PinnDeals Business Matching Platform

PinnProject GmbH runs PinnDeals, a reverse marketplace for business contacts. Anyone looking for a tax advisor, a business partner, a co-founder or a buyer for their company does not sift through offers there; they post a request. Suitable providers and interested parties then reach out directly.

The user base is correspondingly broad: companies and freelancers, founders with an idea, private individuals and service providers ranging from consultants to developers. Many of their plans are confidential, such as a company sale or a succession that should not become public yet.

The starting point was an existing application built with React, Vite and Firebase. For the rebuild, DuoByte documented its data model, page structure and business rules and derived the target architecture on Next.js and Supabase from them.

The platform has to support four very different listing types. A company sale needs details such as the share for sale, asking price, revenue and EBIT, while an expert search needs a project start, budget or hourly rate and the required specialty. Even so, every listing has to remain searchable in one shared directory.

Then there is the business model. Five plans, from a free Standard tier to Partner, determine how many listings, first contacts, service packages and blog posts an account may use and whether it can publish an expert profile. These limits must not be bypassable in the browser, and every payment, cancellation or chargeback in Stripe has to be reflected reliably in the account.

Anonymity was the hardest part. Users who post or write anonymously must not be identifiable through internal IDs, neither in public queries nor in chat, and revealing one's identity has to be controllable for each conversation individually.

After signing up, users create listings through a dedicated form per type: expert search, business partner search, co-founder search and full or partial company sale. The public directory can be filtered by type and free text, and expert searches also by up to three specialties. Photos are resized and converted to WebP in the browser, including HEIC images from iPhones.

In the expert directory, providers present themselves with a profile, categories, references, locations, contact people and service packages. Hashtag search supports both AND and OR matching, and profiles on higher plans are given priority in the results.

Contact happens through chat. The first message to a profile or listing uses one Ping; after that, the conversation continues at no extra cost. Messages and unread counters update in realtime, and messages from higher plans appear further up in the recipient's inbox.

The frontend is built with Next.js 15 and the App Router, React 19, TypeScript, Tailwind CSS 4 and next-intl. Supabase provides the database, authentication, file storage and realtime channels. The key decision: business rules live not only in application code but in PostgreSQL itself.

Row Level Security is enabled on every table. Database functions derive the user exclusively from the session and never accept a user ID as a parameter, so nobody can trigger actions on someone else's behalf. Pings are checked and consumed atomically inside the same function that opens a conversation, and triggers enforce plan limits for listings, service packages and blog posts even if someone bypasses the interface. Public pages read through dedicated views that never expose internal owner IDs.

Stripe Checkout, Billing and the customer portal cover sign-up, renewals and plan changes. A webhook handler running as a Supabase Edge Function verifies every signature, processes each event exactly once and derives the plan from the price that was actually paid. Individually negotiated Partner plans are also activated automatically once paid.

Further Edge Functions send system emails via SMTP and clean up file storage. A scheduled job warns free accounts after three years of inactivity and deletes them 30 days later. GA4, Meta Pixel and Google Ads load only after consent, and that consent is stored in the database with a policy version.

The application ships as a Docker image behind Caddy with automatic HTTPS and security headers. Separate GitHub Actions pipelines for development and production pull configuration from Doppler, deploy the Edge Functions alongside the app and wait for the new container's health check. The codebase follows fixed rules for file size and modularity, and logs mask personal data.

PinnDeals is live. Users publish requests, find providers in the expert directory and hold confidential conversations without revealing who they are upfront. PinnProject GmbH grants Partner terms with their own price and quotas without changing the application.

Because quotas, visibility and anonymity are enforced in the database, new features can be added without re-securing these rules each time. The platform is under active development; recent additions include consent-based conversion tracking and automated Partner onboarding.