Privacy policy

Information on the processing of personal data under Art. 13 GDPR.

Controller

Günther Wullaert
Clara-Mleinek-Straße 2
10557 Berlin, Germany
Email: info@neonhopedb.com

Hosting (Vercel)

This website is hosted by Vercel Inc., 340 S Lemon Ave #4133, Walnut, CA 91789, USA. When the site is accessed, Vercel processes technically necessary access data (including IP address, date and time, page requested, browser and device details) in server log files. The legal basis is our legitimate interest in secure and stable operation (Art. 6(1)(f) GDPR). Transfers to the USA are made on the basis of the EU Standard Contractual Clauses and/or the EU-US Data Privacy Framework.

Database and accounts (Supabase)

Accounts, decks, comments and ratings are stored and processed by Supabase Inc. (USA). Database hosting region: eu-west-3 (Paris). Processing is governed by a data-processing agreement; any transfer to a third country is covered by the EU Standard Contractual Clauses. The legal basis for providing your account is Art. 6(1)(b) GDPR.

Card scans / CDN (Cloudflare)

Card images are delivered via Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA, which processes technically necessary connection data in the process. The legal basis is our legitimate interest in fast and secure delivery (Art. 6(1)(f) GDPR).

Cookies

Only strictly necessary cookies are set: one for your signed-in session (login) and one for the selected language (nh-lang). These are required to operate the site and do not need consent (§ 25(2) TDDDG, Art. 6(1)(f) GDPR). No consent banner is therefore used.

Account and content

When you register, your email address, username and password (stored only in hashed form) are processed. Your username and any decks or comments you make public are visible to other users. Your email address is used solely for signing in and is never shown to other users. The legal basis is Art. 6(1)(b) GDPR.

Email delivery

Confirmation and password-reset emails are sent via Resend (Resend, Inc., USA). Your email address is processed for the purpose of sending these messages. Transfers to the USA are made on the basis of the EU Standard Contractual Clauses. The legal basis is Art. 6(1)(b) GDPR.

Analytics (Vercel Web Analytics)

We use Vercel Web Analytics to understand how the site is used. It measures without cookies and without persistent identifiers, and does not build cross-device profiles. The legal basis is our legitimate interest in designing the website to meet user needs (Art. 6(1)(f) GDPR).

Storage period

Account data is stored for as long as your account exists. After you delete your account, the associated personal data is deleted unless statutory retention obligations require otherwise. Server log files are retained only for a short period in line with the hosting provider’s default retention and are then automatically deleted.

Your rights

You have the right to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20), and to object to processing (Art. 21 GDPR). To exercise these rights, a message to the email address above is sufficient. You also have the right to lodge a complaint with a data protection supervisory authority.