Privacy policy.

The short version

This website uses no cookies, no analytics, no tracking pixels and no third-party content. Fonts and images are served from our own server. We only process personal data that is technically necessary to deliver the site, and the data you choose to send us by email or through our forms.

Who is responsible

Moritz Reiß
Hofmatte 20
79232 March
Germany
Email: hello@kettlebury.com

Hosting and server logs

This website is hosted by Hetzner Online GmbH in Germany. When you visit, the server briefly records technical data such as your IP address, the date and time, the page requested and your browser type. We need this to deliver the site and keep it secure (legal basis: Art. 6(1)(f) GDPR). Log entries are kept only for a short period and then deleted, unless a security incident requires us to keep them longer.

Contacting us by email

If you email us, we use your message and contact details to reply and, if you become a customer, to provide our services (legal basis: Art. 6(1)(b) and (f) GDPR). We delete the correspondence when it is no longer needed, unless we are legally required to keep it. The same applies to our contact form: your name, email address and message go to our own server at Hetzner in Germany and, as a copy, to our mailbox.

No cookies, no tracking

We do not use cookies, analytics tools, advertising networks or social media plugins. We do not sell or share your personal information, and we do not use it for targeted advertising.

Preview request form

If you ask for a free preview with our preview request form, we receive your business name, your town or Google Maps link and your email address, and, only if you choose to add them, your phone number, your wishes and photos, plus the time of the request and the version of the consent text you ticked. We do not store your IP address with it. We use these details to check that the address belongs to the business, to build your preview and to email you about it (Art. 6(1)(b) GDPR, because you asked; for the emails your consent, Art. 6(1)(a) GDPR). You get one email confirming the request. The request waits on our server in Germany (Hetzner) only until we fetch it, usually less than a day; after that it is kept in our customer database (Supabase, hosted in the EU in Ireland; Supabase Inc. is a US company, transfers are covered by Standard Contractual Clauses) until the preview is finished with, and for at most 6 months if you do not become a client. The record of where we confirmed your address is kept for 3 years. Your preview is hosted by BunnyWay d.o.o. (Slovenia, EU); if you pay, Stripe processes the payment. You can withdraw at any time with a short email or by replying “stop”: we then delete your details and put your address on our do-not-contact list. We do not sell or share this information and do not track you across other websites (California Online Privacy Protection Act).

Uploading photos

Purpose: if you upload photos with the preview request form, we use them only for your website: first in your preview and, if you order, on the finished site.

Data: the image files themselves, including the information your phone or camera stores in them (for example the time and, if switched on, the place the photo was taken). The files get new names on our server; your original file names are not stored.

Legal basis: Art. 6(1)(b) GDPR (your request). If people can be recognised in a photo, by uploading it you confirm that they agree; without that we do not use the photo.

Recipients: the photos are kept on our server at Hetzner in Germany and on our work computer. To make the changes I use an AI service by Anthropic as a processor; where data goes to the USA, this is based on the EU-US Data Privacy Framework or standard contractual clauses. They become public only as part of your preview or your website.

How long: on the form server only until we fetch the request, usually a few days, then they are deleted there. If you do not order, we delete them together with your request; if you order, they are kept for as long as the contract runs. On request we delete single photos or all of them straight away.

If you do not send photos and we cannot find any of your business online, your preview uses suitable example photos for now; we swap them for yours as soon as you send some.

Photos and logo sent with “Request a change”

Purpose: if you upload photos or your logo with “Request a change”, I use them only to update your preview and, if you order, for your website.

Data: the files themselves, including the information your phone or camera stores in them (for example the time and, if switched on, the place a photo was taken), your notes on the photos, who took them, your confirmation of the rights and your email address. The files get new names; your file names and your IP address are not stored.

Location data: before I use a photo, I save it again without this embedded information and delete the original. Logos sent as PDF or SVG are kept unchanged.

Legal basis: Art. 6(1)(b) GDPR (your request before a possible contract). If people can be recognised, you confirm with the tick box that they agree; otherwise I do not use the photo.

Recipients: the files are kept on my server at Hetzner in Germany and on my work computer. To make the changes I use an AI service by Anthropic as a processor; where data goes to the USA, this is based on the EU-US Data Privacy Framework or standard contractual clauses. A photo becomes public only as part of your preview or website.

How long: on the form server only until I fetch it, then it is deleted there. If you do not order, I delete the files together with the preview; if you order, for as long as the contract runs. On request I delete single files or all of them straight away.

Ordering from your preview

If you order your website from the preview, we use your details to carry out the contract and to invoice you (Art. 6(1)(b) GDPR; for legal record-keeping Art. 6(1)(c) GDPR). Payment is handled by Stripe Payments Europe Ltd., Ireland; you leave our pages for that, and this website itself loads nothing from Stripe. Stripe processes your card details; we only see the last four digits. If you pay with PayPal, PayPal (Europe) S.à r.l. et Cie, S.C.A., Luxembourg, processes your PayPal account details as an independent controller. A transfer to Stripe, Inc., USA, is possible (EU standard contractual clauses or the Data Privacy Framework). We create invoices with our own invoicing software (Invoice Ninja, hosted by us). Invoices and accounting records are kept for the periods German law requires (up to 10 years).

Your rights

Under the GDPR you have the right to access, correct and delete your personal data, to restrict or object to its processing, to data portability, and to lodge a complaint with a supervisory authority. If you live in a US state with a consumer privacy law, such as California, you may have similar rights, including the right to know what we hold about you and to ask us to delete it. We will not treat you differently for exercising any of these rights.

The easiest way is our form “Your privacy rights”. An objection to marketing and a deletion are carried out as soon as you confirm your email address. Email and post still work as well.

To make a request, email hello@kettlebury.com.

The “Your privacy rights” form

Purpose: to handle your request about your rights and to show that we answered it in time.

Data: what you ask for, your email address, your business name, the link to your preview or your postal address (to find your data), your message, and the time of the request and of your confirmation. We do not store your IP address with it.

Legal basis: Art. 6(1)(c) GDPR with Art. 12 and 15–21 GDPR.

Recipients: the form sends to our own server at Hetzner in Germany. We send the confirmation email and our answer from our own mailbox.

How long: requests that are not confirmed are deleted after 7 days. After we have dealt with a request we keep only the date, what you asked for, the steps taken and your email address as an unreadable checksum, for 3 years.

Changes

This site does not track visitors over time or across websites, so it does not respond differently to Do Not Track signals.

We may update this policy if our website or the law changes. Effective date: 3 November 2026.