Privacy Policy

1. Controller

The controller responsible for the processing of personal data on this website within the meaning of the General Data Protection Regulation (GDPR) is:

scon-marketing GmbH
Im Sundern 1
59929 Brilon, Germany
Represented by its managing director: Jascha Schmitz
Email: info@scon-marketing-gmbh.de
Phone: +49 2961 9898574

2. What data we process

2.1 Server log files

When you visit our website, the hosting server records technical access data: IP address (truncated or pseudonymised where technically possible), time of access, the URL requested, HTTP status code, referrer and browser user agent. This data serves operational security, abuse detection and statistical evaluation. Retention: no longer than 14 days.
Legal basis: Art. 6(1)(f) GDPR (legitimate interest in operational security).

2.2 Registration and account

If you register, we process the following data: email address, optional display name, optional biography, optional language preference and optional region (provided voluntarily for the community map). We do not store a password — sign-in works by “magic link” (a one-time login link sent by email) or optionally through an OAuth provider (see below).
Legal basis: Art. 6(1)(b) GDPR (performance of a contract when you use an account).

2.3 Login sessions

After a successful login we store a session identifier in a strictly necessary cookie (HttpOnly, Secure, SameSite=Lax). The cookie contains no personal content, only a random session ID. Validity: 7 days, extended on active use.
Legal basis: Art. 6(1)(b) GDPR (performance of a contract) and § 25(2) no. 2 TDDDG, the German implementation of the ePrivacy rules on strictly necessary access to terminal equipment.

2.4 Your own notes and annotations

As a signed-in user you can create your own notes on events, people or organisations in our database. These notes are private by default and visible only to you. Depending on your membership you may optionally submit individual research notes for publication. Submitted notes remain private until reviewed; only approved notes can appear on public profiles or matching detail pages. Internal review, risk and AI-assistance fields are never displayed publicly and are not included in user exports.
Legal basis: Art. 6(1)(b) GDPR.

2.5 Subscriptions and payments

If you take out a paid subscription (Community or Researcher), payment data is processed directly by our payment provider Stripe Payments Europe Ltd. We do not store card numbers, bank account details or any other payment information ourselves — only a subscription identifier, your current tier and the expiry date.
Legal basis: Art. 6(1)(b) GDPR.

2.6 OAuth sign-in (optional)

If you sign in through Google, GitHub or Discord, we receive the email address held there, a display name and possibly a profile picture from those services. Please refer to the privacy policies of the respective providers. You actively acknowledge their processing by pressing the relevant OAuth button.
Legal basis: Art. 6(1)(a) GDPR (consent).

2.7 Bot protection on the login and newsletter forms

On the login form and on the newsletter signup form we use Cloudflare Turnstile to fend off automated abuse (bot attacks). When the relevant page is opened, a connection to Cloudflare is established, and your IP address and user agent are transmitted to Cloudflare. Cloudflare Turnstile sets no tracking or marketing cookies. Cloudflare is a certified cloud provider with EU servers and a data processing agreement in place.

Provider: Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA, and Cloudflare Germany GmbH, Rosental 7, 80331 Munich, Germany. Privacy policy: www.cloudflare.com/privacypolicy.
Legal basis: Art. 6(1)(f) GDPR (legitimate interest in defending the login and newsletter signup against automated attacks).

2.8 Embedded YouTube videos

In some places we embed YouTube videos on UAP topics. We use YouTube’s privacy-enhanced mode (domain www.youtube-nocookie.com) combined with a two-click procedure: when the page loads you see only a preview image. The connection to YouTube/Google is established and the video loaded only once you actively click it.

The preview image is loaded from YouTube servers, which transmits your IP address to Google. After you click the video, YouTube in privacy-enhanced mode does not, as a rule, store cookies for personalised advertising. For the processing carried out by YouTube/Google we refer you to their privacy policy: https://policies.google.com/privacy.

Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.
Legal basis for displaying the preview image: Art. 6(1)(f) GDPR (legitimate interest in supplementary journalistic context). Legal basis for playback after the click: Art. 6(1)(a) GDPR (consent by clear affirmative action).

3. Processors

We use the following carefully selected processors (Art. 28 GDPR):

• Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany — hosting of the application and databases, servers located in Germany. Data processing agreement in place.
• Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Dublin 2, Ireland — payment processing. The data processing agreement forms part of the Stripe Services Agreement.
• Resend, Inc., USA — delivery of transactional email (magic-link login, notifications). Sending takes place via the Ireland region; however, account data, delivery logs and metadata are stored in the USA. A transfer to a third country therefore takes place. It is based on a data processing agreement incorporating the EU Standard Contractual Clauses and on Resend’s certification under the EU-US Data Privacy Framework.
• CleverReach GmbH & Co. KG, Schafjückenweg 2, 26180 Rastede, Germany — newsletter delivery, management of the recipient list and record of consent. Servers located in Germany, no transfer to a third country. Data processing agreement in place.

3a. Newsletter

When you subscribe to our newsletter, we process your email address together with the time, the IP address and the technical context of your signup, your confirmation and any later unsubscribe. These records serve solely to evidence your consent and its withdrawal; without them we could demonstrate neither that sending was lawful nor that an unsubscribe was honoured. The legal basis is your consent under Art. 6(1)(a) GDPR.

Signup uses a double opt-in procedure: after you enter your address we send you an email containing a confirmation link. Only once you click it do we add you to the distribution list. Signups that are not confirmed are deleted.

Measurement. Our newsletter contains a counting pixel, and the links it contains are routed through a CleverReach server. This lets us record how often an issue is opened and which links in it are clicked. We read that to see which subjects are being read, and to shape the newsletter accordingly. At CleverReach this evaluation is set to anonymised reporting: recipients who open or click are not identified by name in the reports, and neither full IP addresses nor cookies are collected for it. The legal basis is your consent under Art. 6(1)(a) GDPR, given when you subscribe.

You may withdraw your consent at any time with effect for the future — through the unsubscribe link in every email, or informally at newsletter@mail.from-beyond.space. After withdrawal we remove your address from the distribution list; we retain only what is necessary to evidence the consent previously given.

To limit abusive signups we temporarily store a counter per IP address and per email address. Both are stored exclusively as a cryptographic checksum, never in plain text, and are deleted after one day at the latest. The legal basis is our legitimate interest in abuse-free operation under Art. 6(1)(f) GDPR.

4. Cookies

We use only strictly necessary cookies, required for the operation and security of the application:

• better-auth.session_token — session identifier after login (HttpOnly, Secure, 7 days)
• better-auth.session_data — session cache (HttpOnly, Secure, 5 minutes)
• NEXT_LOCALE — your chosen language preference
• uap_cookie_notice_v1 — a marker that you have seen the cookie notice (local storage, not a server cookie)

No tracking, advertising or marketing cookies are set. Strictly necessary cookies do not require consent under § 25(2) TDDDG.

5. Your rights

You have the following rights against us as controller at any time:

• Access to the data we hold about you (Art. 15 GDPR)
• Rectification of inaccurate data (Art. 16 GDPR)
• Erasure of your data (Art. 17 GDPR)
• Restriction of processing (Art. 18 GDPR)
• Data portability (Art. 20 GDPR)
• Objection to processing (Art. 21 GDPR)
• Withdrawal of consent at any time with effect for the future (Art. 7(3) GDPR)

You can delete your account yourself at any time in the account area. All personal data (master data, notes, bookmarks, sessions, OAuth links) is then deleted without delay and irreversibly. Invoicing data from subscriptions is archived for up to 10 years due to retention obligations under German commercial and tax law (§ 147 AO, § 257 HGB), but is not processed further.

To exercise your rights, please contact the email address given above.

6. Right to lodge a complaint

You have the right to lodge a complaint with a data protection supervisory authority. The authority responsible for us is:

Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia)
Kavalleriestraße 2–4
40213 Düsseldorf, Germany
www.ldi.nrw.de

If you are resident in another EU member state, you may also lodge a complaint with the supervisory authority of that state.

7. Currency and changes

As our services develop, or where legal or regulatory requirements change, it may become necessary to amend this privacy policy. The current version is always available on this page.