1) Introduction and Contact Details of the Controller

1.1 We are pleased that you are visiting our website and thank you for your interest. In the following, we inform you about the handling of your personal data when using our website. Personal data is any data with which you can be personally identified.

1.2 The controller for data processing on this website within the meaning of the General Data Protection Regulation (GDPR; German: DSGVO) is Damian Haller, Ártala – Jahrzähler, Haldenrainstraße 156, 70437 Stuttgart, Germany, email: damian@jahrzaehler.de. The controller responsible for the processing of personal data is the natural or legal person who alone or jointly with others determines the purposes and means of the processing of personal data.

2) Data Collection When Visiting Our Website

2.1 When using our website for informational purposes only, i.e. when you do not register or otherwise transmit information to us, only the data that your browser transmits to the page server of our hosting provider Cloudflare (see section 3) is processed (so-called "server log files"). When you access our website, the following data is processed, which is technically necessary for us to display the website to you:

Processing is carried out pursuant to Art. 6(1)(f) GDPR on the basis of our legitimate interest in improving the stability and functionality of our website. The data is not passed on or used in any other way. However, we reserve the right to subsequently review server log files if there are concrete indications of unlawful use.

2.2 This website uses SSL or TLS encryption for security reasons and to protect the transmission of personal data and other confidential content (e.g. orders or enquiries to the controller). You can recognise an encrypted connection by the character string "https://" and the lock symbol in your browser bar.

3) Hosting & Content Delivery Network

3.1 For the hosting of our website, we use Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA. Cloudflare provides the infrastructure through which our static web pages are delivered (Cloudflare Pages) and also serves as a Content Delivery Network (CDN).

Cloudflare is a US-based company. The data transfer to the USA is secured on the basis of EU Standard Contractual Clauses (SCCs) pursuant to Art. 46(2)(c) GDPR and the Data Processing Addendum (DPA) from Cloudflare. Cloudflare is also certified under the EU-US Data Privacy Framework.

When accessing our website, Cloudflare may process access data for technical reasons (IP address, page accessed, time of access). Processing is carried out pursuant to Art. 6(1)(f) GDPR on the basis of our legitimate interest in a secure and efficient provision of our website.

Further information on data protection at Cloudflare can be found at: cloudflare.com/privacypolicy

3.2 To display current prices on our shop page and the current App Store rating, our server (a function at Cloudflare) retrieves this information from our database provider Supabase (Supabase, Inc., USA; database instance in the EU, Frankfurt am Main). This request is made from the server, not from your browser; your IP address or other data about you is not transmitted to Supabase.

Clicks on the links to Google Play, the App Store and the web app pass through a redirect on our website (/go/…). On the server, we only count which destination was clicked from which page of our website. Your browser's user-agent string (browser and operating system information) is evaluated only to exclude automated requests by programs from the count and, for the QR code (/go/auto), to choose the right destination (Google Play for Android, the App Store for iPhone and iPad, otherwise the web app); it is not stored. No personal data is stored. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in a count, free of automated requests, of how often our website leads to the apps, and in forwarding you to the right destination.

Which store button appears first and whether a QR code is shown is decided by a small script in your browser based on the device type (Android, iPhone/iPad or computer). This check takes place only locally; nothing is transmitted or stored.

4) Cookies and Browser Storage

Without your consent, this website does not set any cookies. So that we do not have to ask for your choice in the cookie notice ("Accept" or "Essential only") on every page view, we store this decision in your browser's local storage (localStorage, key artala_consent_v2_metricool). This storage is strictly necessary to provide the service you have expressly requested (section 25(2) no. 2 TDDDG); the legal basis for the related processing is Art. 6(1)(c) in conjunction with Art. 7(1) GDPR (proof of consent). You can delete the entry at any time in your browser settings.

Analytics cookies from Google Analytics are only set if you consent (see section 5).

You can configure your browser to be informed about the setting of cookies and to decide individually whether to accept them, or to exclude the acceptance of cookies for certain cases or in general.

5) Web Analytics — Google Analytics 4 and Metricool

This website uses Google Analytics 4, a web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland ("Google"). Google Analytics uses cookies (including "_ga", duration approx. 2 years) that enable an analysis of your use of the website.

The information generated by the cookie about your use of this website is generally transferred to a Google server in the USA and stored there. The data transfer to the USA is secured on the basis of EU Standard Contractual Clauses (SCCs) pursuant to Art. 46(2)(c) GDPR. Google is also certified under the EU-US Data Privacy Framework.

We only use Google Analytics with your prior consent (Art. 6(1)(a) GDPR in conjunction with section 25(1) TDDDG). You can withdraw your consent at any time with effect for the future by clicking "Cookie settings" at the bottom of any page and selecting "Essential only".

Further information on data protection at Google can be found at: policies.google.com/privacy

5.2 Metricool With consent, this website loads Metricool's browser tracker from tracker.metricool.com. The provider is METRICOOL SOFTWARE, S.L., c/ Téllez 12, Entreplanta H, 28007 Madrid, Spain. The tracker is used exclusively for anonymous, aggregated audience measurement (visits and pages viewed) for this website.

According to Metricool, the tracker does not use cookies, store information on the visitor's device, or assign unique identifiers. The IP address is processed technically during the connection but is not stored. The measurement request transmits the visited page address, the browser window dimensions and, where available, the referring page. Further information: Metricool – Visit Tracker and Metricool Privacy Policy.

Processing takes place only with your consent, pursuant to Art. 6(1)(a) GDPR. Without consent, the tracker is not loaded. Consent can be changed or withdrawn at any time with effect for the future through “Cookie settings” in the footer. Metricool processes the data as a processor. Its corresponding obligations are set out in section 16.2 of Metricool’s Terms and Conditions.

6) Contacting Us

When contacting us (e.g. by email), personal data is collected. This data is stored and used exclusively for the purpose of responding to your enquiry or for contacting you and the associated technical administration.

The legal basis for the processing of this data is our legitimate interest in responding to your enquiry pursuant to Art. 6(1)(f) GDPR. If your contact is aimed at concluding a contract, the additional legal basis for processing is Art. 6(1)(b) GDPR. Your data will be deleted after your enquiry has been conclusively processed. This is the case when the circumstances indicate that the matter in question has been conclusively clarified and provided that no statutory retention obligations apply.

7) Data Processing for Order Processing

7.1 Insofar as necessary for the processing of the contract for delivery and payment purposes, the personal data collected by us is passed on to the commissioned credit institution pursuant to Art. 6(1)(b) GDPR.

If we owe you updates for goods with digital elements or for digital products on the basis of a corresponding contract, we process the contact data you provided when ordering in order to personally inform you within the scope of our statutory information obligations pursuant to Art. 6(1)(c) GDPR. Your contact data is used strictly for the purpose of notifications about updates owed by us and is only processed by us to the extent necessary for the respective notification.

For the processing of your order, we also work with the following service provider, who supports us in whole or in part in the execution of concluded contracts. Certain personal data is transmitted to this service provider in accordance with the following information.

7.2 Use of Stripe

The following provider's online payment method is available on this website: Stripe Payments Europe Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland.

When selecting a payment method from this provider that requires advance payment by you (such as credit card payment or SEPA direct debit), the payment data you have provided during the ordering process (including name, address, bank and payment card information, currency and transaction number) as well as information about the content of your order are passed on to the provider pursuant to Art. 6(1)(b) GDPR. In this case, your data is passed on exclusively for the purpose of payment processing with the provider and only insofar as it is necessary for this purpose.

You can object to this processing of your data at any time by sending us a message or by contacting the provider. However, the provider may still be entitled to process your personal data if this is necessary for contractual payment processing.

7.3 Management of Orders and Activation Codes (Supabase)

After payment, Stripe transmits the order data (name, email address, billing address, product purchased, amount, payment method, order number) to our database at Supabase (Supabase, Inc., USA, as processor; database instance in the EU, Frankfurt am Main). Your activation code is generated there and linked to the order so that you can redeem it in the app and we can prove the order. The legal basis is Art. 6(1)(b) GDPR (performance of contract) and Art. 6(1)(c) GDPR (tax retention obligations). Where data may be transferred to the USA, this is based on EU Standard Contractual Clauses (Art. 46(2)(c) GDPR). Further information: supabase.com/privacy

7.4 Sending the Code Email (Resend)

We send you your activation code and the contract confirmation by email via the delivery service Resend (Resend, Inc., USA) as processor. For this purpose, your name, email address and the content of the email are transmitted to Resend. A blind copy (BCC) of each code email is sent to us so that we can prove delivery. The legal basis is Art. 6(1)(b) GDPR; for the blind copy additionally Art. 6(1)(f) GDPR (our legitimate interest in proving performance). Resend is certified under the EU-US Data Privacy Framework; EU Standard Contractual Clauses have also been agreed. According to Resend, sending logs and email content are stored for 30 days. Further information: resend.com/legal/privacy-policy

7.5 Online Withdrawal

If you declare a withdrawal using the "Withdraw from contract" button, we process the data you enter (name, email address, contract details, optional note) as well as the date and time of receipt in order to process your withdrawal and to send you the legally required confirmation of receipt. The declaration is received by a function at Supabase (see 7.3) and confirmed to you via Resend (see 7.4); a blind copy is sent to us. To prevent abuse, your IP address is briefly stored only in hashed, non-reversible form for rate limiting. The legal basis is Art. 6(1)(c) GDPR in conjunction with section 356a BGB and Art. 6(1)(f) GDPR (abuse prevention).

8) Rights of the Data Subject

8.1 The applicable data protection law grants you the following data subject rights (rights of access and intervention) vis-à-vis the controller with regard to the processing of your personal data, whereby the respective legal basis for the exercise conditions is referenced:

8.2 RIGHT TO OBJECT

IF WE PROCESS YOUR PERSONAL DATA ON THE BASIS OF OUR OVERRIDING LEGITIMATE INTEREST WITHIN THE FRAMEWORK OF A BALANCING OF INTERESTS, YOU HAVE THE RIGHT AT ANY TIME TO OBJECT TO THIS PROCESSING WITH EFFECT FOR THE FUTURE ON GROUNDS RELATING TO YOUR PARTICULAR SITUATION.

IF YOU EXERCISE YOUR RIGHT TO OBJECT, WE WILL CEASE PROCESSING THE DATA CONCERNED. HOWEVER, FURTHER PROCESSING REMAINS RESERVED IF WE CAN DEMONSTRATE COMPELLING LEGITIMATE GROUNDS FOR THE PROCESSING WHICH OVERRIDE YOUR INTERESTS, FUNDAMENTAL RIGHTS AND FREEDOMS, OR IF THE PROCESSING SERVES THE ESTABLISHMENT, EXERCISE OR DEFENCE OF LEGAL CLAIMS.

IF YOUR PERSONAL DATA IS PROCESSED BY US FOR THE PURPOSE OF DIRECT MARKETING, YOU HAVE THE RIGHT TO OBJECT AT ANY TIME TO THE PROCESSING OF PERSONAL DATA CONCERNING YOU FOR THE PURPOSE OF SUCH MARKETING. YOU MAY EXERCISE THE OBJECTION AS DESCRIBED ABOVE.

IF YOU EXERCISE YOUR RIGHT TO OBJECT, WE WILL CEASE PROCESSING THE DATA CONCERNED FOR DIRECT MARKETING PURPOSES.

9) Duration of Storage of Personal Data

The duration of storage of personal data is determined by the respective legal basis, the processing purpose and, if applicable, additionally by the respective statutory retention period (e.g. commercial and tax retention periods).

When processing personal data on the basis of express consent pursuant to Art. 6(1)(a) GDPR, the data concerned is stored until you revoke your consent.

If statutory retention periods exist for data that is processed within the scope of legal or quasi-legal obligations on the basis of Art. 6(1)(b) GDPR, this data is routinely deleted after the retention periods have expired, provided that it is no longer necessary for the fulfilment or initiation of a contract and/or there is no legitimate interest on our part in the continued storage.

When processing personal data on the basis of Art. 6(1)(f) GDPR, this data is stored until you exercise your right to object pursuant to Art. 21(1) GDPR, unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims.

When processing personal data for the purpose of direct marketing on the basis of Art. 6(1)(f) GDPR, this data is stored until you exercise your right to object pursuant to Art. 21(2) GDPR.

Unless otherwise stated in the other information in this statement regarding specific processing situations, stored personal data will otherwise be deleted when it is no longer necessary for the purposes for which it was collected or otherwise processed.

The following specific retention periods apply:

Last updated: 22 October 2026