Privacy Policy

This is an English translation for convenience. The legally binding version is the German original.

Controller

The controller responsible for the data processing on this website is the provider named in the legal notice.

Hosting & Server Logs

The website is operated on the provider's own servers in Germany (Hetzner Online GmbH, Gunzenhausen). When the site is accessed, technically necessary data is processed (IP address, time, requested resource, user agent). Legal basis: Art. 6 para. 1 lit. f GDPR (DSGVO) (legitimate interest in stable operation). Logs are deleted after a maximum of 14 days.

When signing up for the notification distribution list, the email address is stored via the delivery service provider Resend (Resend Inc., 2261 Market Street #4471, San Francisco, CA 94114, USA). Legal basis: Art. 6 para. 1 lit. a DSGVO (consent). The consent can be withdrawn at any time by email to the address named in the legal notice — the entry is then deleted. The sign-up only takes effect once the confirmation link sent by email has been clicked (double opt-in); without confirmation, the entry lapses.

Resend processes personal data on the basis of the EU Standard Contractual Clauses and a data processing agreement.

Payment Processing (Stripe & PayPal)

Purchases in the Kontor are processed via the payment service provider Stripe (Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland). When a purchase is started, the payment form is loaded by Stripe directly on the page; in the process, connection data as well as the payment and contact data entered in the form (e. g. email address, card details) are transmitted directly to Stripe. For this, Stripe sets technically necessary cookies for fraud prevention. Legal basis: Art. 6 para. 1 lit. b DSGVO (performance of a contract) as well as lit. f (fraud prevention). Before clicking "Buy", no data is transmitted to Stripe.

A transfer to third countries (in particular the USA) may take place; Stripe bases it on the EU Standard Contractual Clauses and the EU-US Data Privacy Framework. Details: stripe.com/de/privacy.

During the payment process, PayPal can additionally be selected as a payment method. If PayPal is selected, a redirect to PayPal takes place (PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg); the data required for payment is processed there. In this respect, PayPal is an independent controller and processes the data for its own purposes (including payment processing and fraud prevention). Legal basis: Art. 6 para. 1 lit. b DSGVO (performance of a contract) as well as lit. f (fraud prevention). A transfer to third countries may take place; PayPal bases it on the EU Standard Contractual Clauses and the EU-US Data Privacy Framework. Details: paypal.com/de/legalhub/privacy-full.

Order Processing, Delivery Emails & Invoices

To fulfil a purchase, the data provided during the ordering process is processed: the email address for delivery and receipt emails, in the case of a gift purchase additionally the recipient's address, the giver's name and an optional greeting, and the text of a dedication if booked. The delivered files receive a personal identifier (see Terms and Conditions). Order data and invoices are stored for as long as statutory retention obligations require. Legal basis: Art. 6 para. 1 lit. b DSGVO (performance of a contract) and lit. c (legal obligations). Storage takes place at Cloudflare (Cloudflare, Inc.) on the basis of a data processing agreement; delivery emails are sent via the service provider Resend named above.

Visitor Statistics

To see how often the site is visited and which content is read, two counting services run on all pages. Neither sets cookies, stores an identifier in the browser or builds profiles across several days or across other websites. Only aggregated figures are evaluated. The legal basis is the legitimate interest in data-minimising reach measurement (Art. 6 para. 1 lit. f GDPR).

Own visitor statistics (GoatCounter). The open-source software GoatCounter is self-hosted at stats.meluciolabs.de on a server of Hetzner Online GmbH in Germany; no data is transferred to a third country. On each page view a small script transmits the address viewed, the page title, the referring page and the screen width. The server adds browser and operating system as well as the country derived from the IP address. The IP address itself is not stored. To avoid counting several views of one visit twice, a check value is formed from IP address and browser identifier; it is held in memory only and discarded after a few hours. The counting data contains nothing that leads back to a person and is currently kept without a fixed deletion period.

Cloudflare Web Analytics. The provider is Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA. On each page view a script from static.cloudflareinsights.com transmits the address viewed, the referring page, details of browser, operating system and device type, and load-time measurements. According to Cloudflare, neither cookies nor local storage are used and individual visitors are not recognised; the IP address is processed for delivery and for country attribution. Cloudflare records only a sample of page views and extrapolates. Processing takes place under the data processing agreement with Cloudflare pursuant to Art. 28 GDPR. Data may be transferred to the USA; Cloudflare is certified under the EU-US Data Privacy Framework, supplemented by EU Standard Contractual Clauses.

Both services currently run side by side so their figures can be compared; afterwards only one will remain. An objection to reach measurement can be lodged at any time (Art. 21 GDPR); an informal message to the controller is sufficient. Both counters can also be blocked with common content blockers in the browser, and the site keeps working unchanged.

Contact Form

Data submitted via the contact form (name, email address, subject, message) is used exclusively to respond to the inquiry and is not disclosed to third parties. Legal basis: Art. 6 para. 1 lit. b and f DSGVO. After the conversation has concluded, the data is deleted, unless statutory retention obligations apply.

AI Conversations on This Website

The website offers optional AI features that let you write in the voice of characters from the books. The text you enter, together with technical connection data, is transmitted to and processed by Cloudflare to generate the reply (Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA; "Workers AI" service). No user account is created and no IP address or other identifier is stored with the conversation. To improve the feature, the question you enter and the generated answer are stored without identifiers, analysed, and deleted after 90 days at the latest.

Legal basis: Art. 6 para. 1 lit. f DSGVO (legitimate interest in an interactive offering around the books); use is voluntary. A transfer to third countries (USA) may take place; Cloudflare bases it on the EU Standard Contractual Clauses and the EU-US Data Privacy Framework. To protect against automated misuse, a cookie-free bot check (Cloudflare Turnstile) may be used.

Depending on the feature, conversation histories or individual settings (such as your own reading progress) are stored exclusively locally in the browser of your own device (in what is called local storage), so they remain usable after navigating away or reloading. This data never leaves the device; stored conversation histories are automatically removed after 30 days. Where a history is offered, the "History" button lets you view it and delete it completely at any time; clearing your browser data removes all locally stored data as well. There is no server-side memory beyond an individual conversation.

Please do not enter personal or sensitive data into the chat — the feature does not need it.

Map (OpenStreetMap)

On the page "The Place", a map from OpenStreetMap can be displayed. The map is loaded only after a click on "Load map"; before that, no connection to OpenStreetMap is made. When loading, technical connection data (in particular the IP address) is transmitted to servers of the OpenStreetMap Foundation (St John's Innovation Centre, Cowley Road, Cambridge, CB4 0WS, United Kingdom). An EU Commission adequacy decision exists for the United Kingdom. Legal basis: Art. 6 para. 1 lit. a DSGVO; consent is given by the click and applies only to the respective page view. Further information in the privacy policy of the OpenStreetMap Foundation.

Fonts & Cookies

This website uses exclusively locally embedded fonts — on its own server: "EB Garamond", "Cinzel" and "Great Vibes", plus further locally delivered fonts for readability and the dedication preview (including "Atkinson Hyperlegible"), each under the free SIL Open Font License. No Google Fonts or other external font services are loaded; therefore, no font-related data is transmitted to third parties when the page is accessed. No cookies are set that are not necessary for technical operation. The only data stored locally in the browser is your own display settings (such as font size, typeface, light/dark), the data of the AI conversations (histories for up to 30 days or the reading progress, deletable at any time) and cached page content for offline use. Cloudflare Turnstile is used to protect the AI features against automated misuse; all of this stays on the device or serves security, and none of it sets tracking cookies. Therefore, there is no cookie banner.

Data Subject Rights

There are rights to access (Art. 15 DSGVO), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection (Art. 21). Requests can be sent informally to the email address named in the legal notice.

There is also the right to lodge a complaint with a data protection supervisory authority (Art. 77 DSGVO).

As of: August 2026