1. Controller
Thornfield Studio · Owner: David Krisch
Konradstr. 28 B, 44536 Lünen (Brambauer), Deutschland
privacy@thornfield-studio.com
2. Hosting and server logs
The website is hosted by Vercel Inc.. When a page is requested, the host may process the IP address, request time, requested route, HTTP status, referrer, browser/user agent and technical request or error data where generated by the current hosting setup. The legal basis is GDPR Art. 6(1)(f); our legitimate interest is the secure and stable operation of the website.
For the current Vercel Pro plan, the standard Runtime Logs reporting window is one day. If Observability Plus is enabled in the future, it may be 30 days.
3. Local storage of your privacy choice
A single first-party local-storage record is used exclusively to remember and honor your choice. It is sent neither to a database nor to a third party. Language is part of the /de or /en URL, so no language cookie is set.
| Name / type | Purpose and content | Duration |
|---|---|---|
thornfield_privacy_choiceFirst-party Local Storage | Your separate choices for Web Analytics and Speed Insights, activation eligibility, policy version and decision timestamp. No marketing identifier and no database transfer. | Until your next choice or browser-data deletion |
| Vercel Web Analytics Optional event data | Only after its own consent and documented approval. Anonymous aggregated page use; no custom events; query parameters and URL fragments are removed before transmission. | Pro reporting window: 12 months; Vercel notes that data may be stored longer for a later plan upgrade. |
| Vercel Speed Insights Optional performance data | Only after its own consent and documented approval. Real-user website performance and Core Web Vitals; query parameters and URL fragments are removed before transmission. | Pro reporting window: 30 days |
4. Separate consent and withdrawal
Web Analytics and Speed Insights are separately selectable optional measurement services. While they are not documented as active, no initial consent prompt is shown and no preference is collected in advance for future processing. We ask explicitly before activation. Refusal has no disadvantage. Processing is then based on GDPR Art. 6(1)(a) and § 25(1) TDDDG. A material change to policy 2026-08-24.5 invalidates an earlier grant and asks again.
You can allow or withdraw either service independently here or through “Privacy settings” in every footer. Withdrawing a service stops its future measurement immediately.
5. Vercel Web Analytics
The purpose is anonymous, aggregated analysis of page use. After consent, timestamp, redacted path or dynamic route, referrer, coarse location, operating system, browser, device type and SDK version may be processed. Query parameters and URL fragments are removed before transmission; no custom events or additional usage properties are sent.
Vercel describes no third-party cookies and a visitor hash derived from the request that resets after 24 hours.
6. Vercel Speed Insights
The purpose is real-user website performance measurement. After consent, redacted path or route, network speed, browser, device, operating system, country, Core Web Vitals with technical attribution, SDK version and received time may be processed. Vercel describes the data as anonymous and not intended for reconstructing sessions or associating it with IP addresses.
7. Existing aggregate data
Existing anonymous aggregate Vercel data points are not individually person-addressable. We therefore do not claim that individual deletion of those points is possible. Withdrawal prevents further transmission by the deselected service in this browser.
8. Recipient and international transfer
Vercel Inc. is the recipient and processor for hosting; this applies to Web Analytics and Speed Insights only after their separate activation. Processing may occur in the United States and other locations. Depending on the specific processing, transfers may rely on the EU-US Data Privacy Framework or the European Commission Standard Contractual Clauses.
Vercel DPA · Vercel Subprocessors · Vercel Privacy · Web Analytics Privacy · Speed Insights Privacy
9. Contact by email
Privacy inquiries can be sent to privacy@thornfield-studio.com The email service is provided by Checkdomain GmbH, Große Burgstraße 27/29, 23552 Lübeck, Deutschland.
The storage period for business email correspondence depends on the purpose of the inquiry and applicable statutory retention obligations.
We process the information you provide to handle and answer your inquiry. The legal basis is GDPR Art. 6(1)(b) where the inquiry concerns entering into or performing a contract, and otherwise GDPR Art. 6(1)(f). Our legitimate interest is the appropriate handling of incoming communications. Where statutory retention duties apply, processing also relies on GDPR Art. 6(1)(c).
10. External platforms
Social profiles are ordinary external links. This website does not load social feeds, players or marketing pixels in the background.
11. Data-subject rights and complaint
Depending on the circumstances, data subjects may request access, rectification, erasure, restriction or portability, object to processing and withdraw consent. Complaints may be submitted to the Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen or another competent supervisory authority.
12. Status and changes
This privacy notice reflects the technical configuration with policy version 2026-08-24.5. Optional measurement loads only after documented activation and your respective consent. If material changes are made, we will update this page and request any required consent again.