What we keep, and why

Who is responsible

Here We Met (Omar Hassanin), c/o IP-Management #12753, Ludwig-Erhard-Str. 18, 20459 Hamburg, Deutschland. Email: contact@herewemet.com.

What we store, and on what legal basis

• Your letter (names, places, notes, colours, city) so the link can show it. Basis: performing the contract (Art. 6 (1) (b) GDPR).
• Your email from checkout, for your receipt, your private link and order updates. Basis: Art. 6 (1) (b) GDPR.
• Your address, for poster orders only, passed to our print partner to make and post the print. Basis: Art. 6 (1) (b) GDPR.
• Opens: when a letter is first and last opened and how often, so you can see it arrived. No IP address is stored with it.
• Drafts stay in your own browser (local storage) until you pay. We never see them before that.
• The ad that brought you: if you come from one of our ads and then order, the ad's name from its link (for example “meta” and “master”) is saved with the order and its payment, so we can see which ads work. Nothing is stored in your browser for this. Basis: legitimate interest (Art. 6 (1) (f) GDPR).
• Order and invoice records are kept for the periods required by German tax and commercial law (up to 10 years). Basis: Art. 6 (1) (c) GDPR.
• Server logs (IP address, time, page) for up to 14 days to keep the service secure. Basis: legitimate interest (Art. 6 (1) (f) GDPR).

Who helps us

• Stripe Payments Europe Ltd. (Ireland) processes payments and issues invoices.
• Vercel Inc. hosts the website; Turso (ChiselStrike Inc.) hosts the database.
• Resend Inc. sends our emails.
• Our print partner receives the print file and your shipping address for poster orders.
• Place search: if you search for a town that is not on our list, our server passes the name you typed to Photon, the open place search run by komoot GmbH (Germany), and fetches that place's map from OpenFreeMap. Both receive the place only, not your IP address or anything else about you.
• Address search: if you look up a street address, or a place that is not on a map's own list, while adding a place, our server passes what you typed to Photon (komoot GmbH, Germany). It receives the search text and the area of the map, not your IP address or anything else about you.
• Google Ireland Limited (Ireland) provides Google Analytics, only if you have agreed to it (see “Statistics and ads, only with your consent”).
• Meta Platforms Ireland Limited (Ireland) provides the Meta pixel, only if you have agreed to it (see “Statistics and ads, only with your consent”).

Some of these providers process data in the USA. Transfers rely on the EU-US Data Privacy Framework or the EU standard contractual clauses.

Cookies

Without your consent the site sets no tracking or advertising cookies. Your browser's local storage keeps your draft. The admin area uses one sign-in cookie for the owner. One cookie, hwm_consent, remembers for six months what you answered in the cookie banner. It holds only that answer and is needed to respect it (§ 25 (2) no. 2 TDDDG).

We count visits with Vercel Web Analytics, which sets no cookies. It tells one visit from another by an anonymous value made from the request and discarded within a day, so we see totals (pages, countries, where visitors came from), not people. Addresses of private pages, such as your order page or a letter, are not recorded. Legal basis: Art. 6 (1) (f) GDPR, our interest in knowing which pages are used.

Statistics and ads, only with your consent

The tools below are loaded only after you choose “Accept” in the cookie banner. Before that, and if you decline, your browser sends nothing to these companies. They are never loaded on your private order page, on a letter or in the admin area, and the addresses of those pages are not passed on. Legal basis: your consent (§ 25 (1) TDDDG, Art. 6 (1) (a) GDPR).

• Google Analytics 4 (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland) shows us how the site is used: which pages are viewed, roughly where visitors are, which device and browser they use, where a visit came from, and whether a checkout was started or an order paid (order number, product, amount). It sets the cookies _ga and _ga_…, kept for up to six months, to tell one browser from another. We use it for statistics only: Google signals and personalised advertising are switched off, and we do not send Google your name, email or address. In Google Analytics, data tied to a single browser is deleted after two months. Google LLC in the USA may process the data; it is certified under the EU-US Data Privacy Framework.
• The Meta pixel (Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland) tells Meta that a page of ours was viewed, a checkout started or an order paid (order number, product, amount), together with your IP address, details of your browser and the address of the page. It sets the cookie _fbp, and _fbc if you came from one of our ads, each kept for up to 90 days. This shows us which of our ads on Facebook and Instagram lead to orders, and lets Meta show our ads to people who are more likely to be interested. If you have a Facebook or Instagram account, Meta can connect the visit to it. We do not send Meta your name, email or address. For collecting this data and passing it on, Meta and we are jointly responsible (Art. 26 GDPR); the agreement is the Controller Addendum. What Meta does with the data afterwards is Meta's own responsibility, described in its privacy policy. Meta Platforms, Inc. in the USA may process the data; it is certified under the EU-US Data Privacy Framework.

So that a paid order can be reported without the address of your private page, your browser hands the order number, product and amount from that page to a neutral page (“/thanks”), using the tab’s temporary memory (session storage), which is emptied again at once.

Changing your mind. You can withdraw your consent at any time, with effect for the future: press “Cookie settings” below or at the bottom of any page and choose “Decline”. Measuring then stops at once and the tools’ cookies are deleted from your browser. After six months the banner asks again.

Cookie settings

Your rights

You can ask for a copy of your data, its correction or deletion, restriction of processing and data portability, and you can object to processing based on legitimate interest. Write to contact@herewemet.com. You can also complain to a data protection authority, for example the Hamburg Commissioner for Data Protection and Freedom of Information.