Privacy Policy

As of: July 2026

Protecting your personal data is a priority. We only process personal data in accordance with applicable law, including the GDPR (EU 2016/679) and the German TDDDG.

The sections below summarize key data processing activities on this website.

1 | Data Controller

Maximilian Braun
Burgstallgasse 10
93309 Kelheim
Germany
E-Mail: info@everythingvc.eu

2 | Hosting

Our website is hosted by Hostinger International Ltd., 61 Lordou Vironos str., 6023 Larnaca, Cyprus. When you visit our site, the webserver automatically collects some technical data in server log files:

IP address
Date and time of access
Requested file name
Transferred data volume
Request status
Browser type and version
Operating system
Referrer URL

This data is used for technical monitoring, stability and security (Art. 6(1)(f) GDPR) and is deleted automatically after at most seven days.

3 | Technically necessary storage

The public website does not use analytics or marketing cookies. Restricted administrative features may use cookies or equivalent browser storage where this is necessary to maintain a secure sign-in session and provide the requested functionality.

This storage is used only for authentication, session continuity and security. Access to or storage of information on a device is based on Section 25(2) TDDDG where it is strictly necessary. Related personal-data processing is based on Article 6(1)(f) GDPR.

4 | Contact form

If you use the contact form, we store the information you submit (name, email address and message) to process your request.

We use Hostinger's email service to notify our editorial team about new contact requests. The submitted contact-form data is transmitted through the configured SMTP mailbox only for this purpose.

Legal basis is Article 6(1)(b) GDPR (pre-contractual measures) or Article 6(1)(f) GDPR (legitimate interest).

We do not share the data without your consent and delete it when no longer needed.

5 | Email briefings

If you subscribe to EverythingVC briefings, we process your email address, signup source, consent-policy version and the times when you requested and confirmed the subscription.

We use a double opt-in process. The first email only asks you to confirm your address. Briefings begin after you click the confirmation link. Confirmation links expire after 48 hours. We do not store the IP address used to submit the signup form.

Our configured email service transmits the confirmation and subsequent briefings. The legal basis is your consent under Article 6(1)(a) GDPR and Section 7(2) UWG. You can withdraw your consent at any time using the unsubscribe link in a briefing or by contacting us. Withdrawal does not affect processing carried out before it.

6 | Database and media storage (Supabase)

Content and media files are stored using Supabase Inc., 970 Toa Payoh North #07-04, Singapore 318992. Database and object storage traffic is always encrypted.

We do not store regular visitor personal data in Supabase unless you submit it via a form.

The legal basis is Article 6(1)(f) GDPR (legitimate interests in secure, efficient site operations).

7 | Administrative access

Authorized team members can sign in to restricted administration features through Payload.

In this process, we process:

Email address and credentials (passwords are stored encrypted)
Authorization role
Session and security information

Processing is necessary to secure and operate restricted administrative features. Legal basis is Article 6(1)(f) GDPR. Access is provisioned internally; there is no public registration.

8 | Your rights

You can request:

access to your data
correction of inaccurate data
erasure
restriction of processing
data portability
an objection to processing
withdrawal of consent

If you believe your data is being processed unlawfully, you may file a complaint with the relevant supervisory authority.

9 | Policy updates

We may update this policy when needed, including for legal changes or when new tools are introduced.