Privacy Policy

1. Controller

The controller responsible for data processing on this website is:

Markus Münch · Grimmhain
Am Gleise 10a · 21614 Buxtehude · Deutschland
grimmhain.reckoning@gmail.com

2. Hosting — Vercel

This website is hosted by Vercel Inc., 340 Pine Street, Suite 701, San Francisco, CA 94104, USA. When you visit this website, Vercel automatically collects log data including IP address, browser type, operating system, referring URL, and timestamp. This data is processed on the basis of Art. 6(1)(f) GDPR (legitimate interest in providing a stable and secure website). Vercel is certified under the EU-US Data Privacy Framework. For details, see: vercel.com/legal/privacy-policy

3. Database & Authentication — Supabase

We use Supabase (Supabase Inc., 970 Toa Payoh North, #07-04, Singapore 318992) for database storage, user authentication, and community forum functionality. The following data may be stored: email address, username, forum posts, and session tokens. Data is processed on the basis of Art. 6(1)(b) GDPR (contract performance) and Art. 6(1)(a) GDPR (consent for newsletter). EU data is stored in EU data centers. Supabase processes data under EU Standard Contractual Clauses. Details: supabase.com/privacy

4. Newsletter & Email Sign-up

When you subscribe to our newsletter, your email address is stored in our Supabase database. This is based on your consent (Art. 6(1)(a) GDPR). You can unsubscribe at any time by emailing grimmhain.reckoning@gmail.com. We will delete your email address immediately upon request.

5. Payment Processing — Stripe

For payment processing, we use Stripe (Stripe Inc., 354 Oyster Point Blvd, South San Francisco, CA 94080, USA). When you make a purchase, payment data (card number, billing address) is transmitted directly to Stripe and processed by them. We do not store payment card data on our servers. Stripe is PCI-DSS certified and operates under EU Standard Contractual Clauses. Details: stripe.com/privacy

6. Cookies & Local Storage

This website uses technically necessary cookies and browser storage for: session management (Supabase authentication token, stored in localStorage), language preference, and shopping cart state. No third-party tracking cookies are set without your consent. You can delete cookies at any time in your browser settings.

7. Your Rights (Art. 15–22 GDPR)

You have the right to:

• Access to your stored personal data (Art. 15)
• Rectification of inaccurate data (Art. 16)
• Erasure of your data ("right to be forgotten") (Art. 17)
• Restriction of processing (Art. 18)
• Data portability (Art. 20)
• Objection to processing (Art. 21)
• Withdrawal of consent at any time (Art. 7(3))

To exercise these rights, contact us at: grimmhain.reckoning@gmail.com

8. Right to Lodge a Complaint

You have the right to lodge a complaint with a supervisory authority. The competent authority for Hamburg/Buxtehude is: Der Hamburgische Beauftragte für Datenschutz und Informationsfreiheit, Ludwig-Erhard-Str. 22, 20459 Hamburg, datenschutz@hmbdi.hamburg.de