English translation for convenience. The German version is legally binding.

Privacy policy

1. Controller

Anonyfox e. K.
Inhaber: Maximilian Stroh
Zehntland 2d
21079 Hamburg
Deutschland
Email: [email protected] or [email protected]

No data protection officer has been appointed, as there is no statutory obligation to do so.

2. Hosting (DigitalOcean, Frankfurt)

This website runs on a server of DigitalOcean, LLC, 105 Edgewater Place, New York, NY 10014, USA, in the Frankfurt am Main (Germany) data centre. A data processing agreement is in place with DigitalOcean (Art. 28 GDPR). Access from the USA cannot be ruled out; transfers are based on the EU-US Data Privacy Framework or EU Standard Contractual Clauses, as applicable. Legal basis: Art. 6(1)(f) GDPR (secure, efficient operation).

3. Cloudflare (CDN, security)

Access takes place through the network of Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA. Cloudflare terminates the HTTPS connection, protects against attacks and forwards requests to our server. In doing so, Cloudflare processes IP addresses, request data and technical metadata. Cloudflare is certified under the EU-US Data Privacy Framework; Standard Contractual Clauses and a data processing agreement also apply. Legal basis: Art. 6(1)(f) GDPR (security and availability).

3a. Cloudflare Web Analytics (audience measurement)

For audience measurement, we use Cloudflare Web Analytics from Cloudflare, Inc. (101 Townsend St., San Francisco, CA 94107, USA) as a processor. A small script from static.cloudflareinsights.com is loaded when a page is accessed. It sets no cookies and uses no local storage. Only aggregated usage data such as page views, referrers, browser and device types and loading times are collected. There is no cross-website tracking and no creation of personal user profiles. The legal basis is our legitimate interest in analysing and improving our offering (Art. 6(1)(f) GDPR). For any transfer to the USA, Cloudflare relies on the EU-US Data Privacy Framework and Standard Contractual Clauses.

4. Server log files

Whenever a page is accessed, our web server (Caddy) automatically stores: the visitor’s IP address (transmitted by Cloudflare), date and time, URL accessed, HTTP status, volume of data transferred, referrer and user agent. Purpose: operation, error analysis and prevention of misuse. Legal basis: Art. 6(1)(f) GDPR. Logs are deleted after no more than 14 days unless they are needed to investigate a security incident. We do not use cookies or tracking.

5. Waiting list (e.g. /agent-kit/)

If you join a waiting list, we store: email address, selected interest (e.g. “kit”, “review” or “both”), time of registration, and IP address and user agent (as evidence of registration and to prevent misuse). Purpose: a one-off notification when the relevant offering launches. Legal basis: your consent, Art. 6(1)(a) GDPR; for IP address/user agent, Art. 6(1)(f) GDPR. The data are held in a database on our server in Frankfurt and are not sold or shared. You may withdraw consent at any time by email; the data will then be deleted, and in any event no later than 12 months after the end of the experiment.

5a. Hospitality Check and enquiry form (/gastro-check/)

The self-check runs in your browser. At the start and on completion, we send an anonymous count (event, score achieved, answer pattern, campaign code from the URL if applicable) to our server, without an IP address, without cookies and without any link to a person. Purpose: measuring how often the check is used. Legal basis: Art. 6(1)(f) GDPR.

If you use the “Automation in 72h” enquiry form, we store your email address, optionally your business and message, your score, the time, and IP address and user agent (to prevent misuse). Purpose: responding to your enquiry. Legal basis: consent, Art. 6(1)(a) and (b) GDPR (pre-contractual measures); for IP address/user agent, Art. 6(1)(f) GDPR. Stored on our server in Frankfurt, without sharing. Deletion on request by email, and no later than 12 months after the last communication if no contract is concluded.

5b. Personalised astrology reports (/venus/, /jahr-2027/, /horoskop-roast/, /venus-sternpunkt/, /doppel-ruecklaeufig/, /situationship-horoskop/, /scorpio-haus-umbau/)

If you order a personalised report (e.g. Venus retrograde or the 2027 annual outlook), we process the birth details you provide at the Stripe checkout (date of birth, optionally time of birth, place of birth), the first name requested for the cover, and your contact details from checkout. Purpose: creating and sending the PDF report ordered. Legal basis: Art. 6(1)(b) GDPR (performance of the contract). Birth details are deleted after fulfilment, no later than 30 days after delivery, unless tax or commercial-law retention obligations for order/invoice data prevent this (these are retained for up to 10 years under § 147 AO / § 257 HGB). Stripe Payments Europe, Ltd. is the payment service provider (see section 6). Birth details are not shared with third parties for advertising purposes.

Free check /scorpio-haus-check/: Your selection of ascendant is evaluated only in your browser. There are no input fields, no storage and no counting of the selection. If you use “Share result”, the link contains only the name of the sign.

5c. Rent Index Check and CO2 Cost Allocation (/mietenspiegel-check/, /co2-kostenaufteilung/)

Residential location query: If you click “Look up residential location” on /mietenspiegel-check/ or /wohnlage-finder/, your browser loads the residential location list for the street entered from our server (one file per street code from the Hamburg residential location register). The house number is evaluated only in your browser. Our server logs can therefore identify at most the street; we delete the logs after no more than 14 days. The query takes place only when you click; the legal basis is Art. 6(1)(a) and (b) GDPR (your request or a pre-contractual measure, as applicable). The other inputs (area, year of construction, amenities, rent or CO2 values) are processed only in your browser until you order.

Order: When you click “Order”, your details are passed to Stripe Checkout as a short order code (street code, house number, area, year of construction, rent, amenities or CO2 quantity, area, costs and period) (section 6). At checkout you also enter the address of the apartment or building. We use these data exclusively to create and deliver the report (Art. 6(1)(b) GDPR). We delete the order code, details and report no later than 30 days after delivery. Invoice data that we are required to retain are excepted (section 6).

5d. Hamburg Regulation Check (/regulierungs-check-hamburg/)

Address search: When you click “Check”, your browser sends the street and house number directly to the address service of the Free and Hanseatic City of Hamburg (Landesbetrieb Geoinformation und Vermessung, api.hamburg.de). This service also receives your IP address. We do not receive this query. Your browser then loads area data and a map tile for the surroundings of the address (approx. 1 × 1 km) from our server. The tile request identifies only the approximate area in our server logs, not the address; we delete the logs after no more than 14 days. If you use “Copy link”, the address is included in the link URL; anyone opening the link sends it to the city’s address service again. The details about the number of apartments and the proposed project are processed only in your browser until you order. The legal basis is Art. 6(1)(a) and (b) GDPR (your request or a pre-contractual measure, as applicable).

Order: When you click “Order”, the street code, house number, coordinate of the address point, number of apartments and your questionnaire answers are passed to Stripe Checkout as a short order code (section 6). At checkout you enter the address and number of apartments again for verification. To create the checklist, we query the address again using the city’s address service. We use these data exclusively to create and deliver the checklist (Art. 6(1)(b) GDPR) and delete the order code, details and checklist no later than 30 days after delivery. Invoice data are excepted (section 6).

5e. AI Visibility Quick Check (/ki-check/)

If you have a website address checked, we process that address and retrieve the robots.txt, llms.txt, sitemap and specified page from the specified server (Art. 6(1)(b) and (f) GDPR; legitimate interest: providing the requested check result). Our retrieval program identifies itself as “AnonyfoxLabKICheck/1.0” and respects robots.txt. Results are cached in memory for up to 10 minutes. Only anonymous statistics (shortened hash of the hostname, top-level domain, check values) are stored permanently, neither the address in plain text nor your IP address. To prevent misuse, we count requests per IP address in memory for no more than 1 minute. If you share a result link, the checked address is part of the URL and appears in the server log files (see section 4). Please do not enter addresses containing personal data or access keys.

5f. AI Visibility: Audit, Schema Package, Sample, Agency Package (/ki-sichtbarkeit/)

When you order an offering on /ki-sichtbarkeit/, we store the domains, questions, competitors and agency name entered at checkout, the order data from Stripe (name, email, address, payment status) and the report created. Basis: performance of the contract (Art. 6(1)(b) GDPR). Our crawler “AnonyfoxLabKIAudit/1.0” retrieves only publicly accessible pages and respects robots.txt. We delete report data and order documents no later than 30 days after the last delivery (for the Complete Package, after the 30-day recheck; for the Agency Package, after the six-month period for additional domains has expired); statutory invoice retention obligations remain unaffected. Stripe details: section 6.

5g. Schema & llms.txt Package, AI Visibility Sample, AI Visibility Complete, Agency Package

For these orders, we store the domains, questions (prompts), competitor names and, for the Agency Package, agency name entered at checkout, as well as the order data from Stripe (name, email, address, payment status) and the reports created. Basis: performance of the contract (Art. 6(1)(b) GDPR). Our crawler retrieves only publicly accessible pages and respects robots.txt. For the AI Visibility Sample, our AI agent runs the questions as web searches; the questions, but not your contact details, are transmitted to the agent’s search service. For the 30-day recheck, we store the domain and due date until the recheck is delivered. We delete report data no later than 30 days after the last delivery; statutory invoice retention obligations remain unaffected.

5e. Pillar 3a Catch-up Contribution Check (/saeule-3a-check/)

Free check: Your details (pension fund, AHV income, income, contributions, withdrawal) are evaluated only in your browser. There is no storage and no transmission to us.

Ordering the sequence sheet: When you click “Personal sequence sheet”, your details are passed to Stripe Checkout as a short order code (section 6); at checkout you may optionally enter a name for the cover. We use these data exclusively to create and deliver the PDF (Art. 6(1)(b) GDPR) and delete the order code, details and PDF no later than 30 days after delivery. Invoice data are excepted (section 6).

5h. Ski weekend in Austria (/oesterreich-ski-check/)

Free check: Starting location, ski resort, travel dates, country of vehicle registration, purchase channel and equipment are processed exclusively in your browser. No external service is queried, inputs are neither stored nor counted, and inputs do not appear in the page URL. We take your date only from your device’s clock to calculate deadlines (e.g. 18 days).

Order: When you click “Order travel sheet”, the starting location, ski resort, travel route, arrival and departure dates, country of vehicle registration (not the registration number itself), purchase channel and your details on tyres, chains, four-wheel drive, local motorway use and a trip to Switzerland are passed to Stripe Checkout as a short order code (section 6). We use these details exclusively to create the travel sheet and deliver it by email (Art. 6(1)(b) GDPR) and delete the order code, details and travel sheet no later than 30 days after delivery. Invoice data are excepted (section 6).

5i. Newsletters “lfm notes” and “lfr notes” (news.lfm.cash, news.lfr.email)

The controller for the two English-language newsletters “lfm notes” (news.lfm.cash) and “lfr notes” (news.lfr.email) is Maximilian Stroh as owner of Anonyfox e. K. (address in section 1 and the imprint).

When you sign up, we store your email address, the time of signup and of confirmation, and the IP address at signup and at confirmation, plus browser user agent, signup source and bounce status. Signup uses double opt-in: you only receive the newsletter after clicking the link in the confirmation email. The legal basis for sending is your consent (Art. 6(1)(a) GDPR). We keep the times and IP addresses as proof of consent (Art. 7(1) GDPR); the legal basis for this is Art. 6(1)(c) and (f) GDPR (accountability and defence against claims).

The newsletters run on our own mail server (lfr) on our DigitalOcean server in the Frankfurt am Main data centre (section 2). Outgoing emails are delivered through the EU servers of SMTP2GO (Sand Dune Mail Ltd, 96-106 Manchester Street, Christchurch 8011, New Zealand). DigitalOcean and SMTP2GO are our processors (Art. 28 GDPR). New Zealand is covered by an adequacy decision of the European Commission (Art. 45 GDPR). We do not track opens or clicks.

Every issue contains a one-click unsubscribe link. We keep proof of consent and opt-out until you request deletion; send logs and bounce data are deleted automatically after at most 400 days; on request we delete everything, and only a hash of your address remains as a block list. You can withdraw your consent at any time with effect for the future, via the unsubscribe link or by email to [email protected], [email protected] or [email protected]. Send access and other requests about your data there as well (section 8).

6. Payments through Stripe Checkout

For purchases, we use Stripe Checkout from Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Dublin 2, Ireland. Payment data are entered directly on Stripe’s pages; we do not receive full card or account details. Stripe processes name, email, billing address, payment data, IP address and device information for payment processing and fraud prevention and acts partly as an independent controller for this; transfers to Stripe, Inc. (USA) are based on the EU-US Data Privacy Framework or Standard Contractual Clauses, as applicable. We receive order, contact and invoice data from Stripe. Legal basis: Art. 6(1)(b) GDPR (performance of the contract) and Art. 6(1)(c) GDPR (tax and commercial-law retention obligations, up to 10 years under § 147 AO, § 257 HGB). Privacy information: stripe.com/de/privacy.

7. Contact by email

If you write to [email protected] or to the project mailbox [email protected], we process your email address, content and metadata to handle your request. Messages to the project mailbox are stored with an external email service provider and may be processed using automated or AI-assisted tools on behalf of the controller. Legal basis: Art. 6(1)(b) GDPR (contract-related enquiries) or Art. 6(1)(f) GDPR (other enquiries), as applicable. Deletion takes place once the enquiry has been resolved and no retention obligations apply.

8. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16 GDPR), erasure (Art. 17 GDPR), restriction (Art. 18 GDPR), data portability (Art. 20 GDPR) and objection (Art. 21 GDPR), and the right to withdraw consent with effect for the future (Art. 7(3) GDPR). You may lodge a complaint with a supervisory authority, e.g. the Hamburg Commissioner for Data Protection and Freedom of Information, Ludwig-Erhard-Str. 22, 20459 Hamburg.

9. No automated decision-making

No automated decision-making, including profiling (Art. 22 GDPR), takes place.