1. Data Controller
Daniela Rost
Kampenwandstr. 11, 83530 Schnaitsee, Germany
Email: support@xlaypand.com
2. Collection and Processing of Personal Data
We only collect personal data to the extent necessary to provide our service. When you visit our website, the following data is automatically collected:
- IP address (anonymized)
- Date and time of access
- Page visited
- Referrer URL
Legal basis: Article 6(1)(f) GDPR (legitimate interest).
3. Hosting
Our website is hosted by Vercel Inc. (San Francisco, CA, USA). Vercel processes access data as part of delivering the website. Data transfers to the USA are covered by an adequacy decision and/or Standard Contractual Clauses (SCCs).
4. Payment Processing (Paddle)
Paddle.com Market Limited acts as the Merchant of Record (MoR) for all payments. Paddle independently collects and processes payment data (credit card, PayPal, etc.). We only receive the following from Paddle:
- Email address
- Subscription status
- Transaction IDs
Paddle privacy policy: paddle.com/legal/privacy
5. AI Chatbot (Anthropic)
Our website provides an AI-powered chat assistant ("Carlos") that uses the Claude API operated by Anthropic, PBC (548 Market Street, PMB 90375, San Francisco, CA 94104, USA). When you interact with the chat, the following data is transmitted to Anthropic in order to generate a response:
- The content of your chat messages
- Any name or email address you optionally enter in the chat intro
- The conversation history of the current session (kept in your browser only)
- Technical metadata required by the API (timestamps, request IDs)
Purpose: Provision of an automated support assistant for product questions about Xlaypand.
Legal basis: Article 6(1)(a) GDPR (consent — given by initiating the chat after being shown the privacy notice) and Article 6(1)(f) GDPR (legitimate interest in offering automated customer support).
Data transfer to the USA: Anthropic processes data in the United States. The transfer is safeguarded by Standard Contractual Clauses (SCCs) under Article 46(2)(c) GDPR and, where applicable, the EU–U.S. Data Privacy Framework.
Retention & training: Under Anthropic's commercial API terms, your inputs and outputs are not used to train Anthropic's models. Anthropic retains API data only for a limited period for abuse-detection and operational purposes.
Anthropic's privacy policy: anthropic.com/legal/privacy
Anthropic's commercial terms: anthropic.com/legal/commercial-terms
Please do not enter sensitive personal data, payment details, passwords, or confidential business information into the chat. If your request requires sharing such information, please email support@xlaypand.com directly.
6. Cookies
Our website does not use tracking cookies. Only technically necessary cookies are used (e.g., session cookies for plugin login status). A cookie consent banner is therefore not required.
7. Analytics & Performance Monitoring
We use two cookieless tools provided by our hosting platform (Vercel Inc., USA) to understand website usage and ensure good page-load performance:
Vercel Web Analytics collects anonymized usage metrics — page views, page paths, referrer, approximate geography (country level), browser type, and device type. No cookies are set, no cross-session identifiers are used, and individual visitors cannot be identified. IP addresses are processed in-memory to deduplicate daily-unique visitor counts and are immediately hashed and discarded — they are never stored.
Vercel Speed Insights measures Core Web Vitals (Largest Contentful Paint, Interaction to Next Paint, Cumulative Layout Shift) and related performance metrics. The same cookieless, anonymized approach applies — no personal data is retained.
Both tools generate aggregate statistics only; no personal profiles are created and no data is sold or shared with third parties.
Legal basis: Article 6(1)(f) GDPR (legitimate interest in understanding website usage and maintaining a fast, reliable service). Consent under the GDPR is not required for this type of cookieless, aggregated analytics.
Data transfers to the USA are safeguarded by Standard Contractual Clauses (SCCs) under Article 46(2)(c) GDPR and the EU–U.S. Data Privacy Framework. Vercel's privacy policy: vercel.com/legal/privacy-policy.
8. Newsletter & Launch Waitlist (Brevo)
For our launch waitlist and email communications, we use Brevo (formerly Sendinblue), operated by Sendinblue SAS, 106 boulevard Haussmann, 75008 Paris, France. Brevo acts as our data processor under Article 28 GDPR.
When you sign up to our launch waitlist, the following data is processed:
- Your email address
- Date and time of signup
- Confirmation status (Double-Opt-In timestamp)
- IP address (for spam prevention and consent documentation)
Purpose: Sending you a one-time notification when Xlaypand goes live, and optionally further service-related updates.
Legal basis: Article 6(1)(a) GDPR (consent — explicitly confirmed via Double-Opt-In email).
Double-Opt-In: After signing up, you receive a confirmation email. Your email address is only added to our list after you click the confirmation link. Until then, it is stored solely for the purpose of sending the confirmation request.
Data location: Brevo stores all data on servers within the European Union (France/Germany). No transfer outside the EU takes place for waitlist data.
Retention: Your email address remains in our list until you unsubscribe. You can unsubscribe at any time via the link at the bottom of any email we send, or by emailing hello@xlaypand.com.
Brevo privacy policy: brevo.com/legal/privacypolicy
9. Your Rights Under the GDPR
Under the GDPR, you have the following rights:
- Access (Article 15 GDPR)
- Rectification (Article 16 GDPR)
- Erasure (Article 17 GDPR)
- Restriction of processing (Article 18 GDPR)
- Data portability (Article 20 GDPR)
- Objection (Article 21 GDPR)
You also have the right to lodge a complaint with a data protection supervisory authority.
10. Contact
For questions regarding data protection, please contact us at: support@xlaypand.com