Privacy policy

Controller

See the imprint for the controller's name and contact details.

What we process

• Account: your email address, display name and a hash of your password, so you can sign in and publish reviews (Art. 6(1)(b) GDPR).
• Reviews and reports you submit (Art. 6(1)(b) GDPR).
• Public profile (optional): only if you switch it on in your account, we publish your display name, handle, bio, website, the month you joined and your published tests on a profile page. You can hide it or change it at any time; it is deleted with your account. We may mark creator accounts as "verified" after checking that they belong to the channel they name (Art. 6(1)(a) and (b) GDPR).
• Affiliate clicks: when you click a shop link we store the link, the time and your country (provided by our CDN, Cloudflare, based on your IP address, which we do not store) (Art. 6(1)(f) GDPR).
• Statistics: we count page views per page and day. No cookies, no IP addresses, no profiles.
• Link sources: some links to our site carry a short campaign code such as ?ref=share or the name of a channel that links to us. When you arrive through such a link we count one visit for that code and day. The code describes the link, not you: no cookies, no IP addresses, nothing that follows you to other pages (Art. 6(1)(f) GDPR).
• Security: after failed logins we store a keyed hash of your IP address for up to 24 hours to block password guessing (Art. 6(1)(f) GDPR).
• Cookies: strictly necessary cookies – your age confirmation, your cookie choice and, while signed in, your session. Analytics cookies from Google only if you agree (see below).

Hosting and CDN

The site is hosted by STRATO AG, Otto-Ostrowski-Straße 7, 10249 Berlin, Germany, on servers in Germany. When you visit the site, the host processes technical connection data (such as your IP address, time of access, requested page and browser) to deliver the pages and keep the servers secure, and may keep it in server log files for a limited period. We have a data processing agreement with STRATO (Art. 28 GDPR); the legal basis is our legitimate interest in a secure, working website (Art. 6(1)(f) GDPR).

Traffic to the site is routed through the content delivery network of Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA. Cloudflare processes your IP address and connection data to deliver the site quickly, protect it against attacks and tell us your country (used only to decide which shop links may be shown). Data may be transferred to the USA; Cloudflare is certified under the EU-U.S. Data Privacy Framework and we have a data processing agreement with Cloudflare (Art. 28 GDPR). Legal basis: Art. 6(1)(f) GDPR.

Spam protection (Google reCAPTCHA)

To keep bots out, the sign-in and registration pages use Google reCAPTCHA, a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. reCAPTCHA is loaded only on these two pages. It processes your IP address, browser information and how you interact with the page to tell people from bots, and may set cookies from Google. Data may be transferred to Google LLC in the USA, which is certified under the EU-U.S. Data Privacy Framework. Legal basis: our legitimate interest in protecting accounts and the site against abuse (Art. 6(1)(f) GDPR). Google's privacy policy: policies.google.com/privacy.

Web analytics (Google Analytics) – only with your consent

If you click “Accept” in the cookie banner, we use Google Analytics 4, a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, to understand how the site is used (for example which pages are read and how visitors find us). Google Analytics then sets cookies (_ga, _ga_<ID>, stored for up to 2 years) and processes usage data such as pages viewed, time of visit, device and browser information and your approximate location. Google Analytics 4 does not store full IP addresses. We have switched off advertising features: no ad cookies, no ad personalisation, no data sharing for ads.

Data may be transferred to Google LLC in the USA, which is certified under the EU-U.S. Data Privacy Framework. We have a data processing agreement with Google (Art. 28 GDPR). Legal basis: your consent (Art. 6(1)(a) GDPR and § 25(1) TDDDG). Without consent Google Analytics is not loaded at all. You can withdraw your consent at any time under “Cookie settings” at the bottom of every page; we then stop the measurement and delete the Google Analytics cookies in your browser. We store your choice in a cookie (analytics_consent) for 6 months. Google's privacy policy: policies.google.com/privacy.

Your rights

You can request access, correction, deletion, restriction or portability of your data and object to processing at any time. You can delete your reviews and your account yourself on your account page. You may also complain to a data protection authority.