Privacy

Controller

Typhora Group LLC
33 N Gould St, Sheridan, WY 82801, USA
Represented by: Heinrich Songmin Berger (CEO)
Email: hey@henny.info

The representative in the Union within the meaning of Art. 27 GDPR — to the extent one is required by law — is Heinrich Songmin Berger, Barbarossaplatz 2, 50674 Cologne, Germany, hey@typhora.group.

Server logs

When you access the site, technical access data is stored in server logs (hosting: Hetzner Online GmbH, Germany): IP address, date and time, page requested, referring page (referrer) and user agent (browser/device). This data is technically required to deliver the site securely and additionally serves to defend against abuse and attacks and for a rough analysis of site traffic (Art. 6 (1) lit. f GDPR — legitimate interest). Access logs are automatically deleted after 14 days at the latest and are not merged with other data sources. They are shared with third parties only within the scope of the internally used analysis with support from Anthropic described below.

Cookies, statistics & reach measurement

This site uses Google Analytics 4 (provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland) to understand how the site is used. This happens solely on the basis of your consent (Art. 6 (1) lit. a GDPR), which you give in the cookie notice. Until you consent, Google Analytics runs in consent mode without cookies and without transmitting personal data. If you consent, cookies are set and usage data (pages visited, approximate region, device/browser) is processed; your IP address is anonymized. Data may be transferred to Google in the USA. Your consent is voluntary and can be withdrawn at any time for the future — via the “Cookies” link in the footer. You can optionally also consent to marketing cookies (e.g. Google Ads); without consent these stay off. In addition, this site uses its own cookie-free reach measurement (self-hosted, no sharing with third parties): for each page view only the requested path and the referring page (referrer) are counted. To roughly distinguish visitors, your IP address is processed solely into a daily-rotating, pseudonymous hash and is NOT stored in clear text. This minimal measurement sets no cookies; apart from the internal analysis described below, no data is shared with third parties. the processing of your IP address is based on legitimate interest (Art. 6 (1) lit. f GDPR) — therefore without consent. In addition, we process derived access characteristics in a tool accessible only internally, with support from Anthropic (Claude API). The following are transmitted to our processor Anthropic PBC / Anthropic Ireland Limited (USA/EU): network/provider identifier (ASN), country of origin, device type, a technical JavaScript characteristic, the number of visit days/sessions, and the page history (paths visited, referring page, timestamps). The IP address is masked for this purpose; it is not transmitted in clear text. The purpose is detecting abuse/automated access and technically understanding our traffic. The legal basis is our legitimate interest in security and analysis (Art. 6 (1) lit. f GDPR). The transfer to the USA is safeguarded by the Standard Contractual Clauses approved by the EU Commission (Art. 46 (2) lit. c GDPR), which are part of our data processing agreement with Anthropic. According to its own statements, Anthropic does not use these inputs to train its models by default and deletes them regularly within 30 days. You can object to this processing at any time for reasons arising from your particular situation (Art. 21 GDPR).

Fonts

The fonts EB Garamond and Inter are served locally from the server. No connection is made to Google Fonts or any other third party.

Video embeds

The portfolio pages (including Media Production and Acting) embed videos from YouTube. The privacy-enhanced mode (youtube-nocookie.com) is used. YouTube sets cookies and transmits data to Google only once a video is played. Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

Contact & newsletter

If you write to me via the contact form or by email, your details are stored to handle your request. If you subscribe to the newsletter or use the contact form, your IP address and the time are additionally stored — as proof of consent (double opt-in) and to defend against abuse (Art. 6 (1) lit. a and f GDPR). This information is visible only to the operator; I won't pass it on without your consent. You can withdraw the newsletter at any time via the unsubscribe link in every email.

System and newsletter emails are sent via the service provider Resend (operator: PLUS FIVE FIVE, San Francisco, USA), which processes the email address and dispatch data on my behalf. The transfer is based on the adequacy decision for the EU-US Data Privacy Framework (Art. 45 GDPR).

Shop, orders & payment

When you order goods in this site's shop, I process the data required to perform the contract — in particular your name, delivery and billing address, email address, and order and payment data (Art. 6 (1) lit. b GDPR). The shop runs on this site itself; payment is handled by Stripe (Stripe, Inc., USA). Card details are processed by Stripe alone and never reach this site. The goods are produced to order via the fulfilment provider Printful (Printful, Inc., USA) and shipped from the facility closest to the delivery address; the order and address data needed for production and shipping are transmitted to Printful for this purpose.

Personal data may be transferred to the USA (a third country); such transfer is based on the necessity for performance of the contract (Art. 49 (1) lit. b GDPR) or on the standard contractual clauses used by these providers.

Order and invoice data are stored for the duration of the statutory commercial and tax retention periods and deleted thereafter.

An account is created with your order, through which you can view your order status and history (Art. 6 (1) lit. b GDPR). The account can be deleted at any time by emailing hey@henny.info; statutory retention obligations remain unaffected.

If you declare a withdrawal via the withdrawal function, the declaration and the date and time of its receipt are stored and confirmed to you (§ 356a (4) BGB; Art. 6 (1) lit. b and c GDPR).

Your rights

You have the right to information, correction, deletion and restriction of the processing of your data, as well as the right to data portability and objection. You may also lodge a complaint with the supervisory authority.