Year in Miles Deutsch

Privacy notice

Controller

Adrian Spies
Siedlung 4a
36093 Künzell
Germany

Phone: +49 15510 332389, e-mail: support@squeezio.app

There is no data protection officer. For any question about your data, contact us using the details above.

Your activity files stay on your device

The recap is computed by JavaScript in your browser. The files you drop, the routes, times, names and every number derived from them are never sent to us or to anyone else. Closing the tab discards them. Only when you order a poster is its print image uploaded (see “Orders”).

The recap counter

When a recap is generated from your own files, the page sends one empty request to /api/recaps on this site, without cookies, referrer or any content. The server adds one to a counter for the current hour and stores nothing else: no IP address, no device data, no identifier. It checks that the request came from this page, using a header your browser sets for that purpose, and does not keep that header. Example recaps are not counted.

Hosting and delivery by Cloudflare

The website, the counter, the order handling and the database run at Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA, as our processor (Art. 28 GDPR; Cloudflare's data processing agreement is part of the contract with Cloudflare: cloudflare.com/cloudflare-customer-dpa). For every page request, Cloudflare processes your IP address, the requested address, the time and your browser's headers to deliver the page and protect it from attacks. The legal basis is our legitimate interest in a secure and reachable website (Art. 6(1)(f) GDPR) and, for orders, the performance of the contract (Art. 6(1)(b) GDPR).

Our Worker writes no logs of its own (Workers Logs are off). A rate-limiting rule counts requests per IP address to /api/checkout, /api/checkout/status, /api/recaps and /api/withdrawal over ten seconds and blocks an address for ten seconds after ten requests. In its dashboard Cloudflare shows us analytics of requests and security events, such as blocked requests, including IP addresses; according to Cloudflare these analytics are kept for at least 31 days. How long Cloudflare keeps IP addresses in its own logs beyond that is not stated by Cloudflare for this plan; Cloudflare's privacy policy applies (cloudflare.com/privacypolicy).

Cloudflare processes data worldwide, including in the US. Cloudflare, Inc. is certified under the EU-US Data Privacy Framework, for which the European Commission has adopted an adequacy decision (Art. 45 GDPR). If that certification lapses, the Commission's standard contractual clauses (Art. 46 GDPR) in Cloudflare's data processing agreement apply instead.

No cookies, no tracking, no third-party content

The website sets no cookies and loads no fonts, scripts or images from other sites. Stripe's payment page is Stripe's own page on checkout.stripe.com; Stripe's cookie policy applies to its cookies (stripe.com/legal/cookies-policy).

Storage in your browser

Only while the shop is open and only when you buy the HD pack does the page keep in your browser:

While the shop is closed, a visit reads and writes none of these entries. The storage is strictly necessary for the purchase you asked for (§ 25(2) no. 2 TDDDG) and serves no other purpose. The legal basis for processing the data stored there is taking steps at your request before entering into the contract and performing it (Art. 6(1)(b) GDPR). You can delete the entries at any time by clearing the site data of yearinmiles.com in your browser.

Orders

Payment through Stripe

You pay on Stripe's payment page. The contracting party for payment processing is Stripe Payments Europe, Limited, Ireland. There you enter your e-mail address, your payment details and, for the HD pack, your billing address, for the poster your name and shipping address; the legal basis is taking steps at your request before entering into the contract and performing it (Art. 6(1)(b) GDPR). For processing the payment Stripe is our processor; for its own purposes such as fraud prevention, anti-money-laundering checks and its own legal duties Stripe is a controller itself (stripe.com/privacy, stripe.com/legal/privacy-center). Stripe also transfers data to the US, relying on the EU-US Data Privacy Framework and the standard contractual clauses (stripe.com/legal/dpa). Where Stripe processes the data as our processor, it does so under our agreement with Stripe, which includes Stripe's data processing agreement (stripe.com/legal/dpa), and on our instructions. How long Stripe keeps the data is described in Stripe's privacy policy: as long as Stripe provides its services, and afterwards as far as Stripe needs the data for its own legal duties, for fraud prevention and for its tax and accounting duties, within the statutory periods (stripe.com/privacy, section 5).

After payment our Worker reads the payment session at Stripe: the product, the payment status, for the HD pack the billing address's country, your e-mail address and, for the poster, name and shipping address. It uses them to check the sales area, send the order confirmation and place the print order, and does not store them. The legal basis is taking steps at your request before entering into the contract and performing it (Art. 6(1)(b) GDPR). Without an e-mail address, and for the poster without a shipping address, we cannot accept an order.

The poster's print image

When you order a poster, the page uploads its print image when the order starts: an image of your year's routes and numbers, not your export. It is kept in Cloudflare's Workers KV storage. Unpaid, it is deleted after two hours. While a bank transfer or direct debit awaits confirmation, it is kept for up to 14 days and deleted if the payment fails. If the shipping address does not fit the printer's address fields, we delete it with the refund. Once the print order is placed, it is deleted 30 days later. The legal basis is taking steps at your request before entering into the contract and performing it (Art. 6(1)(b) GDPR).

Printing and shipping by Gelato

The poster is printed and shipped by Gelato ASA, Dronning Eufemias gate 8, 0191 Oslo, Norway, as our processor (gelato.com/legal/privacy). Gelato receives your name, your shipping address and your e-mail address, which Gelato's order interface requires, and downloads the print image from us. Gelato has the poster printed by a print partner near the shipping address and passes name and address to the carrier that delivers it; your e-mail address may also go to the carrier so it can tell you about the delivery. Norway is part of the European Economic Area, where the GDPR applies. Gelato and its sub-processors also process the data outside the European Economic Area, including in the US; these transfers rely on the EU-US Data Privacy Framework, for which the European Commission has adopted an adequacy decision (Art. 45 GDPR), or on the Commission's standard contractual clauses (Art. 46 GDPR), as Gelato's data processing terms provide (gelato.com/legal/data-processing-terms). How long Gelato keeps the data it processes as our processor is set by Gelato's data processing terms: they apply as long as Gelato processes data for us, and when they end Gelato deletes the data or returns it to us, at our choice (nos. 11.1 and 11.2); they name no fixed period. Under Gelato's data processing terms (no. 11.3), data may remain after deletion in Gelato's ordinary backups, which Gelato uses for no purpose.

What we keep about orders

In our database (Cloudflare D1) we keep one row per payment session: the product, the processing state with its times, an error message where one occurred, when the order confirmation was sent, and the ids of the Stripe payment session, the print image and the Gelato order. A row holds no name, e-mail address or postal address, but its ids link to the data at Stripe and Gelato. We delete the row of an order whose payment failed 30 days after it was written. We need the row of a paid order for handling the order, and we keep it for the regular limitation period of three years to meet or defend claims under the contract (§§ 195 and 199(1) of the German Civil Code, BGB; Art. 6(1)(b) and (f) GDPR): we delete it at the end of the third calendar year after the year of the order; if the order was only paid, confirmed or refunded in a later year, that year counts. If a claim is still open at that date, for example in a dispute, we keep the details it needs until the claim is settled. The records of the payments are kept by Stripe; how long Stripe keeps them is set out above under “Payment through Stripe” (stripe.com/privacy, section 5). We keep the payment records we export from Stripe for our tax records as long as tax law requires (Art. 6(1)(c) GDPR). We keep the row of an order that is not yet complete, for example because its payment is not yet settled, its processing failed or its order confirmation has not been sent, until we have dealt with it, through our Worker or by hand; the matching one of these two periods applies after that. Our Worker's daily runs delete the rows whose period is over. What we delete from the database, Cloudflare D1 can still restore for up to 30 days (Time Travel); this also applies to the details from the withdrawal function. Besides that we count, per day, only the number and size of uploaded print images.

Order confirmation by e-mail

We send the order confirmation to the e-mail address you entered at Stripe, through Cloudflare's e-mail sending (Cloudflare Email Service) as our processor. The law requires us to confirm the contract to you on a durable medium (§ 312f BGB; Art. 6(1)(c) GDPR). Cloudflare keeps a log entry for every e-mail sent, with the recipient and the delivery status, which we can see for 30 days.

Withdrawal through the withdrawal function

When you send a withdrawal through “Withdraw from contract”, we process your name, your details of the contract and your e-mail address. We send you an acknowledgement of receipt and ourselves a copy, both through Cloudflare's e-mail sending, and handle your withdrawal with it (§ 356a BGB; Art. 6(1)(b) and (c) GDPR). We keep our copy of your statement, and any message asking us to send your acknowledgement of receipt by hand, in our mailbox on the same legal bases as a stored statement (see below) and delete it after three years, at the end of the third calendar year after the year of its receipt, unless a statutory retention duty runs longer; then we keep it until that duty ends (Art. 6(1)(c) GDPR). The same applies to an acknowledgement of receipt we send you by hand and to our daily lists of waiting statements (see below); for a list, the year of the date at its head counts.

So that nobody can misuse the withdrawal function to send mass e-mail, we send the e-mails at once for at most five statements a day (by UTC) from the same network (an IPv4 address or an IPv6 /64 address block), at most three to the same e-mail address and at most 500 statements in total. For this our Worker counts in the database, per day, the statements for your IP address or its block and for your e-mail address. It does not store the addresses themselves, only hash values (HMAC) it computes with a random key for the day. Our Worker's daily runs delete the counts and the key shortly after the day ends. The withdrawal function takes at most 20 statements a day from the same network. It takes no further statement it would have to store while 10 stored statements to the same e-mail address, or 2,000 stored statements in all (see below), wait for their e-mails. In all three cases it points to withdrawal by e-mail or letter, which always works. The legal basis is our legitimate interest in protecting the withdrawal function and our e-mail sending against misuse and keeping them available for buyers (Art. 6(1)(f) GDPR).

If a statement reaches one of the limits for sending at once, we still accept it, except in the three cases above. Our Worker then stores your name, your details of the contract, your e-mail address, the page's language and the time of receipt in the database, and in its daily runs sends the copy to us and your acknowledgement of receipt as soon as the limits allow; of the statements that reached their network's limit, it sends at most 50 a day; for this it runs four times a day and handles at most 150 stored statements per run. While stored statements wait, it sends us once a day a list with the number, time of receipt and e-mail address of each waiting statement, so that we can send an acknowledgement by hand if need be (§ 356a BGB; Art. 6(1)(b) and (c) GDPR). Once your acknowledgement of receipt has been sent, by our Worker or by hand, or we have received the message to send it to you by hand, the statement is dealt with. We then keep it for the regular limitation period of three years: the daily runs delete it at the end of the third calendar year after the year of its receipt (§§ 195 and 199(1) BGB). If the statement belongs to a contract with you, we keep it to meet or defend claims under that contract (Art. 6(1)(b) GDPR); otherwise, for example if we cannot match it to an order, we keep it on our legitimate interest in a record of what arrived and when, so that we can answer later claims about whether a contract was withdrawn (Art. 6(1)(f) GDPR). If a claim is still open at that date, for example in a dispute, we keep the details it needs until the claim is settled.

Contact by e-mail

When you write to us, we process your message and contact details to answer you (Art. 6(1)(b) or (f) GDPR) and delete them once the matter is settled and no retention duty applies.

Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). Where we process data on the basis of legitimate interests (Art. 6(1)(f)), you can object on grounds relating to your particular situation (Art. 21). You can lodge a complaint with a data protection supervisory authority, in particular in the member state of your habitual residence, place of work or place of the alleged infringement (Art. 77 GDPR).