Protecting your personal data is important to us. This privacy policy explains which data may be processed when visiting this website, contacting us, making bookings or orders, completing payments, and using specific functions.

1. Controller

Responsible for data processing:
Philip Spahn
Alt-Heddernheim 43
60439 Frankfurt am Main
Phone: 017630734651
Email: philip@philyourstack.de

2. Hosting, infrastructure and access data

We use Google Firebase for hosting, database and authentication. When this website is accessed, Firebase may process technical access data such as your IP address, the time of access and security-related log data. Further information can be found in the Firebase privacy and security information and in Google privacy policy.

3. Cookies, local storage and local browser data

This website does not use separate marketing or analytics cookies. However, technically necessary or convenience-related information is stored locally in your browser, in particular:

• the “appAccepted” cookie and a corresponding local-storage entry to store the confirmed age gate
• the selected website language
• booking preferences such as appointment type, duration, discounts, selected options and voluntary notes
• a draft of the session questionnaire including practice ratings and voluntary free-text entries

These local browser entries are used for the age gate, language selection and continuity of the booking flow. They usually remain on your device until you delete them yourself or your browser removes them.

4. Registration, login and account

If you create an account or log in, we process in particular your name, email address, password (via Firebase Authentication), the invite code entered, registration date, as well as internal account and access markers. Password-reset emails and authentication are also handled via Firebase.

5. Bookings, reservations, orders and request content

When you make reservations, bookings, shop orders or similar requests, we process the data required for preparation, fulfilment and communication. Before a first appointment, and where there are justified doubts about legal age, this may also include age verification by presenting a valid official ID document or, for online appointments, by a visual check during the video call. This may include in particular:

• name and email address
• selected appointment, start and end time, duration and session type
• booking options such as on-site, video, chat, duo session, chat without images or student/trainee discount
• voluntary notes, wishes, limits and information from the session questionnaire
• reference, transaction and status data, remaining payment amount and the connection to the relevant order or booking
• for product orders or certain payment methods, billing or shipping address data as well

6. Voluntary sensitive information

If you voluntarily provide information in free-text fields, messages or the session questionnaire about preferences, limits, physical or sexual topics, this may include particularly sensitive personal data. Please only share information you consciously wish to disclose. Such information is used solely to review, prepare and carry out your request or booking.

7. Payment processing

To initiate and technically process payments, you may be redirected to the external payment page pay-r.de. Depending on the payment method, this may involve processing reference numbers, appointment or order data, the payment amount and, where applicable, name, email address and address details.

Stripe is used in particular for the technical payment processing via pay-r.de. Further information can be found in the Stripe privacy policy.

If you use PayPal as a payment method or interact with PayPal features, the required payment data is transmitted to PayPal. Further information can be found in the PayPal privacy policy.

8. Confirmation and transactional emails

Confirmation and transactional emails may be sent directly through this website or as part of payment processing via Mailgun. Further information can be found in the Mailgun privacy policy. In this context, your email address, appointment or order details, payment reference and any content required for confirmation and fulfilment may be processed.

9. Communication via WhatsApp and Telegram

You can use WhatsApp to contact us and, in some cases, to conduct online appointments. This may involve processing your phone number, profile information and message content. Further information can be found in the WhatsApp privacy policy. The same applies to communication or online appointments via Telegram. Further information can be found in the Telegram privacy policy.

10. External media, fonts and link previews

Google Fonts are loaded to display fonts. In this process, your IP address may be transmitted to Google. Further information can be found in the Google Fonts privacy FAQ.

Images, audio files and other media are partly delivered via ImageKit. In this context, the provider may receive in particular your IP address and technical request data. Further information can be found in the ImageKit privacy policy. Within the admin area, external metadata or favicon services may additionally be queried for link previews. In that case, the URL entered is transmitted to the respective provider.

11. Storage period

We only store personal data for as long as necessary for the respective purposes or as long as statutory retention obligations apply. Typically, this means:

• account data until the account is deleted or the processing purpose no longer applies
• booking, order and payment data until the process is fully completed and beyond that where statutory retention periods apply
• communication content and voluntary information only for as long as necessary to handle your request or booking
• copies or screenshots of ID documents are generally not stored for the sole purpose of age verification unless there is a legal obligation to do so
• local browser data until you delete it yourself or your browser removes it

12. Legal bases

Where the GDPR requires a legal basis, we rely in particular on:

• Art. 6(1)(f) GDPR for providing, securing and technically operating this website as well as preventing misuse
• Art. 6(1)(b) GDPR for registration, bookings, orders, communication for pre-contractual steps or contract performance, and payment handling
• Art. 6(1)(c) GDPR where legal retention or documentation obligations apply
• voluntarily submitted particularly sensitive information is processed only to the extent necessary and only where legally permissible

13. No separate analytics or marketing tools

At present, we do not use our own analytics or marketing tools such as Google Analytics, Meta Pixel or comparable tracking services. This does not affect technically necessary processing by the service providers named above.

14. Your rights

Under the GDPR you have the following rights:
- Access to stored data
- Rectification of inaccurate data
- Erasure of your data
- Restriction of processing
- Data portability
- Objection
- Withdrawal of any consent granted with effect for the future
- Complaint to a supervisory authority

Note on content protection

All content of this website (images, texts) is protected by copyright. Downloading, copying or other use is prohibited without written consent. Violations will be prosecuted.

15. Changes to this privacy policy

We reserve the right to adapt this privacy policy. The current version can always be found on this page.