This policy explains what happens to your data on stopnerfing.com and stop-nerfing.com. We collect as little as possible. There are no cookies, no analytics, no tracking pixels and no third-party scripts or fonts on this site.
Controller
Björn Kindler, Kindler Web Services Bischofshofener Str. 9, 82008 Unterhaching, Germany E-mail: info@kindler-webservices.de Phone: +49 89 62083334
Visiting the site
The web server does not keep access logs for this site. Your browser’s IP address is processed only for the moment needed to deliver the pages.
Signing the letter
What we process. Your e-mail address (required). If you choose a public entry: your name as you enter it, optionally your country and a short comment. Whether you want campaign updates.
Why and on what basis. We use your e-mail address to confirm that you, the owner of the address, really want to sign (double opt-in), to prevent duplicate signatures and to count your signature. Your signature can reveal a political opinion. We therefore process it only with your explicit consent (Art. 6(1)(a) and Art. 9(2)(a) GDPR). Publishing your entry and sending updates are separate consents. You can give one without the other.
Confirmation. After you submit the form, we send one e-mail with a confirmation link. Nothing counts and nothing is published until you open the link and confirm. The confirmation page shows exactly what will be stored. Unconfirmed requests are deleted after 48 hours.
After confirmation. We delete your e-mail address in readable form and keep only a keyed fingerprint (HMAC) of it. The fingerprint lets us recognise duplicate signatures and find your entry if you ask us to delete it. It cannot be turned back into your address without our secret key. If you subscribed to updates, we keep your address until you unsubscribe.
Public entry. If you chose it, your name, country and comment appear on the list of signatories and in the hand-over to AI providers. Your e-mail address is never published and never handed over.
Moderation of comments. Names and comments are checked automatically for links, contact details and unlawful or abusive content. Comments that pass these checks appear after confirmation. Others stay hidden until we have reviewed them. For part of this check we send only the comment text to Mistral AI SAS, 15 rue des Halles, 75001 Paris, France, which classifies it. Mistral AI receives no name, address or other data and processes the text on our behalf under a data processing agreement. Legal basis: our legitimate interest in keeping the public list free of unlawful content (Art. 6(1)(f) GDPR).
How long. Signatures are kept until the campaign ends, at most 24 months after confirmation. Then they are deleted.
Protection against abuse
To stop bots and to prevent our form from being used to send e-mails to strangers, your browser solves a small computing task before the form is sent. We also limit the number of requests per network address. For this we store a keyed fingerprint of your IP address (for IPv6, of its network part) for at most 24 hours. Legal basis: our legitimate interest in a secure service that cannot be misused against third parties (Art. 6(1)(f) GDPR).
If an e-mail to an address bounces permanently or is reported as spam, we store a keyed fingerprint of that address so that it receives no further e-mails from us. This entry is deleted when the campaign ends, or earlier on request. Legal basis: Art. 6(1)(f) GDPR, protecting the recipient and our ability to deliver e-mail.
Service providers
- Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany: hosting of the website and the signature database in Germany.
- Scaleway SAS, 8 rue de la Ville l’Evêque, 75008 Paris, France: delivery of the confirmation e-mail. Scaleway processes your e-mail address and the e-mail content for delivery.
- Mistral AI SAS, Paris, France: classification of comment texts, as described above.
All providers process data within the European Union on our behalf under data processing agreements (Art. 28 GDPR). We do not transfer your data to countries outside the EU.
Deletion and backups
When you delete your signature, it is removed at once. Our database backups are kept for at most 30 days. A deletion record makes sure that a signature you deleted cannot reappear when a backup is restored. This record contains only a random internal ID of the deleted signature and the time of deletion, no e-mail address and no name. It is kept for 35 days on our server and in a separate backup storage at Hetzner in Germany, then deleted.
Your rights
You have the right to access, rectification, erasure, restriction of processing and data portability, and the right to object to processing based on legitimate interest (Art. 15 to 21 GDPR). You can withdraw any consent at any time with effect for the future.
The fastest way is the link in your confirmation e-mail: it lets you hide your public entry, stop updates or delete your signature. You can also write to info@kindler-webservices.de.
You have the right to lodge a complaint with a supervisory authority, for example the Bavarian Data Protection Authority (Bayerisches Landesamt für Datenschutzaufsicht, Promenade 18, 91522 Ansbach, Germany).