Privacy Policy

Data and purposes

Visits and security

Application logs record a request identifier, method, path without the query string, and response status. The application logger reviewed does not record IP addresses, headers, or request bodies; the hosting platform may create separate logs.

Contact messages

The form sends your name, email address, language, and message through Resend to the configured contact mailbox. The message body is not stored in an application database table; it may remain in Resend and the recipient mailbox under their respective terms and settings. For privacy requests, use info @ thinkpunk . net.

Orders and PayPal

To handle a purchase, the site processes email, name, country, products, quantities, amounts, currency, order status, and PayPal identifiers. Card details are handled by PayPal and are not stored by this site.

Newsletter

At checkout you can choose separately whether to subscribe. Buying does not depend on subscribing. The system records your email, choice, consent wording and version, date, and source; it sends a confirmation email and provides an unsubscribe option. No campaign-sending flow was identified in the reviewed code.

Analytics

Google Analytics 4 receives page_view events only after consent. Events use canonical public paths and page titles; they exclude query strings, form data, basket, checkout, orders, and downloads. Public Contact and Impressum pages are included; operational and unrecognised paths are excluded.

Instagram

The server calls Meta’s Graph API for recent public posts from the configured account. Your browser loads images and videos from Instagram/Meta CDNs; Meta receives ordinary technical request data from your browser, including its IP address.

Legal bases

Data needed to receive and fulfil an order is processed to carry out the purchase; accounting documents are retained only where and to the extent required by law. Optional newsletter and Analytics processing is based on your explicit choice.

Data needed to answer a message is used to handle that request; technical data and abuse-prevention limits support service operation and security. The applicable legal basis depends on the law and circumstances of each processing activity; this notice does not assume one basis applies to every visitor or country.

Cookies and browser storage

Your Analytics choice is stored in localStorage for 180 days. The basket, selected language, and order-retrieval proof are stored in localStorage without an automatic expiry set by the site. The locally stored proof does not make an expired download valid.

Google Analytics may set its own cookies only after consent. The PayPal SDK loads during checkout and may use cookies or similar technologies under PayPal’s settings. The site does not determine third-party cookie names or lifetimes. See Cookies & Analytics for details and controls.

Retention: current status and proposal

The application database retains orders and statuses, purchase data, email-delivery metadata, and newsletter records. The code does not provide general automatic deletion of these data. Download links expire after 72 hours and allow up to five downloads: expiry blocks access but does not delete the token record.

The periods below are a proposed future policy, not a feature already in operation. Publishing this notice does not trigger deletion or apply the periods retroactively to existing records. Copies held by providers are also subject to their terms and account settings.

Accounting and tax documents

Proposal: retain for 10 years when and to the extent required by applicable obligations; this does not automatically extend to every order datum.

Order data

Proposal: retain only as long as needed for legal obligations or to establish, exercise, or defend rights, for no more than 10 years; minimize or remove operational data sooner when no longer needed.

Contact messages

Proposal: retain for 12 months. The message is currently sent to Resend and the recipient mailbox, not to an application database table; automatic deletion from the mailbox or provider copies is not configured.

Application security logs

Proposal: 90 days for logs controlled by the application. Separate hosting-platform logs follow Replit’s terms and settings, which have not been verified for this project.

Download tokens

Proposal: delete the record 30 days after the download link expires. Link expiry currently does not delete the record automatically, and no deletion job has been added.

Newsletter

Proposal: keep subscription data until withdrawal; after withdrawal, retain only the minimum evidence for a proportionate period needed for applicable obligations and rights. No fixed number of months is set for this evidence, and records are not automatically deleted.

Analytics

Retention depends on the actual GA4 property setting, which has not been checked. For standard properties, Google documents 2- or 14-month options for user and event data; this does not identify the option active for ThinkPunk®.

Providers and international transfers

The site uses PayPal for payments, Resend to send transactional and contact email, Google for Analytics after consent, Meta for the Instagram API and media CDNs, and Replit for hosting, database, and files. Privacy requests can be sent to info @ thinkpunk . net. The data each provider processes depends on the service actually used and its terms.

Resend states that customer data, including email content, logs, and account records, is stored in the United States regardless of sending region. The selected sending region controls email routing, not data residency. Resend documents 30-day retention for email and log data on Free, Pro, and Scale plans, with flexible retention on Enterprise; ThinkPunk®’s plan, sending region, and account settings have not been checked.

PayPal handles payment data under its privacy statement and the agreement applicable to the product. Its public DPA for card or direct-debit processing does not automatically apply to PayPal Wallet services; the agreement for this account has not been checked. This site does not receive or store card details.

Meta processes technical data from requests to its Graph API and Instagram/Meta CDNs under its privacy policy. Google states that for users in Switzerland, the EU, and the UK it derives coarse location from an IP address and then discards the IP before logging; this does not rule out transient processing for connection and location purposes.

Replit documents that publishing geography is selected per project and determines where compute and storage are hosted; this project’s selected region has not been verified. Its general documentation describes production PITR with a default 7-day window and options up to 28 days on some plans; scheduled backups are separate and depend on settings and plan. These general terms do not establish which options are active for this account.

Choices and rights

You can reject or withdraw Analytics at any time using “Cookie preferences” in the footer or the banner controls. Withdrawal stops further Analytics events and deletes _ga and _ga_* cookies from this browser; it does not retract data already received by the provider.

For data requests or newsletter changes, contact info @ thinkpunk . net. You may exercise rights available under applicable law, including access and correction and, where provided, deletion, restriction, objection, and portability. You may withdraw consent without affecting processing carried out before withdrawal.