Privacy Policy
Last updated: 1 November 2026
1. Controller
The controller responsible for data processing within the meaning of the GDPR is:
Max Becker Digital GmbH
Brühler Straße 97
50968 Köln
Germany
Email: cloudseven@ink-about.com
2. Visiting the website (Vercel)
The website is hosted by Vercel Inc. (440 N Barranca Ave #4133, Covina, CA 91723, USA). When you visit it, Vercel technically processes: IP address, date and time, requested address, HTTP status, amount of data transferred, referrer, browser and operating system. This is necessary for secure and stable delivery.
Legal basis: Art. 6(1)(f) GDPR (legitimate interest in secure operation). For transfers to the USA, standard contractual clauses under Art. 46 GDPR apply and, where Vercel is certified, the EU-US Data Privacy Framework.
Videos, images and downloads of the course are stored in private storage at Vercel (Vercel Blob, Frankfurt region). We deliver them only through our server and only to logged-in buyers. No personal data is stored there.
We serve all images and videos from our own hosting. We do not embed media from third-party servers.
3. Account, login and course progress (Supabase)
We use Supabase (Supabase, Inc., USA) for accounts, purchases, access, course progress and withdrawals. The database is located in the eu-central-1 region (Frankfurt). The following is stored:
- email address and time of login, plus technical login logs (IP address, browser),
- your purchases (Stripe payment ID, amount, currency, status), your access to the course,
- which lessons you have marked as completed,
- withdrawals that you declare through our form (name, email, order details, reason, time of receipt),
- where you came from to the site (style variant and UTM parameters of the link), if you buy and have consented to the cookies in section 6.
Supabase sends the login code by email.
Legal basis: Art. 6(1)(b) GDPR (contract: access and course), for withdrawals Art. 6(1)(c) GDPR (legal obligation to confirm and to keep proof), for variant and UTM Art. 6(1)(a) GDPR (your consent, see section 6). For transfers to the USA, standard contractual clauses apply. Supabase privacy policy: supabase.com/privacy.
4. Payment (Stripe and Link)
Payment is handled on our behalf by Sold through Link, LLC (USA), a company of the Stripe group, as the merchant for the payment (merchant of record). When you click "Continue to payment", we redirect you to a Stripe checkout page. There, Stripe processes name, email address, billing address, payment data, IP address and device and security data. Stripe itself is responsible for this data, for receipts, invoices and VAT. Privacy policy: stripe.com/de/privacy, Link: link.com/privacy.
We transmit to Stripe: the language, your email address and account ID if you are logged in, style variant and UTM parameters if you have consented (section 6), and the time and version of your consent to the immediate start. From Stripe we receive the email address, amount, currency and status of the payment, later also refunds and chargebacks. We do not see payment data such as the card number.
Legal basis: Art. 6(1)(b) GDPR (contract) and Art. 6(1)(c) GDPR (tax retention).
5. Emails (Resend)
We send purchase confirmations and confirmations of receipt for withdrawals through Resend (Resend, Inc., 2261 Market Street #5039, San Francisco, CA 94114, USA). Processed are the email address, the content of the message and technical sending data.
Legal basis: Art. 6(1)(b) and (c) GDPR. Privacy policy: resend.com/legal/privacy-policy.
6. Cookies
We set these cookies:
| Cookie | Purpose | Duration |
|---|---|---|
sb-…-auth-token | keeps you logged in after login | until logout |
NEXT_LOCALE | remembers the chosen language | until the browser is closed |
vp_consent | remembers whether you allowed or declined vp_attribution | 12 months |
vp_attribution | only with consent: remembers the style variant and UTM parameters of the link you came through, so that at purchase we know which page worked. Contains no identifier of you as a person | 30 days |
Stripe sets its own cookies on its checkout page, which are necessary for the payment.
We do not use analytics or advertising tools (for example PostHog or the Meta Pixel). If we introduce them, we will ask for your consent first.
Legal basis: § 25(2) no. 2 TDDDG for login, language and storing your choice, because the service does not work without them. For vp_attribution § 25(1) TDDDG and Art. 6(1)(a) GDPR: we only set it once you choose “Allow” in the cookie banner. You can withdraw your consent at any time via “Cookie settings” at the bottom of every page; we then delete the cookie.
7. Email contact
If you write to us, we process your details in order to reply. Legal basis: Art. 6(1)(b) GDPR (questions about the contract) or (f) (other enquiries).
8. Storage period
We store your account and course progress as long as you have an account. We keep purchase data for as long as commercial and tax law require. We keep withdrawals as proof until the limitation period ends. The logs of Vercel and Supabase are deleted after a short time.
9. Your rights
You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20), objection to processing based on legitimate interests (Art. 21) and withdrawal of consent (Art. 7(3)). An informal message to cloudseven@ink-about.com is enough.
10. Right to lodge a complaint
You can lodge a complaint with a data protection supervisory authority. The authority responsible for us is the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia.
11. Changes
We update this notice when the legal situation or our processing changes. The version with the date given above applies.