Privacy notice

Controller

Eigenzeit Privacy contact: myeigenzeit@gmail.com

Website operation and hosting

Cloudflare hosts and delivers this website. Technical information, including IP address, browser information, requested URL and access time, may be processed to deliver the website, maintain security and resolve errors. The legal basis is our legitimate interest in operating a secure and reliable website (Article 6(1)(f) GDPR). Fonts and videos are hosted by this website. We use Cloudflare’s approximate country information to suggest a supported delivery country and the corresponding currency. You can change the suggestion; we do not request device location or save the detected country in your profile.

Accounts and authentication

Supabase provides our database and email-code authentication. We process your email address, account identifier, session information, orders, delivery details and saved preferences to provide the account and services you request (Article 6(1)(b) GDPR). Google Gmail is used to send authentication emails through Supabase and processes the recipient address, message content and delivery information. Security and abuse prevention are based on Article 6(1)(f) GDPR. An email address is required for email sign-in.

Orders and payments

You can buy as a guest without creating an account or verifying your email before payment. We process your email, delivery address, order and subscription information to fulfil purchases (Article 6(1)(b) GDPR). We store an encrypted purchase record and a keyed email lookup so that, if you later choose to verify your purchase email, you can manage those orders securely. Stripe provides payment processing, hosted checkout and the billing portal. Stripe processes payment, billing and fraud-prevention information; we receive customer references, payment status, invoices, refunds and dispute information. We do not store full card numbers. Accounting obligations are based on Article 6(1)(c) GDPR; fraud prevention, claims management and internal analysis of purchase totals are based on Article 6(1)(f) GDPR. Stripe acts as a processor or independent controller depending on the activity.

Delivery and gift recipients

DHL receives the recipient name, delivery address and shipment information needed for postal delivery. We process delivery data to fulfil orders under Article 6(1)(b) GDPR. For gift recipients, we receive the information from the purchaser and process it under our legitimate interest in delivering the requested gift (Article 6(1)(f) GDPR). Recipients are not automatically added to an account or newsletter. Gift messages are not used for marketing. DHL also processes information under its own privacy notice.

Newsletter and email communications

Resend delivers newsletter confirmation and welcome messages and, when enabled, newsletters and birthday emails. It processes email addresses, message content, delivery information and unsubscribe status. Newsletter registration requires separate consent and email confirmation. Confirmation links expire after 24 hours. We record the consent version, request and confirmation times, and subscription status. Marketing is based on Article 6(1)(a) GDPR; necessary delivery security and consent evidence are based on Article 6(1)(f) GDPR. Unsubscribe using the link in an email or your account. Ordering or signing in does not subscribe you. Our application does not use email open or click events for reader profiling.

Optional profile and personalised emails

You may save a preferred name, country, birthday, interests, reading preferences, reasons for joining and profile motif. The birthday year is optional. These details personalise the account you request (Article 6(1)(b) GDPR). Your account provides separate, optional choices for personalised emails and birthday greetings. We record these choices and any withdrawal as consent under Article 6(1)(a) GDPR. Both choices are off by default and can be changed in your account. Birthday emails, when enabled, are sent only to confirmed newsletter subscribers who have opted in and saved a birthday. The personalised-email choice currently records your preference; automated marketing segmentation and personalised marketing campaigns are not active.

Cookies

The necessary first-party cookie ez_session keeps you signed in for up to 30 days, or until sign-out. The necessary ez_otp_challenge cookie lasts up to ten minutes and ties sign-in code attempts to the browser that requested the code; it is cleared after successful sign-in. The necessary ez_checkout cookie lasts up to two days and lets the browser that started a guest purchase check that specific order’s payment confirmation. It does not sign you in or grant access to account history. These cookies provide the account or purchase you request (§ 25(2)(2) TDDDG; Article 6(1)(b) GDPR for associated processing). No optional website analytics, advertising pixels or third-party media embeds are active. Cookie information is accessible through “Cookies” in the footer. Blocking cookies prevents sign-in or guest confirmation in that browser; orders can still be found later by verifying the purchase email. Stripe’s checkout and billing portal operate under Stripe’s own cookie and privacy notices.

Retention

We retain personal data for as long as necessary for its purpose, applicable legal retention duties or legal claims. Account and delivery data is retained as needed to manage the account and outstanding orders; correspondence is retained as needed to resolve enquiries and related claims. Financial records are subject to statutory accounting periods. Limited consent evidence and suppression records may be retained to demonstrate consent and honour unsubscribe requests. Sessions expire after 30 days; a 24-hour confirmation-link expiry does not itself delete the newsletter record. Provider logs and backups are subject to their applicable retention arrangements.

International transfers

Cloudflare, Supabase, Stripe, Google and Resend may process data outside the EEA, including in the United States. Selecting a European database region does not restrict all provider processing to that region. The providers publish information about processing locations and international-transfer arrangements in the resources linked below. Google Gmail is used under Google’s consumer privacy terms.

• Cloudflare — data processing and transfers
• Supabase — data residency and transfers
• Stripe — privacy and international transfers
• Google — data transfer frameworks
• Resend — data protection and transfers

Your rights

Under the conditions of the GDPR, you have rights of access, rectification, erasure, restriction and data portability. You may object to processing based on legitimate interests and to direct marketing. You may withdraw consent at any time without affecting the lawfulness of earlier processing. Contact Eigenzeit to exercise these rights; proportionate identity verification may be required. Requests are normally answered within one month, subject to permitted extensions. You may lodge a complaint with a supervisory authority, including where you live, work or believe an infringement occurred.

Account privacy controls

Your account can export and clear the optional profile only. Clearing it also withdraws personalised and birthday email choices; it does not cancel subscriptions, unsubscribe from the newsletter or erase accounting records. Full account and order data requests are handled separately. Newsletter unsubscribe, subscription cancellation and account deletion are separate actions.