Datenschutz

Who is responsible

This policy explains how personal data is processed when you visit tales-by-xero.com or contact Tales by Xero. The controller under the General Data Protection Regulation (GDPR) is:

Email: [email protected]. You can also use the contact form for privacy questions and requests.

Hosting and delivery

The website is hosted and delivered through Cloudflare Pages, a service of Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA. Cloudflare receives technical request data, including your IP address, requested URL, access time, browser and operating-system information, and response and traffic data. This is needed to deliver the website, maintain availability, and detect abuse.

The legal basis is Article 6(1)(f) GDPR. My legitimate interest is a secure, reliable website. Request and security logs may be retained by Cloudflare for operating the service, investigating incidents, and meeting legal obligations. The retention period depends on the relevant data and service; Cloudflare describes the criteria in its privacy policy.

Images and fonts are served through this website. The fonts are locally hosted; viewing them does not require a request to Google Fonts.

Cloudflare privacy policy · Cloudflare data processing terms

Visitor statistics

I use GoatCounter to understand which pages and products are useful to visitors. The hosted service is operated by Martin Tournoij in Ireland, with data hosted at Hetzner in Finland and Germany.

The integration records page paths and counts of product opens, image previews, and DriveThruRPG product-link clicks. The referring website is reduced to its origin. URL query parameters and screen dimensions are removed from the submitted payload. Contact-form contents are not sent to GoatCounter. Statistics are only enabled on the production domain; the legal pages themselves do not load GoatCounter.

The service also derives browser, operating-system, language, and approximate location statistics from request information. According to GoatCounter, IP addresses and full User-Agent headers are not stored in its database. For repeat-visit counting, a mapping based on the site, IP address, and User-Agent is kept in memory for up to eight hours. GoatCounter can also retain individual pageview records if that option is enabled in the account. The service does not store tracking cookies or identifiers on your device.

To the extent personal data is processed, the legal basis is Article 6(1)(f) GDPR. My legitimate interest is limited usage measurement to improve the website. You can object to this processing and disable future statistics for this browser below. The preference is stored locally and takes effect when you next navigate to the website. Clearing the site's browser storage removes it.

GoatCounter privacy policy

Local settings

The website stores the animation setting in your browser's Local Storage under tbx:motion. It remembers whether animations are paused or playing. The statistics opt-out is stored under skipgc. These values remain until changed or removed through your browser's site-data settings. They do not contain your name, email, or message.

These settings support the display and privacy choices you request. Device access needed to remember those choices is based on Section 25(2)(2) TDDDG; any associated personal-data processing is based on Article 6(1)(f) GDPR, with the legitimate interest of respecting your settings. You can use the site if storage is blocked, but settings may not persist.

The website does not embed advertising, social-media widgets, or an external CAPTCHA script. Cloudflare may use security cookies when serving a security challenge; those are separate from the website's local settings.

Contact messages

When you use the contact form, I process your email address, subject, message, and any optional name or nickname. Providing this information is voluntary. Email, subject, and message are required to submit the form and handle your request; a name is not required.

The form submits directly to Formspree, Inc., USA. Formspree receives and processes the submission to deliver it and prevent spam. It also receives technical information such as IP address, browser type, access time, and referring address. A hidden honeypot field helps identify automated submissions. Formspree receives the message only when you submit; typing does not send your text to the service.

When a submission redirects you to a Formspree-hosted page, for example during the no-JavaScript submission flow, that page is operated by Formspree and may include its own cookies or a CAPTCHA depending on the form settings. Its privacy policy applies to that page.

Messages are forwarded to [email protected]. The mailbox is provided through Microsoft Outlook. Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland, and Microsoft Corporation, One Microsoft Way, Redmond, WA 98052, USA, process message content, addresses, delivery information, and security data for email delivery and storage. Sending an email directly bypasses Formspree, but still uses the email providers involved in delivery.

Requests related to a contract or steps you ask me to take before a contract are processed under Article 6(1)(b) GDPR. Other messages and spam prevention are processed under Article 6(1)(f) GDPR; my legitimate interests are responding to inquiries and protecting the contact channel from abuse. Your message is not used to subscribe you to a newsletter.

Formspree privacy policy · Microsoft privacy statement

International processing

Cloudflare and Microsoft use international infrastructure, including the United States. Their published policies describe participation in the EU-U.S. Data Privacy Framework for covered transfers under Article 45 GDPR and, where applicable, Standard Contractual Clauses under Article 46 GDPR. The policies linked above explain the relevant scope and safeguards.

Formspree states that it processes data in the United States and other countries where it operates. Its publicly available privacy policy does not identify a specific transfer safeguard for this form. For details about the applicable arrangements, or a copy of any applicable contractual safeguards, please contact me at [email protected].

How long data is kept

Contact messages are kept for handling the request and any necessary follow-up. They are deleted when no longer needed, unless statutory retention duties or the establishment, exercise, or defense of legal claims require longer storage. Those duties are based on Article 6(1)(c) GDPR; keeping evidence for legal claims is based on Article 6(1)(f) GDPR.

Copies can exist in the Formspree account, my Outlook mailbox, and service backups. Formspree's published policy uses purpose-based retention criteria rather than a single fixed period for all submissions. Microsoft states that Outlook items can remain in its systems for up to 30 days after the Deleted Items folder is emptied, unless longer retention is legally required.

GoatCounter's temporary repeat-visit mapping expires within eight hours. Retained statistics remain until deleted in the account; according to the provider, deleted account data can remain in backups for up to 30 days. Irreversibly anonymous aggregate statistics are not subject to GDPR deletion rights.

External links

DriveThruRPG and Ko-fi are linked as external websites. They are not embedded as shop or payment widgets. Following a link opens the relevant provider's website, where its privacy information applies. Purchases and support payments are handled there; this website does not collect payment details.

Your rights

Subject to the conditions in the GDPR, you can request access (Article 15), correction (Article 16), erasure (Article 17), restriction (Article 18), and data portability (Article 20). Where processing relies on consent, you can withdraw it at any time without affecting earlier lawful processing.

You can object under Article 21 GDPR, on grounds relating to your particular situation, to processing based on Article 6(1)(f). I will stop that processing unless compelling legitimate grounds override your interests and rights, or the data is needed for legal claims. Contact [email protected] to exercise these rights.

You can lodge a complaint with a data protection supervisory authority under Article 77 GDPR, particularly where you live, work, or where an alleged infringement occurred. The authority responsible for my location is the Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW), Postfach 20 04 44, 40102 Düsseldorf. LDI NRW complaint information.

I do not make decisions producing legal or similarly significant effects about you solely through automated processing under Article 22 GDPR.