Privacy policy

Controller within the meaning of Art. 4(7) GDPR: Robin Huber, Ernsthöfer Str. 58, 64342 Seeheim-Jugenheim, Germany. Email: support@somehowshop.com, telephone: +49 1512 6293125. The same details are on our Imprint page.

We have not appointed a data protection officer, as we are not required to.

Placing an order: your email address, the answers you give in the offer brief, any files you upload, the amount paid and the status history of your order. Legal basis: performance of a contract (Art. 6(1)(b) GDPR). Without this data we cannot deliver the service.

Withdrawal consent: the fact, wording and timestamp of the confirmation you give at checkout that work may start immediately. Legal basis: legal obligation and our legitimate interest in being able to prove it (Art. 6(1)(c) and (f) GDPR).

Transactional email: order confirmation, status updates and, after completion, an optional review invitation. Legal basis: performance of a contract (Art. 6(1)(b) GDPR). We send no marketing email.

Accounting records: invoice and payment data retained for statutory bookkeeping. Legal basis: legal obligation (Art. 6(1)(c) GDPR).

Security: we record failed and successful administrator logins to protect the shop from abuse. Legal basis: legitimate interest (Art. 6(1)(f) GDPR).

There is no customer account, no password, no advertising cookie, no analytics tracker and no profiling or automated decision-making.

Every time a page is requested, our hosting provider's servers automatically process technical connection data: IP address, date and time, the page requested, referrer, browser and operating system version. This is technically unavoidable and is used to deliver the site securely and to detect attacks. Legal basis: legitimate interest in a stable, secure service (Art. 6(1)(f) GDPR).

In addition, when you place an order, look up an order or return from the payment page, we store your IP address in an abuse-prevention record so that a single address cannot flood the shop with orders or lookups. The record contains only the IP address, the type of action and a timestamp, is never linked to your order, and is deleted automatically after 24 hours. Legal basis: legitimate interest in preventing abuse and fraud (Art. 6(1)(f) GDPR).

Payments — Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Dublin, Ireland (with Stripe, Inc., USA). Stripe processes your payment and handles refunds and disputes. Card details go directly to Stripe — we never see or store them; we receive a payment reference, the amount and the payment result. Stripe's payment script is already loaded on our order page so that the checkout can be started; from that point Stripe may set strictly necessary cookies and process device data of its own. For fraud prevention and its own regulatory duties Stripe acts as an independent controller, governed by its own privacy policy at stripe.com/privacy.

Email delivery — Resend, Inc., 2261 Market Street, San Francisco, CA, USA. Delivers the transactional messages listed above and receives your email address and the message content.

Hosting, database and file storage — Lovable Labs Incorporated, 2261 Market Street, San Francisco, CA, USA, together with its infrastructure providers Cloudflare, Inc. (USA/EU edge delivery) and Supabase, Inc. (USA/EU database and file storage). They store the site, the order records and your uploads on our instructions.

Each of these acts as a processor under a data-processing agreement pursuant to Art. 28 GDPR and only on our documented instructions, except where named above as an independent controller.

Some of the providers above operate infrastructure or support functions outside the European Economic Area, including in the United States. Those transfers are covered by the European Commission's standard contractual clauses and, where applicable, the EU–US Data Privacy Framework. You can request a copy of the safeguards from us at any time.

Files you send live in private storage that is not publicly reachable and is not indexed. Only our staff can open them, through short-lived links generated on demand for a single view.

Abuse-prevention records containing IP addresses: deleted automatically after 24 hours.

Orders that were started but never paid, including any brief answers and uploads attached to them: deleted automatically after 7 days.

Uploads and brief answers of completed orders: kept while your order is open and for a short period afterwards in case of a follow-up question; deleted on request at any time.

Order and invoice records: retained for the statutory bookkeeping period under German law (up to ten years) and then deleted.

Published reviews: kept until you ask us to remove them.

You have the right to access your data, to have it corrected, erased or its processing restricted, to object to processing based on our legitimate interests, and to receive your data in a portable format. Write to support@somehowshop.com and we will respond within one month.

You also have the right to lodge a complaint with a data protection supervisory authority, in particular in the EU member state of your residence, place of work or the place of the alleged infringement. For us this is the Hessischer Beauftragte für Datenschutz und Informationsfreiheit, Wiesbaden.

Browsing and ordering in the shop sets no cookies from us at all. We use no advertising or analytics cookies and show no consent banner because none is needed.

Two strictly necessary cookies exist only inside our staff administration area, which customers never see: one keeps the administrator logged in, one remembers whether the sidebar is open.

Stripe may set strictly necessary cookies and use local storage of its own to process your payment and prevent fraud, both on our order page and on its payment page.