Section 01 · kopf
Head
H1 "Privacy Policy" → language line (link to the German version) → scope line (whose data) → mandatory anchor nav linking sections 2–9. No intro prose, no hero.
Section 02 · controller
Controller
Full name + serviceable address (same slot as the imprint — Founder decision 1, gates P2/P6) + SUPPORT_EMAIL. No DPO (§38 BDSG), no EU representative (Art. 27) — both omitted entirely.
Section 03 · hosting
Hosting & Server Logs
Vercel as processor (Art. 28), technically required logs/IP under Art. 6(1)(f), US transfer + safeguard mechanism (verify against Vercel DPA at copy pass). Error logs carry no form PII (scrubbed).
Section 04 · cookies
Cookies & Local Storage
Honest inventory: ONE functional locale cookie (consent-free, §25(2)(2) TDDDG); no consent banner because no consent-requiring tech exists. Short block + link to /legal/cookies (detail truth lives there).
Section 05 · waitlist
Waitlist
email/shop_url/locale/source/user_agent to Supabase (Frankfurt/EU). Legal bases unstacked: reservation = Art. 6(1)(b); launch notification = separate purpose (copy-pass decision). Provision voluntary; retention = Founder decision 7.
Section 06 · scan
Free Scan — Your Data
shopUrl + OPTIONAL leadEmail (purpose-bound to the report); IP only transient for rate limiting (in-memory); report link-private + noindex; lead_email excluded from read paths. Art. 6(1)(b).
Section 07 · fremdscan
Scanning Third-Party Shops
Art. 14 block: the scanner reads publicly accessible shop pages. Art. 6(1)(f) with written-out balancing test, named data category, Art. 14(5)(b), owner opt-out via /contact. This section is the scanner's go-live gate (P1).
Section 08 · contact
Contact & Scheduling
Email processed only to answer (one statement shared with /contact); cal.com as external provider behind a link — their privacy policy applies, processing starts on click (lawyer check: processor question).
Section 09 · rights
Your Rights & Complaints
Art. 15–20, Art. 21 objection highlighted (sections 3+7 rest on 6(1)(f)), withdrawal only conditional, complaint right WITH named supervisory authority (slot follows address), no automated decision-making (Art. 22). Ends with the dated status line.