1. Controller and contact
Jörg Klausewitz, trading as apptheism, is the controller for the Statpur website, account administration and support. Privacy requests can be sent to the email address below.
apptheism · Jörg KlausewitzFischmarkt 1778462 KonstanzGermany[email protected]+49 7531 28416652. Website and hosting
A request to the website involves processing an IP address, browser information, requested resource and timestamp to deliver and protect the service. The legal basis is Article 6(1)(f) GDPR; our legitimate interest is secure, functional operation. Statpur does not keep persistent HTTP access logs containing visitor IP addresses or requested URLs. Operational and error information is processed where needed for troubleshooting.
The application, collector and database are hosted by Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany. The current server location is Nuremberg. Hetzner also hosts the support mailbox. Transmission is encrypted using HTTPS/TLS. Fonts and the demo video are served from our own server.
The public Statpur pages contain no advertising trackers or embedded external video or font providers. The demo video uses sample data.
3. Account, sign-in and support
When Apple or Google sign-in is offered, the connection starts only after selecting the provider. Statpur processes the stable account identifier and supplied email address, including an Apple private relay address where applicable. Provider passwords are not sent to Statpur. Encrypted Apple credentials are stored to check and revoke the connection. The provider processes connection data during sign-in under its own privacy notices.
An account involves processing an email address, an optional protected password verification value, organisation and website information, and permissions. This is necessary to provide the account and agreed service under Article 6(1)(b) GDPR. For business contacts who are not themselves a contracting party, our legitimate interest in administering the contract is the basis under Article 6(1)(f) GDPR. Sign-in cannot be provided without the required account data.
Session data, administrative actions, usage counters and short-lived rate limits support abuse prevention, tenant separation and enforcement of agreed usage limits under Article 6(1)(f) GDPR. We do not make automated decisions producing legal or similarly significant effects.
When contacted, we process sender details and message content to handle the request. Article 6(1)(b) GDPR applies to contractual enquiries; otherwise, Article 6(1)(f) GDPR applies with our legitimate interest in responding.
4. Functional cookies and browser storage
The tracking script uses neither cookies nor local browser storage. Separately, the Statpur interface uses storage for explicitly requested functions under Section 25(2)(2) TDDDG. Subsequent processing for account use is based on Article 6(1)(b) GDPR, or Article 6(1)(f) GDPR for providing the requested functionality.
- __Host-statpur_session: sign-in session, up to seven days; signing out invalidates it on the server. The cookie is protected from JavaScript access and transmitted only over HTTPS.
- Optional provider sign-in: statpur_google, statpur_google_flow or statpur_apple_flow bind the flow to the browser for up to ten minutes. These cookies are protected from JavaScript access. Apple's cross-site callback requires SameSite=None and HTTPS. On iPhone, the Statpur session and, where applicable, the Apple user identifier are stored in the device keychain. The Watch receives no sign-in secrets.
- statpur_locale: explicitly selected language, one year; English is the default without a selection.
- statpur_shortcuts_enabled: keyboard-shortcut preference in local browser storage until changed or removed.
- statpur_pending_setup: website setup progress in session storage until setup completes or the browser session ends.
5. Website analytics with Statpur
apptheism also uses Statpur on statpur.com to understand how its public pages are used and where visits come from. Measurement covers the home, pricing, privacy, terms and legal notice pages; the signed-in dashboard and account actions are excluded. Approved campaign codes can identify a link from X, for example. Form inputs, full URLs and arbitrary URL parameters are not transmitted. Data is deleted after 90 days. The basis is Article 6(1)(f) GDPR, with the legitimate interest in understanding reach and use of the service while minimising data. Enabling Do Not Track or Global Privacy Control in the browser prevents this measurement.
When a website embeds Statpur, it processes approved page and event identifiers, timestamps, broad referral sources and approved campaign codes. Full page URLs, search queries and form content are not transmitted automatically. Do Not Track and Global Privacy Control are respected.
Visitor counting derives an identifier from the IP address and browser information using a random key that changes daily. The raw IP address and browser information are processed transiently and are not stored in the analytics database. An identifier applies to one website and one UTC day; daily keys are discarded after the day changes. There is no persistent identifier shared across websites. As a precaution, daily identifiers are treated as pseudonymous data.
Each website operator determines the purpose and legal basis of measurement and provides the required notices. Where personal data is processed on behalf of an operator, apptheism follows its instructions and a separate data processing agreement under Article 28 GDPR. Cookieless tracking is not a blanket assurance that every implementation is lawful without consent.
6. Optional revenue attribution
A website can also attribute confirmed Stripe payments to conversions. Through the webhook configured by the website operator, Statpur receives payment and event references, amount, currency, timestamp, refund status and approved attribution. Payer names, email addresses and card details are not retained in Statpur's payment ledger; complete webhook payloads are not stored persistently.
The website operator maintains its own Stripe connection and is responsible for payment processing and the relevant privacy notices. German hosting refers to Statpur's infrastructure, not the payment provider's systems.
7. Retention and deletion
- Analytics data, conversions and attributed payment records: 90 days by default, configurable by the website operator from one to 365 days; expired data is cleaned up hourly.
- Accounts and website settings: for the duration of use. Account → Sign-in & security allows account deletion with a preview of affected workspaces. Deletion can also be requested at [email protected]. Analytics data can be deleted in website settings. Encrypted Apple revocation jobs remain until revocation succeeds. Password reset links are single-use and valid for 30 minutes; expired records are removed hourly.
- Sign-in sessions: up to seven days. Administrative audit records: 365 days. Monthly usage counters: twelve months.
- Support correspondence: for as long as needed to handle the request and retain necessary evidence. Statutory retention duties may require longer storage under Article 6(1)(c) GDPR.
- Access-restricted backups: for as long as needed for recovery or troubleshooting, then deleted or replaced. They are not used for routine analysis; deleting active database records does not simultaneously erase all existing backup copies.
8. Recipients
apptheism and technical service providers receive access where necessary for their roles. Hetzner is the hosting and email provider. Analytics data is shown to the authorised website operator. Disclosure may also be necessary to comply with a legal obligation or establish, exercise or defend legal claims.
The Statpur database and server-side analysis are located in Germany. Cloudflare protects and delivers the public website; Turnstile protects sign-in; international processing is explained in the “Protection against attacks and automated access” section. External links transmit data to the linked website only when opened. Additional notices apply to external services selected as optional features.
9. Rights and complaints
Subject to the applicable legal conditions, rights include access, rectification, erasure, restriction of processing and data portability under Articles 15–20 GDPR. Consent can be withdrawn at any time for the future without affecting the lawfulness of earlier processing.
Processing based on legitimate interests may be objected to on grounds relating to a particular situation under Article 21 GDPR. Requests can be sent to [email protected]. For analytics on another website, its operator is the first contact; we assist the operator in handling requests.
A complaint can be lodged with a data protection supervisory authority under Article 77 GDPR, particularly in the country of habitual residence, work or the alleged infringement. The authority responsible for apptheism is the State Commissioner for Data Protection and Freedom of Information Baden-Württemberg: Heilbronner Straße 35, 70191 Stuttgart, Germany; postal address: Postfach 10 29 32, 70025 Stuttgart, Germany.
Protection against attacks and automated access
The public Statpur website is protected and delivered through Cloudflare. Sign-in, registration and password requests are protected with Turnstile (Cloudflare, Inc., USA). Cloudflare processes information including IP addresses, browser and connection information, and signals used to distinguish human from automated access. Cloudflare operates a global network; processing exclusively in Germany is not promised for these services. Security checks apply to sign-in, registration and password requests.
The purpose is to protect against DDoS attacks, abusive sign-in attempts and automated requests. The legal basis is Article 6(1)(f) GDPR; our legitimate interest is secure operation. The linked privacy notices explain Cloudflare's processing, international transfers and safeguards. Rate limits on the German server use transient data in memory; the application uses keyed hashes for this purpose. No persistent IP access logs are created.
The tracking script runs in the website visitor's browser. It is loaded directly from collect.statpur.com and sends events there. These HTTP requests do not pass through the Cloudflare proxy; Turnstile is not part of the tracking script. Event collection, storage in the Statpur database and server-side analysis take place on our Hetzner infrastructure in Nuremberg, Germany. The dashboard at app.statpur.com and its data API are also delivered directly from there, without the Cloudflare proxy.
Subscriptions and payments
To perform the contract, we process trial dates, plan, usage limits, Stripe customer and subscription identifiers, and invoice, payment and cancellation status. The email address and payment order are transmitted to Stripe. Payment details are collected directly by Stripe in Checkout and the customer portal; Statpur does not store full card details. The legal basis is Article 6(1)(b) GDPR; statutory retention obligations are based on Article 6(1)(c) GDPR.
The payment provider for the EEA is Stripe Payments Europe, Limited, Ireland. Stripe also processes payment data as an independent controller, including for fraud prevention and legal obligations, and may transfer data outside the EEA. Stripe’s privacy policy describes the applicable safeguards and recipients. Cancellation declarations and confirmations are stored encrypted for contract administration and deleted when no longer needed and statutory retention periods have expired.