1. Controller
2. Visiting the website and hosting via Cloudflare
This website is delivered through Cloudflare Workers and the Cloudflare network, provided by Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA. When you visit, data such as your IP address, date and time, requested URL, referrer, browser and device information and security events may be processed.
This serves to deliver the website, ensure stability, analyse errors and protect against attacks. The legal basis is Article 6(1)(f) GDPR; our legitimate interest is the secure, fast and reliable operation of this website.
3. Waitlist and email newsletter
If you join the waitlist, we process your email address, selected language, time of sign-up and, where available, campaign parameters such as source, medium, campaign and the page variant you saw. Only the email address is required.
Brevo, a service of Brevo SAS, 106 boulevard Haussmann, 75008 Paris, France, is used for sending and list management. Sign-up uses double opt-in: your address is activated only after you click the confirmation link.
The legal basis is your consent under Article 6(1)(a) GDPR. You can withdraw it at any time via the unsubscribe link in every email or by writing to us, with effect for the future.
4. Protecting the sign-up form with Cloudflare Turnstile
We use Cloudflare Turnstile to protect the form against automated abuse. Technically necessary connection and verification data such as IP address, user agent and site key may be sent to Cloudflare; the private verification key remains on our server.
The legal basis is Article 6(1)(f) GDPR; our legitimate interest is protecting the form, our email infrastructure and other users against spam and attacks.
5. Necessary cookies and local storage
Your language choice may be stored in the necessary cookie talehouse_locale for up to one year. Your analytics and marketing choice is stored in your browser under talehouse_consent_v1 and mirrored in a necessary first-party cookie, so the choice also works where local storage is unavailable. It contains only the selected categories, the time and a version number.
These are required to provide the language you chose and to respect your privacy decision. The legal basis is section 25(2) no. 2 TDDDG, with subsequent processing based on Article 6(1)(f) GDPR.
6. Comparing page variants
Only if you consent to analytics, the homepage may show you one of several headline variants at random and remember it for 30 days in the cookie talehouse_hero, so you see the same variant on return. In the same way, a test of page designs may store the chosen look in the cookie talehouse_look. Which variant you saw is measured with Google Analytics and may be stored with a waitlist sign-up. Without analytics consent, everyone sees the standard variant and nothing is stored.
The legal basis is section 25(1) TDDDG and Article 6(1)(a) GDPR. You can withdraw consent in the cookie settings at any time.
7. Google Analytics 4
If you consent to analytics and a measurement ID is active, we use Google Analytics 4 by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Page views, page titles, URLs, interactions, technical browser and device information and an approximate region may be collected. We never send the email address you enter in the form to Google Analytics.
Google signals and ad personalization are only enabled if you also consent to marketing. Google Analytics loads only after your consent. The legal basis is section 25(1) TDDDG and Article 6(1)(a) GDPR.
8. Meta Pixel
If you consent to marketing and a pixel ID is active, we use the Meta Pixel by Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland. The pixel may measure page views and events such as a waitlist sign-up and connect them with browser, device, referrer and cookie information.
This helps us measure campaigns on Facebook and Instagram and build advertising audiences. Meta may process data under its own terms. The pixel loads only after your consent. The legal basis is section 25(1) TDDDG and Article 6(1)(a) GDPR.
9. Reddit Pixel
If you consent to marketing and a pixel ID is active, we use the Reddit Pixel. For users in the EEA, the provider is Reddit Netherlands B.V., Looiersgracht 43, 1016 VR Amsterdam, Netherlands. The pixel may record page visits and sign-ups as well as referrer, event and device information.
This serves to measure Reddit campaigns. The pixel loads only after your consent. The legal basis is section 25(1) TDDDG and Article 6(1)(a) GDPR.
10. Recipients and transfers to third countries
Recipients of personal data may be Cloudflare, Brevo and, only with your consent, Google, Meta and Reddit. Where required, we conclude data processing agreements under Article 28 GDPR.
Some providers or their sub-processors may process data outside the European Economic Area. Depending on the provider, transfers rely on an adequacy decision, in particular the EU-US Data Privacy Framework, or on the European Commission's standard contractual clauses.
11. Storage period
We store personal data only as long as necessary for the respective purpose. Newsletter data remains on the active list until you withdraw consent; proof of consent may be kept longer to meet legal obligations. Local consent and language choices remain until you delete your browser data or the cookie expires.
12. Your rights
Under the statutory conditions you have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20) and objection (Art. 21). You can withdraw consent at any time with effect for the future (Art. 7(3) GDPR). An email to us is enough.
13. Right to lodge a complaint
You can complain to a data protection supervisory authority. The authority generally responsible for us is the Bavarian State Office for Data Protection Supervision (BayLDA), Promenade 18, 91522 Ansbach, Germany. You may also contact the authority where you live or work.
14. Status
As of October 2026. We update this policy when features, providers or legal requirements change. The privacy notice for the Tale House app itself is published separately in the app.