Privacy

Fabian Hug
c/o redsundesign GbR
Schanzenstraße 75
20357 Hamburg
Germany

For any question about your data, or to exercise the rights below, write to [email protected].

Analytics run on PostHog, hosted in the European Union. A consent card appears on your first visit and nothing analytics-related is stored in your browser until you answer it.

If you accept, PostHog sets a cookie plus a small local record so repeat visits are recognised as the same person. Legal basis: your consent, Art. 6(1)(a) GDPR. You can withdraw it at any time, with effect for the future, by declining in the card or clearing site data.

If you decline, PostHog runs in cookieless mode. Your visit is still counted, but no identifier is kept, so it cannot be linked to any other visit. The only thing stored in that case is the record of your choice - which exists so you are not asked again.

What is collected either way: pages viewed, referring site, rough device and browser type, and interactions with the site's own controls (filters, outbound job clicks). No form contents, no keystrokes, no session recordings.

This site publishes copies of its content for AI agents and scripts (llms.txt, Markdown twins of pages, and a Model Context Protocol endpoint). Requests to those are logged with the path and the user-agent string so we can see which tools consume the data.

Those events carry a fixed identifier shared by every such request rather than one per visitor, no browser profile is created for them, and IP-based location lookup is switched off. Legal basis: legitimate interest in understanding how the published data is used, Art. 6(1)(f) GDPR.

Payment for a featured listing is handled entirely by Stripe, which acts as Merchant of Record - Stripe is your contractual counterparty for the purchase and issues the invoice. Card details are never sent to or seen by this site.

What reaches us is the fact that a purchase completed, the amount, and a reference for the order, which we use to publish the listing and to reconcile payments. Legal basis: performance of a contract and our legitimate interest in correct accounting, Art. 6(1)(b) and (f) GDPR.

The newsletter is optional and runs on Buttondown. If you subscribe, what is stored is your email address, the moment you asked, the IP address the request came from, and the page you subscribed on.

Nothing is sent until you confirm from a mail we send you first (double opt-in). The address and IP behind that confirmation are kept as evidence that the subscription was really asked for, which is what German case law expects of anyone running a mailing list. Legal basis: your consent, Art. 6(1)(a) GDPR, plus our legitimate interest in being able to prove it, Art. 6(1)(f).

Every issue carries a one-click unsubscribe link, and unsubscribing takes effect immediately. You can also write to the address below. Your address is never sold, rented, or passed to the companies whose jobs appear in an issue.

Buttondown records what an email provider records: that an issue was delivered or bounced, whether it was opened, and whether a link in it was clicked. Opens are measured with the usual invisible image, so blocking remote images in your mail client stops that half of it. We read these as totals, to tell whether the newsletter is worth continuing, and never to build a profile of a reader.

Buttondown is based in the United States, so subscribing means your address is processed there under the European Commission's standard contractual clauses.

The site is hosted on Vercel, which records standard request logs (IP address, timestamp, path, user agent) for a short retention period. These exist to operate and secure the service. Legal basis: legitimate interest, Art. 6(1)(f) GDPR.

Submissions and enquiries reach us by email through addresses on this domain, routed by Cloudflare. If you write to us, your message and address are kept as long as needed to deal with it. Legal basis: legitimate interest in answering you, or steps before a contract, Art. 6(1)(f) and (b) GDPR.

• Vercel - hosting and request logs
• PostHog - analytics, on European infrastructure
• Stripe - payments, as Merchant of Record
• Buttondown - the newsletter, if you subscribe to it
• Cloudflare - DNS and email routing
• GitHub - the repository where listings are published

Where a provider processes data outside the EU, that transfer rests on the European Commission's standard contractual clauses.

One clarification, because it is a fair thing to wonder about: this site uses an AI model to sort scraped job and event postings. It reads public listing pages only. No visitor data of any kind is sent to it.

Analytics events are retained by PostHog under its standard retention. Order records are kept for as long as commercial and tax law requires. Server logs are short-lived. Email is kept until the matter it concerns is settled. A newsletter subscription is kept until you unsubscribe, after which Buttondown keeps the record of the address having unsubscribed, so a later import cannot put you back on the list by accident.

Under the GDPR you can ask for access to your data (Art. 15), correction (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), portability (Art. 20), and you can object to processing based on legitimate interest (Art. 21). Where processing rests on consent, you can withdraw it at any time without affecting what was done beforehand.

Write to [email protected]. You also have the right to complain to a supervisory authority. The one responsible for us is Der Hamburgische Beauftragte für Datenschutz und Informationsfreiheit.

Operator details are on the Imprint.