Privacy policy

Data controller

Hosting and server logs

The website and CMS are hosted on a virtual private server provided by Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany. Server location: Germany. The server is managed through Laravel Forge, provided by Laravel Holdings Inc., 60 Broad Street, 24th Floor #1559, New York, NY 10004, USA. Forge may process technical connection data, server and application logs, access credentials and other data stored on or generated by the managed systems, depending on the features and configuration used.

We have entered into a Data Processing Agreement with Hetzner Online GmbH for the hosting services it provides.

Laravel Holdings Inc. processes personal data on our behalf under Laravel’s Data Processing Agreement, which is incorporated through the Laravel Forge Terms of Service. For transfers of personal data to the United States, the agreement provides for the European Commission’s Standard Contractual Clauses. The use of Forge serves our legitimate interest in the secure and efficient administration of our server infrastructure pursuant to Article 6(1)(f) GDPR. Processing on our behalf is also governed by Article 28 GDPR.

When you access a page or other resource, server logs may record your IP address, time of access, requested URL, HTTP method and status, referrer, user agent and volume of data transferred. This information is used to deliver the website, maintain stability, investigate errors and prevent abuse. The legal basis is Article 6(1)(f) GDPR, reflecting the legitimate interest in operating a reliable and secure website.

Server access and error logs are rotated daily and deleted after 14 days, unless further retention is necessary to investigate an incident or establish, exercise or defend legal claims.

• Hetzner privacy policy
• Laravel Forge Terms of Service
• Laravel privacy policy
• Laravel Data Processing Agreement

Community ratings

Community scores are requested from content.davidhellmann.com when they are displayed, including on gallery listings. These requests transmit your IP address and the requested Site IDs, even if you do not submit a rating. Rating API requests are made without cookies or other browser credentials.

Loading a community rating summary does not create or store an identifier in your browser. When you actively select the first score for a Site, your browser creates a random identifier (UUID) if one does not already exist and stores it in localStorage under bwg-rating-voter-id-v1. If browser storage is unavailable, the identifier is held in memory for that page instead.

Rating drafts and a marker indicating that a rating has already been submitted may also be stored locally. No cookies are set for this function. Local data has no automatic expiry and remains until the website data is cleared in your browser; drafts are removed when a submission succeeds or the server reports that the Site has already been rated.

Submitting a rating sends the Site ID, the three scores and the UUID to content.davidhellmann.com. Your IP address is also transmitted as part of the network request. The UUID is a pseudonymous identifier, not proof of your identity.

On the server, the UUID is converted into an HMAC hash before persistent storage; the Site ID, scores, hash and timestamps are retained. The IP address is also hashed for rate limiting and kept in the application cache for no more than 24 hours. General server logs are separate. Rating records remain for as long as the Site’s community rating exists and are deleted when the Site is permanently deleted from the CMS. Deleted data may remain in server or database backups until the applicable backup retention period expires.

The purposes are to calculate community ratings, maintain their integrity and prevent duplicate submissions and abuse. The legal basis for this processing is Article 6(1)(f) GDPR. Local storage is used only after you actively begin the rating process and is necessary to provide the rating function you requested and to prevent duplicate submissions.

Clearing localStorage does not delete a rating already sent to the server. If possible, include your stored UUID when making a privacy request about a rating, so the corresponding pseudonymous record can be located. Do not send passwords or other unrelated browser data.

Cabin Analytics

This website uses Cabin Analytics, provided by Nic Mulvaney LTD, United Kingdom, for privacy-focused audience measurement. Its script is loaded from helge.bestwebsite.gallery. According to Cabin, the service uses no cookies, persistent identifiers or fingerprinting and does not create visitor profiles.

Data may include the page path, referrer, screen width, load time, time of access, country, browser, device, operating system, language and UTM parameters. Cabin states that it converts the IP address transmitted with the request into a country code in memory and immediately discards the IP address. It stores aggregated statistics.

We also measure interactions such as opening filters, submitting a search, following links, using share buttons, opening screenshots and progressing through community voting. These custom events use fixed action names. We do not add search text, individual rating values or the voting UUID to these events. A share event records a button click, not whether a post was published.

Cabin states that account and analytics data are stored and processed in Amazon Web Services’ Ireland region. Its collection infrastructure may receive requests in other regions and forward them to Ireland without writing the request data to disk there. The tracking script is delivered through Bunny CDN.

The legal basis is Article 6(1)(f) GDPR. The legitimate interest is understanding website use and performance while minimising personal data. Under the current Cabin Pro (Legacy) subscription, aggregated analytics have no fixed retention limit. They remain until the domain or account is deleted. Cabin states that deletion is irreversible, while the domain name and monthly total page views may be retained for internal benchmarking.

• Cabin documentation
• Cabin privacy policy
• Cabin security information

Gallery content and screenshots

Gallery listings and screenshots document publicly accessible websites. They may contain personal data such as creators’ names, professional details or images of people published on those websites. The source is the respective public website; this data is not collected directly from every person shown.

The purpose is to curate and document web design. The legal basis is Article 6(1)(f) GDPR, reflecting the interest in maintaining an independent design archive while taking the rights of affected people into account. Content remains for as long as the listing is part of the archive, subject to review of correction, objection and removal requests. Because the material comes from a large number of public websites and the people shown cannot always be identified or contacted with proportionate effort, this publicly available policy provides the relevant information about the processing. Requests concerning individual content are reviewed on a case-by-case basis. See the Legal notice for removal requests.

Contact and removal requests

This website does not provide a contact form. Clicking an email link does not transmit data to us; data is processed only if you choose to send an email.

If you contact the operator, the contact details, message and any information about the affected website or your authority to make the request are processed by the operator and the email service provider to handle it. The legal basis is Article 6(1)(f) GDPR, reflecting the interest in responding to enquiries and resolving requests, and Article 6(1)(c) GDPR where processing is required by law.

This data is deleted once it is no longer needed, unless retention is required by law, necessary to maintain a permanent domain exclusion, or needed to establish, exercise or defend legal claims.

Recipients and international transfers

Recipients may include Hetzner, Laravel Forge, Cabin and, where needed, email, IT security or legal advisers and competent authorities. Published gallery content is accessible to visitors worldwide. Laravel Forge may involve transfers to the United States that are safeguarded by the European Commission’s Standard Contractual Clauses. Other international transfers by service providers are subject to the safeguards described in the relevant section above. You can request further information about those safeguards using the contact details in this policy.

Your rights

Subject to the conditions of the GDPR, you have the right to access your personal data, request correction or erasure, restrict processing and, where applicable, receive your data in a portable format.

You have the right to object, on grounds relating to your particular situation, to processing based on Article 6(1)(f) GDPR. In that case, processing will stop unless compelling legitimate grounds override your interests, rights and freedoms, or processing is needed for legal claims. Send requests to the email address above. Where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of processing before withdrawal.

You may lodge a complaint with a supervisory authority, in particular in the EU member state of your habitual residence, place of work or the alleged infringement. In Austria, you can contact the Austrian Data Protection Authority, Barichgasse 40–42, 1030 Vienna, dsb@dsb.gv.at.

This policy will be updated when the website, its services or applicable legal requirements change.