The controller responsible for processing personal data on this website is: Gwydion Braunsdorf, Marktplatz 7, 87724 Ottobeuren, Germany. Contact: hello@gwydion.dev
This privacy policy explains the nature, scope, and purpose of processing personal data in connection with visiting gwydion.dev, using the contact form, and the “Terminanfragen” Google Drive integration for the studio websites I build and maintain.
This website is hosted by Vercel Inc. (United States). When you access the site, Vercel processes technically necessary data (for example IP address, time of access, requested resource, amount of data transferred, referrer, user agent) to deliver and secure the website.
Processing is carried out to provide the online service (Art. 6(1)(f) GDPR — legitimate interest in secure and stable operation). Where a data processing agreement exists, transfers to third countries rely on standard contractual clauses adopted by the EU Commission where no adequacy decision applies.
More information: https://vercel.com/legal/privacy-policy
This website uses Vercel Analytics, a privacy-friendly analytics service provided by Vercel Inc. (United States). Vercel Analytics collects aggregated, non-personal usage data (such as pages visited, referrer, broad geographic origin at country level, browser and device category). No cookies are set and no individual user profiles are created.
Processing serves the purpose of analysing anonymised usage behaviour to improve the website. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in optimising the website). As no personal data is stored permanently or profiled, the impact on the right to informational self-determination is minimal.
More information: https://vercel.com/docs/analytics/privacy-policy
When you use the contact form, the data you enter (name, email address, message text) is processed to handle and respond to your request. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in responding to incoming inquiries).
Messages are sent via Resend (Resend Inc., USA). The data listed above is processed to deliver the email to hello@gwydion.dev. A data processing agreement may be in place with Resend; transfers to the United States rely on appropriate safeguards (for example standard contractual clauses). More information: https://resend.com/legal/privacy-policy
Data is deleted when it is no longer needed for the purpose, unless statutory retention obligations apply.
To protect the contact form from abuse, your IP address may be processed temporarily in limited in-memory rate limiting. The purpose is to block automated or excessive requests. Legal basis: Art. 6(1)(f) GDPR. Data is discarded automatically after a short time and is not stored permanently.
Your colour scheme preference (light/dark) may be stored in the browser using localStorage so this setting persists on your next visit. The language follows the URL and is not stored. No tracking cookies are used for advertising and no data is shared with third parties. The legal basis for storing the colour scheme is Art. 6(1)(f) GDPR (convenient use of the site). You can delete the entry in your browser settings at any time.
For the tattoo studio websites I build and maintain, I operate the Google app “Terminanfragen” (booking requests). It lets a studio connect its own Google Drive to its website, so booking requests submitted through the website form are saved as a PDF, together with the uploaded images, in a folder the studio chooses.
The app only requests the “drive.file” scope. It can therefore only see and edit folders the studio explicitly selects in the Google folder picker and files the app created itself. It has no access to any other content in Google Drive. When connecting, the Google account’s email address and the name and ID of the selected folder are also stored, so the studio and I can see where requests are delivered.
The token issued by Google is stored per website, encrypted (AES-256-GCM), in a private Vercel store in Frankfurt, and is only used to save requests and to check regularly that the folder is still reachable. Google Drive data is not shared with third parties, not sold, and not used for advertising or to train AI models.
The use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy (https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements.
Each studio is the controller for its booking requests; I process them on its behalf (Art. 28 GDPR). The legal basis for the connection is Art. 6(1)(b) GDPR (performance of the contract with the studio). A studio can revoke access at any time at https://myaccount.google.com/permissions. On request I delete the stored connection immediately; an email to hello@gwydion.dev is enough.
You have the right to obtain information about personal data concerning you (Art. 15 GDPR), to rectification (Art. 16 GDPR), to erasure (Art. 17 GDPR), to restriction of processing (Art. 18 GDPR), to data portability (Art. 20 GDPR), and, under certain conditions, to object to processing (Art. 21 GDPR).
Where processing is based on consent, you may withdraw consent with effect for the future (Art. 7(3) GDPR).
You have the right to lodge a complaint with a supervisory authority regarding the processing of personal data (Art. 77 GDPR). The supervisory authority competent for the controller is: Bayerisches Landesamt für Datenschutzaufsicht (BayLDA), Promenade 27, 91522 Ansbach, Germany, https://www.lda.bayern.de
This policy will be updated when legal or technical aspects of the website change. The version published on gwydion.dev applies.