Privacy policy

1. Controller

2. General information

We process personal data only where necessary to provide this website, communicate with prospective customers and customers, or fulfil legal obligations. Personal data means information that can identify a person directly or indirectly.

Relevant legal bases include Article 6(1)(b) GDPR for pre-contractual and contractual communication and Article 6(1)(f) GDPR for the secure and reliable operation of this website.

3. Hosting with STRATO

This website is hosted by STRATO GmbH, Otto-Ostrowski-Straße 7, 10249 Berlin, Germany. When the site is accessed, the hosting provider processes technical access data required to deliver content and maintain secure, stable operation.

This may include access times, requested files, browser and device information, referrers and IP or host information. STRATO provides hosting log files and states that it anonymises the requesting client’s hostname or IP address.

Processing is based on our legitimate interest in a secure, functional website under Article 6(1)(f) GDPR. Where STRATO processes data on our behalf, this takes place under a processing agreement pursuant to Article 28 GDPR.

4. Email enquiries

When you contact info@ailorium.de, we process the information you send, particularly your email address, message and any further information you voluntarily provide.

Enquiries relating to a contract are processed under Article 6(1)(b) GDPR. Other enquiries are processed under Article 6(1)(f) GDPR, based on our legitimate interest in answering appropriately. Data is deleted when no longer needed, unless legal retention obligations apply.

5. Orders in the AILORIUM shop

We process data necessary to complete a purchase and deliver the product. This may include your name, email address, billing address, products, price, order number, payment status and order time. For digital content, we also retain the checkout declarations concerning immediate performance and supply where necessary for the contract or legally required evidence.

Processing is based on Article 6(1)(b) GDPR. Retention required by law is based on Article 6(1)(c) GDPR. The German and English shops use a common customer and order database.

6. Payments through Stripe

We use Stripe for payment processing. Information needed for payment is transmitted to Stripe or collected directly on Stripe’s payment pages. Depending on the payment method, this may include name, email address, billing and payment information, IP address, browser and device details and further information required for payment processing, fraud prevention or identity checks.

AILORIUM does not store complete card or bank-account details. Stripe provides payment status and technical references so that payments can be linked to orders. Purchased content or software access is released only after confirmed payment.

Depending on the Stripe service used, Irish Stripe entities are involved for users and businesses in the European Economic Area. Stripe may transfer personal data to affiliates and service providers. For transfers to third countries, Stripe states that it uses appropriate transfer mechanisms, including the EU–US Data Privacy Framework and standard contractual clauses.

Payment processing is based on Article 6(1)(b) GDPR. Stripe may act as an independent controller for other purposes, such as fraud prevention or regulatory duties. See Stripe’s privacy policy.

7. Protected product delivery and customer accounts

For an optional account, we store your supplied name, verified email address, password hash, registration time and wishlist. Passwords are not stored as plain text. A time-limited email code is used to confirm registration and reset passwords. Paid purchases are linked using the verified email address. Your wishlist is available across devices after signing in.

Accounts, wishlists and purchases are shared between ailorium.de and ailorium.com. Login sessions are separate for each domain, so you may need to sign in separately using the same account credentials.

We use a necessary session cookie for login. Technical counters and hashed email and IP references limit login and code attempts. Changing a password invalidates existing logins on other devices. Contact info@ailorium.de with account questions or deletion requests.

After payment, we process order and entitlement data to provide the purchased content or software access and allow it to be accessed again. This includes order numbers, products, payment and delivery status, timestamps and security information. Processing is based on Article 6(1)(b) GDPR and, where necessary, Article 6(1)(f) GDPR for secure delivery and prevention of unauthorised access.

8. Cookies, local storage and tracking

We currently use no analytics, advertising or marketing trackers such as Google Analytics or Meta Pixel. Necessary session, security and payment information may be processed. Your cart selection is stored locally in your browser so that it remains available when you change pages or return to the shop.

When you visit a Stripe payment page, Stripe’s privacy and security mechanisms also apply. Stripe may use necessary cookies or similar technologies for payment processing and fraud prevention.

9. Newsletter / AILORIUM Updates

Newsletter signup is voluntary and based on your consent under Article 6(1)(a) GDPR. We process your email address and evidence of signup and confirmation. English-shop subscriptions are maintained separately from the German newsletter list.

We use double opt-in: after signup, you receive an email and must open its confirmation link before being added to the active mailing list. Unconfirmed records are removed after 14 days during automatic list maintenance.

We record signup and confirmation times and pseudonymised technical evidence. IP addresses are hashed on the server using a secret key rather than stored in plain text.

You may withdraw consent at any time for the future using the unsubscribe link in every newsletter. Your email address is then removed from the mailing list. Email is currently sent through the STRATO-hosted website’s mail function; no external newsletter marketing service is used.

10. SSL/TLS encryption

The website uses encrypted HTTPS connections to protect data in transit between your browser and the web server. Communication between the shop and the payment provider also uses encrypted connections.

11. Retention

Personal data is generally kept only for as long as needed for its purpose. Order, contract and payment records may be retained to meet statutory commercial and tax obligations. After the relevant periods end, data is deleted unless another legal basis justifies retention.

12. Your rights

Subject to the legal requirements, you have rights of access, rectification, erasure, restriction of processing and data portability. You may object to processing based on Article 6(1)(f) GDPR where the statutory conditions apply. Consent can be withdrawn at any time for the future. To exercise your rights, email info@ailorium.de.

13. Right to complain

You may complain to a data-protection supervisory authority about the processing of your personal data, particularly the authority responsible for your residence, workplace or the controller’s place of business.

14. Updates to this policy

AILORIUM continues to develop. We adapt this policy to the services actually used when new payment methods, newsletter features, analytics or other external services are introduced.

Personal and billing details in your account

A display name is optional. Your full name and billing address are collected no later than checkout for contract performance and invoice preparation under Article 6(1)(b) and (c) GDPR. Account details can be changed. Billing details supplied for an order are saved as a separate snapshot; later profile changes do not alter that order record. Statutory retention obligations apply to order and invoice data.

Optional birthday

You may optionally provide the day and month of your birthday. With separate consent, we process this information and your email address to send a birthday message with a surprise, possibly a voucher or product offer, under Article 6(1)(a) GDPR. This is separate from newsletter signup. The sending feature is still being set up.

You may withdraw consent for the future by clearing the consent checkbox and saving your profile, and may delete the day and month there. We retain the consent time and text version and, where applicable, the withdrawal time as evidence. Optional details are not a condition of purchase.