Privacy Policy

This Privacy Policy explains how personal data is processed when you visit this website, buy a digital product, create an account or contact us. We process personal data only in accordance with the EU General Data Protection Regulation (GDPR) and applicable German data protection law.

1. Controller

The controller responsible for data processing on this website is:

2. Hosting

This website is hosted by Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany. The servers are located in Germany (European Union). The provider processes connection data on our behalf as a processor under Art. 28 GDPR; a data processing agreement is in place. The legal basis is our legitimate interest in the secure and efficient provision of our website (Art. 6 (1)(f) GDPR).

3. Server log files

When you access our website, the server automatically collects information that your browser transmits and stores it in log files: IP address, date and time of access, the page requested, referrer URL, browser type and operating system. This data is required for the technical delivery and security of the website and is not merged with other data. The legal basis is Art. 6 (1)(f) GDPR.

4. Cookies and consent

We use cookies and comparable technologies. Technically necessary technologies are used on the basis of Art. 6 (1)(f) GDPR and § 25 (2) of the German Telecommunications Digital Services Data Protection Act (TDDDG). All non-essential technologies, in particular analytics and marketing, are only used after you have given your consent via our cookie banner (Art. 6 (1)(a) GDPR, § 25 (1) TDDDG). You can withdraw your consent at any time with effect for the future using the cookie settings link in the footer.

Every cookie and recipient is listed individually, with its purpose, retention period and any transfer outside the EEA, in our Cookie Policy. That list is generated from the same registry the consent banner uses, so the two cannot drift apart.

5. Shop, orders and payment

Your basket is stored in a first-party cookie on your device and in a record on our server, so it is still there when you come back. No account is required to shop.

We are the seller, and therefore the controller for your order. Payment is handled for us by Stripe under its Managed Payments programme: the merchant of record is Sold through Link, LLC, a Stripe company, which facilitates the sale on our behalf, provides the checkout, takes the payment, screens it for fraud, sends your receipt, and — as the supplier deemed responsible for indirect taxes — determines and remits the applicable VAT or sales tax. The checkout form is embedded in our page but is served and operated by Stripe; the data you type into it (name, email address, billing country, payment details) is collected by Stripe, not by us. We never see or store your card details.

Once a payment succeeds, we receive the order data back from Stripe and store it on this server, because we deliver the files and provide support. The order record contains your name and email address, the products bought, the amounts actually charged, the currency, any discount code used, and the payment and refund timestamps. In addition we store a cryptographic hash of your personal download link, so the link can be checked without the link itself being stored anywhere.

The legal basis for processing your order data is the performance of the contract and pre-contractual measures (Art. 6 (1)(b) GDPR) and, for tax and accounting obligations, compliance with a legal obligation (Art. 6 (1)(c) GDPR); fraud prevention is based on legitimate interests (Art. 6 (1)(f) GDPR).

Our data protection agreement for these services is with Stripe Payments Europe, Limited, 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland. Under it, Stripe acts as our processor where it processes data to provide us the platform and its services, and as an independent controller in its own right where it decides for itself — in particular for payment processing, fraud monitoring, and its own legal, regulatory and tax obligations. Data may be transferred to Stripe entities in the USA; such transfers are safeguarded by the EU-US Data Privacy Framework and, in addition, the EU Standard Contractual Clauses. For details, see Stripe’s privacy policy at stripe.com/privacy.

Stripe screens payments for fraud automatically, which may result in a payment being declined. This is a decision about the payment, not an automated decision about you producing legal effects within the meaning of Art. 22 GDPR; if a payment is declined and you think that is wrong, write to us and a person will look at it.

6. Customer accounts

You can optionally create an account to see your order history and re-download your files. For this we store your email address, your name if you give one, and an encrypted (hashed) password. Guest orders can be attached to an account only after you have confirmed the email address they were placed with, so nobody can claim someone else’s purchases. The legal basis is the performance of the contract (Art. 6 (1)(b) GDPR). You can ask us to delete your account at any time.

7. Downloads and transactional emails

After a completed purchase we send you an order confirmation containing your personal download links, and we send further transactional messages where they are needed (for example a password reset). These emails are sent to the address linked to your order, on the basis of Art. 6 (1)(b) GDPR. Your download links remain valid so you can come back to your files; we can reissue them if they are ever compromised.

Our emails are delivered through Brevo (Brevo GmbH, Köpenicker Str. 126, 10179 Berlin, Germany), which processes the recipient address and message content on our behalf as a processor under Art. 28 GDPR, on servers in the European Union.

8. Newsletter and freebie sign-ups

Where we offer a newsletter or a free download in exchange for your email address, we pass the address — and your first name if you give one — to Brevo (Brevo GmbH, Köpenicker Str. 126, 10179 Berlin, Germany), which stores the subscriber list on our behalf as a processor under Art. 28 GDPR. The legal basis is your consent (Art. 6 (1)(a) GDPR). You can withdraw it at any time with effect for the future, using the unsubscribe link in every message or by emailing us; we then delete your address from the list.

9. Contact form and email

If you write to us through the contact form or by email, we process the name, email address and message you provide in order to answer you. Contact-form messages are not stored in a database on this website — they are forwarded to our mailbox. To keep the form from being abused by bots we briefly count submissions per IP address in a short-lived technical record; that record is not used to identify you and expires automatically. The legal basis is Art. 6 (1)(b) GDPR where your request relates to a contract, otherwise our legitimate interest in answering enquiries and in protecting the form from abuse (Art. 6 (1)(f) GDPR). We delete correspondence once it is no longer required and no statutory retention periods apply.

10. Product reviews

If you leave a review, we store the name you choose to display, your email address and your review text together with the product and date. Only the display name, rating and text are published; your email address is not. By default, reviews can only be left by customers who actually bought the product, which means we check your review against your order. The legal basis is your consent, given by submitting the review (Art. 6 (1)(a) GDPR), and our legitimate interest in genuine, verified feedback (Art. 6 (1)(f) GDPR). Ask us and we will remove your review.

11. Prices in your currency

Where our content delivery network attaches a two-letter country code to your request, our server may read it to choose which currency to display prices in. It is used for that alone: it is not stored with your visit and is not combined with any other data. The legal basis is our legitimate interest in showing usable prices (Art. 6 (1)(f) GDPR).

12. Analytics and advertising measurement

Subject to your consent, we use Google Analytics 4, a web analytics service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. It uses cookies and similar technologies to analyse how visitors use our website (for example pages visited, products viewed, purchases completed) so we can understand and improve it. Data may be transmitted to and stored by Google LLC in the USA; Google is certified under the EU-U.S. Data Privacy Framework, and the transfer is additionally covered by the EU Standard Contractual Clauses. The legal basis is your consent (Art. 6 (1)(a) GDPR, § 25 (1) TDDDG), which you can withdraw at any time. We use Google Consent Mode, so no analytics cookies are set and no analytics data is sent before you consent.

We may also use advertising-measurement tools to see which adverts led to a visit or a sale. These likewise run only with your consent, and some of their events may be sent from our server rather than your browser, in which case identifiers such as your email address are transmitted in irreversibly hashed form only. The recipients actually in use on this site at any time — with their purpose, any transfer outside the EEA and its safeguard, the retention period and a link to their own privacy policy — are always listed in our Cookie Policy, which is generated from the site’s own configuration rather than written by hand.

13. Records of your cookie choice

To be able to demonstrate that consent was properly obtained, we keep a record of each choice made in the cookie banner: what was shown, what was chosen, and when. This record deliberately contains no IP address, no user agent, no email address and no account ID — it cannot be traced back to you. Your own choice is stored separately in a cookie on your device so you are not asked again on every page. The legal basis is our legal obligation to demonstrate consent (Art. 7 (1) GDPR, Art. 6 (1)(c) GDPR).

14. How long we keep data

• Order and invoice data — for the statutory retention periods under German commercial and tax law (up to 10 years).
• Account data — until you ask us to delete the account, subject to the retention periods above for the orders attached to it.
• Newsletter subscriptions — until you unsubscribe.
• Reviews — until you ask us to remove them.
• Correspondence — until your enquiry is settled and no statutory retention period applies.
• Server log files — for a short period for security and troubleshooting purposes.

15. Your rights

You have the right to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20) and to object to processing (Art. 21 GDPR). Where processing is based on consent, you may withdraw it at any time with effect for the future. To exercise any of these rights, simply email us at the address in our Legal Notice.

You also have the right to lodge a complaint with a data protection supervisory authority. The authority competent for us is the Berlin Commissioner for Data Protection and Freedom of Information (Berliner Beauftragte für Datenschutz und Informationsfreiheit), Alt-Moabit 59-61, 10555 Berlin, Germany. You may also complain to the authority in the EU country where you live or work.

16. Changes to this Privacy Policy

We may update this Privacy Policy to reflect changes to our website, our shop or legal requirements. The current version always applies.

Last updated: 25 July 2026.