions you use (sign-in, payment, language). No consent is required for these (§ 25(2) no. 2 of the German TDDDG). The full list is on the Cookies page.
4. Requests by WhatsApp or e-mail
You can contact us free of charge on WhatsApp or by e-mail. When you send the lead pack request form, your device opens WhatsApp or your e-mail program with a prepared message to BRNZ. We only receive what you send (for example name, organisation, project types, technologies, region, minimum budget and notes) and use it to answer your request. Legal basis: Art. 6(1)(b) GDPR (steps prior to a contract), otherwise Art. 6(1)(f). WhatsApp is operated by WhatsApp Ireland Limited (Meta); WhatsApp's own privacy policy applies to its use, and data may be transferred to the USA. For internal work we use Gmail (Google) and a self-hosted WhatsApp connection. We keep requests as long as needed for the business relationship, and business correspondence as long as the law requires.
5. Account and credits
For an account we process your e-mail address, name, organisation, role (agency, freelancer or client), currency and language, as well as credits bought and used, orders (for a lead pack also the profile you describe, such as project types, technologies, region, minimum budget and notes), unlocked projects and your alert settings (project types, countries, minimum budget). The purpose is to provide the account and the paid services; the legal basis is Art. 6(1)(b) GDPR. For signing in, we store your private account link only as an irreversible hash. You can download your data and delete your account at any time in the account area; we then remove your details but keep booking and payment records as long as the law requires (in Switzerland usually 10 years, Art. 958f Code of Obligations).
6. Payments through Stripe
You pay for credits through Stripe. You enter payment details directly at Stripe; we receive no card data, only the amount, currency, status and a reference of the payment. For accounts in Switzerland, the contracting party is Stripe Payments Europe, Limited (Ireland). Stripe processes, among other things, your e-mail address, name, billing address, tax ID and payment data, partly as an independent controller (for example for fraud prevention and legal obligations), and may transfer data to other countries including the USA. Details: stripe.com/privacy. Legal basis: Art. 6(1)(b) and (c) GDPR.
7. E-mails from us
We send sign-in links, order confirmations, lead packs and, if you switch them on in your account, alerts about new projects. You can switch alerts off in your account at any time.
8. Project listings from public sources
DevHero lists currently open software and web development projects worldwide from three kinds of public source: (a) public tenders from official open-data sources (EU TED, UK Contracts Finder and Find a Tender, Spain's Plataforma de Contratación del Sector Público); (b) projects that clients post on freelance boards (PeoplePerHour); (c) contract roles with a stated rate from public job posts (Himalayas, Jobicy, Hacker News). Each listing shows our own English summary, the project type, the technologies named, the budget or rate (in the source currency and as a US-dollar value at ECB reference rates), country or city, posting date and deadline.
The listings are mainly about organisations: for public tenders the buyer is a public authority. Contact persons named in tender notices are not stored or shown. We do not store names, usernames, e-mail addresses or phone numbers of private individuals who posted projects; where a freelance post comes from an individual, we only summarise the project description, budget and country. Publicly, listings appear without the client or buyer, the source link and the reference; signed-in users can unlock these, together with the original title and a quote from the notice or post, with credits. The unlocked link leads to the original notice or post on the source platform, whose own terms and privacy policy apply.
The purpose is to show agencies, freelancers and in-house teams open projects they can apply or bid for. Where personal data is concerned at all, the legal basis is our legitimate interest, and that of our users, in finding projects that were published so that suppliers would respond (Art. 6(1)(f) GDPR). Is this your project or notice? We correct or remove it on request: write to [email protected]. You can object to the processing at any time in the same way.
9. Access for AI agents and their payments
Through /agents/, /mcp and /a2a, software agents can query our data, open an account, pay and send requests. We store what they send (such as name, e-mail, organisation and the text of a lead pack request), the agent's name and who it acts for (if given), the user agent and a shortened hash of the IP address (Art. 6(1)(b) and (f) GDPR). Agent accounts get an API key; an e-mail address is optional.
Payments: for payments in USDC (x402, on Base or Solana) we process the payment data sent by the agent and the payer's wallet address; a service provider (Coinbase Developer Platform or PayAI) verifies and settles the payment and receives that data for this purpose. Blockchain transactions are public and permanent and cannot be deleted by us. For Lightning payments we process the invoice and payment hash through our Lightning service (LNbits, BTCPay Server or our own node). Card payments through Stripe (including shared payment tokens from agent wallets) work as described in section 6. We keep payment records for the periods required by law.
10. Recipients and transfers abroad
Data is only received by the service providers named above for their task, by our team (BRNZ), and by authorities where we are legally obliged. The EU Commission has issued an adequacy decision for Switzerland. Transfers to countries without an adequate level of data protection (for example the USA) only take place with appropriate safeguards, such as the recipient's certification under the Data Privacy Framework or standard contractual clauses.
11. Your rights
You have the right of access, rectification, erasure, restriction of processing and data portability, and the right to object to processing based on legitimate interests. You can withdraw any consent at any time. Write to [email protected]; downloading and deleting are also available directly in your account. You can lodge a complaint with a supervisory authority: in Switzerland the Federal Data Protection and Information Commissioner (FDPIC), in the EU the authority of your place of residence or work.
12. Security and automated decisions
The connection to the website is encrypted (HTTPS), and access to internal data is password-protected. We do not make automated individual decisions or create profiles.
13. Changes
We update this policy when our processing changes. The version published here applies.
Last updated: 18 October 2026