1. Introduction

This Privacy Policy explains how Anastasia Berg (“I”, “me”, “my”) processes personal data in connection with the website hagstone-bramble.com, the web app Ember Grin (hagstone-bramble.com/ember-grin, also reached through embergrin.com) and my freelance services. Personal data is processed in accordance with the General Data Protection Regulation (GDPR), the German Federal Data Protection Act (BDSG) and the German Telecommunications Digital Services Data Protection Act (TDDDG).

2. Data Controller

The party responsible for data processing on this website is:

Anastasia Berg
Schaapkamp 10A
21147 Hamburg, Germany
Email: contact@hagstone-bramble.com
Phone: 040 3342 8008

3. Data Processing Activities

3.1 Client Inquiries and Project Work

When you contact me about a potential project or during a collaboration, I process your name, email address, company information and project-related communications. This is necessary for the performance of a contract or for pre-contractual measures (Article 6(1)(b) GDPR). This data is kept for six years after the project ends, as German commercial law requires (§257 HGB).

3.2 Invoicing and Tax Compliance

For invoicing I process your name, billing address, tax identification number where applicable, and payment information. This is necessary to meet my legal obligations under German tax law (Article 6(1)(c) GDPR). Invoices and related tax documents are kept for ten years, as required by §147 AO.

3.3 Website Hosting

This website and Ember Grin are hosted by STRATO GmbH, Otto-Ostrowski-Straße 7, 10249 Berlin, Germany. When you visit, your browser sends technical data that STRATO records in server logs: IP address, date and time, the page requested, the referring page, browser and operating system. This is needed to deliver the website and keep it secure, which is my legitimate interest (Article 6(1)(f) GDPR). Server logs are deleted automatically after seven days. A data processing agreement under Article 28 GDPR is in place with STRATO.

3.4 Site Security (WP Cerber)

To protect this website against attacks and spam I use WP Cerber, a security plugin for WordPress (Cerber Tech Inc.). It runs on this website’s server. It sets a few technical cookies with random names and random values that tell people apart from automated bots; they contain no personal data and are deleted after 24 hours. It also records login attempts and other security events, such as blocked requests, with IP address, date and time, the address requested and the browser, so that attacks can be recognised and blocked. Legal basis: my legitimate interest in a secure website (Article 6(1)(f) GDPR); the cookies are strictly necessary for it (§25(2) No. 2 TDDDG). These records are deleted after 90 days.

3.5 Cookies and Your Consent

Some features of this website store information in your browser. Anything that is not strictly necessary is only used once you agree to it in the privacy settings (“Cookie Settings”), which appear on your first visit. Nothing is pre-selected. You can change your choice at any time through the “Privacy settings” link in the footer.

The consent tool is Klaro, served from this website itself; no third party is contacted to show it. Your choice is kept in your browser’s local storage under the name “klaro-consent” for 365 days (or, if your browser blocks local storage, in a cookie of the same name), so you are not asked again on every page. Storing this choice is strictly necessary (§25(2) No. 2 TDDDG) and serves my legal obligation to record consent (Article 6(1)(c) and Article 7(1) GDPR).

3.6 Google Analytics

If you agree in the privacy settings, this website uses Google Analytics 4, a web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google Analytics sets cookies that recognise your browser on return visits and records which pages you view, how long you stay, where you came from, your approximate location (country or city, derived from your IP address), and your device, browser and operating system. Google Analytics 4 does not log or store IP addresses; they are only used to derive the approximate location and are then discarded.

Cookies: “_ga” and “_ga_[ID]” distinguish visitors and sessions and are kept for two years.

Legal basis: your consent (Article 6(1)(a) GDPR, §25(1) TDDDG). Without your consent Google Analytics is not loaded at all. The data is kept for 2 months. You can withdraw your consent at any time through “Privacy settings” in the footer.

3.7 Microsoft Clarity

If you agree in the privacy settings, this website uses Microsoft Clarity, provided by Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland. Clarity shows me how visitors use the pages: mouse movements, clicks, scrolling and the pages visited are recorded as session recordings and summarised as heatmaps, together with device, browser, approximate location and the referring page. Text you type into fields is masked and not recorded.

Cookies: “_clck” recognises your browser on return visits (one year), “_clsk” groups the pages of one visit (one day); Microsoft may also set “MUID” (one year).

Legal basis: your consent (Article 6(1)(a) GDPR, §25(1) TDDDG). Without your consent Clarity is not loaded at all. Session recordings are deleted after 30 days, heatmaps after 13 months. You can withdraw your consent at any time through “Privacy settings” in the footer.

3.8 Ember Grin (the pumpkin face app)

Ember Grin works without an account, without cookies, without tracking and without advertising. Everything the app shows, including its fonts, drawings and sounds, comes from this website; no other server is contacted while you use it.

Kept in your browser only. So that your pumpkin is still there when you come back, the app keeps a few things in your browser’s local storage: the current face and its name (“ember-grin-face”, “ember-grin-face-fit”, “ember-grin-name-typed”), your print settings (“ember-grin-print”), your sound settings (“ember-grin-sound”) and whether you have seen the first-visit hint (“ember-grin-hint-seen”). This data never leaves your device and I cannot see it. It is strictly necessary for features you use (§25(2) No. 2 TDDDG). You can delete it at any time through your browser’s settings for this site.

Pictures and stencils. The PNG pictures and PDF stencils are made in your browser. The files carry the pumpkin’s share link and a copyright line in their metadata, so if you named your pumpkin, that name is in the file too.

Share links. A share link contains the design itself (the shape, the parts, their positions and the name you gave the pumpkin). I do not store designs when you create a link. When a share link is posted in a messaging app or social network, that service asks this website for a preview; the website then draws a picture of the pumpkin and keeps it on the server so it does not have to be drawn again. The picture shows only the pumpkin. These preview requests come from the messaging service, not from you, and are logged like any other request (see 3.3).

Sound. The music and sound effects are only downloaded, from this website, when you switch sound on.

Visit counting. To see how many people use Ember Grin and where they get stuck, the app tells this website, once per visit, which steps were reached (for example: opened the editor, shuffled, saved a stencil). The website adds one to that day’s total for the step, and to the totals for the type of device (phone, tablet or computer, from the browser identification every browser sends with each request) and for the language your browser asks for first. If you came through the QR code on a flyer, the flyer’s letter is counted as well. Only these daily totals are stored. The counter stores no IP address, no browser identification, no cookie and no ID, and it stores nothing on your device and reads nothing from it, so a visit cannot be traced back to you or linked to another visit. Before counting, the website compares the request’s IP address with a short list of my own connections, so that my own visits are not counted; the address is not kept. Legal basis: my legitimate interest in knowing how the app is used, so that I can improve it (Article 6(1)(f) GDPR). The request itself is logged by the hosting like any other (see 3.3).

3.9 Emails to Ember Grin Addresses

If you write to hello@embergrin.com, orchard@embergrin.com, mortuary@embergrin.com or ideas@embergrin.com, your message is forwarded by Porkbun, LLC, 11575 SW Pacific Hwy PMB 40649, Tigard, OR 97223, USA (the provider of the embergrin.com domain) to my mailbox at Apple (Apple Distribution International Limited, Hollyhill Industrial Estate, Hollyhill, Cork, Ireland). I process your email address, your message and any drawings you send in order to reply and, if your drawing is used in Ember Grin, to credit you by the name you give me. Legal basis: my legitimate interest in answering you (Article 6(1)(f) GDPR) and, for the credit, your consent (Article 6(1)(a) GDPR). Messages are deleted when the conversation is finished, unless your drawing becomes part of Ember Grin; then your name and the drawing are kept for as long as it is used. If you prefer your message not to pass through the USA, write to contact@hagstone-bramble.com instead.

3.10 The embergrin.com Domain

embergrin.com forwards to hagstone-bramble.com/ember-grin. The forwarding is run by Porkbun, LLC (address in 3.9), whose servers receive your IP address and the address you requested in order to redirect you. Legal basis: my legitimate interest in a short, memorable address (Article 6(1)(f) GDPR).

3.11 Links to Ko-fi

Ember Grin and this website link to my page on Ko-fi, where you can say thanks with a payment. It is a plain link: nothing from Ko-fi is loaded until you click it. On Ko-fi, the privacy policy of Ko-fi Labs Limited applies.

4. International Data Transfers

Google, Microsoft and Apple may process data in the United States. Google LLC, Microsoft Corporation and Apple Inc. are certified under the EU-US Data Privacy Framework, for which the European Commission has adopted an adequacy decision (Article 45 GDPR). Emails to embergrin.com addresses and the forwarding of embergrin.com pass through Porkbun’s servers in the United States. Porkbun is not certified under the Data Privacy Framework; according to its privacy policy it protects such transfers with the European Commission’s standard contractual clauses (Article 46(2)(c) GDPR).

5. Your Rights

Under the GDPR you have the following rights regarding your personal data:

• Right of access (Article 15 GDPR)
• Right to rectification (Article 16 GDPR)
• Right to erasure (Article 17 GDPR)
• Right to restriction of processing (Article 18 GDPR)
• Right to data portability (Article 20 GDPR)
• Right to withdraw consent at any time, with effect for the future (Article 7(3) GDPR)

Right to object (Article 21 GDPR): where I process your data on the basis of my legitimate interest (Article 6(1)(f) GDPR), you can object at any time on grounds relating to your particular situation.

To use any of these rights, write to contact@hagstone-bramble.com. I will answer within one month.

6. Supervisory Authority

You have the right to lodge a complaint with a supervisory authority. The one responsible for me is:

Der Hamburgische Beauftragte für Datenschutz und Informationsfreiheit
Ludwig-Erhard-Straße 22
20459 Hamburg
Phone: 040 428 54-4040
Email: mailbox@datenschutz.hamburg.de

7. Changes to this Privacy Policy

I update this policy when the way I process data changes or the law requires it. The current version is always available on this website.