Privacy policy (Datenschutzerklärung)

1. Who is responsible

The controller responsible for data processing on this website within the meaning of the General Data Protection Regulation (GDPR) is:

I am not required to appoint a data protection officer. For any question about your data, simply write to the address above.

2. The short version

• You can read this whole site without giving me any personal information.
• Usage statistics and Instagram videos are optional. They only switch on if you agree, and you can change your choice at any time under Privacy settings.
• If you write to me or join a release list, I use your details for exactly that and nothing else. I never sell data.

3. Hosting and server log files

This website is hosted by Vercel Inc., USA. When you visit a page, Vercel’s servers automatically record technical information that your browser sends: your IP address, the date and time of the request, the page requested, the referring page, and your browser and operating system. This is necessary to deliver the site securely and to detect and fix errors.

Legal basis: Art. 6 (1) (f) GDPR (my legitimate interest in a secure, working website). I have a data processing agreement with Vercel. Vercel is certified under the EU-U.S. Data Privacy Framework; transfers to the USA are additionally covered by the EU Standard Contractual Clauses. Log data is deleted after a short period. More: Vercel privacy policy.

4. What is stored on your device

This site stores one small entry in your browser’s local storage: your privacy choice from the consent banner, so you are not asked again on every page. This is strictly necessary to provide the service you asked for (§ 25 (2) no. 2 TDDDG) and needs no consent.

Anything beyond that, namely usage statistics (section 5) and Instagram videos (section 6), only happens with your consent (§ 25 (1) TDDDG, Art. 6 (1) (a) GDPR). You can withdraw consent at any time with effect for the future via Privacy settings at the bottom of every page.

The fonts on this site are served from my own server. No connection to Google or other font providers is made.

5. Usage statistics (PostHog), only with consent

If you agree to usage statistics, I use PostHog, a product analytics service by PostHog Inc., USA, to understand which pages and stories people spend time with and where the site could be clearer. PostHog then processes: pages visited, clicks and scroll depth, time on page, browser, device and operating system, approximate location derived from your IP address, and the referring website. With your consent, PostHog may also record anonymised session replays of how the page is used; everything you type into forms is always masked and never recorded. PostHog stores an identifier in your browser (cookie and local storage) to recognise repeat visits.

Data is processed on PostHog’s servers in [the EU (Frankfurt) / the USA, matching the configured host]. Legal basis: your consent, Art. 6 (1) (a) GDPR and § 25 (1) TDDDG. I have a data processing agreement with PostHog; where data reaches the USA, PostHog relies on the EU-U.S. Data Privacy Framework and the EU Standard Contractual Clauses. Without your consent PostHog is not loaded at all. More: PostHog privacy policy.

6. Instagram videos, only with consent

Some of my videos are shown on this site from Instagram, a service of Meta Platforms Ireland Limited, Ireland. Until you agree, you only see a still image and nothing is loaded from Instagram. If you accept Instagram videos in the consent banner, or press play on a video, your browser connects to Meta’s servers. Meta then receives at least your IP address, browser information and the page you are on, and may set cookies. If you are logged in to Instagram, Meta can link the visit to your account. Meta may also process data in the USA.

Legal basis: your consent, Art. 6 (1) (a) GDPR and § 25 (1) TDDDG. For the collection and transmission of data through the embed, Meta and I may be jointly responsible (Art. 26 GDPR); Meta is responsible for everything that happens afterwards. More: Instagram privacy policy. You can also open any video directly on Instagram instead.

7. Contact form and email

If you write to me through the contact form, I process the details you enter: your name, email address, optionally the brand or company you write for, the topic you choose, and your message. If you email me directly, I process your email address and whatever your message contains. I use this only to read and answer your message, and, for brand enquiries, to prepare a possible collaboration.

Messages from the form are delivered to my inbox, and a confirmation is sent to you, by the email service Resend (Resend, Inc., USA). I have a data processing agreement with Resend; transfers to the USA are covered by the EU Standard Contractual Clauses.

Legal basis: Art. 6 (1) (b) GDPR where your message relates to a collaboration or other contract, otherwise Art. 6 (1) (f) GDPR (my legitimate interest in answering messages). I delete your message once the conversation has ended, unless statutory retention periods apply (for example, business correspondence under German commercial and tax law).

8. Spam protection (Cloudflare Turnstile)

To keep the contact form free of spam and abuse, I use Cloudflare Turnstile by Cloudflare, Inc., USA. When the form loads, Turnstile checks whether the request comes from a person by evaluating technical signals such as your IP address and browser characteristics. It does not show puzzles and is not used for advertising.

Legal basis: Art. 6 (1) (f) GDPR (my legitimate interest in protecting the form from automated misuse); access to your device for this purpose is strictly necessary under § 25 (2) no. 2 TDDDG. Cloudflare is certified under the EU-U.S. Data Privacy Framework. More: Cloudflare privacy policy.

9. Release list for “The Wrong Train”

If you join the release list for the workbook, I store your email address with Resend (see section 7) and send you a short confirmation and then one email when the workbook is available. Nothing else.

Legal basis: your consent, Art. 6 (1) (a) GDPR. You can unsubscribe at any time via the link in every email or by writing to me; your address is then deleted from the list.

10. Links to social media

Links to my Instagram, TikTok and YouTube profiles are plain links. No data is sent to these platforms until you click one; after that, the privacy policy of the respective platform applies.

11. Your rights

You have the right to:

• access the personal data I hold about you (Art. 15 GDPR),
• have incorrect data corrected (Art. 16 GDPR),
• have your data deleted (Art. 17 GDPR),
• restrict processing (Art. 18 GDPR),
• receive your data in a portable format (Art. 20 GDPR),
• object to processing based on legitimate interests (Art. 21 GDPR),
• withdraw any consent at any time with effect for the future (Art. 7 (3) GDPR).

An email to hello@anascomfortpages.com is enough. You also have the right to lodge a complaint with a data protection supervisory authority, for example the authority of the German state where I am based: [name of the state data protection authority].

12. Encryption

This site is delivered over an encrypted connection (TLS). You can recognise it by the “https://” in your browser’s address bar.

13. Changes

I update this policy whenever the site changes how it handles data. The current version is always available on this page. See also the imprint.