Privacy policy

Translation for convenience – the German version is legally binding.

Controller

Patrick Schöller, Salzgasse 11, 74206 Bad Wimpfen, Deutschland, support@pulseposter.com

Overview

We do not use cookies or any third-party tracking or analytics services; we measure the reach of our pages ourselves, anonymously and without recognising visitors. Fonts and scripts are served from our own server; no third-party content is loaded when you visit the page. A connection to Stripe is only made when you are redirected to payment during checkout.

Server logs

Our server processes technically necessary connection data (IP address, time, requested file, browser type) for security and stable operation (Art. 6(1)(f) GDPR) and deletes it after a short time. We also keep an anonymous usage statistic (language, day, pulse value, design settings and whether an order followed; per measurement attempt also coarse technical details without personal reference: operating system, browser, device model or screen size where the browser reports it, whether the camera flash can be controlled, the number of cameras, the best signal quality reached (roughly rounded) and, if applicable, the reason for a failure such as a denied camera permission) – without IP address, cookies, names or texts and not attributable to any person. In addition we count page views anonymously: each view only increases a counter for the day, the page, the language and the rough origin (only the host of the referring website or the value of “utm_source” in the link you followed – not the full address); when you leave the page, the time spent is counted in rough classes (e.g. “10–30 seconds”). We do not store your IP address, your browser identifier (user agent) or any identifier, we set no cookies and store nothing in your browser for this counting, and visitors cannot be recognised across views. To prevent abuse, your IP address is briefly processed in memory to limit requests per period. Automated visits recognised as bots are not counted; if your browser sends “Do Not Track” or “Global Privacy Control”, nothing is counted. If a pulse measurement is started, the rough origin is also kept in the statistics row described above. Displays of promotion banners are counted anonymously too (seen, code copied, button clicked). The legal basis is Art. 6(1)(f) GDPR (legitimate interest in improving the offer). You can object at any time (email us) or enable “Do Not Track” in your browser. The server is hosted by IONOS SE, Montabaur, Germany (data processing agreement, Art. 28 GDPR); domain and mailbox are provided by Strato AG.

Pulse measurement (health data)

The camera is only accessed with your permission. Analysis runs entirely in your browser; no video frames are stored or transmitted. The calculated pulse value is health data (Art. 9 GDPR). Linked to you, it only leaves your device if you place an order, because it is printed on your poster. Independently of that, after a measurement the value is added to the anonymous usage statistic without any personal reference (no IP address, name or identifier; see “Server logs”). We ask for your explicit consent in the checkout (Art. 9(2)(a), 6(1)(a) GDPR), which you can withdraw at any time.

Orders & invoices

For framed posters, Stripe additionally collects your delivery address during payment and passes it to us; we use it only for production and shipping (Art. 6(1)(b) GDPR) and pass it, together with the print file, to the print and shipping provider we commission. We process email, name, optional address, poster content and payment/invoice data to perform the contract (Art. 6(1)(b) GDPR) and to meet statutory retention duties (Art. 6(1)(c); currently up to 8 years for invoice data). Poster files (incl. the pulse value) are stored temporarily on our server before payment so that we can still deliver if a technical fault occurs after payment; if no order is placed, they are deleted after 30 days at the latest. After an order, we keep the poster files (for framed posters including the production file) for 60 days so that we can access them in case of questions, a lost email, complaints or a reprint; they are then deleted automatically.

Payment (Stripe)

Paid orders are processed by Stripe Payments Europe Ltd., Dublin, Ireland, on a Stripe-hosted page. Data such as email, payment data and technical data are transmitted to Stripe; transfers to third countries are covered by the EU-US Data Privacy Framework / standard contractual clauses.

Email & contact form

Emails are sent via Strato AG, Berlin. The contact form uses a local captcha on our own server – no external captcha service. Your request is deleted once handled.

Browser storage

Only technically necessary items (language, whether you closed a promotion banner or which promotion code you followed during your visit, checkout inputs and generated files until payment is completed).

Your rights

Access, rectification, erasure, restriction, portability, objection and withdrawal of consent: support@pulseposter.com. You may complain to a supervisory authority, e.g. the State Commissioner for Data Protection Baden-Württemberg, Stuttgart.

Users in Brazil (LGPD)

If you are in Brazil, the Brazilian General Data Protection Law (Lei nº 13.709/2018 – LGPD) also applies. The controller named above is also the data protection contact (“encarregado”): support@pulseposter.com. Legal bases: performance of the contract (Art. 7 V LGPD) for order, payment and delivery; legal obligations (Art. 7 II) for invoices; legitimate interests (Art. 7 IX) for server logs and the anonymous statistic; and, for the pulse value as sensitive health data, your separate explicit consent at checkout (Art. 11 I), which you can withdraw at any time. Your data is processed in Germany (server, email) and by Stripe in the EU and possibly the USA; this international transfer is necessary to perform the contract with you or based on your consent (Art. 33 VIII and IX LGPD). You have the rights under Art. 18 LGPD (confirmation, access, correction, anonymisation, blocking or deletion, portability, information on recipients, withdrawal of consent) – email support@pulseposter.com. You may also complain to the Brazilian data protection authority ANPD (gov.br/anpd).