Privacy Policy

This page is available in English and German.

Privacy Policy

Status: August 2025
Last updated: Augst 2025
Languages: The German version is the legally binding version. This English version is additionally available.*

This privacy policy informs you pursuant to Articles 13, 14 GDPR and Sections 25 et seq. TTDSG about how personal data is processed when using our website Time Money Code (operated by Alexander Holz), our blog, as well as associated web applications.

1. Controller

Time Money Code – Alexander Holz
c/o Online-Impressum.de #30635
Europaring 90
53757 Sankt Augustin
Germany
Email: timemoneycode@gmail.com

2. Scope

This privacy policy applies to all content and services on https://timemoneycode.vercel.app, including the blog, SaaS platform, web applications and any form of interaction.

3. Categories of Processed Data

Depending on purpose and your use, we process the following categories of personal data:

  • Name, email address (e.g., during registration, newsletter subscription)
  • Password (stored encrypted; never in plain text)
  • Usage data (e.g., visited pages, login times)
  • Payment data (via LemonSqueezy)
  • Data from the contact form (see Section 10)
  • IP address, browser and device data
  • Other data provided actively (e.g., profile information, feedback)

Note on email addresses:
The processing of your email address is based on the following legal grounds depending on the processing purpose:

  • Art. 6(1)(b) GDPR (contract/registration),
  • Art. 6(1)(a) GDPR (consent for newsletter),
  • Art. 6(1)(f) GDPR (legitimate interest, e.g. support requests).

4. Purposes, Legal Bases for Processing and Legitimate Interests

Purpose Legal Basis Legitimate Interest / Note
Contract performance (SaaS platform, blog access) Art. 6(1)(b) GDPR —
Support, error correction, maintenance Art. 6(1)(f) GDPR IT security, service quality, user support
Analysis and improvement of our offering Art. 6(1)(a) GDPR (consent) —
Email communication (newsletter, contact requests) Art. 6(1)(a)/(b) GDPR —
Use of cookies/tracking/device access Section 25 TTDSG, Art. 6 GDPR (only with consent) Operation/optimization of service
Legal obligations (e.g., tax retention laws) Art. 6(1)(c) GDPR —

TTDSG note:
Any access to information on end devices (e.g., cookies, local storage, device fingerprinting) is based on § 25 (1) TTDSG (with consent) or § 25 (2) TTDSG (if technically necessary for operation).

5. Hosting & Infrastructure

Our website and platform are hosted and operated by the following service providers:

  • Vercel Inc. (USA/EU): Frontend hosting (partial own responsibility, e.g. server error logs; details at vercel.com/legal/privacy-policy)
  • Render.com: Server hosting
  • Supabase Inc. (USA/EU): Backend, authentication, database
  • Buttondown LLC (USA): Newsletter delivery and management (buttondown.email/legal/privacy)

Data Processor / Joint Controller:
We have data processing agreements (DPAs) pursuant to Art. 28 GDPR with all providers where required. Some services, such as Google Analytics and Microsoft Clarity, may involve joint controllership under Art. 26 GDPR. Detailed information and copies of contracts are available upon request.

Data transfers to third countries:
Personal data may be transferred to servers in third countries, mainly the USA. Transfers occur exclusively based on appropriate safeguards such as the EU Standard Contractual Clauses (Art. 46 GDPR) and technical and organizational measures (e.g. encryption, data minimization).
Note: The data protection level in the USA does not fully correspond to that in the EU, and access by US authorities cannot be completely excluded.

6. Payments

Payment processing is conducted exclusively by LemonSqueezy LLC (USA). The following data is processed:

  • Name, email, billing address
  • Payment data (credit card, other payment methods depending on selection)

The sharing of data with LemonSqueezy and payment service providers is for contract fulfillment (Art. 6(1)(b) GDPR) and to comply with legal obligations.
Data transfers to the USA occur based on the EU Standard Contractual Clauses (Art. 46 GDPR).

7. Analytics & Tracking

We use analytics and tracking services only with your explicit consent. These services include:

Name Provider Purpose Retention Period Category
Google Analytics Google Ireland Ltd. Web analytics 2–24 months Statistics
Microsoft Clarity Microsoft Session recording 1 month Statistics

Google Analytics and Microsoft Clarity partly operate under a joint controllership pursuant to Art. 26 GDPR. They pursue some own purposes, for which agreements have been made.

A detailed list of tracking technologies and cookies, including retention periods and providers, is available anytime via the "Cookie Settings" link in the footer (managed via tarteaucitron.js).

8. Embedded Third-Party Content

We embed the following content only after your explicit consent via a two-click solution:

  • YouTube videos (Google Ireland Ltd.)
  • Google Maps (Google Ireland Ltd.)

After loading these contents, personal data is transmitted to the respective operators. Their privacy policies can be found on their websites. We have no influence on their data processing.

The legal basis for processing is Art. 6(1)(a) GDPR and Section 25 TTDSG (consent).

Note: After clicking the respective button and loading the content, the third party’s privacy policy applies.

9. Social Sharing

Our website includes share buttons for:

  • Twitter/X
  • Facebook
  • LinkedIn
  • WhatsApp
  • Email

These buttons are simple links. Only when you click a link can the respective provider collect personal data.
From that moment on, the provider’s privacy policy applies and we bear no responsibility.

10. Contact Form / Contact

When you use our contact form or send emails, we process:

  • Name
  • Email address
  • Message content
  • IP address

Purpose: Solely to handle your inquiry (Art. 6(1)(b) GDPR).
Retention: Max. 12 months after completion or until deletion upon your request.

Note: Processing is not possible without a valid email address.

11. Administrator Access

Administrator access is only permitted for support or troubleshooting on:

  • Login and session data
  • User-generated content (for troubleshooting)
  • Error logs

All accesses are logged and restricted to the minimum necessary.
Legal basis: Art. 6(1)(f) GDPR (legitimate interest).

12. Newsletter

For newsletter dispatch, we use Buttondown LLC (USA) employing a double opt-in procedure. The following data is collected and stored:

  • Email address (mandatory)
  • Name (optional)
  • Date/time of registration and confirmation
  • IP address
  • Technical dispatch data

Data is stored on servers in the USA and subject to the EU Standard Contractual Clauses (Art. 46 GDPR). A data processing agreement (Art. 28 GDPR) exists.

Tracking: Opening and click rates are only recorded with explicit consent.

Unsubscription: Possible at any time via a link in each email.

Legal basis: Art. 6(1)(a) GDPR (consent).
Objection: You may object to advertising emails at any time (Art. 21 GDPR).

Further info: buttondown.email/legal/privacy

13. Cookies / Consent Management (tarteaucitron.js)

We use the consent management tool tarteaucitron.js to obtain, manage, and document your consents pursuant to TTDSG and GDPR.

  • Essential cookies: Active without consent if technically necessary (§ 25(2) TTDSG, Art. 6(1)(f) GDPR).
  • Optional cookies/trackers: Activated only with explicit consent (§ 25(1) TTDSG, Art. 6(1)(a) GDPR).

A complete list of all cookies used, including their purpose, provider, category, and retention period, is accessible at any time via the "Cookie Settings" link in the footer. You may revoke or adjust your consent there.

14. Retention and Deletion

Personal data is retained only as long as necessary for the intended purpose or as required by law.

Category Retention Period
Account and profile data Until account deletion, max. 3 months
Newsletter data Until consent withdrawal, deleted at latest after 7 days
Contact and support data Max. 12 months
Analytics data Max. 24 months (pseudonymized/anonymized)
Payment data Up to 10 years (tax retention periods)
Error logs 30 days

Data is deleted or anonymized after expiration.

15. Processors & (Joint) Controllers

We have concluded data processing agreements (DPAs) pursuant to Art. 28 GDPR with all service providers processing data on our behalf (e.g., Supabase, Render.com, LemonSqueezy, Buttondown).

For providers with own purposes or joint controllership (e.g., Google Analytics, Microsoft Clarity), corresponding agreements under Art. 26 GDPR are concluded or evident.

To clarify:

  • Google Analytics: Partial joint controllership + DPA under Art. 26 and 28 GDPR
  • Buttondown: DPA under Art. 28 GDPR
  • LemonSqueezy: DPA under Art. 28 GDPR

A current list of categories and transfer countries is available on request.

16. Security (Technical and Organizational Measures - TOMs)

We implement appropriate technical and organizational measures to protect data (Art. 32 GDPR):

  • SSL/TLS encryption of all data transmissions
  • Restricted access with role and rights management
  • Pseudonymization and data minimization according to state of the art
  • Privacy by design and default (Art. 25 GDPR)
  • Logging of critical system access
  • Regular backups, updates, and privacy training
  • Deletion and anonymization procedures according to retention periods (see Section 14)

17. Automated Decision-Making & Profiling

Currently, no automated decisions or profiling pursuant to Art. 22 GDPR are performed.
Should this change, you will be transparently informed, including about logic, significance, and consequences.

18. Applicant Data

(If applications are accepted; otherwise remove this section)
In case of job applications, we inform separately about the nature, purpose, and retention periods of processed data according to § 26 BDSG.

19. Privacy for Children

Our services are not directed at persons under 16 years of age. We do not knowingly collect data from children under 16.

20. Your Rights

You have the following rights:

  • Access (Art. 15 GDPR)
  • Rectification (Art. 16 GDPR)
  • Erasure (Art. 17 GDPR)
  • Restriction of processing (Art. 18 GDPR)
  • Data portability (Art. 20 GDPR)
  • Objection (Art. 21 GDPR, especially against direct marketing)
  • Withdrawal of consent (Art. 7(3) GDPR)

You are not obliged to provide data; however, without certain data, full contract performance or functionality may not be possible.

Right to complain:
You can complain to any data protection supervisory authority. The competent supervisory authority for us in Bavaria is:

Bavarian Data Protection Authority (BayLDA)
Promenade 18
91522 Ansbach
Germany
Website: https://www.lda.bayern.de
Email: poststelle@lda.bayern.de
Phone: +49 981 180093-0

Please contact us first, so we can respond to your concerns as promptly as possible.

21. Data Protection Officer

Currently, no data protection officer has been appointed as this is not legally required. Should this change, contact details will be provided here.

22. Changes

We reserve the right to amend this privacy policy as needed.

The currently valid and legally binding German version can be found at:
https://timemoneycode.vercel.app/privacy-policy.html

Questions or concerns?
You can reach us anytime at timemoneycode@gmail.com or the address listed in the imprint.

Only the German version of this privacy policy is legally binding. The English translation serves informational purposes only.