Privacy Policy — HookBert

Effective 29.09.2026

1. Controller

The controller for data processing is:

Florian Haase
Im Langen Hahn 33
58515 Lüdenscheid
Germany

Email: support@hookbert.com
Contact form

2. Hosting, Logs, and Backups

We host the Service with Hetzner Online GmbH in Germany. Hetzner acts as our processor under a data processing agreement (Art. 28 GDPR). Server logs may contain your IP address, browser and operating-system information, referrer, requested URL, and request time. We process this data for secure and reliable operation (Art. 6 Para. 1 lit. f GDPR) and normally delete logs after 30 days.

Backups are stored on Hetzner Object Storage for disaster recovery and retained for about 30 days. Hetzner's privacy policy is available at https://www.hetzner.com/legal/privacy-policy/.

3. Cookies and Security

We use necessary session and CSRF cookies to keep you signed in and secure the Service (§ 25 Para. 2 TDDDG; Art. 6 Para. 1 lit. b and f GDPR).

Cloudflare Turnstile may process IP address, browser, device, and interaction data to prevent bot abuse (§ 25 Para. 2 TDDDG; Art. 6 Para. 1 lit. f GDPR). Cloudflare's policy is at https://www.cloudflare.com/privacypolicy/.

Fonts are delivered from our own servers together with the website.

4. Accounts and Authentication

We process your name, email address, account settings, acceptance of our Terms and Privacy Policy, and security information to create and operate your account (Art. 6 Para. 1 lit. b GDPR). This data is required to enter into and perform the contract. Without it we cannot create or operate an account (Art. 13 Para. 2 lit. e GDPR).

Email one-time codes and service emails are delivered through Resend, which receives the recipient address and email content. Processing may occur in the USA based on the EU-US Data Privacy Framework and/or Standard Contractual Clauses. See Resend's privacy policy.

If you sign in with Google, Google provides your user ID, name, email address, and profile photo URL. We store that photo URL. When the photo is shown, your browser loads the image from Google, which receives your IP address for that request. Google is an independent controller for sign-in and may process data in the USA using applicable transfer safeguards. See Google's privacy policy.

You may schedule account deletion in your profile. After the 30-day grace period, account data is deleted from live systems unless law requires retention. Copies may remain until backups expire.

5. Product Submissions, Reviews, and Clicks

When you submit a product, we process and store its URL, hook, listing status, administrator feedback, publication data, and other timestamps to provide the Service (Art. 6 Para. 1 lit. b GDPR).

Live hooks and URLs are published in the feed, on public product pages, and in the sitemap. Your account email is not displayed with a public listing. We count outbound product clicks and associate the aggregate count with the product so you can measure your hook's performance. We do not create a visitor profile from those counts.

Rejection decisions and feedback may be emailed to the account owner through Resend. Administrators can update stored feedback later without sending another email.

6. Contact

When you contact us, we process your message and optional email address to answer you (Art. 6 Para. 1 lit. b or f GDPR). We retain it until the matter is resolved unless law requires longer retention.

7. Payments

Advertising slots are paid through Dodo Payments (Dodo Payments Inc., 8 The Green, STE A, Dover, Delaware 19901, United States), which acts as merchant of record and independent controller. Dodo Payments processes the billing data needed to complete the purchase (Art. 6 Para. 1 lit. b GDPR). We send Dodo Payments your account email and an internal reference for the slot. We do not store card or bank details. We keep the slot, period, status, and Dodo Payments payment reference so we can provide the placement.

Dodo Payments' privacy notice is at https://dodopayments.com/legal/privacy-policy. Buying a slot is optional. If you do, Dodo Payments needs billing data to complete the payment (Art. 13 Para. 2 lit. e GDPR).

8. Analytics

Where configured, we use Umami for cookieless, aggregated usage analytics such as page views and referrers (Art. 6 Para. 1 lit. f GDPR: understanding and improving the website). If that Umami host is outside the EEA, the transfer safeguards in section 9 apply. See Umami's privacy policy.

9. Recipients and International Transfers

We share personal data only with the providers named above, processors bound by data-processing terms (Art. 28 GDPR), or authorities where legally required. Transfers outside the EEA, in particular to Google, Resend, Cloudflare, and Dodo Payments in the USA, use an adequacy decision such as the EU-US Data Privacy Framework (Art. 45 GDPR) and/or Standard Contractual Clauses (Art. 46 GDPR).

10. Retention

Unless a more specific period is stated, we keep personal data only as long as necessary:

Account and product data: while the account is active, followed by the deletion process described above
Contact requests: until resolved
Sign-in codes: a few minutes
Server logs and backups: about 30 days
Review records and click counts: while the associated product remains stored
Advertising purchases: while the account exists, then with account deletion, unless commercial or tax law requires us to keep a record longer
Analytics: according to our Umami configuration

11. Your Rights

Subject to statutory conditions, you have rights of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20), objection (Art. 21), and withdrawal of consent (Art. 7 Para. 3). Withdrawal does not affect processing that already took place.

If processing is based on legitimate interests, you may object for reasons arising from your situation. We will stop unless compelling legitimate grounds override your interests or processing is needed for legal claims.

If we use your data for direct marketing, you may object at any time. We will then stop using it for that purpose (Art. 21 Para. 2 and 3 GDPR).

You may complain to a supervisory authority (Art. 77 GDPR), including the Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen at https://www.ldi.nrw.de/.

We do not use automated decision-making or profiling under Art. 22 GDPR. Internet transmission cannot be completely secure; we use TLS in transit.

Contact

Data protection questions: support@hookbert.com or the contact form.