Privacy notice

The controller under GDPR Article 4(7) is Waldemar Enns. Privacy requests go to the address below.

This notice applies to the Erasely website. It describes running the site, the waitlist, the newsletter, optional audience measurement, optional error monitoring, and sign-in.

We do not sell this data and we do not pass it to ad networks. Recipients are only the parties named here.

The footprint check, access and erasure requests, and the draft complaint to a supervisory authority are not switched on yet. This notice will be updated before those features process personal data.

The website and the PostgreSQL database run on servers of Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany.

The purpose is the technical operation of the website. The legal basis is GDPR Article 6(1)(f). The legitimate interest is a site that stays available and protected. Processing takes place in Germany.

When you open the site, the web server or the reverse proxy may record connection data: IP address, date and time, requested address, volume of data transferred, HTTP status, and user agent. That happens only where the hosting environment keeps such logs.

The logs are deleted once they are no longer required to run the site and to defend it against abuse.

The legal basis is GDPR Article 6(1)(f). The legitimate interest is delivering the site and protecting it against abuse.

If you join, we store:

• your email address
• the fact, the wording version, and the time of your consent
• the time you signed up and, after you confirm, the time of confirmation

The records sit in a PostgreSQL database on the hosting infrastructure in Germany. We do not store the IP address of the signup in plain text.

The purpose is the waitlist: confirming the signup and writing to you when the footprint check opens. To confirm, we send an email with a link (double opt-in). The link is valid only for a limited time. We store the related token only as a hash and delete it after confirmation or expiry.

The legal basis is GDPR Article 6(1)(a). You can withdraw consent at any time with effect for the future. Processing before the withdrawal stays lawful. Send the withdrawal to kontakt@waldemarenns.de.

The email address and the consent are required to add you. Without both, we do not store the address (GDPR Article 13(2)(e)).

We keep the record until you withdraw consent, use the unsubscribe link in a waitlist email, or the waitlist purpose ends. We then delete it, unless a statutory retention duty says otherwise. We store the unsubscribe token only as a hash, with no expiry.

Postmark sends the email. Postmark is a service of ActiveCampaign (formerly Wildbit) in the United States. Postmark receives the email address and the content of the message.

The transfer to the United States relies on the EU-US Data Privacy Framework or on standard contractual clauses.

If you subscribe to the newsletter, we store:

• your email address
• the time and the wording version of your consent
• the confirmation of the opt-in

The legal basis is GDPR Article 6(1)(a). We write to you only after double opt-in. You can withdraw consent at any time through the unsubscribe link in the mail or through one-click unsubscribe. Unsubscribing deletes the record.

Postmark sends the newsletter. Postmark is a service of ActiveCampaign (formerly Wildbit) in the United States. Postmark receives the email address and the content of the message.

The transfer to the United States relies on the EU-US Data Privacy Framework or on standard contractual clauses.

We do not use open or click tracking.

Umami runs only when both the website id and the host are set. Otherwise the site loads no analytics script.

When both values are set, the site loads a script from the self-hosted Umami instance. The script sets no cookies and builds no usage profiles. The instance receives page views with technical details: page, referrer, browser, device, and language. The software is built so that it does not store the IP address as a profile.

The legal basis is GDPR Article 6(1)(f). The legitimate interest is a rough, aggregated view of which pages are used, without advertising profiles. Because nothing is stored on the device, we do not ask for consent under § 25(1) TDDDG for this.

The instance is self-hosted. Page views go to that host. If it is in a third country, in particular the United States, the transfer relies on the EU-US Data Privacy Framework or on standard contractual clauses.

Sentry runs only when a DSN is set. Without a DSN, no error report leaves the application.

When Sentry is on, error and performance data go to Sentry (Functional Software, Inc.). The application records performance data only for a sample of 10 percent of activity. A report can in particular include the time, the address opened, the browser, and the stack trace. On the server, the report can also include the requested URL, query parameters, headers, and cookies. The IP address is not attached on purpose. A forwarded header can still contain it.

How long a report is kept is set by the Sentry project. The application does not set its own period. The data stays stored while it is needed to diagnose errors.

The legal basis is GDPR Article 6(1)(f). The legitimate interest is finding errors and keeping the application stable.

The region depends on the Sentry project. If the project is in the United States, the transfer relies on the EU-US Data Privacy Framework or on standard contractual clauses.

Sign-in is optional and uses GitHub OAuth. If you sign in, we receive from GitHub:

• the user id
• the login name
• the display name
• the email address, if GitHub provides it
• the address of the profile image

We store these details in PostgreSQL, in the account table: the GitHub user id, the login name, the display name, the email address when GitHub provides a verified address, and the profile image address. We do not store the GitHub access token. The same public account view also lives in the encrypted session.

GitHub (GitHub, Inc., United States) processes the sign-in on its side. Where that sends data to the United States, the transfer relies on the EU-US Data Privacy Framework or on standard contractual clauses.

The legal basis is GDPR Article 6(1)(b). Sign-in provides the access you start.

The account stays stored until you ask for deletion. The session ends when you sign out, and after seven days at the latest.

Instead of GitHub, you can sign in with a single-use link. You enter an email address. We send the link to that address. The page does not say whether an account already exists for the address.

We store the address, the time, and only the SHA-256 hash of the link. We do not store the link itself. It is valid for 15 minutes and works once. We delete expired hashes, and used hashes that are older than a day. We do not store an IP address for this. Clicking the link creates the account or signs in an existing account. The address is then verified.

Postmark, a service of ActiveCampaign (formerly Wildbit) in the United States, sends the mail. Postmark receives the email address and the message. We do not measure opens or clicks.

The transfer to the United States relies on the EU-US Data Privacy Framework or on standard contractual clauses.

The legal basis is GDPR Article 6(1)(b). The link provides the access you asked for.

The site does not set an advertising cookie. The following cookies can appear.

Session

The nuxt-session cookie is set when you sign in. Its content is the encrypted session: the account id, the email address, the display name, the GitHub details above when you use GitHub, the time of sign-in, and a session id. It does not contain a GitHub access token. The cookie is HttpOnly, SameSite=Lax, and Secure, applies to the path /, and expires after seven days. Signing out deletes it.

The legal basis is § 25(2) No. 2 TDDDG, because the cookie is required to provide the sign-in service you asked for, and GDPR Article 6(1)(b).

Language

The i18n_redirected cookie stores the language code de or en so the chosen language stays in place. It lasts one year, SameSite is Lax, and the path is /. It is not HttpOnly. The Secure flag is not set in the default configuration.

The legal basis is GDPR Article 6(1)(f). The legitimate interest is a stable language. Because the cookie stores only that language and is required for the language version, we do not ask for consent under § 25(2) No. 2 TDDDG.

GitHub check value

During GitHub sign-in we set the oauth-state cookie. It holds a random check value against cross-site request forgery, the PKCE verifier, and the chosen language. It is HttpOnly, SameSite=Lax, and Secure, applies only to the path /auth/github, and expires after ten minutes. Returning from GitHub deletes it.

The legal basis is § 25(2) No. 2 TDDDG, because the cookie is required to finish the GitHub sign-in you started, and GDPR Article 6(1)(b).

The waitlist and the newsletter need your email address and your consent. Sign-in with GitHub or with an email link is voluntary. The link needs the address it should go to. Connection data arises technically when you open the site, even if you type nothing.

There is no automated decision-making, including profiling, under GDPR Article 22.

You have these rights against the controller:

• access to the data stored, GDPR Article 15
• rectification of inaccurate data, GDPR Article 16
• erasure, GDPR Article 17
• restriction of processing, GDPR Article 18
• data portability, GDPR Article 20
• objection to processing we base on GDPR Article 6(1)(f), GDPR Article 21

If we rectify, erase, or restrict data, we inform recipients to whom we disclosed it where GDPR Article 19 requires that and it is not impossible or disproportionate.

Where processing is based on consent, you can withdraw that consent at any time with effect for the future, GDPR Article 7(3).

Send your request to the email address of the controller. We reply within the period in GDPR Article 12. kontakt@waldemarenns.de

You can lodge a complaint with a supervisory authority, GDPR Article 77, in particular in the member state of your habitual residence, your place of work, or the place of the alleged infringement. For the controller in Baden-Württemberg, that authority is the Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg (LfDI BW).