PRIVACY POLICY

1. Overview

This privacy policy explains what personal data we process when you visit our website www.mad-mirror-studios.com, contact us, book a call or use the business check-up: for which purposes, on which legal basis, who receives the data, how long we keep it and what rights you have.

Personal data is any information relating to an identified or identifiable person (Art. 4(1) GDPR), such as your name, your email address or your IP address. We process it in accordance with the General Data Protection Regulation (GDPR), the German Federal Data Protection Act (BDSG) and the German Telecommunications Digital Services Data Protection Act (TDDDG).

2. Controller

MAD MIRROR STUDIOS GbR, represented by its partners Marlon Baum and Melvin Baum
Zentgrafenstraße 93, 34130 Kassel, Germany
Email: hello@mad-mirror-studios.com
Phone: +49 176 416 316 47

We are not required to appoint a data protection officer (Art. 37 GDPR, § 38 BDSG). Please send questions about data protection to the email address above.

3. Hosting and server log files

This website is hosted by Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA. With every page request, your browser automatically transmits technical data that is processed in server log files: IP address, date and time, requested address, status code, amount of data transferred, referrer, and browser and operating system.

We need this data to deliver the website, keep it stable and secure and fend off attacks. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is a secure and working website. The log data is only kept for as long as these purposes require and is not combined with other data sources.

Vercel is our processor (Art. 28 GDPR) and delivers the website through a worldwide server network. Data may be transferred to the USA in the process; Vercel is certified under the EU-U.S. Data Privacy Framework, and the EU standard contractual clauses apply in addition (see section 17).

4. Fonts, content and our backend

We serve fonts from our own server. No connection is made to Google Fonts or any other font provider.

Project pages, images and the website's functions (forms, booking, business check-up) run on our backend at Supabase Pte. Ltd., 65 Chulia Street #38-02/03, OCBC Centre, Singapore 049513, with its data center in Frankfurt am Main. When your browser loads content from there, your IP address is transmitted to Supabase for technical reasons. The legal basis for delivering the website is Art. 6(1)(f) GDPR; for your requests, the legal bases in the following sections apply.

Supabase is our processor. The data is stored in Frankfurt am Main; where Supabase or its sub-processors can access it from Singapore, the USA or other third countries for operation, maintenance and support, this is based on the EU standard contractual clauses, which are part of our contract with Supabase.

5. Contact by email or phone

When you contact us by email or phone, we process your details (such as your name, contact details and the content of your message) to answer your request. The legal basis is Art. 6(1)(b) GDPR if your request aims at a contract with us, otherwise Art. 6(1)(f) GDPR; our legitimate interest is answering requests.

We run our mailboxes, calendars and video calls on Google Workspace of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, as our processor. Any transfer to Google LLC in the USA is based on the EU-U.S. Data Privacy Framework.

6. Contact form, project configurator and call-back request

When you write to us through the website, send a configuration or ask for a call back, we process your details: name, email address, optionally company and phone number, your message, your answers in the configurator and your preferred times for a call back. In addition, we receive the language, the topic of the request and, where applicable, a reference to a service page or a business check-up. We use this data to handle your request, prepare an offer or a call and follow up where needed.

The legal basis is Art. 6(1)(b) GDPR (pre-contractual measures at your request). For following up and for merging several requests with the same email address we rely on Art. 6(1)(f) GDPR; our legitimate interest is handling requests completely and efficiently.

We store your request as a contact in our own customer management system (Supabase, data center in Frankfurt am Main). We send the notification to us and the confirmation to you through the email service Resend (Resend, Inc., USA) as our processor; the transfer to the USA is based on the EU standard contractual clauses.

To prevent misuse, we limit the number of requests per connection. For this, your IP address is processed briefly in memory and is not stored. So that our confirmation emails can't be misused to send messages to other people's addresses, we also count them per recipient address and day using a hash of the address (not the address itself), which we delete after 49 hours at the latest. The legal basis is Art. 6(1)(f) GDPR.

We also protect all forms on this website (contact form, project configurator, call-back request, call booking including rescheduling and cancelling, business check-up, website check with fix request) against spam and automated requests with Cloudflare Turnstile. The provider is Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA. Turnstile only loads once you use a form, for example by clicking into a field; as long as you only read the website, no connection to Cloudflare is made. Your browser then loads a script from challenges.cloudflare.com that checks whether a human is using the form. Cloudflare receives your IP address, technical characteristics of your browser and connection (such as the browser identifier and features of the encrypted connection) and the address of the website the form is on; Cloudflare may store and read information in your browser for this. Usually you notice nothing; only in case of doubt does a box appear for you to tick. The result is a single-use check value that your browser sends to our server with the form. Our server has Cloudflare confirm it and transmits your IP address in the process; we do not store the check value or the result.

The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is protecting our forms, our inbox and our services against misuse and automated attacks. Storing and reading information in your browser is strictly necessary for us to provide the form you are using securely (§ 25(2) no. 2 TDDDG). For the check, Cloudflare is our processor (Art. 28 GDPR). According to Cloudflare, it also uses the characteristics under its own responsibility to improve its bot detection, but not to identify individuals, build profiles or show advertising. Cloudflare is certified under the EU-U.S. Data Privacy Framework (see section 17). More at https://www.cloudflare.com/turnstile-privacy-policy/ and https://www.cloudflare.com/privacypolicy/. If you would rather not use Turnstile, just write to us at hello@mad-mirror-studios.com.

Your browser keeps your progress in the configurator until you close the tab (see section 13). It is only sent to us when you submit the request.

7. Call booking and video calls

When you book a call in a free slot, we process your name, email address, phone number and company if given, topic, notes and the chosen time. We create the appointment in our Google calendar; Google sends the invitation, with a Google Meet link for a video call, to your email address. We send the booking confirmation and, the day before the call, a reminder by email through Resend.

With the confirmation you receive a personal link to reschedule or cancel the appointment. Anyone who has this link can manage the appointment, so please do not share it.

If you join a video call on Google Meet, Google processes the data needed for the connection, such as your IP address, device information, your display name and picture and sound during the call. We do not record calls without your express prior consent.

The legal basis is Art. 6(1)(b) GDPR. Google is our processor; any transfer to Google LLC in the USA is based on the EU-U.S. Data Privacy Framework.

We protect booking, rescheduling and cancelling against spam with Cloudflare Turnstile (see section 6).

8. Business check-up and website check

In the business check-up we process the website address you enter and, if you provide them, your goal and your Instagram and LinkedIn profiles. Our server retrieves the publicly accessible website and these profiles, measures the load time through Google's PageSpeed Insights interface (Google Ireland Limited) and has the information found evaluated by the AI model Claude of Anthropic Ireland, Limited. Data may be transferred to Anthropic PBC in the USA in the process; this is based on the EU standard contractual clauses. Under its contractual terms, Anthropic does not use this data to train its models. Only the addresses and the publicly found content are sent to Google and Anthropic, not your IP address.

We store the result under a random identifier in our customer management system (Supabase, Frankfurt am Main) so the link to your check-up works. Anyone who has this link can open the result. If someone checks the same website with the same goal and in the same language within seven days, we show them the same result instead of retrieving the website again.

To prevent misuse, we store a salted hash of your IP address (not the address itself), which we use to limit the number of check-ups per day, and delete it after 48 hours.

We also protect the check-up against automated requests with Cloudflare Turnstile (see section 6).

The legal basis is Art. 6(1)(b) GDPR (carrying out the check-up you requested) and, for misuse prevention, Art. 6(1)(f) GDPR. The evaluation is automated but does not lead to any decision with legal effect for you (see section 20).

Where the checked website or the profiles you name contain personal data of third parties, such as the operator, we process it on the basis of Art. 6(1)(f) GDPR; our legitimate interest is an assessment based on publicly available information on request. Those affected can object; we then delete the check-up.

The same applies to the website check, with these differences: it only processes the website address you enter. Our server retrieves the public homepage, the files robots.txt, llms.txt and sitemap.xml and up to twelve linked pages of the same website. It also checks how the website answers over http and with or without "www" and what its error page looks like (by requesting an address that doesn't exist); if the website turns our checker away, it requests the homepage once more with the identifier of an ordinary browser. It measures the homepage through Google's PageSpeed Insights interface and sends Claude, along with the information found, a screenshot of the mobile homepage that this interface provides. If someone checks the same website in the same language within 24 hours, we show them the same result. We limit the number of website checks per day with a salted hash of your IP address, which we delete after 48 hours at the latest.

If you request fixes in the website check, we process your name, your email address, optionally company, phone number and message, together with the chosen fixes and the result of the check, like a request through the contact form (see section 6).

For the MAD MIRROR Awards, we retrieve the publicly accessible websites of selected businesses and rate them by the methodology published on this website. We publish the name of the business, its website and the results. Where this is personal data, for example for sole traders, the legal basis is Art. 6(1)(f) GDPR; our legitimate interest is a transparent comparison of publicly accessible websites. Those affected can object to being included or ask for a correction, informally at hello@mad-mirror-studios.com.

9. Images and videos on the project pages

The images and videos of our projects are stored on our own storage (Supabase, Frankfurt am Main) or delivered with the website. Some videos are loaded directly from Dropbox (Dropbox International Unlimited Company, One Park Place, Hatch Street Upper, Dublin 2, Ireland). If you open a project page with such a video, your browser loads it from Dropbox servers; your IP address is transmitted to Dropbox in the process, possibly also to the USA.

The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is showing our work in good quality. Any transfer to the USA is based on the EU-U.S. Data Privacy Framework or the EU standard contractual clauses.

10. Videos from YouTube and Vimeo

On some pages, such as project pages, we show videos hosted on YouTube (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland) or Vimeo (Vimeo.com, Inc., 330 West 34th Street, 5th Floor, New York, NY 10001, USA). Until you press play, you only see a preview image from our own server; no connection to YouTube, Google or Vimeo is made.

Only when you click do we load the player, for YouTube in privacy-enhanced mode (youtube-nocookie.com), for Vimeo with the Do Not Track setting enabled. Data such as your IP address, device and browser information and the page the video plays on is then transmitted to the respective provider, including to the USA. The providers may use cookies or similar technologies.

The legal basis is your consent given by the click (Art. 6(1)(a) GDPR, § 25(1) TDDDG). The transfer to the USA is based on the EU-U.S. Data Privacy Framework. More in the privacy policies of Google (https://policies.google.com/privacy) and Vimeo (https://vimeo.com/privacy).

11. Instagram feeds

On social media project pages we may show the client's public Instagram feed. Instagram is operated by Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland. Until you consent, no connection to Instagram or Meta is made.

The feed loads from instagram.com once you allow "External media" in the cookie banner or click "Load feed" below the feed; that choice then applies to every feed on this website. Data such as your IP address, device and browser information and the page the feed appears on is then transmitted to Meta, including to the USA. If you are logged in to Instagram, Meta can link the visit to your account. Meta may use cookies or similar technologies.

The legal basis is your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG), which you can withdraw at any time under "Cookie settings" in the footer. The transfer to the USA is based on the EU-U.S. Data Privacy Framework. We and Meta are jointly responsible for loading the feed and transmitting the data to Meta (Art. 26 GDPR); Meta provides the agreement at https://www.facebook.com/legal/controller_addendum. Meta alone is responsible for any further processing, see Instagram's privacy policy (https://privacycenter.instagram.com/policy).

12. Google Analytics

If you consent to the "Statistics" category in the cookie banner, we use Google Analytics 4, a web analytics service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google Analytics shows us which pages are visited, for how long, and how visitors find us. For this Google sets cookies (_ga and _ga_<id>, stored for up to two years) and processes data such as your IP address, device and browser information, the pages you view and the page you came from. Google Analytics 4 does not store full IP addresses. We use no advertising or personalisation features. Google deletes user-level and event-level data after 14 months at the latest; after that, only aggregated statistics without any personal reference remain.

Before you consent, Google Analytics is not loaded and no connection to Google is made. The legal basis is your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG), which you can withdraw at any time under "Cookie settings" in the footer; we then delete the analytics cookies. Google is our processor; any transfer to the USA is based on the EU-U.S. Data Privacy Framework. More in Google's privacy policy (https://policies.google.com/privacy).

13. Cookies and browser storage

We set no cookies without your consent. For the website to work, it keeps a few details in your browser's storage (local storage and session storage). These details stay on your device:

• mms-consent (local storage): your choice in the cookie banner. We ask again after twelve months.
• mms-lang (local storage): the language you chose, until you clear your browser storage.
• mms-configurator-draft (session storage): your progress in the project configurator, until you close the tab or submit the request.
• mms-checkup-handoff (session storage): the checked website address when you move from the business check-up to the contact form; it is read there once and then deleted.
• mms-contact-prefill (session storage): your name, email address and company from the message you sent, so you don't have to type them again if you then request a call; until you request a call or close the tab.
• mms-chunk-reload (session storage): a marker that the page was reloaded once after a website update, until you close the tab.
• mms-scroll (session storage): the scroll position of the pages you visited last, so that "back" takes you to the same spot, until you close the tab.
• mms-ref (session storage): the address of the page you came from, when we forward you to your device's language version on your first visit. Only with your consent to statistics is it passed to Google Analytics once and then deleted; otherwise it stays until you close the tab.
• mm-audit-guess:<id> (session storage): your guess in the website check before the result appears, until you close the tab.

This storage is strictly necessary to provide the service you requested (§ 25(2) no. 2 TDDDG); any further processing is based on Art. 6(1)(f) GDPR.

When you use a form, Cloudflare Turnstile may also store and read information in your browser to protect against spam, for example in the embedded check window from challenges.cloudflare.com (see section 6). This serves solely to protect the form you are using and is strictly necessary for it (§ 25(2) no. 2 TDDDG).

Apart from this check, third-party cookies are only set with your consent: by Google Analytics ("Statistics" category), by Instagram ("External media" category) and by YouTube or Vimeo when you play a video. We use no advertising cookies. You can change your consent at any time under "Cookie settings" in the footer or withdraw it with effect for the future.

14. Our social media profiles

We have our own profiles on Instagram (Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland) and LinkedIn (LinkedIn Ireland Unlimited Company, Wilton Plaza, Wilton Place, Dublin 2, Ireland). The links on our website are plain links; no data flows to the platforms until you click one.

When you visit our profiles, the platforms process your data under their own privacy terms, including in the USA. Where the platforms provide us with statistics on the use of our profiles, we are jointly responsible with them for creating these statistics (Art. 26 GDPR); LinkedIn provides information at https://legal.linkedin.com/pages-joint-controller-addendum (LinkedIn currently shows this page only after login) and Meta at https://www.facebook.com/legal/terms/page_controller_addendum. If you message us there, we process your message to answer it.

The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is showing our work and communicating with prospects. You can exercise your rights against us and directly with the respective platform, which has direct access to your data.

15. Clients and business partners

When you engage us, we process the data of your contact persons needed for the offer, the work and invoicing, such as name, role, contact details, correspondence and billing data. The legal basis is Art. 6(1)(b) GDPR and, for keeping business records, Art. 6(1)(c) GDPR in conjunction with § 257 HGB and § 147 AO.

Where necessary, we pass data on to tax advisors, banks and payment providers and to freelancers and service providers we engage for your project. If we process personal data on your behalf as part of a project, we conclude a data processing agreement for it (Art. 28 GDPR).

16. Recipients at a glance

These service providers receive data from us or from your browser, each only to the extent described:

• Vercel Inc., USA: website hosting.
• Supabase Pte. Ltd., Singapore, data center in Frankfurt am Main: backend, customer management and media storage.
• Resend, Inc., USA: sending confirmations and reminders by email.
• Cloudflare, Inc., USA: spam protection for the forms (Cloudflare Turnstile), only once you use a form.
• Google Ireland Limited, Ireland, and Google LLC, USA: Google Workspace (email, calendar, Meet), PageSpeed Insights in the business check-up and the website check, Google Analytics only with your consent, YouTube only after your click.
• Anthropic Ireland, Limited, Ireland, and Anthropic PBC, USA: AI evaluation in the business check-up and the website check.
• Dropbox International Unlimited Company, Ireland: delivery of some project videos.
• Vimeo.com, Inc., USA: videos, only after your click.
• Meta Platforms Ireland Limited, Ireland: Instagram feeds, only with your consent.

Beyond this, we only pass on data if you have consented, if it is necessary to perform a contract or if we are legally obliged to. We do not sell data.

17. Transfers to third countries

Some of the providers named are based outside the EU, for example in the USA or Singapore, or may transfer data there. For companies certified under the EU-U.S. Data Privacy Framework, the European Commission has found an adequate level of data protection (Art. 45 GDPR). Where no such decision applies, we agree the EU standard contractual clauses with the provider (Art. 46(2)(c) GDPR). You can obtain a copy of these safeguards on request.

18. Storage period

We only keep personal data for as long as the respective purpose requires or statutory obligations demand:

• Requests, configurations, call-back requests, bookings and check-ups: 24 months after the last contact or after the appointment. We then delete the data or anonymise it so that it can no longer be linked to a person. Copies of your request in our mailbox and appointments in our calendar are deleted after the same period, unless they must be kept as commercial or business letters. If the request led to an engagement, the storage period for clients applies.
• Hashes of IP and email addresses: 49 hours at the latest.
• Server log files: as long as needed for operation and security (see section 3).
• Google Analytics: user-level and event-level data for 14 months at most.
• Browser storage: see section 13.
• Contract and accounting records: six, eight or ten years under commercial and tax retention obligations (§ 257 HGB, § 147 AO).

If you withdraw consent or object to processing, we delete the data concerned unless a legal obligation or another legal basis requires otherwise.

19. Obligation to provide data

You are under no statutory or contractual obligation to provide us with personal data. Without the details marked as required, however, we cannot handle your request or booking. Processing the connection data is technically necessary to visit the website.

20. No automated decision-making

We do not make solely automated decisions within the meaning of Art. 22 GDPR that produce legal effects for you or similarly significantly affect you. The business check-up produces an automated assessment of your website; decisions about working together are made by people.

21. Your rights

You have the following rights towards us:

• Access (Art. 15 GDPR): you can ask whether and which data we process about you.
• Rectification (Art. 16 GDPR): you can ask us to correct inaccurate data and complete incomplete data.
• Erasure (Art. 17 GDPR): you can ask us to delete your data unless we are obliged to keep it.
• Restriction (Art. 18 GDPR): you can ask us to restrict processing where the legal requirements are met.
• Data portability (Art. 20 GDPR): you can receive data you provided to us in a common machine-readable format or have it transmitted to another controller.
• Withdrawal (Art. 7(3) GDPR): you can withdraw consent at any time with effect for the future; processing up to that point remains lawful.
• Objection (Art. 21 GDPR): see the following notice.

An informal message to hello@mad-mirror-studios.com is enough.

22. Right to lodge a complaint

You can lodge a complaint with any data protection supervisory authority, in particular in the member state of your habitual residence, your place of work or the place of the alleged infringement (Art. 77 GDPR). The authority responsible for us is:

Der Hessische Beauftragte für Datenschutz und Informationsfreiheit (Hessian Commissioner for Data Protection and Freedom of Information)
Wilhelmstraße 7, 65185 Wiesbaden, Germany
Phone: +49 611 1408 0
Email: poststelle@datenschutz.hessen.de

23. Encryption

We transmit the website and all forms in encrypted form (TLS). You can tell by the address in your browser starting with https.

24. Changes

This privacy policy applies from 21 October 2026 and replaces all earlier versions. We update it when the website, our service providers or the law change. The current version is always available on this page.