Privacy Policy

1. Overview

We take the protection of your personal data seriously. This privacy policy explains what data is processed when you visit the alex pfeffer store, why, on which legal basis, how long it is kept, and what rights you have under the EU General Data Protection Regulation (GDPR).

The short version: visiting the Store creates the technical server logs that any website produces, and our host Vercel counts page views without cookies (section 3). The Store sets no cookies and loads no fonts or scripts from third parties. The one exception is a YouTube video you start yourself (section 4). Your cart lives only in your browser.

2. Controller

Email: alex@alexpfeffer.com

There is no legal obligation for us to appoint a data protection officer.

3. Hosting, server logs and page statistics

The Store is hosted by Vercel Inc., 440 N Barranca Avenue #4133, Covina, CA 91723, USA. When you open a page, your browser sends a request to Vercel's servers, which process the technical data needed to deliver the page and keep the service secure: your IP address, the date and time of the request, the requested URL, the referring page, your browser type and version, and your operating system.

Vercel keeps this data in server logs for a limited period for security and error analysis and then deletes it. We do not combine it with other data or use it to identify individual visitors.

Legal basis: our legitimate interest in providing a stable and secure website (Art. 6 (1) (f) GDPR). We have concluded a data processing agreement with Vercel. Vercel participates in the EU-US Data Privacy Framework; where data is transferred to the USA, the transfer is based on that framework and on the EU standard contractual clauses included in the agreement.

We use Vercel Web Analytics to see which pages are visited. A small script served from the Store’s own domain reports each page view to Vercel: the time, the page address, the referring page, your approximate location (country, region and city), your operating system, browser and device type. Download and sign-in links have their personal parts removed before the report is sent. Vercel Web Analytics sets no cookies and stores nothing on your device. Vercel counts visitors with a hash formed from the request and discards that hash after 24 hours, so we only ever see totals and cannot identify you.

Legal basis for the page statistics: our legitimate interest in knowing which pages are used, so we can improve the Store (Art. 6 (1) (f) GDPR). You can object at any time; a browser setting or extension that blocks the script also stops the reports.

Vercel's own privacy policy: https://vercel.com/legal/privacy-policy

4. Fonts, scripts and videos

The fonts used by the Store (Manrope and Geist Mono) are served from our own hosting. Your browser does not connect to Google or any other font provider. The Store loads no external scripts, no tracking pixels and no social media plugins, except a YouTube video you start yourself.

The Blazar Core page shows a feature tour video from YouTube, a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Until you press play, the page shows a preview image from our own hosting and makes no connection to YouTube. When you press play, the video loads from youtube-nocookie.com, YouTube’s privacy-enhanced mode. Your browser then sends YouTube your IP address and technical data about your device, and YouTube may store cookies or similar data on your device while the video plays. Google may process this data in the USA; Google participates in the EU-US Data Privacy Framework.

Legal basis: your consent, given by pressing play (Art. 6 (1) (a) GDPR and Section 25 (1) TDDDG). Google’s privacy policy: https://policies.google.com/privacy

5. Cart and demo audio in your browser

When you add a product to your cart, the list of product IDs is stored in your browser's session storage. This data stays on your device, is never sent to us, and is deleted automatically when you close the browser tab. It is not a cookie and cannot be used to recognise you.

The interactive Themis and TYDE previews load audio samples from the Store when you press play and process them in your browser. Neither preview records audio or accesses your microphone.

6. Cookies

The Store does not set cookies, so no consent banner is shown. A YouTube video you start yourself may store cookies or similar data from YouTube on your device (section 4). Pressing play is your consent to that.

7. Contact by email or support form

If you contact us by email or the support form, we process your email address, your name if given, the selected product and the content of your message to handle your request. The support form sends your message to our inbox through Brevo. Your email address is used as the reply address. Sending a support request does not subscribe you to the newsletter.

To limit automated or repeated form submissions, we store keyed hashes derived from your email and IP address with short-lived request counters in Supabase. These records do not contain your message or the original email or IP address. Records older than two days are removed when subsequent requests are processed.

Legal basis: performance of a contract or pre-contractual steps (Art. 6 (1) (b) GDPR) where your request concerns a purchase, otherwise our legitimate interest in answering enquiries (Art. 6 (1) (f) GDPR).

We delete your messages once your request has been dealt with, unless we are required to keep business correspondence under commercial or tax law (Section 257 HGB, Section 147 AO), in which case it is kept for six or ten years respectively.

8. Newsletter, free downloads and early access

If you ask for TYDE + Glass Particles, we send your email address, request date, requested freebie and version of the consent text to Brevo. Brevo records the double opt-in process so we can evidence your subscription.

If you sign up for early access to a product that is not on sale yet, such as Blazar Core, we send your email address, request date, the product and the version of the consent text to Brevo. We use that address only to tell you about early access to that product and its release.

If you ask for the Blazar Core Demo, we send your first name, email address, request date and the version of the consent text to Brevo. We use your first name to greet you on the download page and in our emails, and your address to send you the demo and emails about Blazar Core.

We use Brevo (Sendinblue GmbH), Köpenicker Straße 126, 10179 Berlin, Germany, to send these emails and to hold the subscriber list. Your address is stored on servers in the European Union. We have concluded a data processing agreement with them. Their own privacy policy: https://www.brevo.com/legal/privacypolicy/

Subscriptions use a double opt-in: after you enter your address we send a confirmation email. For the free download, following its link adds you to the Store - Freebie list and opens the download page. The encrypted download access link expires after seven days; the file download URL expires after fifteen minutes. No store account is created for the free download. For early access, following the link adds you to the early access list for that product, such as Store - Blazar Core Early Access. For the Blazar Core Demo, following the link adds you to the Store - Blazar Core Demo list and opens its download page, under the same seven-day and fifteen-minute limits.

To limit repeated signup requests, we store keyed hashes derived from your email and IP address in Supabase, with short-lived request counters. These records do not contain the original email or IP address; records older than two days are removed when subsequent requests are processed.

Legal basis: your consent (Art. 6 (1) (a) GDPR). You can withdraw it at any time, with effect for the future, using the unsubscribe link in any email or by writing to us. Withdrawal does not affect the lawfulness of what was sent beforehand.

We use your address for these emails until you unsubscribe. A suppression record may be retained to honour your opt-out. The record of your consent is kept for as long as we may need to evidence it. To exercise any right, email alex@alexpfeffer.com.

9. Purchases and download access

Purchases are processed by Paddle.com Market Limited, Judd House, 18-29 Mora Street, London EC1V 8BT, United Kingdom, as merchant of record. When you buy, Paddle collects your email address, billing country and, where needed, address and VAT number, together with your payment details, and processes them as an independent controller under its own privacy policy: https://www.paddle.com/legal/privacy. Payment details such as card numbers or PayPal credentials never reach us.

Paddle passes on to us your email address, the products ordered, the amount paid, the currency and a transaction reference. We store these as your order record, together with the license key we issue for the product.

Our order records, your sign-in sessions and the product files you download are held for us by Supabase Inc., 970 Toa Payoh North #07-04, Singapore 318992, acting as our processor, on servers in Frankfurt, Germany (AWS eu-central-1). We have concluded a data processing agreement with them. Their privacy policy: https://supabase.com/privacy

Order confirmations and receipts are delivered through Brevo (Sendinblue GmbH), acting as our processor for transactional email under the same agreement as above. A transactional email is sent because you placed an order, not on the basis of consent, and it is separate from the newsletter.

To give you access to your downloads, we store the email address used at checkout and, when you request access, send a one-time sign-in link to it and record the time of the request and the IP address it came from. This protects your purchases from being retrieved by someone else.

Right after payment, the thank-you page shows your license keys without a sign-in link. For this, your browser keeps the transaction reference and email address that Paddle reported in the tab you paid in, and sends both to us; we show the keys only when both match an order paid within the last 24 hours.

When the Blazar Core Demo unlocks the full version, it sends your license key to us. We check the key and your purchase, and record the license id, the platform, the version, the time and a keyed hash of your IP address. We use this record to recognise a license key that has been shared. To limit repeated requests, we keep keyed hashes of the license id and IP address with short-lived request counters, removed after two days.

Legal basis: performance of the contract (Art. 6 (1) (b) GDPR) and, for invoice data, our legal obligation to keep accounting records (Art. 6 (1) (c) GDPR).

Order and invoice data is kept for ten years from the end of the year of purchase (Section 147 AO). Sign-in links expire after ten minutes and can be used once; access logs are kept for a limited period for security purposes.

10. Your rights

Under the GDPR you have the right to:

• access the personal data we hold about you (Art. 15 GDPR),
• request correction of inaccurate data (Art. 16 GDPR),
• request deletion of your data (Art. 17 GDPR),
• restrict processing of your data (Art. 18 GDPR),
• receive your data in a portable format (Art. 20 GDPR),
• object to processing based on our legitimate interest (Art. 21 GDPR),
• withdraw any consent you have given, with effect for the future (Art. 7 (3) GDPR),
• lodge a complaint with a supervisory authority (Art. 77 GDPR).

To exercise these rights, email alex@alexpfeffer.com. The supervisory authority responsible for us is Der Hamburgische Beauftragte für Datenschutz und Informationsfreiheit, Ludwig-Erhard-Straße 22, 20459 Hamburg, Germany, https://datenschutz-hamburg.de. You may also contact the authority of your own place of residence.

11. Changes to this policy

We update this policy when the Store changes, for example when purchases open or a new service provider is added. The date at the top shows the current version.