Privacy notice
Last updated: 24 October 2026
1. Controller
The controller under the General Data Protection Regulation (GDPR) is:
Maximilian Kuchlbauer, trading as MaxBeautifulDesigns, Flurstr. 1, 84524 Neuötting, Germany
Email: hello
We have not appointed a data protection officer because the law does not require one for us.
2. Overview: which data we process and why
- Visiting the website (technical access data, server logs): Section 3
- Adapting the page per visit (country, language, source), nothing stored: Section 3b
- Anonymous counting of the steps on product pages for visits from our ads: Section 3c
- Cart in the browser: Section 4
- Purchase and payment: Section 5
- Order, download and "Find my order": Section 6
- Sending email (order confirmation, links to your downloads): Section 7
- Free samples ("Free Week 1", free Christmas sampler) and voluntary newsletter: Section 7a
- Withdrawal through the online function: Section 8
- Contact by email: Section 9
- Reach measurement without cookies: Section 3a
- Measuring our advertising (Meta Conversions API): Section 5a
- Measuring our Google ads (conversion import): Section 5b
We set no cookies and use no advertising pixels. For reach measurement we use a service without cookies (Section 3a). For visits from a Meta ad, a few events (product view, checkout start, purchase) are sent to Meta from our server (Section 5a). For checkouts, free sample sign-ups and paid orders that came from a Google ad, the click ID is provided to Google, and for paid orders outside the EEA, the UK and Switzerland a hash of the email address, without cookies and without a Google script (Section 5b). Fonts are served from our own server; there is no connection to Google Fonts. We do not make automated decisions, including profiling, within the meaning of Art. 22 GDPR.
3. Visiting the site, hosting at Cloudflare, server logs
The site runs on Cloudflare Workers by Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA ("Cloudflare"). The static pages, the file storage for downloads (Cloudflare R2) and the order store (Cloudflare KV) are also hosted there. When you load a page, Cloudflare processes on our behalf in particular your IP address, date and time, the requested URL, browser and device information (user agent), your browser's language setting, the page you came from (referer), the country derived from the IP address and the response status. We have switched on request logging (Cloudflare Workers Logs) to find errors and detect abuse. These logs can contain the data listed, including the IP address. According to Cloudflare's documentation, Workers Logs are kept for 3 days (Free plan) or 7 days (Paid plan) and are deleted afterwards. We do not analyse them permanently.
Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest is the secure, stable and error-free operation of the site and protection against attacks and abuse. We have a data processing agreement (Data Processing Addendum) with Cloudflare under Art. 28 GDPR.
Third-country transfer: Cloudflare is based in the USA. Cloudflare states that it is certified under the EU-US Data Privacy Framework (adequacy decision of the European Commission of 10 July 2023); in addition, its data processing agreement includes the EU Standard Contractual Clauses as a safeguard under Art. 46 GDPR. Information: cloudflare.com/
To protect against abuse we also count requests per IP address (when a purchase is started and on "Find my order"). For this the IP address is stored as part of a counter key in Cloudflare KV and deleted automatically after about 20 minutes at the latest. Legal basis: Art. 6(1)(f) GDPR (protection against automated mass requests and guessing of order details).
To understand our reach we also count page views and purchases in aggregate on our own server: per hour, how many visits came from which kind of source (ad network, search engine, other website, direct) and which steps toward a purchase were reached. We also count, per hour, how often each page is viewed, which kind of device (phone, tablet, computer) a visit uses, how many visits reach each product page and each payment step, which links on our pages are clicked (the page, the area of the page such as menu or footer, and the target page or website, without the link text, without the position and without identifiers), and how many sign-ups for our free samples were confirmed, by source. For a purchase we store product, amount, country, source type, device type, and, if the link you came from carried them, the campaign name, the search keyword of the ad (the keyword we booked, not what you typed) and the ad variant, without name, email address or payment details. For each visit we also count the country (a two-letter code that our hosting provider derives from the request, shown as visitors by country; the IP address itself is not stored). Requests from automated programs such as search engine crawlers or AI assistants are counted separately by program name, category and kind of page per hour; the browser identification text of such requests is not stored. The device type is derived from your browser type once at checkout; the browser type itself is not stored. No cookie, no IP address and no identifier is stored for this, and nothing is written to or read from your device. The counters are stored in Cloudflare D1 (database service of Cloudflare, Inc., Section 3) in the EU region and deleted after 13 months at the latest. Legal basis: Art. 6(1)(f) GDPR (our legitimate interest in knowing which channels bring visitors and purchases). You can object at any time (Section 12).
3a. Reach measurement with Cloudflare Web Analytics
We use Cloudflare Web Analytics by Cloudflare, Inc. (address in Section 3) to understand which pages are visited and how fast they load. Your browser loads a small script from static.cloudflareinsights.com and sends measurements to cloudflareinsights.com. According to Cloudflare this includes the page visited (without query string), the referrer, browser, operating system, device type, country and performance metrics (load times). Cloudflare states that the service does not collect or use visitors' personal data and does not rely on cookies or local storage; the script stores nothing on your device and reads nothing from it. For technical reasons Cloudflare receives your IP address with every request; according to Cloudflare it is not used to recognise individual visitors. We only see aggregated statistics.
Legal basis: Art. 6(1)(f) GDPR (our legitimate interest in a data-saving analysis of usage and loading speed to improve the site). You can object to the measurement at any time (Section 12); because nothing is stored on your device, no consent is requested. Third-country transfer and processing on our behalf as in Section 3 (Cloudflare Data Processing Addendum, EU-US Data Privacy Framework, Standard Contractual Clauses).
3b. Adapting the page per visit (nothing stored)
When you open the home page, the shop page, a product page or the cart, our server adapts the page for that one visit. It uses information your browser sends with every request anyway: (1) the country Cloudflare derives from your IP address (we name the paper size that is usual there first, US Letter or A4, and outside the euro area we say that the price is in euros, and for visitors from the USA and Canada we add an approximate price in US or Canadian dollars, calculated from the daily euro reference rate of the European Central Bank; the binding price stays the one in euros, and the exact amount is shown by Stripe before you pay); (2) your browser's language setting (Accept-Language: we show the order texts first in German or in English and write prices in your language's number format); (3) the address parameters utm_source, utm_medium, utm_campaign and utm_content and the referring page (referer): if you come from a Meta, Pinterest or Google ad (also recognised by a Google click id gclid, gbraid or wbraid in the address) we show a slimmer header, leave out the add to cart button, show a headline that fits the campaign, offer a choice of three packs in the order form on our Christmas pages and leave out items under 3.99 EUR in the product suggestions; if you come from one of our guides we show a link back to it; if you come from Etsy we note that these are the same printables as in our Etsy shop; (4) the calendar date in Germany (seasonal notes); (5) what you are looking for, only from words in the address and the referring page: the parameters utm_campaign, utm_content and utm_term of our ads (utm_term can carry the search word of a Google ad), a search on our shop page (q), a search word that a search engine passes in the referer, and the page of our own site you came from (a product page, a guide or a shop search). From these words we pick one of three groups, kids, money and work, or home and life, and put matching products, collections and a matching heading first on the home page, the shop page and in the product suggestions. From the same words we also pick a more specific topic (for example Christmas, preschool, wedding or budget spreadsheets) and show a matching selection of products at the top of the home page; without a clear word that selection follows the season (Germany date). Nothing else about you is used for this.
This information is evaluated in memory only while the request is handled and then discarded. We do not store it, build no profile from it, assign no identifier, set no cookies, write nothing to your device and read nothing from it. This is why no consent under Section 25 of the German Telecommunications Digital Services Data Protection Act is needed. The price, the products and the contract terms never depend on this information; only wording, order and the links shown change. There is no automated decision with legal or similarly significant effect within the meaning of Art. 22 GDPR. Where information appears in the server logs described in Section 3 (for example the requested address with its address parameters), the purpose, retention and deletion described there apply.
Legal basis: Art. 6(1)(f) GDPR, our legitimate interest in presenting the page clearly and in a way that fits your region and language. You can object (Section 12). Without the address parameters and without a referring page you see the default view; you can suppress the referer in your browser settings.
3c. Anonymous counts for visits from our ads
If you open a product page or a story page (/story/..., the same product shown as a series of slides) from one of our ads on Meta (Facebook, Instagram), Pinterest or Google (recognised by the utm_source address parameter of our ads, by the fbclid click id or by a Google click id gclid, gbraid or wbraid in the address; the click id itself is not part of the report), our own script (/app.js) reports single steps to our server. How long and how far: page viewed; page left before any scroll, tap or key press; page visible for 10, 30, 60 and 120 seconds; a quarter, half, three quarters and all of the page scrolled; another image viewed; on story pages which picture of the story (1st, 2nd and so on) was on screen. Ordering: order box on screen; "Details" link of the declaration or "Order and payment details" opened; declaration box ticked; order button tapped; order button tapped without the tick, and whether the hint to tick the box was then on screen; which pack you picked in the choice of three packs; added to the cart; returned from the payment page with "back"; on story pages the link to the free sample and the link to the product page tapped, and the free sample form sent after arriving from a story page. Our server also counts the redirect to the payment page. Each report contains only the name of the step, the product id, the value of utm_content (the name of the ad), the ad network, whether it was a product page or a story page, and the layout version of the story page. Times are sent only as these fixed steps, never as exact durations; nothing you type is sent. So that "back" from the payment page can be counted, the return address given to Stripe for a visit from our ads contains back=cancel, the ad network and utm_content, and the link from a story page to the free sample contains the product id, the ad network and utm_content; these are the same values as above and contain nothing about you. For each step only this count entry is stored, in Cloudflare Workers Analytics Engine (Cloudflare, Section 3, as processor). We store no IP address, no user agent, no identifier, no click id and nothing that links several steps of the same person; we set no cookies and write nothing to your device. The IP address is used briefly in memory to limit requests per minute (protection against abuse) and is not stored by us. We only see totals, for example "12 views, 3 orders from ad X". According to Cloudflare the count entries are deleted after three months.
The purpose is to find out at which step visitors from our ads stop, so that we can make the page simpler. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in a data-saving improvement of our shop). The script only reads the address of the page you opened and how you use that page; it does not access cookies, local storage or device identifiers and stores nothing. If your browser sends the "Global Privacy Control" or "Do Not Track" signal, nothing is counted. You can also object at any time (Section 12); without ad parameters in the address nothing is counted.
4. Cart, local storage, cookies
We set no cookies for visitors. Only the shop operator's own admin login sets two cookies on the operator's device (admin session and, if chosen, a marker so that his own visits are not counted); visitors never receive them. Your cart is stored only in your browser's local storage (localStorage) and contains product identifiers only, no personal data. The data leaves your device only when you go to checkout. If you switch the language of the order texts (German or English), that choice is also kept only there (key mbd-ui) and never leaves your device. Access to this information on your device is strictly necessary for the cart function you requested (Section 25 (2) no. 2 of the German Telecommunications Digital Services Data Protection Act), so no consent is needed. You can clear local storage in your browser settings at any time.
On the payment pages of Stripe and Link, cookies or similar technologies may be used according to their own information; Stripe and Link are responsible for them (see Section 5).
5. Purchase and payment (Stripe Managed Payments, Link)
For payment we send you to a payment page operated by Stripe (Stripe Managed Payments).
- According to Stripe's terms, the Stripe company Sold through Link, LLC ("Link") is the merchant of record for the payment. It appears to you as "Sold through Link", sends payment receipts and invoices, collects and remits VAT or sales tax, and handles payment requests, refunds and payment disputes.
- Stripe and Link collect and process your payment data and other details for this, in particular name, email address, billing address, payment method, IP address and device information, also for fraud prevention and tax calculation. They do so under their own data protection responsibility. Their privacy policies apply: stripe.com/privacy, stripe.com/
legal/ and link.com/privacy. We do not see your payment or card details. Stripe may use automated fraud detection; this is Stripe's responsibility.privacy-center - From Stripe we receive the data we need to perform the contract and for bookkeeping and tax, in particular order number, purchased products, amount, time, payment status, and your email address and name as far as Stripe makes them available to us. These data can be viewed in our Stripe account.
- Stripe is based in the USA. Stripe states that it participates in the EU-US Data Privacy Framework (stripe.com/
legal/ ) and also uses Standard Contractual Clauses.data-privacy-framework
Legal bases: Art. 6(1)(b) GDPR (performance of the purchase contract) and Art. 6(1)(c) GDPR (tax and commercial law record keeping duties, e.g. Section 147 of the German Fiscal Code, Section 257 of the German Commercial Code). A purchase is not possible without this data. We do not store your payment data, postal address or plain email address in our own order store. We keep bookkeeping-relevant data in our Stripe account for the statutory periods (up to 8 years) and delete it afterwards.
5a. Measuring our advertising (Meta Conversions API)
We run ads on Facebook and Instagram (Meta Platforms Ireland Limited, Merrion Road, Dublin 4, Ireland, "Meta"). To measure which of our ads lead to product views, checkouts and purchases, and so that Meta can deliver our ads to people who are more likely to be interested (campaign optimisation), we send up to three events from our server to Meta (Conversions API). No Meta pixel and no Meta script runs on our website, no cookies are set or read, and your browser does not connect to Meta for this.
When and what. Only if you came to our website from a Meta ad (the address then carries a click ID, fbclid), we send these events, each with the click ID (formatted as fbc):
- "ViewContent", when you open a product page or its slideshow page (
/story/...) with the click ID: the product identifier, its price and the currency. We send it after the page has been delivered, at most once per click ID and product. - "InitiateCheckout", when you click the buy button and we forward you to the payment page: the product identifiers, the number of products, the total price and the currency.
- "Purchase", after the paid order: the order number, the product identifiers, the amount paid and the currency.
We send no email address, phone number, name, address, IP address, browser identifier, country or cookie ID. Without a click ID (for example direct visit, search, Etsy) nothing is sent. We keep the click ID for the Purchase event for at most 8 days in our order store (then deleted automatically). So that the same event is not sent twice, we keep a non-reversible hash value of the click ID, event and product for at most 2 days. To prevent mass sending, our hosting provider counts the events per IP address in memory for one minute (at most 10); we do not store the IP address and do not send it to Meta. The browser identification (user agent) is only checked in memory to leave out robots and link previews; it is neither stored nor sent.
How the click ID stays with your visit. So that the checkout start and the purchase can still be matched to the ad when you look around before you buy, our script (/app.js) appends the click ID and the time of your first page view (fbclid and fbt) to the addresses of links within our website that you tap, to our search form, and to the order form. This happens only in the address bar and in the order form: nothing is stored on your device, no cookie, no local storage, and the cart contains product identifiers only, as before. When we forward you to the payment page, the same two values are part of the return address that we give to Stripe (the "back" link of the payment page), so that you land on our page with the click ID again; Stripe, our payment processor (Section 5), therefore sees them in that address. If you do not want this, open our website without the click ID (see the objection paragraph below).
Legal basis and purpose. Art. 6(1)(f) GDPR: our legitimate interest in measuring and optimising the effect of our own ad campaigns in a data-saving way and spending the advertising budget sensibly. We weighed this against your interests: only the few details listed are sent, without direct identifiers, nothing is tracked on our website, and you can object at any time. No consent is needed and none is asked for; buying is possible regardless.
Recipient and responsibility. The recipient is Meta Platforms Ireland Limited. For the collection and transmission of the data to Meta with the Meta Business Tools we and Meta are joint controllers (Art. 26 GDPR; agreement: facebook.com/
Right to object (Art. 21 GDPR). You can object to the transmission at any time without giving reasons, also before a purchase: write to hello?fbclid= from the address). We cannot retrieve events already sent from Meta ourselves; you can contact Meta about them.
5b. Measuring our Google ads (conversion import)
We also run ads on Google (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, "Google"). To see which of our Google ads lead to purchases, checkouts and sign-ups for our free samples, and so that Google can show our ads to people who are more likely to buy, we let Google collect lists of these events. No Google script, no Google tag and no cookie runs on our website, nothing is stored on your device, and your browser does not connect to Google for this.
When and what. Only if you came to our website from a Google ad, the address carries a click ID (gclid, on Apple devices sometimes gbraid or wbraid). Our script (/app.js) adds it to the order form when you click the buy button, and to the sign-up form of a free sample when you send it. (1) Checkout started: when we forward you to the payment page, we keep one entry with the click ID, our order number, the time and the cart total in EUR, and keep the click ID next to the payment session for at most 14 days. (2) Purchase: if you then pay, we keep one entry with the click ID, the order number, the order time, the amount paid and the currency. (3) Free sample sign-up: the click ID travels inside the encrypted confirmation link; only when you confirm your address (double opt-in) do we keep one entry with the click ID, the time of the confirmation and a fixed internal value of 0.50 EUR, without your email address. (4) Hashed email for purchases: for every paid order (also without a click ID) we add a hash of your email address: we remove spaces, write it in lower case (for gmail.com and googlemail.com addresses also without dots and without a "+" part, as Google specifies) and compute its SHA-256 value. The hash cannot be turned back into the address; Google compares it with the hashed addresses of signed-in Google users who clicked one of our ads, to count a purchase whose click ID was lost (for example a purchase on another device). Google fetches these entries once a day from our server through a password protected address. Apart from that hash we send no email address, name, address, IP address, browser identifier or cookie ID. Without a click ID nothing is kept for checkouts and sign-ups. Only for visitors and buyers outside the European Economic Area, the United Kingdom and Switzerland: for checkouts and sign-ups the country of the visit decides, for purchases the billing country (otherwise the country of the visit); if the country is in those regions or unknown, nothing is kept and no hash is created.
Storage period. The click ID next to an unpaid payment session is deleted automatically after 14 days. The entries for checkouts, sign-ups and purchases, including the hashed email address, are deleted automatically after 90 days (Google only accepts clicks of the last 90 days).
Legal basis and purpose. Art. 6(1)(f) GDPR: our legitimate interest in measuring and optimising the effect of our own ad campaigns in a data-saving way and spending the advertising budget sensibly. Because we have very few purchases, the earlier steps (checkout started, confirmed sign-up) help Google learn which ads reach interested people. We weighed this against your interests: only the few details listed are passed on, the email address only as a hash and only for buyers outside the regions named above, nothing is tracked on our website, and you can object at any time. No consent is needed and none is asked for; buying and the free samples are possible regardless.
Recipient. The recipient is Google Ireland Limited. For the click IDs Google uses the data as a controller under its own terms (Google Ads data protection terms: business.safety.google/
Right to object (Art. 21 GDPR). You can object at any time without giving reasons: write to hello?gclid= from the address).
6. Order, download and "Find my order"
So that you receive your files, we store an order record in our order store (Cloudflare KV): Stripe checkout session ID, order number (MBD-...), purchased products, time of purchase, status, the version and time of your consent to early performance (Section 356 (6) of the German Civil Code, as evidence) and a keyed hash (HMAC, made with a secret key) of your email address. We do not store the email address itself, your name or your address there. We also keep a counter of downloads per file (60 days). The hash is pseudonymised and still counts as personal data because we can compare it with an email address that is entered.
Download links are signed and valid for 14 days. On "Find my order" you enter your email address; we compute the hash from it and compare it with the stored values. If orders exist, we email you (Section 7) a link, valid for 24 hours, that shows fresh download links. The answer page is always the same, whatever the result. Alternatively you can enter your email address and order number; the links then appear on the page. The email address you enter is processed in memory only, to send the email, and not stored.
Storing the version and time of your consent is additionally based on Art. 6(1)(f) GDPR (proof of compliance with statutory duties and defence against claims). Otherwise the legal basis is Art. 6(1)(b) GDPR (delivering the files and support) and Art. 6(1)(f) GDPR (protection against misuse of downloads through download counters). Retention: we keep order records without a fixed expiry date for as long as the shop is operated so that you can download your purchased files again at any time (lifetime access is part of our offer). You can ask us to delete your record at any time (Section 12); access to the files through "Find my order" then ends. Receipts relevant for tax are held by Stripe and Link and in our bookkeeping (Section 5).
The files themselves are in a non-public Cloudflare R2 bucket and are delivered only through the signed links. Section 3 applies to Cloudflare.
7. Sending email (Resend)
We send you order confirmations with download links, the links from "Find my order" and confirmations of withdrawals by email. For this we use the email service Resend of Plus Five Five, Inc. (Resend), USA, as processor. Resend processes your email address, the content of the message (order number, product names, download links) and sending logs (delivery status). We chose Ireland (EU) as sending region; according to Resend's documentation the region only determines where mail is sent from and not where customer data is stored, and processing takes place mainly in the USA. Our data processing agreement with Resend (Data Processing Addendum, resend.com/
Legal basis: Art. 6(1)(b) GDPR (delivering the purchased files, support, confirmation of receipt of a withdrawal). The email address comes from your payment at Stripe (order confirmation) or from what you enter. We do not store it in our order store (only as a hash, Section 6); the email service keeps sending logs for a limited time according to its settings.
7a. Free samples and newsletter
To get the free sample week of our preschool curriculum ("Free Week 1") or the free Christmas sampler (7 pages from our Christmas packs) you enter your email address and confirm it with a link. The free samples are not tied to the newsletter: you get them even if you do not want the newsletter. The newsletter is a separate, voluntary box in the form that is not ticked by default. Content of the newsletter: new printables, free samples, guides and occasional offers from MaxBeautifulDesigns; in the first days a short series: for the free sample week up to four emails (day 2: how to use Week 1 with two sample pages; day 4: what a whole year looks like; day 7: how to continue with the full curriculum or the complete year, with the real prices; day 10, only if it falls between 1 November and 20 December: our Christmas kit), for the Christmas sampler three short Christmas emails about the pages and the full Christmas bundle (days 1, 3 and 6), then about twice a month. The series advertises our own products. The box names this, and we store which wording you agreed to.
A. Sample week without the newsletter. After you submit the form you receive an email with a confirmation link (valid for 72 hours; double opt-in so that nobody can request files with someone else's address). Until you confirm we do not store your email address; it is only contained, encrypted, in the confirmation link. After you confirm we show you the download links and send you one email with the same links. After that you get no further email from us, we do not store your address and do not add it to a contact list. Legal basis: Art. 6(1)(b) GDPR (fulfilling your request for the free file). To prevent abuse we count signup and download requests per IP address and per hash (Section 3, Art. 6(1)(f) GDPR); a field that people do not see keeps automated signups out.
B. With the newsletter (only if you tick the voluntary box). The same confirmation link then also confirms the newsletter. We store in our storage (Cloudflare KV) a keyed hash (HMAC) of your email address, the version of the consent text, the time of signup and of confirmation and the page where you signed up, so that we can prove your consent (Art. 7(1) GDPR). We do not store your email address itself there. For sending the newsletter your email address is stored after confirmation in the contact list of our Resend account (Section 7, processor); the address is kept only there. The same record also holds which series you are in and how far it has got (the number of the next email) and the time of your confirmation, nothing else. An automated job on our Cloudflare Worker runs every hour, finds the emails that are due (day 2, 4, 7, 10 after your confirmation, see above), reads your address from the contact list at that moment and sends the email through Resend. Once you unsubscribe, the contact is deleted at Resend and the record is marked, so no further email is sent. An email that is more than three days overdue (for example after a fault) or, for the Christmas email, out of season is skipped, not sent late.
Links, images and measuring. We do not use tracking pixels and do not measure whether you open an email or click a link in it. Links from these emails to our shop carry the parameters utm_source=email, utm_medium=nurture, utm_campaign (freeweek or freechristmas) and utm_content (the day). When you follow one, they are handled like the campaign parameters of any other visit (Section 3 and the order record: the campaign name can be stored with an order so that we can see which series led to a purchase; they contain nothing about you). The two sample page images in one email are static files on our own domain with the same address for everyone: if your email program loads images, our host (Cloudflare, Section 3) sees a request for them like for any file; you can switch image loading off in your email program and lose nothing but the pictures.
Legal basis of the newsletter is your consent (Art. 6(1)(a) GDPR, Section 7 (2) no. 3 of the German Act against Unfair Competition); for keeping proof of consent Art. 6(1)(c) and (f) GDPR. The consent is voluntary and not required for the sample week (Art. 7(4) GDPR). Unsubscribe and withdrawal: you can withdraw your consent at any time with effect for the future, with the unsubscribe link in every newsletter email, on the page /unsubscribe or by email to hello
Retention: Without the newsletter we do not keep your address after the confirmation and download emails have been sent (the email service Resend keeps its sending log for a short time under its own retention periods). With the newsletter until you unsubscribe; we then delete your address from the contact list at Resend, end the series (no further email is sent) and cancel emails already scheduled at Resend. The proof of consent (hash, version, times, time of unsubscribing) is kept for three more years (regular limitation period, Section 195 of the German Civil Code) and then deleted automatically. Unconfirmed signups leave no data apart from the abuse counters.
8. Withdrawal through the online function
If you withdraw through the "Withdraw from contract here" page we process your name, the details of the contract (order number or product and date), your email address, any details of which products are affected, and the date and time. From this we send you a confirmation of receipt and a notice to our mailbox to process the withdrawal and the refund. We also store the details with date and time in our storage (Cloudflare KV), so that receipt can be proven even if an email cannot be delivered; they are deleted there automatically after three years. Legal basis: Art. 6(1)(c) GDPR in conjunction with Section 356a of the German Civil Code (statutory duty to provide a withdrawal function and confirmation of receipt) and Art. 6(1)(b) GDPR. Retention: as long as needed for the refund, bookkeeping and evidence (up to 8 years for accounting records, up to 6 years for business letters). To prevent abuse we count requests per IP address (Section 3).
9. Contact by email
When you write to us we process your email address, the content of your message and, if applicable, your order number to answer your request. Legal basis: Art. 6(1)(b) GDPR (questions about or before a purchase), otherwise Art. 6(1)(f) GDPR. We delete the correspondence when the request is dealt with and no statutory retention period (e.g. for business letters, up to 6 years) applies. The email service through which we receive messages (mailbox hello@) processes the data on our behalf.
10. Links to other sites
Our site links to our Etsy shop. No data is sent to Etsy merely by displaying the page. Etsy's privacy policy applies once you click the link.
11. Recipients
Recipients of your data, as described above: Cloudflare, Inc. (hosting, storage, logs, reach measurement) as processor; Plus Five Five, Inc. (Resend, email sending) as processor; Stripe and Link (payment, tax, receipts) under their own responsibility; where applicable our tax adviser, and tax authorities where required by law; and Meta Platforms Ireland Limited (measuring our advertising, Section 5a); and Google Ireland Limited (measuring our Google ads, Section 5b).
12. Your rights
Under the GDPR you have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection (Art. 21). Where we process data on the basis of Art. 6(1)(f) GDPR you can object at any time on grounds relating to your particular situation. You can withdraw any consent at any time with effect for the future. Write to hello
13. Right to lodge a complaint with a supervisory authority
You have the right to complain to a data protection supervisory authority, in particular in the member state of your residence or workplace. The authority responsible for us is the Bavarian State Office for Data Protection Supervision (BayLDA), Promenade 18, 91522 Ansbach, Germany, www.lda.bayern.de.
14. Changes
We update this notice when the site or the services we use change. The version published here applies.