Privacy Policy

Last updated: 1 September 2026

1. Controller and scope

The controller responsible for processing personal data in connection with this website and the image style tool available at tool.florian-kirschbaum.com is:

Florian Kirschbaum Fotografie
c/o Impressumservice Dein-Impressum
Stettiner Str. 41
35410 Hungen
Germany

Email: kirschbaum.florian@gmail.com

This Privacy Policy explains how personal data is processed when you visit this website, contact us, purchase digital products, subscribe to the newsletter or use the image style tool. Personal data means any information relating to an identified or identifiable individual.

2. Hosting and technical delivery

2.1 Squarespace

The main website is operated using Squarespace. For users in the European Economic Area, the provider is Squarespace Ireland Ltd., Le Pole House, Ship Street Great, Dublin 8, Ireland. Affiliated companies, in particular Squarespace, Inc. in the United States, may also process data in connection with the service.

When you access the website, technically necessary information is processed. This may include:

your IP address;
the date and time of access;
the requested page or file;
the referrer URL;
browser type and version;
your operating system; and
information about your device and network.

This processing is necessary to deliver the website, maintain its stability and security, and detect technical errors or misuse. The legal basis is Article 6(1)(f) GDPR. Our legitimate interest is the secure and reliable operation of our website.

Where Squarespace uses non-essential cookies or similar technologies, these are activated only after consent has been given. The legal bases are Article 6(1)(a) GDPR and Section 25(1) of the German Telecommunications Digital Services Data Protection Act (TDDDG).

Squarespace may process data in the United States. According to Squarespace, transfers are based, among other safeguards, on the EU-US Data Privacy Framework and the European Commission's Standard Contractual Clauses.

Further information:

2.2 Vercel

The image style tool at tool.florian-kirschbaum.com is hosted by Vercel Inc., 440 N Barranca Avenue #4133, Covina, CA 91723, United States.

When the tool is accessed, Vercel processes technical connection and log data. This may include the IP address, device and browser information, the time and destination of a request, and technical error data. This processing is necessary to deliver, secure and stabilise the tool. The legal basis is Article 6(1)(f) GDPR. Our legitimate interest is the secure and functional operation of the image style tool.

Processing in the United States cannot be ruled out. Vercel provides a Data Processing Addendum containing contractual safeguards for processing and international transfers.

Further information:

3. Cookies and consent management

This website uses cookies and similar technologies. Cookies are small pieces of information that may be stored on or accessed from your device. Some are required for the website to function. Others are used for audience measurement, analytics or advertising.

Strictly necessary cookies and access to information on your device are used under Section 25(2) TDDDG. Any associated processing of personal data is based on Article 6(1)(f) GDPR where it is required for the secure and user-friendly operation of the website.

Analytics and marketing technologies are activated only after consent has been given. The legal bases are Section 25(1) TDDDG and Article 6(1)(a) GDPR. You may change or withdraw your consent at any time with future effect through the website's cookie settings.

The retention period depends on the relevant cookie or service. You can also inspect and manage cookies stored on your device through your browser settings.

4. Audience measurement with Squarespace Analytics

We use analytics features provided by Squarespace to evaluate the use of this website. Information such as page views, the source of a visit, device and browser details, approximate location and interactions with the website may be analysed.

Where analytics rely on cookies or similar technologies or enable visitors to be recognised, they are used only after consent has been given. The legal bases are Article 6(1)(a) GDPR and Section 25(1) TDDDG. You may withdraw consent at any time through the cookie settings.

Further information about processing by Squarespace is available at https://www.squarespace.com/privacy.

5. Contacting us

5.1 Contact form

If you submit an enquiry through a contact form, we process the information entered in the form and the technical data associated with its transmission. Form data is also provided to Squarespace so that the form can be delivered and your message forwarded to us.

We use this information to respond to your enquiry and manage any subsequent communication. If the enquiry relates to a contract or steps taken before entering into a contract, the legal basis is Article 6(1)(b) GDPR. Other enquiries are processed under Article 6(1)(f) GDPR. Our legitimate interest is the effective handling of incoming messages.

The information is deleted once the enquiry has been fully resolved, unless statutory retention obligations or other legitimate grounds require continued storage.

5.2 Contact by email or telephone

If you contact us by email or telephone, we process the contact details you provide and the content of your message in order to handle your request. The legal basis is Article 6(1)(b) GDPR where the communication concerns a contract or pre-contractual steps. In all other cases, the legal basis is Article 6(1)(f) GDPR.

6. Orders and digital products

When you order a product or digital service through the website, we process the information required to complete the order. This may include your name, email address, billing address, purchased content, order value, payment status and transaction information.

We process this information to fulfil the order, provide purchased content, issue invoices, communicate with customers and comply with tax and commercial law obligations. The legal bases are Article 6(1)(b) and Article 6(1)(c) GDPR.

Order and invoice data is retained for the applicable statutory retention periods. Where no longer retention period is required, the information is deleted once the purpose of processing no longer applies.

7. Payments through Squarespace Payments

We use Squarespace Payments, an integrated Squarespace payment solution, to process payments in our online shop. Squarespace and the participating payment service providers receive the information required to process a payment. This may include your name, billing address, email address, payment method, amount, currency, time of payment, transaction identifiers, technical connection data and fraud-prevention information.

According to the current provider information, Squarespace Payments uses, in particular:

Stripe as its technical payment processor;
Sift for fraud monitoring and detection; and
banks, card networks and providers of digital payment methods, depending on the selected payment method.

Payment processing is based on Article 6(1)(b) GDPR. Where fraud prevention and security checks are not already necessary to perform the contract, they are based on Article 6(1)(f) GDPR. Our legitimate interest is the prevention of fraudulent or abusive transactions. Legally required checks and retention are based on Article 6(1)(c) GDPR.

Depending on the selected payment method, data may be processed outside the European Economic Area. According to their own statements, the relevant providers use appropriate transfer mechanisms.

Further information:

Squarespace: https://www.squarespace.com/privacy
Squarespace Payments: https://www.squarespace.com/payments-terms
Stripe: https://stripe.com/privacy
Sift: https://sift.com/service-privacy

8. Newsletter and email delivery through Brevo

8.1 Newsletter subscription

We use Brevo to send our newsletter. The provider is Sendinblue GmbH, Köpenicker Straße 126, 10179 Berlin, Germany.

When you subscribe to the newsletter, we process your email address and any additional information you provide voluntarily. We also process records of the subscription and its confirmation. We use a double opt-in procedure: after registering, you receive an email containing a confirmation link. Your address is added to the newsletter list only after you select that link.

The legal basis for sending the newsletter and the related processing is your consent under Article 6(1)(a) GDPR. Evidence of consent is retained under Article 6(1)(f) GDPR. Our legitimate interest is to demonstrate a valid subscription and prevent misuse.

You may withdraw consent at any time by using the unsubscribe link in each newsletter or by contacting us. Your address will then be removed from the active distribution list. It may remain on a suppression list where this is necessary to ensure that no further newsletters are sent. Statutory evidence and retention obligations remain unaffected.

8.2 Performance measurement

Newsletters may contain technical measurement features that allow us to evaluate delivery, openings and link selections. Where such measurement is linked to an individual subscriber, it is based on the consent given during registration under Article 6(1)(a) GDPR. Consent may be withdrawn at any time with future effect.

8.3 Transactional and results emails

Brevo is also used for emails that you expressly request or that are required to perform a contract. These may include the one-time results email from the image style tool and order or service messages. These emails are separate from a newsletter subscription.

The legal basis is Article 6(1)(b) GDPR where the message is necessary to perform a contract or provide a requested service. In other cases, processing is based on Article 6(1)(f) GDPR. Our legitimate interest is the reliable delivery of requested messages.

We have entered into a data processing agreement with Brevo. Further information is available at https://www.brevo.com/legal/privacypolicy/.

9. Image style tool and AI-assisted photo analysis

9.1 Process and data involved

The image style tool allows you to upload one of your own photos voluntarily. The image is analysed automatically to produce a written assessment, in particular of its colour, contrast, composition and editing style. Depending on how you use the tool, your email address, answers provided within the tool, the generated result and technically necessary connection data may also be processed.

A photo may contain personal data, particularly where individuals are recognisable or metadata is embedded in the file. You must therefore upload only images that you are permitted to use. Images of other people should be uploaded only where the necessary rights and permissions for this processing have been obtained.

Before the upload and analysis, we obtain your express consent to process the photo and transmit it to Anthropic. The legal basis is Article 6(1)(a) GDPR. If an image contains special categories of personal data within the meaning of Article 9 GDPR, processing is additionally based on your express consent under Article 9(2)(a) GDPR. Consent may be withdrawn with future effect. Withdrawal cannot reverse an analysis that has already been completed.

9.2 Processing by Anthropic

We use the Claude API provided by Anthropic PBC, 548 Market Street, PMB 90375, San Francisco, CA 94104, United States, for the automated analysis. The uploaded photo and the instructions required for the analysis are transmitted to Anthropic. Anthropic's response is then used to generate your personal result.

Under its commercial terms, Anthropic processes content transmitted through its commercial API as a processor. Anthropic's Data Processing Addendum, including Standard Contractual Clauses, forms part of its commercial terms. Anthropic states that it does not use API content to train its models without express permission.

We do not claim a separate zero data retention arrangement unless one has been expressly agreed with Anthropic. Anthropic's retention period therefore depends on the standard policy applicable to the API model and features used. According to the current documentation, content is not retained by default for many API features. Certain models or safety checks may, however, require limited retention, including for up to 30 days. Where a suspected violation of Anthropic's usage rules is identified, information may be retained for longer in accordance with Anthropic's policies.

Data is transferred to the United States. The transfer is based on Anthropic's Data Processing Addendum and the European Commission's Standard Contractual Clauses.

Further information:

9.3 Storage by us and results email

We process the uploaded photo only for as long as technically necessary to perform the analysis. We do not store it permanently. Temporary technical copies and log data are deleted once they are no longer needed to provide and secure the service, unless legal obligations or legitimate security interests require longer retention.

If you request your result by email, your email address and result are processed through Brevo to create and deliver the message. A newsletter subscription is separate and occurs only if you select the additional voluntary checkbox and subsequently complete the double opt-in process.

10. Meta Pixel

With your consent, we use the Meta Pixel on this website. For users in the European Economic Area, the provider is Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland.

The Meta Pixel enables us to determine whether visitors access certain pages or take particular actions after selecting an advertisement. Information transmitted to Meta may include your IP address, browser and device information, pages visited, referrer information, timestamps, cookie identifiers and event data. Meta may associate this information with an existing user account and process it for its own measurement, security and advertising purposes.

The Meta Pixel is activated only after consent has been given. The legal bases are Article 6(1)(a) GDPR and Section 25(1) TDDDG. You may withdraw your consent at any time through the cookie settings.

Where we and Meta jointly determine the collection and transmission of event data, we are joint controllers for this limited processing under Article 26 GDPR. Meta is independently responsible for its subsequent processing. Processing may take place in the United States. According to Meta, international transfers are based on the EU-US Data Privacy Framework and Standard Contractual Clauses.

Further information:

11. Pinterest

11.1 Pinterest Save button

A Pinterest Save button is embedded on certain images. The provider is Pinterest Europe Ltd., Palmerston House, 2nd Floor, Fenian Street, Dublin 2, Ireland. The button allows users to save an image or page to their Pinterest account.

When the Pinterest code is activated, your browser establishes a connection with Pinterest. Information transmitted may include your IP address, browser and device details, the address of the page viewed, referrer information, the time of access, and cookie or user identifiers. If you are signed in to Pinterest, Pinterest may associate the visit with your account.

The Save button and the Pinterest code required for it are activated only after consent has been given. The legal bases are Article 6(1)(a) GDPR and Section 25(1) TDDDG. You may withdraw consent at any time through the cookie settings.

Processing outside the European Economic Area, particularly in the United States, may take place. According to Pinterest, international transfers are protected by appropriate safeguards, including Standard Contractual Clauses and, where applicable, the EU-US Data Privacy Framework.

11.2 Pinterest Tag

With your consent, we use the Pinterest Tag. The provider is Pinterest Europe Ltd., Palmerston House, 2nd Floor, Fenian Street, Dublin 2, Ireland.

The Pinterest Tag is used to measure the effectiveness of Pinterest content and advertisements and to create audiences for advertising. It may transmit information such as your IP address, browser and device details, cookie identifiers, referrer URL, pages visited and actions taken on the website. Pinterest may combine this information with other data in accordance with its own privacy policy.

The Pinterest Tag is activated only after consent has been given. The legal bases are Article 6(1)(a) GDPR and Section 25(1) TDDDG. You may withdraw your consent at any time through the cookie settings.

Further information:

12. Profile links to Instagram and Pinterest and other external websites

The website menu contains icons that are standard links to our Instagram and Pinterest profiles. This website may also contain other links to external websites. Merely viewing a page on this website does not, solely because of such a link, establish a connection with the relevant social network or external provider. The external website is opened only when you select the link. From that point onwards, the external provider processes data under its own responsibility and its own privacy information applies.

For users in the European Economic Area, Instagram is provided by Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland. Information about Instagram's processing is available at https://privacycenter.instagram.com/policy/.

Information about processing by Pinterest Europe Ltd. is available at https://policy.pinterest.com/en/privacy-policy. Processing associated with the separately embedded Pinterest Save button and Pinterest Tag is described in the preceding section.

13. Recipients and international transfers

We disclose personal data only where this is necessary for the purposes described in this Privacy Policy, where we are legally required to do so, where valid consent has been given, or where another legal basis permits the disclosure.

Recipients may include hosting and platform providers, payment service providers, email service providers, AI providers and technical service providers engaged by us. Processors are appointed in accordance with Article 28 GDPR.

Where data is transferred to a country outside the European Economic Area, we use a transfer mechanism recognised by law. This may include an adequacy decision, certification under the EU-US Data Privacy Framework or the European Commission's Standard Contractual Clauses. Despite these safeguards, the level of data protection in a third country may differ from that in the European Union.

14. Retention periods

Unless a specific period is stated in this Privacy Policy, we retain personal data only for as long as it is required for the relevant purpose. It is then deleted or anonymised unless statutory retention obligations, the establishment or defence of legal claims, or other lawful grounds require continued storage.

15. Your rights

Subject to the applicable legal conditions, you have the following rights in particular:

access to your personal data under Article 15 GDPR;
rectification of inaccurate data and completion of incomplete data under Article 16 GDPR;
erasure under Article 17 GDPR;
restriction of processing under Article 18 GDPR;
data portability under Article 20 GDPR;
objection to processing based on Article 6(1)(e) or Article 6(1)(f) GDPR under Article 21 GDPR; and
withdrawal of consent with future effect under Article 7(3) GDPR.

Withdrawal does not affect the lawfulness of processing carried out on the basis of consent before it was withdrawn.

Where personal data is processed on the basis of legitimate interests, you may object on grounds relating to your particular situation. Where personal data is processed for direct marketing, you have the right to object to that processing at any time.

To exercise these rights, you may contact us using the email address stated above.

16. Right to lodge a complaint

You have the right to lodge a complaint with a data protection supervisory authority. In particular, you may contact the supervisory authority responsible for your habitual residence, place of work or the place of the alleged infringement.

17. Security

The website uses an encrypted HTTPS connection. This protects information transmitted between your browser and the website against unauthorised interception while in transit. Complete protection against every risk associated with electronic data processing cannot, however, be guaranteed.

18. No solely automated decision with legal or similarly significant effects

The image style tool produces a creative assessment. It does not result in a decision based solely on automated processing that produces legal effects concerning you or similarly significantly affects you.

19. Updates to this Privacy Policy

We update this Privacy Policy when the website, the services used or the legal requirements change. The version published on this website at the relevant time applies.