Your information

Privacy policy

This policy explains which personal information Gesttalt handles, why it is needed, how long it is kept, and the choices available to you.

Controller

Name: Pedro Piñera Buendía
Trading as: Gesttalt
Email: gesttalt@pepicrft.me
Last updated: 23 July 2026

No data protection officer has been appointed because Gesttalt is not currently required to appoint one.

Information, purpose, and legal basis

Account and authentication: Email address, password hash, login links, session records, and security events are used to create and secure your account and perform the service contract. The legal basis is Article 6(1)(b) of the General Data Protection Regulation.
Publication: Posts, pages, images, themes, publication settings, domain names, and delivery records are processed to store and publish material at your direction. The legal basis is Article 6(1)(b) of the General Data Protection Regulation.
Connected applications: Application details, authorization grants, public keys, and security tokens are processed to provide requested publishing interfaces and protect accounts. The legal bases are Article 6(1)(b) and Article 6(1)(f) of the General Data Protection Regulation. The legitimate interest is operating a secure, interoperable service.
Service operation and security: Network address, request metadata, browser and transport signals, error logs, delivery logs, and aggregated service measurements are processed to prevent abuse, diagnose failures, and keep the service reliable. The legal basis is Article 6(1)(f) of the General Data Protection Regulation. The legitimate interests are service security and reliability.
Messages and legal reports: Contact details, correspondence, reported content addresses, explanations, and decisions are processed to answer requests and comply with legal duties. The legal bases are Article 6(1)(c) and Article 6(1)(f) of the General Data Protection Regulation. The legitimate interests are resolving requests, protecting rights, and documenting responsible moderation.

Required information and sources

An email address is required to create an account because Gesttalt uses it to confirm ownership, authenticate you, and send security notices. Without it, an account cannot be provided. Publication and support information is supplied by you. Request and security information is generated when you use the service. Domain information may also be read from public Domain Name System records.

Gesttalt does not use your information for advertising, sell it, or make decisions with legal or similarly significant effects solely by automated means. Illegal-content reports and moderation decisions are assessed by a person.

Service providers and international transfers

Hetzner Online GmbH: Provides computing, network delivery, database infrastructure, object storage, and backups in Germany. Gesttalt selects the Falkenstein, Germany region. Hetzner privacy information
Cloudflare, Inc.: Provides Turnstile abuse protection on account registration and legal-reporting forms. It receives the network address and browser, transport, site, and challenge signals needed to distinguish people from automated abuse. Processing outside the European Economic Area may occur under Cloudflare's data-processing terms and applicable transfer safeguards. Turnstile privacy information
Plunk: Delivers transactional email through Gesttalt's mail relay. Primary hosted processing is in Germany. Amazon Web Services Simple Email Service may transmit messages internationally under the European Commission's standard contractual clauses. Plunk data-processing terms
Fastmail Pty Ltd: Hosts the gesttalt@pepicrft.me mailbox used for support, privacy requests, and legal reports. Fastmail is based in Australia and uses the European Commission's standard contractual clauses for restricted transfers. Fastmail data-processing terms

Gesttalt may disclose information to courts, regulators, law-enforcement authorities, or other recipients when legally required, or when necessary to establish, exercise, or defend legal claims.

Retention

Unconfirmed accounts are automatically deleted after 30 days.
Active account and publication information is kept while the account exists. A permanent deletion job is available in account settings. It removes the account, publication, connected applications, and stored media; encrypted backups expire within 30 days.
Login links are removed after 15 minutes, email-change links after 7 days, and browser session records after 14 days. Expired application authorization records are removed within 35 days. Expired or revoked agent registration records are removed after 7 days.
Application request, error, and security logs are kept for 7 days. Service measurements are kept for 15 days.
Resolved illegal-content reports and their decision records are automatically deleted after 3 years. Open reports are kept until a decision is completed.
Support, privacy, and legal correspondence in the contact mailbox is deleted no later than 3 years after the matter closes, unless longer retention is required for a legal claim or by law.
Plunk states that application programming interface logs and hosted backups are deleted after 30 days. Temporary mail relay queues retain a message only while delivery is attempted.

A legal preservation duty or active claim may require a limited record to be kept longer. When that duty ends, the record is deleted.

Cookies and browser storage

Gesttalt uses only storage necessary to provide requested features. The signed session cookie maintains a login for the current browser session. If “Keep me logged in” is selected, a signed authentication cookie lasts up to 14 days. Theme previews use session storage until the browser tab closes. Cloudflare Turnstile uses the signals and storage necessary to protect registration and reporting forms. No advertising or optional analytics storage is used.

Your rights

Depending on the circumstances, you may request access, correction, deletion, restriction, or portability of your information, and you may object to processing based on legitimate interests. Where processing relies on consent, you may withdraw it for the future. Contact gesttalt@pepicrft.me. Gesttalt may need to verify your identity before fulfilling a request.

You may complain to any competent supervisory authority. The authority for the Berlin establishment is the Berlin Commissioner for Data Protection and Freedom of Information, Alt-Moabit 59-61, 10555 Berlin, Germany, mailbox@datenschutz-berlin.de.

Customer publications

A publication owner separately determines how information from its visitors is used and is responsible for its own legal notices and privacy information. When Gesttalt processes visitor information solely on a publication owner's instructions, the publication owner is the controller and Gesttalt is the processor. Contact gesttalt@pepicrft.me before using Gesttalt for processing that requires a written data-processing agreement.