Privacy policy

The German version is binding.

Last updated: November 2026

1. Controller and contact

The controller for the processing of personal data on this website is the provider of ProfileFit; the contact details are in the imprint.

For questions about data protection, to withdraw your consent and to exercise your rights, write to [email protected]. No data protection officer has been appointed.

2. Overview

ProfileFit is in development. profilefit.app currently offers only this information page, the sign-up for the monthly ProfileFit update and the legal pages. The application itself is not yet publicly accessible. Before it becomes public, we will extend this policy.

We process personal data only as far as needed to run the website, to send the update, to measure the page's reach and to prove your consent. We do not sell data and do not use it for third-party advertising.

3. Hosting and delivery of the website

Hetzner. The website, its database, the reach measurement (section 8) and the backups run on servers of Hetzner Online GmbH, Gunzenhausen, in data centres in Germany. Hetzner processes the data on our behalf (Art. 28 GDPR).

Cloudflare. Every request to profilefit.app and stats.profilefit.app passes through the network of Cloudflare, Inc., San Francisco, USA. Cloudflare delivers the website, encrypts the connection, fends off attacks and redirects requests for pages that are not yet public. In doing so, Cloudflare processes on our behalf (Art. 28 GDPR) your IP address and technical details of the request (time, requested address, browser identifier). The legal basis is our legitimate interest in delivering the website securely and reliably (Art. 6 (1) (f) GDPR). On the transfer to the USA, see section 12.

Logs. Our server keeps no access logs with IP addresses. The application's error messages contain no IP addresses and are overwritten continuously. To fend off misuse, our server holds the IP address of requests to the sign-up form in memory for up to 15 minutes to limit too frequent requests; it is not stored.

4. Contact by e-mail

If you write to an address at profilefit.app, for example to [email protected] or as a reply to an update, Cloudflare forwards your message to our mailbox at Microsoft (Outlook.com). We process your address and the content to answer your request (Art. 6 (1) (f) GDPR; for requests about your rights, Art. 6 (1) (c) GDPR). We delete the message once the request is settled; we keep requests about your data protection rights for three years as proof.

5. Cookies and browser storage

Without your consent we set no cookies for analytics or advertising. These cookies are needed for the site to work:

These cookies are strictly necessary to provide the service you asked for and to respect your choice (§ 25 (2) no. 2 TDDDG). No consent is needed for them.

Only if you allow Google Analytics (section 9) does Google set these cookies:

Both apply to profilefit.app only. On spam protection in the sign-up form, see section 7; on reach measurement, sections 8 and 9.

6. Monthly ProfileFit update and pilot question

What you receive. Once a month, an e-mail about what is finished in ProfileFit and when you can test it. After you confirm your address, we ask once whether you would like to test ProfileFit early as a pilot customer. If you answer yes, we write to you personally as soon as a first version is ready to test.

What we store. Your e-mail address, whether you signed up as a company or as a freelancer, the language of the page, campaign details from the page address if present (UTM parameters), your answer to the pilot question, the version of the sign-up text you agreed to, the times of sign-up, confirmation and unsubscribe, and technical details for matching with Resend. We do not store your IP address or browser identifier for the sign-up.

Required details. To sign up we need your e-mail address and whether you are a company or a freelancer; without them we cannot send you the update. There is no legal or contractual obligation to provide them. Answering the pilot question is voluntary.

Double opt-in. After signing up you receive an e-mail with a confirmation link that is valid for seven days. We send the update only after you confirm. If you do not confirm, we delete your address after 30 days.

The legal basis is your consent (Art. 6 (1) (a) GDPR), including for the pilot question. The confirmation e-mail and keeping the proof of your consent rest on our legitimate interest in being able to prove the consent (Art. 6 (1) (f), Art. 7 (1) GDPR).

Sending with Resend. We send the confirmation e-mail and the update through Resend, a service of Plus Five Five, Inc., San Francisco, USA, acting on our behalf (Art. 28 GDPR). The e-mails are sent from Resend's servers in Ireland. For the confirmation e-mail, Resend receives your e-mail address and the content of the e-mail. After you confirm, we create a contact at Resend with your e-mail address, language and audience (company or freelancer), through which the update is sent and your unsubscribe is managed. We do not track whether you open an e-mail or click its links. On the transfer to the USA, see section 12.

Withdrawal. You can withdraw your consent at any time with effect for the future: through the unsubscribe link in every update, on the page shown after your confirmation, or by e-mail to [email protected]. The withdrawal does not affect the lawfulness of processing before it.

Retention after unsubscribing. After you unsubscribe we send nothing more. We keep the record of your sign-up (the details above with the times of consent and unsubscribe) for three years so that we can prove we wrote to you only with your consent (Art. 6 (1) (f) GDPR); after that we delete it. At Resend your contact stays marked as unsubscribed for that time, so that you receive no further e-mail, and is deleted together with our record.

7. Spam protection in the sign-up form (Cloudflare Turnstile)

We protect the sign-up form against automated sign-ups with Cloudflare Turnstile from Cloudflare, Inc., San Francisco, USA. Turnstile is loaded only when you start filling in the form. It then checks technical features of your browser and connection, including your IP address, and tells us only whether the check passed; for this our server also passes your IP address to Cloudflare. The legal basis is our legitimate interest in protecting the form and your address from misuse (Art. 6 (1) (f) GDPR); where information is read from your browser for this, it is strictly necessary for the sign-up you asked for (§ 25 (2) no. 2 TDDDG). On the transfer to the USA, see section 12.

8. Reach measurement with Umami

To understand how many people visit this page and sign up, we use Umami. We run Umami ourselves on our server at Hetzner (stats.profilefit.app, reached through Cloudflare, section 3); we pass the data to no other third parties. Umami sets no cookies and stores no IP addresses.

The script reads the screen size and language setting in your browser. It also records the page visited, the referring page, campaign details from the page address, browser, operating system, device type and the location derived from the IP address (country, region, city), as well as the steps "sign-up submitted" (with audience, language and the position of the form on the page), "address confirmed" (with language) and "pilot question answered" (with the answer). Requests are grouped by a pseudonymous identifier calculated from the IP address, the browser identifier and a value that changes monthly; it links requests at most within one calendar month, and your IP address cannot be worked out from it.

The legal basis is our legitimate interest in measuring the page's reach and the success of the sign-up without tracking you across websites (Art. 6 (1) (f) GDPR). We consider reading the screen size and language setting necessary to run the page (§ 25 (2) no. 2 TDDDG); supervisory authorities partly take a different view for reach measurement. You can object to the measurement at any time (section 15), for example by e-mail; a script or ad blocker in your browser also prevents it. We delete the measurement data after 24 months.

9. Google Analytics (only with your consent)

To evaluate the page's reach and the success of the sign-up with Google's reports as well, we use Google Analytics 4 in addition to Umami, a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland ("Google"), but only if you click "Allow" in the cookie notice at the bottom of the page. Before that, your browser loads no code from Google and makes no connection to Google; without your consent we count only with Umami (section 8).

What is recorded. After your consent, your browser loads Google's script and sends to Google the page visited (from the page address only the path and campaign details, UTM parameters; never keys from confirmation or unsubscribe links), the referring page, the page title, the time, browser, operating system, device type, screen size and language, and the steps "sign-up submitted", "address confirmed" and "pilot question answered" as in section 8. Google processes your IP address to determine your approximate location (country, region, city); according to Google, Google Analytics 4 does not store IP addresses. Google sets the cookies _ga and _ga_<id> (section 5), through which it recognises your visits as a returning visit. The data is processed on Google's servers, including by Google LLC, USA, as sub-processor of Google Ireland Limited (section 12).

What we have switched off. Google Signals (linking with Google accounts), personalised advertising and sharing the data with other Google services are off in our settings; we use no Google advertising services. Google processes the data for Google Analytics on our behalf under Google's data processing terms (Art. 28 GDPR).

The legal basis is your consent, given in the cookie notice: § 25 (1) TDDDG for the cookies and Art. 6 (1) (a) GDPR for the processing. The consent is voluntary; the site works fully without it. The cookie pf_consent remembers your choice for twelve months (section 5).

Withdrawal. You can withdraw your consent at any time with effect for the future, as easily as you gave it: click "Cookie settings" at the bottom of every page and then "Decline". Google Analytics is switched off immediately and the cookies _ga and _ga_<id> are deleted. The withdrawal does not affect the lawfulness of processing before it.

Retention. Google Analytics keeps the data about your visit for 14 months and deletes it afterwards; aggregated figures without reference to individual visits remain.

10. Error monitoring with Sentry

When errors occur on our server, we send technical error reports to Sentry, a service of Functional Software, Inc., San Francisco, USA, acting on our behalf (Art. 28 GDPR). The data is stored in Sentry's EU region in Frankfurt. The reports are created only on the server, not in your browser, and contain neither your IP address nor cookies. The legal basis is our legitimate interest in running the site without errors (Art. 6 (1) (f) GDPR).

11. Fonts

We serve the fonts from our own server. No connection to Google or any other font provider is made for fonts.

12. Transfers to third countries

Cloudflare, Resend (Plus Five Five, Inc.), Sentry (Functional Software, Inc.), Microsoft (for our mailbox, section 4) and, only with your consent, Google (Google Analytics, section 9; Google LLC, USA, is the sub-processor of Google Ireland Limited and certified under the EU-U.S. Data Privacy Framework) are companies based in the USA or belong to one. For companies certified under the EU-U.S. Data Privacy Framework, there is an adequacy decision of the European Commission (Art. 45 GDPR). Where a provider is not certified, the transfer rests on the European Commission's standard contractual clauses (Art. 46 (2) (c) GDPR) in its contract terms.

13. Retention at a glance

14. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). You can withdraw a consent at any time with effect for the future (Art. 7 (3)). Write to [email protected] for this; for Google Analytics, "Cookie settings" and "Decline" at the bottom of every page is enough (section 9), for the update the unsubscribe link (section 6).

You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), in particular in the member state of your habitual residence, your place of work or the place of the alleged infringement.

15. Right to object

Where we process your data on the basis of our legitimate interest (Art. 6 (1) (f) GDPR), you can object at any time on grounds relating to your particular situation (Art. 21 GDPR). We then stop processing the data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims. Send your objection to [email protected].

16. No automated decision-making

We make no decisions based solely on automated processing (Art. 22 GDPR).