Can I get a signed DPA / AVV?

Yes. We sign a standard German GDPR DPA (Auftragsverarbeitungsvertrag) on request - reach out from /sales. The text is the standard form most customer DPOs already know, no surprise clauses; we also accept your own paperwork if your legal team prefers their template. Reply time is within a working day. Most teams under 50 seats don't need one (the standard plan terms cover the legal posture); larger setups get a short signed addendum alongside.

How do I export my data?

Account settings → export. Returns a JSON archive containing every record you own, every file you uploaded, and the relevant audit-log entries. No support ticket, no waiting period, no fee. Same export shape works on every plan.

How do I delete my account?

Account settings → delete. Confirms once, then removes records, files, embeddings, and audit-log entries within 30 days. Stripe payment metadata stays as long as German tax law requires it (10 years), in line with §147 AO; everything else is gone.

Who are your subprocessors?

Two: Stripe (payment processing only, transferred under the EU-US Data Privacy Framework) and our transactional mail relay (EU-hosted). Neither sees your records. The full list and what each one is allowed to touch lives at /privacy and /security.

Does Contact Book use Google Analytics or Meta Pixel?

No. No third-party analytics at all. Device + session metrics live in our own Postgres + Redis. The cookie banner that GA / Meta require doesn't apply because we don't load them - one fewer dialog between a visitor and the page they came for.

Contact Book

Compare

Contact Book: the GDPR-friendly alternative to Vibe-coded DIY

Plain-language privacy notice, standard German GDPR DPA available on request, self-serve export + delete.

GDPR alternative

DIY

Build vs buy

Vibe coding

Finn GlasCo-Founder + Engineering

·April 4, 2026·

2 min read

GDPR isn't a checkbox - it's a posture. If you're moving off Vibe-coded DIY because their AVV / DPA is opaque, Contact Book is what a clean alternative looks like: subprocessor list of two (Stripe + mail relay), self-serve export + delete from account settings, and a standard German GDPR DPA on request when your procurement team needs one.

At a glance

Vibe-coding your own personal CRM is genuinely satisfying for the first weekend. Contact Book earns its place around month three, when you realise you've spent twenty hours patching CSV import bugs, fighting with auth, and still don't have reminders firing reliably. The cost isn't the build - it's the long tail of being your own product team for one user.

GDPR posture

GDPR is a posture, not a checkbox

Three things matter under GDPR for a tool like this: (1) lawful basis for processing, (2) data subject rights (export, delete, port), and (3) the auftragsverarbeitungsvertrag / DPA chain. Contact Book treats them as engineering invariants, not legal optics. Lawful basis is the contract you sign with us. Subject rights are self-serve from your account settings - no support ticket required. The subprocessor list has two entries (Stripe + mail relay). A standard German GDPR DPA is available on request from /sales whenever your procurement team needs one - we don't charge for it and don't gate it behind a plan tier. Where Vibe-coded DIY sits on each of these is the rest of this page.

Contact Book vs Vibe-coded DIY: GDPR comparison

	Ours Contact Book	Theirs Vibe-coded DIY
Initial setup	5 minutes	1 weekend
Total time over 2 years	~5 hours	~80+ hours
Reliable cadence reminders		If you build a worker
Live multi-tab updates
Mobile UI		DIY
Hosted in Germany		Whatever you pick
Backups + disaster recovery
Updates + security patches
MCP server / agent integration		If you build it
Free tier		Hosting cost
Yours to fork
Yours to walk away from

When to pick which

Pick Contact Book when

You want a tool that already works on Sunday evening, not one you're still patching by Sunday at midnight.

Your time is worth more than €1/month.

You'd rather spend the weekend on the actual people in your contact list than on the tool.

Pick Vibe-coded DIY when

Building it is the point - you'd write it for the practice, not the product.

You have very specific needs none of the existing tools nail.

You want every byte to live on hardware you physically control, and you have the time to operate it.

GDPR questions

What customer data-protection teams typically ask before signing a DPA.

Start with Contact Book

Free plan, no credit card. We host in Germany. Export + delete are self-serve.

Written by

Finn Glas

Co-Founder + Engineering

Finn is one of the Co-Founders. He owns the engineering side, the infrastructure, and most of the late-night fixes that ship before anyone notices.

finn.glas at aicuflow dot comLinkedIn Website