Privacy Policy

Last updated: [DATE] · Information pursuant to Art. 13 and 14 GDPR

1. Controller

The controller responsible for data processing on this website is:

Hannah [SURNAME]
[STREET AND HOUSE NUMBER]
[POSTCODE] [CITY], Germany
Email: [EMAIL ADDRESS]

I have not appointed a data protection officer, as I am not required to do so.

2. What I process, why, and on what basis

Data	Purpose	Legal basis	Kept for
Server log data: IP address, date and time, page requested, referrer, browser and OS	Delivering the site, security, troubleshooting	Art. 6(1)(f) — legitimate interest in a functioning, secure website	[7–30 days]
Name, email address, billing details, purchase record	Processing your order and delivering the product	Art. 6(1)(b) — performance of a contract	Up to 10 years where retention is required by German tax and commercial law
Email address, if you contact me	Answering your enquiry	Art. 6(1)(b) or 6(1)(f)	Until the matter is resolved, then per statutory retention periods
Email address, if you subscribe	Sending you the emails you asked for	Art. 6(1)(a) — your consent	Until you unsubscribe

3. Recipients and processors

I use the following service providers, each under a data processing agreement pursuant to Art. 28 GDPR:

Provider	Function	Location
[HOSTING PROVIDER]	Website hosting	[COUNTRY]
[PAYMENT PROVIDER]	Payment processing and delivery of the download	[COUNTRY]
[EMAIL PROVIDER]	Sending transactional and, if you subscribe, marketing email	[COUNTRY]

Your payment details are handled by the payment provider. I do not see or store your full card number.

Where a provider processes data outside the EU/EEA, the transfer is safeguarded by the European Commission's Standard Contractual Clauses or an adequacy decision. [Name the mechanism for each non-EU provider, or delete this sentence if all are in the EU.]

4. Fonts

This website uses the typefaces Fraunces and Public Sans. They are loaded from my own server. No connection to Google's servers is made when you visit, and your IP address is not transmitted to Google.

ACTION REQUIRED — THIS PARAGRAPH IS NOT TRUE YET

The sales page and these legal pages currently load fonts from fonts.googleapis.com. That transmits every visitor's IP address to Google before they have consented to anything, which in Germany is a well-known problem: the Munich Regional Court awarded damages against a site operator for exactly this, and it triggered a wave of opportunistic warning letters afterwards.

Fix it before launch by self-hosting the fonts:

Download both families from Google Fonts or the google-webfonts-helper tool.
Put the .woff2 files in a /fonts folder next to your HTML.
Delete the two <link> tags pointing at fonts.googleapis.com from every page.
Add local @font-face rules pointing at your own files.

Once that is done, this paragraph becomes accurate and you can delete this box. If you decide not to self-host, you must instead delete this paragraph, disclose Google as a recipient in section 3, and obtain consent before the fonts load.

5. Cookies

[Complete this section once you know what your checkout and analytics actually set.]

Cookies that are strictly necessary for the website to function, including those set during checkout, are used on the basis of Art. 6(1)(f) and § 25(2) TTDSG and do not require consent. Any cookie that is not strictly necessary — analytics, advertising, tracking pixels — requires your prior consent under § 25(1) TTDSG, obtained through a consent banner, and you can withdraw that consent at any time.

DECIDE THIS BEFORE LAUNCH

If you add analytics, a Meta pixel, or any advertising tag, you need a proper consent banner that blocks those scripts until the visitor agrees. A banner that merely announces cookies while loading them anyway is not compliant.

If you run no analytics and no ad pixels — which is entirely viable at launch — this section stays short and you avoid the banner altogether. That is the simpler path and I would take it initially.

6. Your rights

Under the GDPR you have the right to:

Access (Art. 15) — ask what data I hold about you and receive a copy.
Rectification (Art. 16) — have inaccurate data corrected.
Erasure (Art. 17) — have data deleted, subject to statutory retention obligations.
Restriction (Art. 18) — have processing limited in certain circumstances.
Data portability (Art. 20) — receive your data in a structured, machine-readable format.
Object (Art. 21) — object to processing based on legitimate interests.
Withdraw consent (Art. 7(3)) — at any time, without affecting the lawfulness of processing before withdrawal.

To exercise any of these, email [EMAIL ADDRESS].

7. Right to lodge a complaint

You may lodge a complaint with a supervisory authority, in particular in the Member State of your residence, place of work or the place of the alleged infringement. The authority responsible for me is:

Die Landesbeauftragte für den Datenschutz Niedersachsen
Prinzenstraße 5, 30159 Hannover, Germany
www.lfd.niedersachsen.de

CHECK

This assumes you are established in Lower Saxony. If you are in a different Bundesland, replace it with that state's authority — jurisdiction follows where you are established.

8. Is providing data required?

You are not legally obliged to provide personal data. However, I cannot process an order or deliver the product without an email address and the details the payment provider requires.

9. Automated decision-making

I do not use automated decision-making or profiling within the meaning of Art. 22 GDPR.

10. Changes

I may update this policy as the site changes. The current version always applies and is dated at the top.

BEFORE PUBLISHING

Fix the fonts first (section 4). It is the only item here that is a live, known liability rather than a form-filling exercise.

Name your actual providers in section 3 and sign their data processing agreements — Shopify, Stripe, Gumroad, Lemon Squeezy and the major email tools all publish one.

This is a draft, not legal advice. I am not a lawyer. A privacy policy has to describe what your site genuinely does; this one describes what I believe it does based on what we built, and you should verify each claim against your final setup.