Privacy policy

1. Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) is:

E-mail: hello@astryla.com

2. Visiting this website

Each time a page is called up, information is automatically recorded in server log files: IP address, date and time of access, page requested, referrer URL, browser and operating system.

Legal basis: Art. 6 (1) (f) GDPR — legitimate interest in the secure and proper operation of the website.

Retention: The log files arise at our hosting provider Vercel (section 8); we do not store them ourselves. Vercel keeps them for one day, after which they are deleted automatically.

3. Cookies, audience measurement and appearance

We use no tracking or advertising services that follow you across websites, and no advertising cookies requiring consent. The site has one fixed appearance; there is no light or dark toggle and we store nothing for it.

The sign-in service Clerk is, however, loaded on every page (see section 5). It sets strictly necessary cookies for session management and writes configuration data to your browser’s local storage — even if you never sign in; that includes a counter for Clerk’s own product telemetry. In addition, a strictly necessary cookie remembers your language choice, so that a return visit opens in the same language.

Legal basis: Art. 6 (1) (f) GDPR — legitimate interest in operating the sign-in and in a consistent language choice.

For anonymous audience measurement we use Vercel Web Analytics. According to Vercel, the service sets no cookies and records for each page view: the time, the page visited, the referrer URL, an approximate location (country, region, city), operating system, browser and device type. Before this data leaves your browser, we remove every parameter from the page address except those naming the chapter, the work, the payment outcome (successful or not) and the campaign or source of the link — in particular e-mail address, payment ID and invite code. To count visits, Vercel derives a hash from the request; according to Vercel, it is discarded after 24 hours, and the measurement data is not linked to your IP address. We see only aggregated figures and cannot identify any individual from them.

Legal basis: Art. 6 (1) (f) GDPR — legitimate interest in learning, with minimal data, which pages and works are used.

4. Purchase and payment

Purchases are handled by Dodo Payments as merchant of record. Your contractual partner for the purchase is therefore Dodo Payments, not us. Payment details — card and billing data, address, tax data — are entered solely in their embedded payment window; we neither see nor store them.

After a purchase, Dodo Payments passes us the buyer’s e-mail address, a payment ID, the product bought and the payment status, so that we can unlock access to the edition purchased.

Legal basis: Art. 6 (1) (b) GDPR — performance of the contract for the edition purchased.

Role: For the payment, Dodo Payments is a controller in its own right, not our processor. Transfers to third countries are based on the European Commission’s standard contractual clauses. Details are set out in their privacy policy.

5. Account and access to your purchase

So that your edition is waiting for you when you sign in, we create an account automatically after a purchase, using the e-mail address you gave when buying. You receive no password: signing in is password-free, by e-mail code or via Google or Apple.

That account holds your e-mail address and your entitlement (which work, which edition, when, and the payment ID). Accounts and sign-in are operated by Clerk, Inc. as our processor; the data is processed in the USA.

Legal basis: Art. 6 (1) (b) GDPR — providing the edition you purchased.

Retention: An account with a purchase attached to it is not deleted automatically: it holds access to something paid for, even if it is never claimed. An account without a purchase is deleted once it has gone unused for twelve months.

Deletion: You can have your account deleted at any time — write to the address above. Your purchase is unaffected; we will then tell you how to obtain your files.

6. Delivery of the audio files

Audio files and reading texts are served from a content delivery network operated by Cloudflare, Inc. When you request them, Cloudflare processes technically necessary connection data such as your IP address.

Legal basis: Art. 6 (1) (b) and (f) GDPR — delivery of the content and secure operation.

7. Contact by e-mail and contact form

When you write to us by e-mail or through the contact form, we process your e-mail address, your name (optional in the form), the content of your message and, for the form, the language of the page you sent it from, in order to answer your enquiry.

The form passes your details via our hosting provider Vercel to Microsoft 365, which delivers them as an e-mail to our mailbox hello@astryla.com, with your address as the reply-to address. The website does not store the message and writes neither your address nor its content to its logs. Our mailbox is operated on Microsoft 365 (Exchange Online) (section 8).

Legal basis: Art. 6 (1) (f) GDPR — legitimate interest in answering enquiries; where your enquiry concerns entering into or performing a contract with us, Art. 6 (1) (b) GDPR.

Retention: We delete your message once it is no longer needed to deal with your enquiry, at the latest after three years, unless statutory retention obligations require otherwise.

8. Recipients and processors

We use the following service providers. Contracts under Art. 28 GDPR are in place with all processors.

Vercel Inc., 440 N Barranca Avenue #4133, Covina, CA 91723, USA
Website hosting, audience measurement (Vercel Web Analytics) and forwarding of contact form messages — processor; certified under the EU-US Data Privacy Framework.

Clerk, Inc., 660 King Street, Unit 345, San Francisco, CA 94107, USA
Accounts and sign-in — processor; processing in the USA on the basis of the data processing agreement including the standard contractual clauses.

Dodo Payments
Payment as merchant of record — controller in its own right; third-country transfers based on the standard contractual clauses.

Cloudflare, Inc., San Francisco, USA
Delivery of the audio and text files — processor; transfers based on the standard contractual clauses and certification under the EU-US Data Privacy Framework.

Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland
Mailbox and delivery of contact form messages (Microsoft 365, Exchange Online) — processor under Microsoft's Products and Services Data Protection Addendum; third-country transfers based on the standard contractual clauses and Microsoft Corporation's certification under the EU-US Data Privacy Framework.

9. Your rights

Under the GDPR you have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection to processing (Art. 21).

An e-mail to the address above is enough to exercise them.

10. Right to lodge a complaint

You may lodge a complaint with a data protection supervisory authority. The authority responsible for us is:

Phone: +49 30 13889-0
E-mail: mailbox@datenschutz-berlin.de

11. Changes to this policy

We update this privacy policy when our offering or the legal requirements change. The version published at the time applies to your next visit.