Privacy policy
1. Controller
The controller responsible for data processing on this website is: Süßakquise Owner: Florian Steven Rech Waakirchner Straße 48 81379 Munich Germany Phone: +49 171 41 57 885 Email: founder@suessakquise.io
2. General information
We process personal data only where it is needed for the stated purpose and the GDPR or another law permits it. You can generally use this website without providing any data. We have data processing agreements (Art. 28 GDPR) with every service provider listed below that processes data on our behalf.
Some providers are based in the USA. Transfers there rely on the EU-US Data Privacy Framework (adequacy decision, Art. 45 GDPR) where the provider is certified, and otherwise on EU Standard Contractual Clauses (Art. 46(2)(c) GDPR).
3. Hosting, database and server log files
The website, database and file storage run on Lovable Cloud (Lovable Labs Inc., USA; infrastructure: Cloudflare, Inc., USA, and Supabase, Inc., USA, with servers in the EU). When you visit the website, technically necessary data is processed: IP address, date and time, page requested, referrer URL, browser type and operating system.
The legal basis is Art. 6(1)(f) GDPR (legitimate interest in a secure, working website). Log files are deleted automatically after a short period once they are no longer needed for operation and security.
Fonts are loaded directly from our own server. No connection to Google Fonts is made.
4. Storage in your browser
We store your language choice, your cookie banner decision, and previously detected company websites and brand colours for three days in your browser's local storage. This lets us instantly prefill repeat cakes for the same company and avoids unnecessary repeat colour analysis. This is technically necessary for the website to work as you want (§ 25(2) no. 2 TDDDG). We store an analytics identifier only with your consent (see section 12).
5. SSL/TLS encryption
This website uses SSL/TLS encryption, so data you send to us cannot be read by third parties. You can recognise the encrypted connection by "https://" in the address bar.
6. Ordering a campaign
When you order a campaign, we process: your name, email address, phone number, company, your billing address if you provide it, the recipient details (see section 7), the texts for the cake and postcard, your "Anything else?" field and uploaded files (logos, images, inspiration).
We use this data to process the order, have the cake made and delivered by our partner bakery, and communicate with you. We do not bake the cakes ourselves. They are made by an external partner bakery in Germany, which receives the order and delivery data it needs.
The legal basis is Art. 6(1)(b) GDPR (contract and pre-contractual steps). Uploaded files are kept in private storage and are only accessible via expiring links. We keep order and invoice data as long as tax and commercial law requires (up to 10 years, § 147 AO, § 257 HGB). Recipient data is deleted much sooner, see section 7.
7. Data of cake recipients
If you receive a cake from Süßakquise, the person who ordered it (our customer) gave us your name, your company and either your delivery address or your business email address, and your phone number if needed. If the address is missing, we email you and ask you to enter it yourself via a personal link.
We use your data only to get the cake to you. We share it only with our partner bakery and its delivery service, as far as needed to make and deliver the cake. An address you enter yourself is never shared with the person who ordered or their company. On the delivery day, the person who ordered only receives the contact details they gave us themselves, so they can get in touch with you.
Customer analytics: When ordering you can optionally tell us how you heard about us. With cookie consent we also remember the source of your first visit (e.g. LinkedIn) and store it with the order. After a reported opportunity we ask you once by email after 90 days whether the deal was won.
Recipients never enter our customer database (CRM) and never receive marketing from us. We only email you about this one delivery: the address request, at most three reminders and, if you don't enter anything, one final message after 30 days.
Deletion: 14 days after the delivery date we delete your data automatically, and likewise 14 days after a cake has expired or you declined it. We only need those 14 days to resolve delivery problems. We keep the cake and postcard texts afterwards for at most 30 days after delivery, with names, company and contact details masked, to evaluate which messages work well. Only anonymous characteristics such as occasion, tone, delivery time or the role optionally chosen by the customer (e.g. "manager"), which cannot be linked to a person, are kept permanently. If you unsubscribe, our email service keeps your address on a suppression list so you receive no further emails.
The legal basis is Art. 6(1)(f) GDPR. Our and our customer's legitimate interest is delivering a personal gift to you. You can object at any time (see section 14). We will then stop the delivery and delete your data.
8. Payment via Stripe
Payments are processed by Stripe (Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Dublin 2, Ireland). Stripe receives your name, email address, payment details, the amount and, if provided, your billing address. We never see your card details. Stripe may also transfer data to Stripe, Inc. in the USA (Data Privacy Framework).
The legal basis is Art. 6(1)(b) GDPR and Art. 6(1)(c) GDPR (legal obligations such as fraud prevention and record keeping). More at https://stripe.com/privacy
9. Sending emails
We send order confirmations, verification codes, reminders, delivery emails and the personal discount code promised after submitted feedback through Lovable's email service (Lovable Labs Inc., USA). This processes the recipient address, content, time sent and delivery status. The service keeps sending logs only for a limited period. The legal basis is Art. 6(1)(b) GDPR or Art. 6(1)(f) GDPR.
10. Cake designer ("kitchen") and verification code
In the cake designer you enter a name, a company and a cake message. We research the publicly visible brand colours of the company website and generate an AI-created design image and postcard text. For a direct order, you enter the target's public website for each cake. We identify three brand colours from it, which you can review and change before ordering. We temporarily store the detected website and company details with the original colours for three days so we can reuse them instantly when entered again. We also store the website and your confirmed colours with the order and share them with our partner bakery for the design. For this, website content and your designer inputs are sent to AI models via the Lovable AI Gateway (Lovable Labs Inc., USA, with models from Google and OpenAI). After successful payment, we also create one AI-generated production image for each cake using the same design details. Our partner bakery receives that image through a private, expiring link. The production image is deleted with the recipient data 14 days after delivery or expiry. We only store a design generated in the designer if you then order it.
If you click "Send me a link to finish later" on the order form, we store what you have entered so far (including details about the target people) together with your email address for 7 days and send you exactly one email with the link. After that, the draft is deleted automatically. The legal basis is your request (Art. 6(1)(b) GDPR).
To limit free designs per day, we store an irreversible hash of your IP address with a timestamp. If you request a verification code with your business email address, we store the email address, a hash of the code and when it was confirmed. These records are deleted automatically after 7 days.
The legal basis is Art. 6(1)(b) GDPR (you use the designer at your own request) and Art. 6(1)(f) GDPR (protection against misuse and costs).
11. Customer database (CRM)
We store paying customers and people who request a code with their business email address, with name, email address, company, language, contact source, orders, internal notes and a log of consents given or withdrawn. We use this to look after you and respond to your requests. We only send marketing emails with your consent or, as an existing customer, about similar own offers under § 7(3) UWG. You can object at any time, for example via the unsubscribe link in every email.
We send discount and marketing emails through Brevo (Sendinblue GmbH, Germany). We only pass your name, email address and company to Brevo when you actively tick the "Yes, send me discounts & offers" box during checkout. If you then do not complete your order, you receive one reminder with a discount code. Every such email contains an unsubscribe link; it deletes your contact from Brevo completely, so you will not receive any further marketing emails. Your order emails (confirmation, address requests, reminders) run through a separate sending channel and are not affected by unsubscribing. The legal basis is Art. 6(1)(a) GDPR; you can withdraw your consent at any time via the unsubscribe link.
The legal basis is Art. 6(1)(b) GDPR, Art. 6(1)(f) GDPR (customer care, proof of consent) and, where given, Art. 6(1)(a) GDPR. We delete the data when you object or the customer relationship ends, unless a retention obligation applies. Cake recipients are never in the CRM.
Feedback: about 14 days after the last delivery of an order, we ask you once by email for short feedback (satisfaction, result per cake, free text). We store your answers with your order to improve Süßakquise and keep the figures on our website accurate (Art. 6(1)(f) GDPR). After submission, we email you the announced personal, single-use discount code and record its redemption with the related order. For recipients we only store the company and the result, never names. We may show sentences from your feedback on our website without your name or company. We only show your company logo as a customer if you explicitly agree (Art. 6(1)(a) GDPR); you can withdraw that consent at any time by email.
12. Pseudonymous website analytics
Only if you agree do we collect pseudonymous usage statistics, for example which pages are visited, how long visitors stay and which buttons are used. For this we store a randomly generated identifier in your browser's local storage, which lets us recognise repeat visits in the same browser. The identifier is additionally hashed before being stored in our database and never linked to names, email addresses, orders or CRM contacts.
If you decline, no website analytics take place and no analytics identifier is stored in your browser. Analytics events are deleted after twelve months.
The legal basis is your consent under Art. 6(1)(a) GDPR and § 25(1) TDDDG. You can withdraw it at any time via "Cookie settings" in the footer of every public page. On withdrawal we immediately delete the identifier from your browser and stop the analytics.
13. Booking via Calendly and chatbot
The Calendly booking calendar (Calendly LLC, 115 E Main St, Ste A1B, Buford, GA 30518, USA) is only loaded when you click a booking button. Only then is data such as your IP address and the booking details you enter (name, email address, time) sent to Calendly. Calendly is certified under the EU-US Data Privacy Framework. The legal basis is Art. 6(1)(b) GDPR. More at https://calendly.com/privacy
Chatbot messages are sent to the Lovable AI Gateway to generate an answer. We do not store the conversation. We store the questions asked without name, email or IP address to improve our offer. Please don't enter personal data in the chat. The legal basis is Art. 6(1)(f) GDPR.
14. Your rights
You have the right at any time to: - access your stored data (Art. 15 GDPR) - rectification (Art. 16 GDPR) - erasure (Art. 17 GDPR) - restriction of processing (Art. 18 GDPR) - data portability (Art. 20 GDPR) - withdraw consent with effect for the future (Art. 7(3) GDPR)
Right to object (Art. 21 GDPR): Where we process your data based on legitimate interest (Art. 6(1)(f) GDPR), you can object at any time on grounds relating to your particular situation. You can object to direct marketing at any time without giving reasons. We will then no longer process your data for that purpose.
Just write to founder@suessakquise.io. You also have the right to lodge a complaint with a supervisory authority (Art. 77 GDPR). The authority responsible for us is the Bavarian State Office for Data Protection Supervision (BayLDA), Promenade 18, 91522 Ansbach, Germany.
15. Data security
We use technical and organisational measures to protect your data against manipulation, loss and unauthorised access, such as encrypted connections, private file storage with expiring links and owner-only access to customer data.
16. Changes to this privacy policy
This privacy policy is current as of October 2026. We update it when our website or the law changes.