1. Controller
Kevin Ludwig
Donaustraße 11
72555 Metzingen, Germany
Email: mail@kevinludwig.com
2. Hosting and Logs
This website is hosted by Vercel Inc., USA. Vercel processes all data transmitted when you visit the website and stores your IP address and technical request details (time, requested URL, browser) in logs. The logs are deleted after 30 days at the latest.
The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest is the secure and stable operation of the website.
3. Contacting Us
If you contact us via the contact form, by email or by phone, we process your details to handle your inquiry. In the contact form, name, email address and message are required; without them we cannot handle the inquiry.
Form inquiries and the automatic confirmation sent to you are delivered via Microsoft 365 (Microsoft Ireland Operations Ltd., Ireland).
The legal basis is Art. 6(1)(b) GDPR where your inquiry aims at a contract, otherwise Art. 6(1)(f) GDPR. Our legitimate interest is responding to inquiries. We delete the data once the inquiry has been handled, unless statutory retention obligations apply.
4. Questions to the AI in the FAQ
Below the frequently asked questions you can ask a question of your own. The answer is generated by an AI model based on the content of this website. To do so, we send your question to Vercel (AI Gateway), which passes it on to Google Cloud (Vertex AI), where the model Claude by Anthropic generates the answer.
The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest is answering questions about our services right away.
5. Spam Protection for the Contact Form, AI Questions, Shopify-Check and App Preview
When you submit the contact form or a question to the AI, start a Shopify-Check or an app preview, or unlock the full check or the preview on your phone, Vercel BotID uses technical characteristics of your browser, your IP address and your user agent to check whether the request comes from a human. The data is processed only for this check.
The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest is preventing spam and abuse.
6. Web Analytics with Plausible
We analyze the use of this website with Plausible Analytics, which we run ourselves on a server of Hetzner Online GmbH in Germany. The following is recorded: pages visited, referrer, browser, operating system, device type, approximate location, scroll depth, time on page, clicks on links and buttons, and the selected type of a submitted inquiry. The IP address is not stored but hashed with a key that changes daily; after 24 hours it can no longer be linked to a person.
The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest is statistical analysis to improve the website.
7. Appointment Booking via Cal.com
For appointment booking, we link to Cal.com (Cal.com, Inc., USA). If you book an appointment there, Cal.com processes your details on our behalf. We delete the data once the appointment has been handled, unless statutory retention obligations apply.
On the contact page and on the results page of the Shopify-Check you can load the Cal.com calendar directly in the page. It only loads once you start it with the button. Your browser then sends your IP address and technical details about your device and browser to Cal.com. Your choice is stored locally in your browser only, so the calendar loads right away on your next visit; you can delete it via your browser's site data. The legal basis for loading it is your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time.
The legal basis is Art. 6(1)(b) GDPR.
8. Shopify-Check
Checking a store. When you enter the address of a Shopify store, our server fetches publicly accessible pages and the public interface (Storefront API) of that store (respecting its robots.txt), renders the home page in a browser and requests loading time data from Google (PageSpeed Insights, Chrome UX Report); we send only the store address to Google. We store the result with the store address, without any link to you. If the store operator is a natural person, it may concern them. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is showing the check, comparing later checks and improving it. We delete results 12 months after the last check unless a monthly check is running. Revenue and share abroad for the projection stay in your browser; we do not store them. For analyses across all checks we keep anonymous figures without the store address and without a time (month, findings, rounded measurements, size classes) that cannot be attributed to any store.
Full check. To unlock it, we process your email address, the store address and, if provided, your phone number. You receive the findings, a personal assessment and a new check every month by email; in these and in a few other emails we present KL's Shopify services to you. If you provide a phone number, Kevin Ludwig will call you about your check. The email address is required, it is the consideration for the check. We keep your details and the results in our customer management system and assess how well our services fit your store. If your link carried a campaign tag, we note there which channel you came from, to see which channels work (Art. 6(1)(f) GDPR). The legal bases are Art. 6(1)(b) GDPR (contract for the check) and your consent (Art. 6(1)(a) GDPR). You can unsubscribe and withdraw your consent at any time via the link in every email or by message to mail@kevinludwig.com; processing up to then remains lawful. Without any reaction, the emails end after 12 months. After that, or after you unsubscribe, we delete your data unless there is a business relationship or a statutory retention obligation. When you open your findings via the link in the email, we set a technically necessary cookie that only holds the access to your findings (30 days).
Evidence. To be able to prove request, confirmation and unsubscription, we store their times, IP address and browser identifier, the text shown and the confirmation email, also after you unsubscribe, for three years from the end of the year of the last contact. Your email address stays on a blocklist as a hash value, not in plain text, so that you receive no more emails; only when you request and confirm the check again yourself do we remove it from the list. The legal basis is Art. 6(1)(c) in conjunction with Art. 7(1) GDPR and Art. 6(1)(f) GDPR (defence against claims).
Service providers. Database: Neon (Neon, Inc., USA; data centre in Frankfurt). Our customer management system is an application of our own that also runs on Vercel and Neon. Sending the emails: Microsoft 365 (see section 3). Hosting and spam protection: Vercel (see sections 2 and 5).
9. App Preview
Preview of a store. When you enter the address of a Shopify store, our server fetches the public interface (Storefront API) and publicly accessible pages of that store, renders the home page and a product page in a browser and stores products, collections, logo and colours from them under the store address, without any reference to you. Our server loads the store's images and delivers them via our domain. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is showing you the preview. We delete the preview after 30 days.
Preview on your phone. To send you the link to the preview, we process your email address, the store address and, if provided, your phone number. You receive the link (valid for 30 days) and a personal assessment by email; in it and in a few other emails we present KL's services around Shopify and apps. With a phone number, Kevin Ludwig calls you about your preview. The email address is required; it is what you give in return for the preview. We keep your details in our customer management system, with the channel as for the Shopify check (section 8). The legal bases are Art. 6(1)(b) GDPR (contract for the preview) and your consent (Art. 6(1)(a) GDPR). You can unsubscribe and withdraw your consent at any time via the link in every email or by writing to mail@kevinludwig.com; processing up to then remains lawful. We delete your data after you unsubscribe or 12 months after the last contact, unless there is a business relationship or a statutory retention obligation. If you add the preview to your home screen, your device only stores the shortcut; you can remove it at any time.
Evidence and service providers. As for the Shopify-Check (section 8).
10. Transfers to the USA
Vercel, Microsoft, Cal.com and Neon may transfer data to the USA. For Vercel Inc. and Microsoft Corporation, the European Commission's adequacy decision under the EU-US Data Privacy Framework applies (Art. 45 GDPR). Cal.com, Inc. and Neon, Inc. base transfers on the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR) or the EU-US Data Privacy Framework.
11. Your Rights
You have the right of access (Art. 15 GDPR), rectification (Art. 16 GDPR), erasure (Art. 17 GDPR), restriction of processing (Art. 18 GDPR) and data portability (Art. 20 GDPR). You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR).
12. Right to Object
Where we process your data on the basis of Art. 6(1)(f) GDPR, you may object to this processing at any time on grounds relating to your particular situation (Art. 21 GDPR). You may object to the use of your data for direct marketing at any time without giving reasons (Art. 21(2) GDPR). A message to mail@kevinludwig.com is sufficient.