Privacy Policy

Last updated: 14 September 2026

In short

  • Google Analytics is used on the website for reach measurement — but only if you explicitly consent when you visit. Without your consent, the website sets no analytics cookies and your browser sends no data to Google. You can change your choice any time further down on this page. Exception: after every purchase, our license service reports the purchase to Google Analytics, even without consent — details in section 3.2.
  • No Facebook Pixel, no ad networks. For reach measurement we use only Google Analytics, and only with your consent (section 3.2). The following service providers also receive data: Strato (hosting, section 2), LemonSqueezy (purchase, license, emails to buyers, affiliate program script; sections 4, 7 and 10), Cloudflare (our license service, which the thank-you page and the feature request form also use, and the Turnstile spam protection; sections 4, 6 and 7), Resend (emails for the feature request form; section 6) and Google (purchase report by our license service; section 3.2).
  • Functional localStorage without cookies: your language choice (DE/EN) and your cookie preference are stored in your browser, never transmitted to us.
  • Feature-request form at /feature-request: one-time data submission with your explicit consent — we contact you for follow-up questions or when the feature ships. Details in section 6.
  • No other newsletter tools. Direct email is the only further channel.
  • Server logs: Strato stores IP, user agent and requested URL for technical necessity — retained 7 days, then deleted.
  • Desktop app: It sends no usage or analytics data. It connects to the internet only for updates (the update notice can be switched off; the automatic update check cannot, and it transmits a random installation ID) and for your license (activation, a check about once a week). Details in section 7.

Change your cookie choice now

Reset your current cookie decision here — the consent banner will appear again on your next page navigation.

1 · Controller

Controller in the sense of the GDPR and other national data protection laws:

SuePrise
Owner: Susanne Hassepaß
Barbarossastraße 60
10781 Berlin
Germany
Email: info@deutsche-hypnose-online.de

2 · Website access

When you access this website, the hosting provider (Strato AG, Otto-Ostrowski-Straße 7, 10249 Berlin, Germany) automatically creates server log files. Recorded are:

  • IP address of the requesting device
  • Date and time of the access
  • Requested URL and HTTP status code
  • Transferred data volume
  • User agent (browser type and version, operating system)
  • Referrer, if transmitted by the browser

This data is technically necessary to provide the website and to ensure security and stability (e.g. defending against DDoS attacks). Legal basis is Art. 6(1)(f) GDPR (legitimate interest in stable operation). Logs are automatically deleted after 7 days unless a security incident requires longer retention.

3 · Cookies, local storage and consent

3.1 · Strictly necessary local storage (no consent needed)

This website uses browser-side localStorage for two functional purposes:

  • Language choice — remembers whether you prefer DE or EN
  • Cookie choice — remembers your Accept/Reject decision so you aren't asked again on every page

localStorage stays 100 % in your browser and is never transmitted to the server. Both values are purely functional and not personal data — no consent is required under §25(2)(2) TDDDG (technical necessity exception). You can delete the values any time in your browser settings.

3.2 · Google Analytics: analytics cookies (consent-based) and purchase report

This website uses Google Analytics 4 — a web analytics service operated by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland („Google"). Google Analytics helps us understand which pages and content are useful to visitors, and where we need to improve.

Important: On this website, Google Analytics is loaded and processes data only after you click „Accept" in the cookie banner. Without your consent, no analytics is performed on the website, no cookies are set and your browser transmits no data to Google. There is one exception: after every purchase, our license service reports the purchase to Google Analytics, even without your consent. What this purchase report contains is described further below.

If you consent, Google Analytics sets cookies (including _ga, _ga_*) and captures:

  • IP address: according to Google, Google Analytics 4 does not log or store IP addresses. For visitors from the EU, Switzerland and the UK, Google uses them on servers in those regions only to derive the approximate location and then discards them.
  • Visited URLs and time spent
  • Browser type and version, operating system, screen resolution
  • Approximate geographic location (country/region, no finer granularity)
  • Referrer (the page you came from)

Legal basis for the website analytics: Art. 6(1)(a) GDPR (consent) in conjunction with §25(1) TDDDG. Consent is voluntary and revocable any time — see the button at the top of this page to reset your choice.

Retention: Analytics cookies have a validity of up to 2 years. Google automatically deletes user-level and event-level data once the retention period set in our Google Analytics account (at most 14 months) has expired. Standard reports with aggregated figures are not affected by this deletion.

Transfer to third countries: With Google Analytics, data may also be processed on servers of Google LLC in the USA. Google is certified under the EU-US Data Privacy Framework, providing an adequate level of data protection. Details: policies.google.com/privacy.

Opt-out: You can stop the website analytics by Google Analytics any time by clicking „Reset cookie preference" at the top of this page and then selecting „Reject" when the banner reappears. You can also install the Google Analytics opt-out browser add-on. Neither of these stops the purchase report described below.

Purchase report: When you buy Hypnotika TranceDeck, LemonSqueezy notifies our license service on Cloudflare of the order. The license service then sends a report to Google Analytics (https://www.google-analytics.com/mp/collect, Measurement Protocol). It contains:

  • the event purchase with amount, currency and the ID of your order at LemonSqueezy (transaction_id).
  • an identifier (client_id): if your browser holds a Google Analytics cookie (_ga), the website passes its ID to LemonSqueezy when you click a purchase link, and the license service uses it for the report. On this website, Google Analytics only sets this cookie after your consent. Without that ID, the license service creates a substitute identifier from the order ID and the time of the report.
  • the indication to Google that the data should not be used for personalised ads (non_personalized_ads).

The report is sent by the license service, not by your browser. It does not contain your name, email address, license key or IP address. Purpose: we measure sales and see which pages and campaigns lead to purchases. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in measuring sales). Recipient, retention and transfer to third countries: as described above for Google Analytics.

4 · Content and services from other providers on the website

This website loads fonts, images and stylesheets only from trancedeck.deutsche-hypnose-online.de, and scripts as well, except for those listed below. No external fonts (such as Google Fonts), no social media plugins and no advertising networks are embedded. The website only uses content or services from other providers in these cases:

  • Google Analytics (https://www.googletagmanager.com): only after your consent, see section 3.2.
  • Home page and download page: they load LemonSqueezy's affiliate program script (https://lmsqueezy.com/affiliate.js). As with any request, your browser transmits your IP address and technical details (user agent) to LemonSqueezy. According to LemonSqueezy, the script creates an identifier when you open a page through an affiliate link with a code in the address (such as ?aff=1234). If you buy before this identifier expires, the purchase is attributed to the affiliate; for this, the script adds the required details to the purchase links (see docs.lemonsqueezy.com).
  • Feature request form: it loads the Cloudflare Turnstile script (https://challenges.cloudflare.com/turnstile/v0/api.js) and, when you submit the form, sends your details to our license service (https://hypnotika-keys.trancedeck.workers.dev). Details in section 6.
  • Thank-you page after purchase: it uses the order ID in its address to fetch your license key from our license service (https://hypnotika-keys.trancedeck.workers.dev). Details in section 7.

5 · Direct contact

If you contact us by email, the information transmitted (name, email address, message content) is processed to handle your request. Legal basis is Art. 6(1)(b) GDPR (pre-contractual communication) or Art. 6(1)(f) (legitimate interest in replying). Data will be deleted once its purpose is fulfilled, at the latest after 2 years, unless statutory retention periods apply.

6 · Feature request form

At /feature-request you can submit feature wishes. When you submit the form, we process the following data:

  • Required: feature description, status (interested or customer), email address
  • Optional: name, "why do I need this" reasoning
  • Technical: IP address and user agent (for spam protection and abuse mitigation)

Purpose: we contact you if we have follow-up questions about your suggestion and notify you once when the feature ships. We don't use your data for other advertising or newsletters.

Legal basis: Art. 6 (1) (a) GDPR (consent). You confirm consent actively via checkbox before submitting the form.

Storage location: Cloudflare Workers KV. According to Cloudflare, Workers KV replicates the data globally across Cloudflare's network, without restricting it to a region. For transfers from the European Economic Area to the United States, Cloudflare relies on its certification under the EU-US Data Privacy Framework; should this certification lapse or become invalid, it relies on standard contractual clauses, with supplementary measures where necessary (see cloudflare.com/privacypolicy).

Email delivery: After you submit the form, our license service sends two emails via the email service Resend (Plus Five Five, Inc., San Francisco, USA): a confirmation to you, with your name (if given) and your request, and a notification to us with your details from the form (request, status, email address and, if given, name and reasoning) and your IP address. According to Resend, the data it processes for its customers, including email content and delivery logs, is stored in the United States. Resend states that transfers there are covered by the standard contractual clauses in its Data Processing Addendum (DPA) and by its participation in the EU-US Data Privacy Framework (see resend.com/security/gdpr).

Spam protection: The form embeds Cloudflare Turnstile. According to Cloudflare, Turnstile processes signals such as your IP address, the TLS fingerprint of your connection, the user agent, and the sitekey and origin of the request, in order to tell humans from automated programs (bots). According to Cloudflare, Turnstile does not access, store or transmit messages, form entries or other inputs on the page. For bot detection, Cloudflare processes the signals on our behalf; as a controller in its own right, Cloudflare also uses them to improve Turnstile's bot detection (see the Turnstile Privacy Addendum). For transfers to the United States, what is stated above under "Storage location" about Cloudflare applies. According to Cloudflare, Turnstile only sets the cf_clearance cookie if the additional "pre-clearance" feature is switched on. When you submit the form, our license service checks the Turnstile result with Cloudflare and also transmits your IP address in the process. How long the license service stores your IP address for limiting requests is described in section 7.

Retention: as long as we have not yet implemented or rejected the feature. After sending the implementation notification, name + email are deleted within 30 days. Our license service stores your IP address and the user agent in the same record as your other details; this deletion does not cover them, and the record has no automatic deletion period. You can request access, correction or deletion any time by emailing support@deutsche-hypnose-online.de.

Withdrawal: you can withdraw your consent for the future at any time — informally by email to the address above. The lawfulness of past processing is not affected.

7 · Hypnotika TranceDeck desktop app

The desktop app needs no account and stores nothing in a cloud. It stores all session data (tracks, recordings, settings, presets, history) on your machine and uploads none of it. The app transmits no audio, session, usage or analytics data to us or any third party. What it sends for updates and for your license, including a random installation ID, is described further below.

If you switch on "Session recording (MP3)", the app saves recordings by default in the folder "Documents\Hypnotika Sessions"; you can change the folder there. If "Documents" on your machine is linked to OneDrive, OneDrive may sync the recordings to Microsoft's cloud.

The app connects to the internet only for updates and for your license:

  • Update notice: when the app starts and the last successful request is at least 24 hours old, a request to https://trancedeck.deutsche-hypnose-online.de/updates/latest.json. Can be switched off under "Settings → Software & License → Check for updates automatically". With "Check now" you can check manually there, even when the switch is off.
  • Automatic updates: 30 seconds after every start a request to https://trancedeck.deutsche-hypnose-online.de/updates/latest.yml. With every one of these checks the app sends a random installation ID (request header x-user-staging-id). The app creates this ID at its first update check and stores it in its data folder, where it stays until the folder is deleted. The update function uses it to roll out an update to only part of the installations at first, if needed. The ID goes only to the update server, not to our license service. If a newer version exists, the app downloads the installer from the same address in the background. It is only installed after you confirm. This check cannot be switched off in the app.
  • License: On activation the app sends your license key and a device label (operating system, date and time of activation) to our license service on Cloudflare (https://hypnotika-keys.trancedeck.workers.dev), which passes them on to our sales partner LemonSqueezy. After that, whenever the app starts and the last successful check is at least a week old, it checks with the license key and activation ID whether the license is valid. Removing the license from a device sends the same details, as a fallback directly to LemonSqueezy (https://api.lemonsqueezy.com). In the same way, the app frees a device slot at start when it only knows an earlier activation from its backup. The license cannot work without these connections, so they cannot be switched off.

If there is no internet connection during the check or the license service cannot be reached, the app silently keeps working with the stored license and tries again at the next start. So once activated, your sessions run without internet too.

As with any request on the internet, each of these requests transmits your IP address and technical details of the request (user agent). Our license service also uses your IP address to limit the number of requests per minute (protection against abuse). To do so, it stores your IP address with a counter in Cloudflare Workers KV; Cloudflare automatically deletes this entry 60 seconds after the last counted request. The same 60 seconds apply when the license service limits how often the thank-you page can fetch your license key. For the feature request form (section 6), it counts submissions per hour; there, Cloudflare deletes the entry one hour after the last counted submission.

License key after purchase: After your purchase, LemonSqueezy notifies our license service of the order. The license service stores your license key in Cloudflare Workers KV (on the storage location see section 6), in two entries: one under the ID of your order, and one under your email address together with the order ID. The thank-you page after your purchase uses the order ID to fetch your license key and show it to you. The entry with your email address is for support: it lets us find your license key by your email address. Cloudflare automatically deletes both entries 30 days after they were stored. If LemonSqueezy later reports a change to your license key, the license service stores them again and the 30 days start over. Legal basis: Art. 6(1)(b) GDPR (performance of the contract: handing over the license you bought).

License service logs: Cloudflare's logs (Workers Logs) are switched on for our license service. For every request they record details of the request and the response, according to Cloudflare including the request headers. For requests from your device, these contain your IP address and the user agent. This also applies to the thank-you page and to the feature request form from section 6, which use the same service. If a report from LemonSqueezy lacks the license key, the order ID or an amount, the license service also writes details from it to the log: the order ID and, depending on the case, amount and currency or your email address. The logs are used for troubleshooting. According to its documentation, Cloudflare retains them for at most 7 days.

Legal bases: for the license connections Art. 6(1)(b) GDPR (performance of the contract: use of the license you bought), for limiting requests Art. 6(1)(f) GDPR (legitimate interest in protection against abuse). For the update notice and automatic updates Art. 6(1)(f) GDPR (legitimate interest in secure, up-to-date software).

Recipients, retention, third countries: the update requests go to our hosting provider Strato; section 2 applies to them (server logs, deleted after 7 days, see there). The license connections go to Cloudflare (see also section 6) and to LemonSqueezy (see also section 10). How long these two providers store data and in which countries they process it is described in their privacy notices: cloudflare.com/privacypolicy and lemonsqueezy.com/privacy.

Links inside the app (for example to the help pages, your LemonSqueezy customer account or VB-Audio) open your browser; the privacy policy of that site applies there. The Stream Deck plugin talks to the app only locally on your machine.

8 · Data subject rights

You have the following rights under GDPR:

  • Art. 15 — access to your processed data
  • Art. 16 — rectification of incorrect data
  • Art. 17 — erasure ("right to be forgotten")
  • Art. 18 — restriction of processing
  • Art. 20 — data portability
  • Art. 21 — objection to processing

To exercise any of these rights, an informal email to info@deutsche-hypnose-online.de is sufficient.

9 · Right to complain

You have the right to lodge a complaint with the supervisory authority if you believe that the processing of your personal data violates GDPR. The competent authority for us is:

Berliner Beauftragte für Datenschutz und Informationsfreiheit
Alt-Moabit 59–61
10555 Berlin, Germany
datenschutz-berlin.de

10 · Email communication with buyers

10.1 · Update notices (existing customers)

When you purchase Hypnotika TranceDeck, our payment processor LemonSqueezy passes us your email address as part of order processing. In addition to the strictly required transactional emails (order confirmation, license key delivery), we occasionally use this address for:

  • Notifications about new versions of Hypnotika TranceDeck
  • Important security or feature changes
  • References to new help content (blog posts, guides)

Legal basis: Section 7 (3) of the German Unfair Competition Act (UWG) in conjunction with Art. 6 (1) (f) GDPR (legitimate interest). You bought from us; we use your email address exclusively for our own similar products (= updates of the app you purchased).

You can object at any time — via the „Unsubscribe" link in every email or by simple email to support@deutsche-hypnose-online.de. No costs arise for you and your license remains unaffected.

10.2 · Newsletter opt-in (voluntary)

At checkout you optionally consented to also receive broader content from us: notices about other SuePrise products, hypnosis-related topics, workshop announcements.

Legal basis: Art. 6 (1) (a) GDPR (consent). This consent is voluntary and independent of the purchase — you receive your license and all update notices even without ticking this box.

We use a double-opt-in process: after ticking the box, you receive a confirmation email with a link you must click to be added to the newsletter list.

Withdrawal possible at any time — via the „Unsubscribe" link in every email or by mail to the support address above. On withdrawal, the update notices under 10.1 remain unless you also unsubscribe from those.

10.3 · Storage and forwarding

We store your email address for delivery purposes in a sending tool we operate (currently: LemonSqueezy Customer Email). According to LemonSqueezy, the data is stored and/or processed in the United States or where LemonSqueezy or its partners, affiliates and third-party providers maintain facilities; LemonSqueezy states that it protects transfers from the European Economic Area with appropriate safeguards. Details: lemonsqueezy.com/privacy. No forwarding to third parties takes place — the address stays between you, us, our sending service provider LemonSqueezy and Cloudflare, where our license service runs (see section 7).

On unsubscription or withdrawal, your address is removed from the sending list. In a technically necessary suppression list (= „do not contact again" list) the entry remains so that accidental re-addition is prevented.

11 · Currency

This privacy policy is currently valid, dated 14 September 2026. Further development of our service or changing legal requirements may make an adjustment necessary. The current version is always available at trancedeck.deutsche-hypnose-online.de/en/privacy.