Privacy Policy / Datenschutzerklärung
Privacy Policy / Datenschutzerklärung
Last updated: 2026-06-18
1. Controller
The controller responsible for data processing on this website (Art. 4(7) GDPR) is:
Johannes Kantorczyk
Landsberger Straße 185, 12623 Berlin, Deutschland / Germany
Email: hello@tryeverstory.com · Phone: +49 176 72027558
We have not appointed a Data Protection Officer, as we are not legally required to.
2. Overview of what we process
We process personal data to operate this store, fulfil orders, produce your memory reel,
and meet legal obligations. We minimise what we collect and never sell your data.
3. Hosting & store platform (Shopify)
Our store runs on Shopify (Shopify International Ltd., Ireland; Shopify Inc., Canada).
Shopify acts as our processor under a data processing agreement (Art. 28 GDPR) and
processes order, device, and usage data on our behalf. Some processing may involve transfers
to the USA and other third countries; these are covered by EU Standard Contractual Clauses
and, where applicable, the EU-US Data Privacy Framework.
- Legal basis: Art. 6(1)(b) GDPR (performance of contract) and Art. 6(1)(f) (legitimate
interest in a secure, efficient online store).
4. Server log files
Our hosting automatically collects access data (IP address, date/time, page requested,
browser/OS, referrer) for security and operation.
5. Orders and customer account
To process an order we collect: name, billing/contact address, email, phone (optional),
order contents, and payment status. If you create an account, we store these for reuse.
- Legal basis: Art. 6(1)(b) GDPR. Retention: for the duration of the contract and as long
as statutory commercial/tax retention periods require (generally up to 6 to 10 years under
German HGB/AO).
6. Photos you upload (special note)
To produce your memory reel you upload family photographs. These images, and any people
depicted, may constitute personal data.
- Retention: photos and the finished reel are deleted after delivery plus a grace period of
90 days (so we can re-supply or correct), unless you ask us to delete sooner or
to keep them longer.
6a. How your photographs are processed, and who processes them
Your reel is produced with a combination of **automated image and video processing and human
editing**. A person reviews and approves every reel before it is delivered. To do this, your
photographs are stored and processed by the following providers acting on our behalf:
| Provider | Role | Location |
|---|---|---|
| Cloudinary | Receives and stores the photographs you upload | EU / USA |
| Cloudflare (R2, D1, Pages) | Stores order files and the finished reel for delivery | EU / USA |
| fal.ai and the image/video model providers it routes to | Restoration, colourisation and animation of individual photographs | USA and, depending on the model used, other third countries |
Transfers outside the EU/EEA are made on the basis of the EU Standard Contractual Clauses and/or
an adequacy decision, and are limited to what is needed to produce your reel. If you would rather
your photographs were not processed outside the EU/EEA, email us before ordering and we will tell
you whether we can produce your reel that way.
- Legal basis: Art. 6(1)(b) GDPR (performance of the contract), Art. 49(1)(b) GDPR for the transfer
where no other basis applies.
7. Payments
Payments are handled by our payment providers (e.g. Shopify Payments / Stripe, PayPal,
and any others enabled at checkout). The relevant provider processes your payment data directly;
we receive only the data needed to confirm and fulfil the order.
8. Cookies, analytics and advertising measurement
We use technically necessary cookies to run the store (basis: Art. 6(1)(f) GDPR / § 25(2) TDDDG).
Any non-essential cookies (analytics, marketing) are set only with your consent via our
cookie banner (basis: Art. 6(1)(a) GDPR / § 25(1) TDDDG). You can withdraw consent at any time
via the banner/settings. Declining leaves the shop fully functional.
These are the non-essential services we run, all of them gated behind that consent:
| Service | Provider | What it does | Cookies / identifiers |
|---|---|---|---|
| Meta Pixel and Meta Conversions API | Meta Platforms Ireland Ltd. | Measures whether our Facebook and Instagram ads lead to visits and orders. The Conversions API sends the same events from our server, including a hashed version of your email address for order events. | `_fbp`, `_fbc` |
| Google Analytics 4 | Google Ireland Ltd. | Aggregate statistics on how the shop is used | `_ga`, `_ga_*` |
| Pinterest Tag | Pinterest Europe Ltd. | Measures whether our Pinterest posts lead to visits and orders | `_pinterest_ct_ua` and similar |
| Klaviyo | Klaviyo Inc. | Sends order and abandoned-basket emails, and measures whether they were opened | `__kla_id` |
- These providers process data in the USA as well as the EU. Transfers rely on the EU-US Data
Privacy Framework where the provider is certified, otherwise on Standard Contractual Clauses.
- Meta and Google act as joint controllers with us for the collection and transmission of this
data, under Art. 26 GDPR. You can exercise your rights against either party.
- You can withdraw consent at any time via the cookie banner, and object to Meta's own use of the
data in your Facebook or Instagram ad settings.
9. Contact
If you email us, we process your message and contact details to handle your enquiry.
- Legal basis: Art. 6(1)(b) or (f) GDPR. Retention: until your enquiry is resolved, then per
statutory periods.
10. Social media (Instagram, TikTok)
We maintain profiles on Instagram and TikTok and link to them. Visiting those platforms is
governed by the respective platform's privacy policy; we have no control over their processing.
11. Your rights
Under the GDPR you have the right to: access (Art. 15), rectification (Art. 16), erasure
(Art. 17), restriction (Art. 18), data portability (Art. 20), and objection (Art. 21). Where
processing is based on consent, you may withdraw it at any time with future effect (Art. 7(3)).
To exercise any right, contact hello@tryeverstory.com.
You also have the right to lodge a complaint with a supervisory authority, e.g. the data
protection authority of your federal state (Land) in Germany.
11a. If you are in the United Kingdom
The same rights apply to you under the UK GDPR and the Data Protection Act 2018. You may lodge a
complaint with the Information Commissioner's Office (ico.org.uk, helpline 0303 123 1113).
11b. If you are in the United States
We sell to customers in the US and we want to be plain about what that means, whether or not your
state gives you a statutory right to ask.
- **We do not sell your personal information, and we do not share it for cross-context behavioural
advertising** in the sense those terms are used in the CCPA/CPRA. We do not receive money or
anything of value for it.
- We do use the advertising and analytics services listed in section 8. If you decline the cookie
banner, none of them load. That is the same control a "Do Not Sell or Share My Personal
Information" link would give you, available to everyone on every page.
- We never use your uploaded photographs for advertising, for marketing, or to train AI models.
They are used to make your reel and are deleted on the schedule in section 6.
- Residents of California, Colorado, Connecticut, Virginia and other states with comparable laws may
request access to, correction of, or deletion of their personal information, and may appeal a
refusal. Email hello@tryeverstory.com and we will answer within 45 days. We will not discriminate
against you for asking.
- We do not knowingly collect personal information from children under 16.
12. Changes
We may update this policy to reflect legal or operational changes. The current version applies.