Privacy policy

1. Controller

Responsible for data processing on this website:

Sebastian Waldleben (Thinking House Lab), Nachtweide 3a, 39326 Wolmirstedt, Germany

Email: waldleben@web.de

Phone: +49 151 25320433

2. Hosting, Cloudflare and server log files

This website is a static site. It sits on a server I run myself and is delivered through a tunnel of the network service Cloudflare: Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA. Every page request therefore passes through Cloudflare's network. Cloudflare processes the connection and request data on my behalf (Art. 28 GDPR), above all your IP address, the address requested and your browser identification, in order to deliver the site and protect it against attacks. This is based on Cloudflare's data processing agreement (Data Processing Addendum). Cloudflare stores this data only as long as it is needed for delivery and protection, and deletes it as set out in the data processing agreement.

Cloudflare may also process this data in the USA. Cloudflare, Inc. is certified under the EU–US Data Privacy Framework; the transfer is based on the European Commission's adequacy decision of 10 July 2023 (Art. 45 GDPR). In addition, Cloudflare's data processing agreement includes the European Commission's standard contractual clauses (Art. 46(2)(c) GDPR). Cloudflare's privacy policy: https://www.cloudflare.com/privacypolicy/

When you open a page, your browser automatically transmits technical data: IP address, date and time, the page requested, the referring page, and browser and operating system. This data is needed to deliver the page and to keep the server secure. It is not combined with other data and not used for advertising. Cloudflare shows me aggregated traffic figures based on it, such as the number of requests and visitors, without naming individual people.

The web server records requests in technical log files. They are used only for troubleshooting and to fend off attacks. Your IP address is shortened before it is written: for IPv4 addresses the last of the four number blocks is set to 0, for IPv6 addresses only the first three blocks are kept. The log files are deleted automatically after 7 days at the latest. Since 3 October 2026 they are no longer included in backups of the server; older backups that still contain log files with full IP addresses are deleted.

Error reports (Network Error Logging): with every page, Cloudflare sends the headers “NEL” and “Report-To”. They ask your browser to tell Cloudflare when a connection to this website fails, for example because of a timeout or a dropped connection. Successful requests are not reported. If your browser supports this (mainly Chrome, Edge and other Chromium-based browsers), it sends a short report to a.nel.cloudflare.com when such an error occurs. The report contains the address requested, the type of error, time and duration, the server's IP address, your browser identification and the referring page; Cloudflare sees your IP address, as with any request. Cloudflare uses these reports to detect problems in its network and to improve availability. No cookies are set; your browser only remembers the instruction itself, for 7 days at most. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in a reliably reachable website).

Legal basis for the processing in this section: Art. 6(1)(f) GDPR (legitimate interest in delivering the website securely and reliably).

3. Visitor statistics (Cloudflare Web Analytics)

Cloudflare does not insert the statistics script into the page if your request runs through a Cloudflare data centre in the EU, Iceland, Liechtenstein, Norway, Switzerland or the United Kingdom. Your request normally runs through a data centre near you. If you visit the site from one of these countries, the script therefore does not run as a rule. Only if your request runs through a data centre in another country, for example because you use a VPN, is it inserted anyway.

For requests through data centres in all other countries, Cloudflare inserts a small script into the page. Your browser loads it from static.cloudflareinsights.com, an address of Cloudflare. The script reports the page view to Cloudflare: which page you open, which page you came from, and how quickly the page loads and responds. Cloudflare also recognises your browser, operating system and device type, and the country the request comes from. Cloudflare derives the country from your IP address.

According to Cloudflare, the script sets no cookies, stores nothing in your browser and does not read anything stored there. Also according to Cloudflare, your IP address is discarded at the nearest Cloudflare data centre and not stored, and no “fingerprint” of your device is created. I only see aggregated figures, for example how often a page was viewed and from which countries. I don't see names or IP addresses.

Purpose: I want to get an idea of how many people read the pages, which topics are of interest and whether the pages load quickly. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in aggregated visitor statistics without cookies). The GDPR also applies to visits from outside the EU, because I, as the controller, am based in Germany (Art. 3(1) GDPR).

Recipient: Cloudflare processes this data on my behalf (Art. 28 GDPR), based on the same data processing agreement as in section 2. Because the script is only inserted for requests through data centres outside the countries listed above, the reports usually go to a Cloudflare data centre outside the EU. Cloudflare may also process the data in the USA. The same safeguards as in section 2 apply: the EU–US Data Privacy Framework and, in addition, the standard contractual clauses.

Storage period: according to Cloudflare, the individual reports are kept in full for 7 days and then condensed to roughly a tenth. I can access the statistics for the past six months. Cloudflare's description of Web Analytics does not say when the condensed data is finally deleted.

Objection: you can object to the visitor statistics at any time (Art. 21 GDPR, section 11); an informal message to the contact details in section 1 is enough. Because I cannot recognise anyone in the statistics, however, I cannot remove individual visits. You can reliably prevent being counted yourself: block scripts from static.cloudflareinsights.com in your browser, for example with a content blocker. The website works just the same without the script.

4. Cookies and local storage

This website does not set cookies.

Two settings can be stored in your browser's local storage: your language choice and, if you tick the box, your decision to load YouTube videos without asking again. Both stay on your device and are never transmitted to me. You can delete them at any time in your browser settings; the YouTube choice also with the button “Revoke YouTube consent” in section 7 or under each video.

Legal basis: § 25(2) no. 2 TDDDG (strictly necessary to provide the function you asked for).

5. Language selection

To show you the right language, the site reads the language setting your browser reports. Your location is not determined, and your IP address is not used for this. You can switch languages at any time.

Legal basis: § 25(2) no. 2 TDDDG (strictly necessary to show you the site in your language).

6. Fonts

The fonts are stored on this server. No connection to Google Fonts or any other font service is made.

7. Embedded YouTube videos

Videos are embedded from YouTube, a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Until you click, only a placeholder from this server is shown, and no connection to YouTube is made.

When you click “Load video from YouTube”, the video is loaded via youtube-nocookie.com and starts playing. Your browser then connects to Google's servers. Google receives at least your IP address and the address of the page you're on, and may use cookies or similar technologies once the video plays. Data may be transferred to the USA. Google LLC is certified under the EU–US Data Privacy Framework; the transfer is based on the European Commission's adequacy decision of 10 July 2023 (Art. 45 GDPR).

If you also tick “Remember my choice on this device”, videos on this site are loaded as soon as you open a video page, without asking again. From then on, the connection to Google is made when the page opens. The video does not start by itself; it only plays when you click play. The stored choice is valid for 12 months; after that, every video asks again.

Legal basis: your consent, Art. 6(1)(a) GDPR and § 25(1) TDDDG. You can withdraw it at any time with effect for the future, as easily as you gave it: with the button “Revoke YouTube consent” below or under each video. This deletes the stored choice on your device; after that, every video asks again. Google's privacy policy: https://policies.google.com/privacy

8. Contact by email or phone

If you write to me by email or call me, I process your contact details (e.g. email address or phone number) and your request in order to answer. Legal basis: Art. 6(1)(f) GDPR (my legitimate interest in answering enquiries); where it concerns a contract or steps prior to entering into one, Art. 6(1)(b) GDPR. I delete emails, voicemail messages and notes on calls once the matter is settled, unless statutory retention periods apply.

My mailbox is hosted by WEB.DE, a service of 1&1 Mail & Media GmbH, Zweigniederlassung Karlsruhe (Karlsruhe branch), Brauerstraße 48, 76135 Karlsruhe, Germany. Your email is stored there. This only happens if you write to me; simply visiting this website does not contact any email service.

9. My YouTube channel

Google Ireland Limited is responsible for the YouTube platform (privacy policy: https://policies.google.com/privacy). On my channel Thinking House Lab, I see public comments together with the name you use on YouTube, and I can reply to, hide or delete them. YouTube also shows me aggregated statistics from which I cannot identify individual people.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in running the channel and talking with viewers). You can exercise your rights under section 11 both with me and with Google.

10. What this site doesn't use

Apart from Cloudflare's visitor statistics (section 3), no analytics tools, no advertising networks, no social media plug-ins, and for now no newsletter. If any of that changes, this policy will change first.

11. Your rights

You have the right to access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). You can withdraw any consent at any time with effect for the future (Art. 7(3)).

Right to object: Where I process data on the basis of Art. 6(1)(f) GDPR (sections 2, 3, 8 and 9), you can object to this processing at any time on grounds relating to your particular situation (Art. 21 GDPR). I will then stop processing the data unless I can demonstrate compelling legitimate grounds that override your interests, or the processing serves the establishment, exercise or defence of legal claims.

To exercise any of these rights, an informal message to the contact details in section 1 is enough.

You also have the right to lodge a complaint with a data protection supervisory authority, in particular in the EU member state of your habitual residence (Art. 77 GDPR). The authority responsible for me is the Landesbeauftragte für den Datenschutz Sachsen-Anhalt (data protection commissioner of Saxony-Anhalt), Otto-von-Guericke-Straße 34a, 39104 Magdeburg, Germany, https://datenschutz.sachsen-anhalt.de

12. Status

Status of this privacy policy: October 2026