Privacy Policy
Ilia Isakov, Leuningerstr. 10, 56410 Montabaur
Email: [email protected]
We process personal data only to the extent necessary to provide our online shop and our services. Processing is based on the GDPR, in particular:
When you use our shop, we process the following data:
Our shop is hosted on servers in Germany. For the delivery of static content and for DDoS protection we use Cloudflare Inc. (USA). In doing so, Cloudflare forwards all requests to our pages and our server and processes the connection data and also the content of the requests, such as your entries in forms. For the basis of transfers to the USA see section 12. (Legal basis: Art. 6(1)(f) GDPR) More information: https://www.cloudflare.com/privacypolicy/
Payments are processed by Stripe Payments Europe Ltd. (Ireland). When you pay, your payment data is transmitted directly to Stripe. We do not store complete credit card data ourselves. As soon as the payment step is created (in checkout when you submit the delivery address; for the express buttons as soon as they are built on the design page, in the cart or in checkout, even if you do not buy afterwards), we also store with the payment at Stripe: the items, your visitor ID (section 11.7) and, if you are signed in, the identifier of your customer account; in checkout also your email address, your name, your delivery address and, if provided, your phone number, a different billing address, the shipping method, a redeemed voucher or discount code and the version of the terms and of the review request notice with time (for express payments, email address and delivery address come from your wallet); campaign details and the origin of your visit; your choice for the “Advertising” category in the cookie notice with time and version; with your “Advertising” consent also the click identifiers gclid and fbclid and the identifiers from the Meta cookies _fbp and _fbc (sections 11.3, 11.4 and 11.7). The cookies Stripe sets in the checkout for fraud prevention are listed in section 11.7. Stripe processes your data in accordance with its own privacy policy: https://stripe.com/privacy. The legal basis is Art. 6(1)(b) GDPR for the payment, our legitimate interest in attributing orders to their advertising source for campaign details and origin (Art. 6(1)(f) GDPR), our legitimate interest in transferring your choice and the versions of the terms and the review notice with the payment to the order and being able to prove them there (Art. 6(1)(f) GDPR), and your consent for click and Meta identifiers (Art. 6(1)(a) GDPR).
For the production and shipping of your order we work with Printful Inc. (USA/Latvia). Printful receives the data required to fulfill the order (name, delivery address, email address, phone number if provided, product details and a gift message if the order has one). For the basis of transfers to the USA see section 12. (Legal basis: Art. 6(1)(b) GDPR) Privacy policy of Printful: https://www.printful.com/policies/privacy
To create your designs we use AI services. We transmit your selection (product, theme, style, motifs), the sentence you type, your messages to the assistant in the generator and images you upload as a reference. We do not transmit your name, email address, postal address or payment details; if your sentence or your images themselves contain information about people, such as a name or a photo, it is transmitted with them. The AI service that creates your motif classifies every uploaded image: photo of a person, an animal or an object, lettering or crest, scene or finished picture, style sample. Whether your designs count as based on a photo depends partly on this classification (section 7b). Some of the AI services are located in the USA (section 12). We delete uploaded images 90 days after they were used, unused ones after 24 hours. The generated design images are kept in our storage (section 8). The rights of use in the generated designs lie with the operator. (Legal basis: Art. 6(1)(b) GDPR)
We advertise with Google Ads (section 11.3) and use the Google Ads API to manage our campaigns, retrieve reports and request keyword ideas. Reporting purchases through this interface is prepared but currently switched off; no purchase is reported to Google this way. Before we switch it on, we will update this section and section 11.3; it will then only take place with your “Advertising” consent. Our use of Google API Services complies with the Google API Services User Data Policy (https://developers.google.com/terms/api-services-user-data-policy).
Data collection and use (Data Usage): Through the Google Ads API we manage our campaigns, retrieve reports and request keyword ideas; we currently do not report purchases through this interface. Which data Google receives through the Google tag with your “Advertising” consent is described in section 11.3. The reports are used solely to measure and manage our advertising campaigns.
Data sharing (Data Sharing): Google user data is not passed on to any other third parties. Google user data is not sold or passed on to advertising platforms, data brokers or information resellers. Google processes the data in accordance with its own privacy policy (https://policies.google.com/privacy) and the API terms of use.
Data storage and protection (Data Storage & Protection): We process the reports on our servers in Germany; the connection to Google is encrypted with HTTPS. We do not store Google user data permanently on our systems. Access to the Google Ads API is protected by OAuth 2.0 and limited to authorized systems.
AI training: We do not use any data received through Google API Services or transmitted to Google to train AI or ML models.
Every finished design gets its own page in our shop at www.isakum.com/designs/... (in English at www.isakum.com/en/designs/...), where it can be viewed and ordered. This also applies to designs you create without a customer account. Anyone who knows its address can open the page without signing in. It shows the design on product images, a title, a description, keywords and the classification by theme, motif and style. It does not show your sentence, your uploaded images, the name from your customer account or your contact details. Lettering you asked for on the shirt can be seen as part of the motif on the product images, even if it contains a name. If the design is based on a photo, the motif may show the person or animal pictured as a drawing. Only designs we have added to our gallery appear in lists in our shop (gallery, category, motif and home pages) and in our sitemap. One exception is the review band on our pages: an approved review links to the page of the design it is about if search engines may index that page, even if the design is not in the gallery (section 9d).
Texts and check: shortly after your design is finished, the AI service Gemini from Google writes the title, description, keywords and address of the page. For this we transmit your selection (product, theme, motifs, style, target group), a description of the finished motif, your sentence and the text on the shirt. We do not transmit images, your name, your email address or your visitor ID. The texts describe the motif in their own words. They do not reproduce your sentence or, without your consent (see below), your lettering; we check every text for longer sequences of words from them. Individual words or short groups of words from them may appear where they describe what can be seen. The address of the page contains neither your lettering nor sequences of words from your sentence, not even with your consent. If the address of a page changes, for example because we rewrite its texts, the earlier address remains stored and redirects to the new one; an earlier address may contain words that a new one would no longer carry. In the same step Gemini assesses whether your sentence or the text on the shirt contains a person’s name or information about health, religion, sexual orientation, political opinion or ethnic origin. Whether a design is based on a photo follows from the type you choose when uploading an image and from how the image is classified during design: the AI service that creates your motif classifies every uploaded image. If an image is a photo of a person, an animal or an object according to this classification, this applies to all designs of this generation, even if you chose a different type. As a precaution we treat images with the choice “Detect automatically” or “Artwork or scene” like photos unless the classification clearly rules this out. The check is an automatic assessment and may miss something in individual cases. A daily run searches the texts and addresses of designs outside our gallery for sequences of words from your sentence, without your consent also from your lettering, and for terms that must not appear there. It has the affected texts rewritten, usually again by Gemini. We keep the previous version for 30 days so that we can undo mistakes.
Search engines: search engines may index pages without any of the findings mentioned, as well as pages of designs in our gallery, which passed this check before being added, even if a later check fails. If a design is based on a photo, contains a person’s name or any of the information mentioned, if the check has not been completed yet or has failed, or if we have blocked the page because of a trademark, the page carries the instruction “noindex”. This also applies to a design from our gallery for which a later check finds a photo, a person’s name or any of the information mentioned. A page that we have taken out of search engines on request also carries “noindex”, even with your consent. It then remains reachable through its address, but search engines do not include it. If you change your consent, if we rewrite the texts, if we block a page because of a trademark or if we take it out of search engines on request or release it again, we report its address through the IndexNow service (api.indexnow.org), as well as an earlier address that we remove on request; we report pages from our gallery twice a day if they have changed. IndexNow passes the report on to the participating search engines, among them Bing (Microsoft), Yandex, Seznam and Naver; Google does not take part. Only the address is sent. Search engines only take over a change when they fetch the page again.
Gallery, catalogues, marketplaces and videos: only designs we select ourselves go into our gallery, into product catalogues for advertising platforms, into pins on our Pinterest account and onto marketplaces such as Etsy, eBay or Amazon. We write our own texts for them, also with the help of AI services, currently Gemini from Google and Claude from Anthropic (USA); for this they receive the print files and product images of the design, your selection and the existing texts. These texts may contain your lettering, because it can be seen on the image, even without your consent; they do not contain sequences of words from your sentence. For videos on our own accounts on Instagram, Facebook, Pinterest, TikTok and YouTube we may also select designs outside the gallery. The video shows the shirt with the motif and points to the design page; it does not show your sentence. Gemini from Google writes the caption for the video from the title, motif, style and category of the design, for some videos also using the motif image. We do not include designs with a photo, a person’s name or any of the information mentioned, or designs not yet checked, in any of these places, not even with your consent. If a later check finds a photo, a person’s name or any of the information mentioned in a design from our gallery, or if it fails, the design is missing from the lists in our shop, from our sitemap and from the product catalogues, and we do not select it for any new video; we check such a finding and, if it is confirmed, take the design out of the gallery and off the marketplaces.
Your generation page: all designs of a generation also appear together on one page at www.isakum.com/generierung/... (in English at www.isakum.com/en/generation/...). It carries “noindex”, but anyone who knows its link can open it. The design pages of this generation link to it, including pages that search engines may index. Others see the product images of all finished designs of the generation there, including those based on a photo or containing a person’s name or any of the information mentioned, but neither your sentence nor your uploaded images nor your selection of theme, motifs and style. Designs we have blocked because of a trademark are visible there only to you.
“Show publicly” consent: if you marked an image as “Photo” while designing, the generator shows a box with the text “My designs may be shown publicly and found by search engines, including my photo, names and text. I can withdraw this at any time on the design page.” It is not ticked in advance. What the consent does: it applies to the designs of the generation for which you give it. With it, search engines may also index pages based on a photo or containing a person’s name, and your lettering may appear in the title and description of these design pages. Every design page can be reached through its link even without consent (see above). Even with consent we do not show your photo itself, only the motif drawn from it, and the texts do not take over your sentence either. Gallery, catalogues, marketplaces and videos remain closed to such designs. Pages with information about health, religion, sexual orientation, political opinion or ethnic origin keep “noindex” even with your consent. On the design page only you, as the creator, see the switch “Show publicly and let search engines find it”, as soon as a design of your generation is based on a photo or contains a person’s name, and always once you have consented. We recognise you as the creator by your customer account or by the secret random token your browser stores while you design (section 11.7). For older generations created without such a token, your visitor ID is enough to withdraw a consent you have given; consent cannot be given there. We store every change made in the generator or on the design page with your generation as a record, with wording, version, language, place of the declaration and time. You can withdraw your consent at any time with effect for the future using the same switch. If you can no longer reach the switch, for example on another device, write to [email protected] and we will record the withdrawal for you and store it as a record in the same way, additionally with the date and subject or identifier of your email. After that, pages with a photo or a person’s name carry “noindex” again, and we rewrite the texts of all designs of this generation outside the gallery without your lettering.
Other people (information under Art. 14 GDPR): if your photo shows another person or your sentence or lettering names another person, we have received that person’s data from you: their likeness drawn in the motif and their name. When designing, you assure us that you may use your text and images and that they do not infringe the rights of others. We process this data as described in this section: on the design page and your generation page, in the check and for the texts. Towards this person the legal basis is our legitimate interest, and yours, in creating and showing your design as you commissioned it (Art. 6(1)(f) GDPR); you can only give the “Show publicly” consent for yourself. The person can object to this processing (Art. 21 GDPR) and contact [email protected], for example to have the page taken out of search engines or removed; otherwise the rights in section 15 apply to them. We cannot notify them ourselves, because we do not know them and have no contact details for them (Art. 14(5)(b) GDPR).
Retention: design pages, your generation page, their texts and earlier addresses have no fixed deletion period; they remain as long as we offer the design or until you ask for their removal. We store the result of the check with the design for as long as it exists. We store the record of your consent with your generation for as long as the consent applies, otherwise until the end of the third calendar year after the year of the last change; after that, only a note without wording that there is no consent remains there. After 30 days we delete earlier versions of texts that our daily run or a rewrite of existing designs outside the gallery initiated by us has replaced. If you delete your customer account, we detach your designs from the account: designs, design pages and your generation page remain, your sentence and your visitor ID remain stored with the generation, and a “Show publicly” consent you have given continues to apply until you withdraw it. If you would like us to remove a design page or an earlier address or to take a page out of search engines, please write to [email protected] stating the address. A page that we take out of search engines on request then carries “noindex”, even with consent, appears neither in a list in our shop nor in our sitemap or a product catalogue, we include it neither in the gallery nor in a new video, and it remains reachable through its address. An earlier address that we remove no longer redirects to the page, and we never assign it again; for this we permanently keep only a check value (hash) of the address, not the address itself. We note both kinds of request on the design with the time and the date and subject or identifier of your email for as long as the design exists; a removed address does not appear in this note. If an order belongs to the design, it is kept as part of that order.
Recipients: as the provider of Gemini, Google receives the data mentioned above for the texts and the check, print files, selection and texts for gallery designs, and title, motif, style, category and in some cases the motif image for the captions of our videos. Anthropic receives print files, product images and texts for work on gallery designs. Meta (Instagram, Facebook), Pinterest, TikTok and Google (YouTube) receive the videos we publish there; Pinterest also receives the image, title, description and address of gallery designs that we publish there as pins. For product catalogues we provide image, title, description and address of gallery designs to Google (Merchant Center), Microsoft (Bing), Meta and Pinterest; we list offers on Etsy, eBay and Amazon. Through IndexNow the participating search engines receive the address of the page. For transfers to third countries see section 12. Anyone who knows their address can open the pages; search engines can also access pages without “noindex”.
Legal basis: the legal basis for the design pages and your generation page, through which you view, share and order your designs, is Art. 6(1)(b) GDPR. For the texts of the pages, the check for photos, names and sensitive information, the daily run including the backup, the indexing of pages without findings, the IndexNow reports, the gallery, catalogues, marketplaces and videos including naming your lettering in their texts and the help of AI services with them, and for the pages continuing to exist after you delete your customer account, we rely on our legitimate interest in offering and promoting our designs so that they can be found, in keeping links to your designs working and in protecting your input in the process (Art. 6(1)(f) GDPR). You can object to this processing (Art. 21 GDPR, section 15); a short email to [email protected] with the address of the design page is enough. The legal basis for the indexing of pages with a photo or a person’s name and for naming your lettering in the title and description of your design pages outside the gallery is your consent (Art. 6(1)(a) GDPR). We store the record of a consent given on the basis of our duty to provide proof (Art. 6(1)(c) in conjunction with Art. 7(1) GDPR), and the record of a withdrawal on the basis of our legitimate interest in being able to prove it as well (Art. 6(1)(f) GDPR). We store the notes on requests that we carry out in response to your email and the check value of a removed address on the basis of our legitimate interest in being able to prove that they were carried out and in permanently excluding the address from being assigned again (Art. 6(1)(f) GDPR). Your right to lodge a complaint is set out in section 16.
For data storage and user sign-in we use the open-source software Supabase, which we run ourselves on our server in Germany (section 4). Your account data (email address, password as a non-reversible hash) and your order data are stored there in a PostgreSQL database. No data is transferred to Supabase Inc. in the process. We store images and videos (generated designs, product views, reference images you upload, photos and videos for reviews, mirrored photos from Google reviews, images in our emails) in the R2 object storage of Cloudflare, Inc. (USA) in data centres in the EU; Cloudflare processes them on our behalf (Art. 28 GDPR). Our backups are stored there in encrypted form. (Legal basis: Art. 6(1)(b) GDPR; for photos and videos for reviews and for photos from Google reviews, the one stated in section 9d)
We use Brevo (Sendinblue SAS, France) as our processor to send our emails: order, payment and shipping confirmations, notices about your customer account, the notification about finished designs (section 9a), review requests (section 9d), reminders about an unfinished cart (section 9e), requests via our form that we forward to our mailbox, and our replies to them (section 9c), emails about gift cards (section 9g) and, only with your consent, the newsletter (section 9f). For this, Brevo processes your email address, your name where the email contains it, the content of the email and technical delivery data. The legal basis depends on the purpose of the email: Art. 6(1)(b) GDPR for emails about orders and your customer account, otherwise the one stated in the relevant section.
Brevo tells us whether an email was delivered, whether it bounced or was marked as spam and whether you unsubscribed. We record these reports with the email in our delivery log (section 14) so that we can trace sending, detect bounces and respect unsubscribes (Art. 6(1)(f) GDPR). If Brevo reports an unsubscribe, a spam complaint, or that your address is permanently undeliverable or invalid or has been blocked by Brevo for sending, we no longer send advertising emails to this address (newsletter, reminders about designs and carts, review requests) and enter a check value of the address in our blocking list for this purpose (section 14). We do not have Brevo report to us whether you open an email or follow a link in it, and we do not store this. Brevo itself deletes its sending logs in our account after one month and does not store previews of the emails.
Brevo adds an invisible image to every email to count opens and routes links in the email through its own addresses; on our plan, neither can be switched off. We have instructed Brevo not to attribute opens to you, and we do not evaluate opens or clicks. Privacy policy of Brevo: https://www.brevo.com/legal/privacypolicy/
If you enter your email address while waiting for your designs, we store that address together with the time of entry, your IP address shortened to the network (IPv4 to 24 bits, IPv6 to 48 bits) and the version of the notice text you saw. We use the address to send you the link to your finished designs together with pictures of them and, where the notice at the field said so, to remind you of these designs no more than twice (about one day and about three days after the first message); in case of an error we send the message that no design could be finished. We do not send any other advertising this way.
The legal basis is your consent under Art. 6(1)(a) GDPR. You can withdraw it at any time with effect for the future, using the delete link at the end of each message or a short email to [email protected].
We delete the address and the shortened IP address no later than 30 days after the first message. We keep the time of consent and the version of the notice text beyond that, because we must be able to prove the consent. Section 9 applies to the sending itself.
If you would also like to receive news and offers, a separate sign-up with a confirmation click is required. Without this confirmation we do not send you the newsletter (section 9f).
When we contact creators, bloggers, editorial offices, clubs or companies about working together, we process data that we did not collect from you directly.
Source: We use only publicly available information, for example your public profile on Instagram or TikTok, your website or your legal notice.
Data: name or profile name, contact details from your profile or website, publicly visible information about your posts (for example the number of followers, posts and comments), our messages and your replies, and notes on the status of the contact.
Purpose and legal basis: We check whether working together fits Isakum, contact you and conduct the conversation. The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest is to make our offer known through collaborations. If a collaboration takes place, Art. 6(1)(b) GDPR applies to carrying it out.
Recipients: Your messages run through the platform on which we contact you or through our email provider; their privacy notices apply there. An AI service may suggest a draft of a message to you; for this it receives your name or profile name, publicly visible information about your posts and our notes about you. If you receive a free shirt, our print service provider receives the delivery data (section 6). We do not sell any data. For transfers to third countries see section 12.
Retention: We delete your information once the request has been settled, at the latest twelve months after the last contact. If you decline or object, we reduce your information within one week to a blocking note so that we do not contact you again: the platform, your profile name and a non-reversible check value of your email address. Records of a collaboration with a delivery (name, profile name, platform, consideration, costs, delivery date and discount code) are kept until the end of the tenth calendar year after the year of delivery (section 14).
Your rights: The rights in section 15 apply. You can object to the processing at any time (Art. 21 GDPR), including its use for direct marketing. A short no in the message or an email to the address in section 1 is enough. Your right to lodge a complaint is set out in section 16.
Automated decisions: There is no automated decision-making within the meaning of Art. 22 GDPR. From public figures we calculate a score that helps us choose; a person decides whether to contact you.
On our “Companies & clubs” page (www.isakum.com/en/companies-and-clubs, in German /firmen-und-vereine) you can send us a request using a form.
Data: We process what you enter: the name of your company or club, your name, your email address, your message and, if you provide it, the number of items you want. We cannot accept the request without company or club, name, email address and message; the number of items is optional. We do not store your IP address or your browser identification with a request in our database. The counter against misuse holds the IP address briefly; if a connection exceeds a limit against too many calls, it is also recorded in our server log (below and section 10). In addition there are our replies and notes on the status of processing. Please only tell us what we need for your request, and no information about health, religious or political beliefs or trade union membership. If you name other people in your message, for example members of your team, their details come from you; this section applies to them as well. Please point these people to this section.
Protection against misuse: So that the form is not misused on a large scale, we count your requests for ten minutes under your IP address (for IPv6 under its /64 network) in our cache; the counter then expires. As soon as you click into a field of the form or reach it with the tab key, and at the latest when you send the form, the Cloudflare bot protection loads (section 10). If it does not deliver a clearance, for example because an ad blocker blocks it, your browser instead solves a small computing task that only our server sets and checks; we count how many such tasks are fetched under your IP address in the same way for one hour (section 10). If an unusually large number of requests arrives on one day, we only store further requests in our database, do not forward them by email and only process them after we have checked and released them.
Purpose and procedure: We ourselves use your details only to answer your request and to carry out any order resulting from it, not for advertising. We store your request in our database on our server in Germany (section 8) and handle it in the admin area of our shop; it is stored even if forwarding by email fails. Every reply is sent by a person; there is no automated decision-making within the meaning of Art. 22 GDPR. If you have allowed “Advertising” in the cookie notice, the Google tag also loads on this page; it can report the submission of the form and in doing so detect email address and name in the form fields and transmit them to Google as hashes (section 11.3).
Recipients: On the way to our server your entries pass through the Cloudflare network, which also processes their content (section 4); Cloudflare also provides the bot protection (section 10). Except in the case of the daily limit above, we send your request with all details from the form via our email service provider Brevo (section 9) to our mailbox (section 12); your name and email address are set as the reply-to address. We send our reply either from our admin area via Brevo or directly from our mailbox, in both cases to the email address from your request; if you reply to it, your email reaches us in that mailbox. For every email we send via Brevo, Brevo reports to us whether it was delivered or bounced; for the counting image and the links in emails sent via Brevo see section 9. If an order is placed through our shop, sections 5 and 6 apply to it. For transfers to third countries see section 12.
Legal basis: If you want to order from us yourself, the legal basis is Art. 6(1)(b) GDPR (pre-contractual measures at your request). If you write on behalf of a company or club or ask a general question, the legal basis is Art. 6(1)(f) GDPR; our legitimate interest is to answer requests, to carry out orders from companies and clubs and to know the previous correspondence in case of follow-up questions or a later order; that is why we keep the request for up to 365 days after our last reply. The counters, the computing task, the entry in our server log and the bot protection serve our legitimate interest in protecting the form against automated and mass requests (Art. 6(1)(f) GDPR); the bot protection querying information from your browser for this purpose is strictly necessary for sending the form, which you have requested (section 25(2) no. 2 TDDDG). For the Google tag, section 11.3 applies.
Retention: We delete the request and its copies in our admin area, including our replies and draft replies, no later than 365 days after our last reply, or, without a reply, no later than 365 days after receipt. For our replies sent via Brevo we keep a delivery log with your email address as recipient, time, status and Brevo's delivery reports (above); we delete it after 365 days (section 14). It contains the subject line and text of the reply, whose subject line usually names your company or club, for 30 days only. If an order is placed through our shop, the statutory retention periods apply to the order data (section 14). The emails in our mailbox, that is the email with your request, your further emails to us and replies we send directly from the mailbox, are not covered by this automatic deletion; for them the principle in section 14 applies that we delete data as soon as the purpose of storing it no longer applies.
Your rights: The rights in section 15 apply; you can also request the deletion of your request before these periods expire. We then delete the request with our replies, draft replies and the notifications about it in our admin area, and in the delivery log your email address and the stored texts of our replies, including check copies we made of them; an entry about a sent reply in the activity overview of our admin area expires by itself after seven days. We delete the emails in our mailbox there by hand. You can object to processing based on our legitimate interest under Art. 21 GDPR on grounds relating to your particular situation; a short email to [email protected] is enough. Your right to lodge a complaint is set out in section 16.
After delivery we ask customers by email for a review, publish reviews on isakum.com after checking them and also show excerpts there from reviews of our business profile on Google.
Review request by email: In our checkout, below the field for your email address, there is a notice that we will ask you once by email for a review after delivery and that you can object to this at any time. We store which version of this notice you saw and the time with your order and, if you pay through Stripe, also in the payment details (section 5). No earlier than seven and no later than 90 days after your order has been marked as delivered in our system, we send one email per order to the email address of the order asking for a review. It contains your first name from the delivery address, the name of the product, a personal link to our review page that is valid for 30 days and, where applicable, links through which you can also review us on Google or Trustpilot. You do not receive this email if you paid with the express buttons (such as Apple Pay or Google Pay) or ordered through Amazon, eBay or Etsy, if you have already reviewed the order or if you have objected.
Sending and retention: We send the email through Brevo (section 9). Brevo reports to us whether it was delivered; for the counting image and the links in emails sent via Brevo see section 9. We see these reports in our admin area with your order, as well as how often and by how many different visitors the review page was opened and from which page the visit came (only its domain, for example that of your email service; section 11.2). We delete the delivery log (email address, order, time, status and these reports with their type, time and, for a rejection, the reason) after 365 days, and the stored content of the email, which does not contain your personal link, after 30 days. We note on the order that we have asked you, so that we do not ask you a second time; this note is kept for as long as the order (section 14).
Legal basis and objection: The legal basis is our legitimate interest in obtaining feedback on our products and gaining reviews for our shop (Art. 6(1)(f) GDPR in conjunction with section 7(3) of the German Act against Unfair Competition, UWG). You can object to the review request at any time (Art. 21(2) GDPR) without incurring any costs other than the transmission costs at the basic rates: through the “Unsubscribe” link at the end of the email, through the unsubscribe function of your email program or with a short email to [email protected]. So that we do not write to you again afterwards, we store in our blocking list only a non-reversible check value (hash) of your email address, not the address itself. We keep this entry for as long as we send advertising by email; the legal basis is our legitimate interest in respecting your objection permanently (Art. 6(1)(f) GDPR).
Your review on our site: The personal link opens our review page. It shows the name from your delivery address, the product ordered with colour and size, and pictures of the product; anyone who knows the link can see these details. Third-party analytics and advertising services do not load on this page (section 11); our own visitor measurement records the visit (section 11.2). You give stars and write a text of at least 10 characters; a title, a photo (JPEG, PNG or WebP) and a video (MP4, WebM or MOV) are optional. When you upload a photo we reduce it to at most 1600 pixels on the longest side and save it anew; embedded details such as the location, device and time of capture are removed in the process. We repackage videos when you upload them without changing picture or sound; embedded details such as the location, device, time of capture, title and comment are removed in the process. If a video cannot be cleaned in this way, we do not accept it. Uploaded files are kept in our storage (section 8) under an address that cannot be guessed. If you replace or remove a file in the form, we delete it immediately; we delete files from a form you do not submit after 31 days. To prevent mass uploads, our server counts the uploads per IP address (for IPv6 per /64 network) for one hour, and for each uploaded file we note the order, the type (photo or video), the size and the time so that we can limit the number and size of uploads per order; we delete this note together with the review to which the file belongs or, if no review is submitted, 31 days after the upload. The legal basis is our legitimate interest in protection against misuse (Art. 6(1)(f) GDPR).
With your review we store the stars, title, text, photo and video, the time and the link to your order, to the reviewed design and, if you ordered with a customer account, to your account. Only someone who comes through the link of a delivered order can submit a review, and only once per order. We check every review before it is published. For a new review we receive a notice in our admin area with the stars and the beginning of the title or text; we delete its content after about 60 days at the latest.
If we approve your review, we show the stars, title, text, photo, video and date on isakum.com without your name: with the reviewed design and in the review band above the footer of many pages, such as the home page, where it links to the reviewed design if search engines may index its page (section 7b). The photo and video can then be accessed publicly; whatever you write in your text or show in the photo and video therefore becomes public. Please only show or name other people if they agree. If you gave four or five stars, we offer you links after submitting to also review us on Google or Trustpilot. Only your click takes you there; their privacy notices apply there.
The legal basis for storing and publishing your review is your consent, which you give by submitting after the notice directly above the button (Art. 6(1)(a) GDPR). We store which version of this notice you saw and the time of submission with the review so that we can prove your consent (Art. 6(1)(c) in conjunction with Art. 7(1) GDPR). You can withdraw your consent at any time with effect for the future (Art. 7(3) GDPR); an email to [email protected] is enough. We then remove the review from display, delete the photo and video from our storage immediately and the remaining details of the review 30 days after your withdrawal; browsers and caches may still show a full-size photo or video that has already been loaded for up to 24 hours. We do not approve a review again once you have withdrawn your consent to it. We delete reviews that we do not approve, together with the photo and video, 30 days after that decision. As long as we have not decided on a review, it remains stored without being shown; if we have not decided 30 days after receipt, the review is treated as not approved and we delete it together with the photo and video 30 days later. Approved reviews remain stored until you withdraw your consent or until we delete the order or the reviewed design. If your customer account is deleted, at your request or because of inactivity (section 14), we also delete the reviews of that account together with the photo and video. We do not specifically delete the reduced copies of photos that our website keeps for display, neither after a withdrawal nor after a rejection or the deletion of an account; they may remain accessible for some time, in visitors’ browsers for up to 60 days.
Reviews from Google (information under Art. 14 GDPR): In the review band we also show excerpts from reviews that people have posted publicly on our business profile on Google. We do not collect this information from you directly.
Source: our business profile on Google, which our server retrieves through a Google interface.
Data: From up to six reviews with text we take the name under which the review appears on Google, the stars, the date, the text (shortened to 600 characters) and up to four photos, as well as the identifier under which Google keeps the review; we do not display this identifier. We do not take profile pictures.
Purpose and legal basis: We show visitors reviews of our shop that have been posted publicly. This is our legitimate interest (Art. 6(1)(f) GDPR).
Recipients: The excerpts are visible to all visitors of our pages. We store the photos unchanged in our storage (section 8) and show them from there, so that visitors’ browsers do not connect to Google for them. Only a click on a Google review takes you to our profile on Google.
Retention: Our server retrieves the reviews again every night and, in addition, when a page with the review band is opened, in that case no earlier than twelve hours after the last successful retrieval; in doing so it replaces the stored version. If a retrieval fails, we keep showing the last version for no more than about 72 hours; after that we delete names, texts and photos at the next retrieval attempt, at the latest the following night. When a retrieval succeeds, we renew stored photos that are older than 20 days and delete photos that Google no longer provides; we delete a photo that could not be renewed for 30 days at the next retrieval attempt, at the latest the following night. If we switch off the review band, we no longer retrieve anything and delete names, texts and photos the following night. If you delete your review on Google, it disappears from our site with the next successful retrieval.
Your rights: You can object to this processing at any time on grounds relating to your particular situation (Art. 21(1) GDPR); an email to [email protected] is enough. If we hide your review following your objection, we delete it from our systems immediately together with its photos; browsers and caches may still show the excerpt for up to 20 minutes and a photo that has already been loaded for up to 24 hours. So that it does not return with later retrievals, we store, without a fixed period, only the identifier under which Google keeps it and the time it was hidden, not your name and not the text. Your other rights are set out in section 15, your right to lodge a complaint in section 16.
How you can review your purchase through Google Customer Reviews is described in section 11.3.
As long as we offer this reminder, there is a separate box at checkout that is not ticked in advance: “Remind me by email if I do not complete the order (at most two emails, the second with a discount code). If I am not signed in, I first confirm this via a link sent by email. Unsubscribe at any time.” Ticking it is voluntary; your order does not depend on it. Only if you tick it do we store details for a reminder. If you untick the box when you submit checkout again, we delete your open reminder and note your withdrawal in the record. Payments via the express buttons (section 5) do not receive a reminder. If we do not offer the reminder, we create no entry for it and send neither a confirmation email nor a reminder.
Confirmation: If you are not signed in to a customer account with a confirmed email address, we first send you an email with a link. Your consent only takes effect when you press the button “Yes, confirm reminder” on the linked page; merely opening the link confirms nothing. The link is valid for 7 days. Without confirmation we send no reminder. We send no confirmation email and create no new entry if a confirmed reminder or a still valid request from another checkout is already waiting for your address, or if a limit against misuse has been reached (see below). If you submit checkout again in the same browser or with the same customer account while the link from the first email is still valid or after you have confirmed, we do not send another confirmation email; the reminder then applies to your new cart. If you are signed in with a confirmed address, your consent takes effect immediately; a request waiting for your address is then replaced by yours. If someone else entered your address in our checkout (that entry is then the source of your address), you receive no reminder without your confirmation; we delete the entry and the record according to the periods under Retention, and the confirmation email remains listed in the delivery log.
Protection against misuse: So that nobody can use our checkout to send confirmation emails to other people's addresses, we allow only a few new requests per day for each email address and each internet connection, and we limit all confirmation emails per hour. For this we count check values that we derive with a secret key from the address and from your IP address (for IPv6 from the network range of your connection). We do not store the IP address itself; the counters expire after 24 hours. When you press the button on the confirmation page, your IP address (for IPv6 the network range of your connection) is also held for one minute in a counter against mass requests.
Process: We send the first reminder no earlier than one hour after you submitted your details at checkout and only after your confirmation. We send a second one no earlier than one day after submission and at least 23 hours after the first; it contains a discount code that you can redeem once and only for a limited time. There is at most one open reminder per email address. We send no further reminder if you have ordered in the meantime (also through another payment with the same email address), if you have unsubscribed from reminders or from all promotional emails, if your address is blocked for promotional emails after a report from Brevo (see Recipients), or if you have already received a reminder about another cart in the last 7 days. The email shows a picture of your design only if the design is in our gallery or comes from you; the link in the email leads to your design or to checkout. The pictures are kept in our storage (section 8).
Data: For the reminder we store:
We do not store your name or your delivery address for this.
Separately, as proof of your consent we store the wording, version and language of the sentence at the box, your email address, the identifier of the payment and, where applicable, of your order, whether you confirmed via the link or via your customer account, and the times of consent, confirmation, the last reminder sent and withdrawal.
Recipients: We use Brevo to send the emails (section 9). Brevo receives your email address and the content of the emails: the confirmation link, the total, the link to your design or to checkout, where applicable a picture of your design and the discount code, and a personal unsubscribe link. Brevo reports to us whether an email was delivered, rejected or reported as spam and whether you unsubscribed via Brevo. We do not have Brevo report to us whether you open an email or follow a link in it, and we do not store this; for the counting image and the links in emails sent via Brevo see section 9. We store these reports with the respective delivery to your email address in the delivery log, with their type, time and, for a rejection, the reason, without the subject; in our administration, delivery can be seen for a customer account with your address. If you unsubscribe via Brevo, report one of our emails as spam, or Brevo reports that emails to your address permanently cannot be delivered, we block all promotional emails to your address on our side, with the same consequences as a withdrawal (see Withdrawal).
Legal basis: We send the reminders only with your consent (Art. 6(1)(a) GDPR); because they are advertising, we need your prior express consent for them (section 7(2) no. 2 of the German Act against Unfair Competition, UWG). The confirmation email and the counters against misuse are based on our legitimate interest in sending reminders only to people who requested them themselves and in protecting our checkout against misuse (Art. 6(1)(f) GDPR). The same interest is the basis for storing the entry and the record until you confirm: we need them to carry out and document the confirmation. We keep the delivery log in order to be able to trace and respect delivery and unsubscriptions (Art. 6(1)(f) GDPR). Counting how many reminders were sent and how many carts were then ordered is based on our legitimate interest in assessing the effect of the reminders (Art. 6(1)(f) GDPR). We keep the record because we must be able to prove the consent (Art. 6(1)(c) in conjunction with Art. 7(1) GDPR) and in order to defend against claims until they become time-barred (Art. 6(1)(f) GDPR).
Withdrawal: You can withdraw your consent at any time with effect for the future (Art. 7(3) GDPR). The “Unsubscribe” link at the end of each reminder or the unsubscribe function of your email program is enough. After that you receive no more reminders, including no reminders about designs under section 9a; we delete a still open reminder immediately, and the record receives the time of withdrawal. You can also declare your withdrawal with a short email to [email protected]; we then enter it by hand, with the same effect. So that we can respect the withdrawal permanently, we also keep a check value of your address as a blocking note for as long as we send advertising by email (Art. 6(1)(f) GDPR); we delete the record and the delivery log according to the periods under Retention. Only new consent that you give via the confirmation link or as a signed-in customer with a confirmed address lifts this blocking note for reminders again; consents to reminders about designs under section 9a that you gave before the withdrawal are not revived by this.
Retention:
Deletion takes place in daily runs, so at the latest one day after the respective period has ended.
We only send reminders about designs in your customer account that you have not ordered if you have expressly allowed us to send you advertising by email. We do not currently obtain such permission; we therefore do not currently send these reminders.
Your rights: The rights in section 15 apply. Where we rely on our legitimate interest, you can object on grounds relating to your particular situation (Art. 21(1) GDPR); you can object to the use of your data for direct marketing at any time without giving reasons (Art. 21(2) GDPR). Your right to lodge a complaint is set out in section 16.
You can subscribe to our newsletter. It brings you new designs, ideas and offers by email. Signing up is voluntary; without your email address we cannot send you a newsletter. You sign up, for example, with a separate checkbox that is not preselected next to the email field on the page with your finished designs, or via the sign-up field at the bottom of certain pages, for example when confirming or unsubscribing from emails. Every sign-up field shows the sentence you consent to: “Yes, I would like the Isakum newsletter with new designs, ideas and offers by email. You get a one time code for your first order. Unsubscribe at any time via the link in every email. Details in the privacy policy.” Section 9a applies to the link to your designs, which you can request in the same email field; you sign up for the newsletter only with the separate checkbox.
Process: After you submit, we send you an email with a confirmation link, no more than one such email per address within 24 hours; if you enter the address again during that time, the link in the first email remains valid. If the address is already confirmed and not unsubscribed, we send none. The link opens a page with the button “Yes, confirm newsletter”. Only when you click it is your subscription confirmed (double opt-in); merely opening the link, for example by a scanning program of your email provider, confirms nothing. We then create a discount code that can be redeemed once, show it on the page and send it to you with a welcome email, which also states how long it is valid. If you sign up again while we still keep your earlier subscription (see retention), there is no further code. We send the newsletter only to confirmed addresses that have not unsubscribed, are not on our blocking list and for which the wording of the consent is stored. If someone else entered your address, it comes from that entry on our website (Art. 14 GDPR). You then receive only confirmation emails as described above; without your click on the button we do not send you a newsletter. What we keep about an unconfirmed request is set out under retention.
Data: your email address, the language of the page, the place where you signed up, the times of sign-up, confirmation email, confirmation and, where applicable, unsubscription, the wording and version of the consent sentence (on a renewed sign-up also the earlier consent) and your discount code. We keep the code in our voucher management without your address; it is linked to you only through your subscription. If you redeem it with an order, section 5 applies. We do not ask for your name, and we do not store an IP address with your subscription. When you sign up, our bot protection checks your request (section 10); if its check field does not load, you solve a small arithmetic task instead, and for one hour we count per IP address (for IPv6 per /64 network) how many such tasks are fetched. We also count sign-ups and confirmations per IP address (for IPv6 per /64 network) for no more than 60 seconds to slow down misuse. In your browser we only note after submitting that you entered your address for the newsletter, so that we do not offer you the sign-up again (section 11.7). Whether you chose the newsletter at the email field on the result page and whether the sign-up worked is counted by our visitor measurement without your address (section 11.2).
Sending and recipients: We send the confirmation email, the welcome email and the newsletter via Brevo (section 9). For this Brevo receives your email address and the content of the email and reports to us whether the email was delivered, whether it bounced or was marked as spam and whether you unsubscribed. We do not have Brevo report to us whether you open an email or follow a link in it, and we do not store this; for the counting image and the links in emails sent via Brevo see section 9. We record each sending in our delivery log: recipient address, template, time, status and Brevo's reports (type and time of the event, for a rejection the reason; we do not store the link you opened). If you have a customer account with the same address, we also see the delivery with your account in our admin area, next to your orders and designs. We keep the content of each email without the confirmation link, unsubscribe link and discount code. For transfers to third countries see section 12.
Legal basis: For the newsletter, the welcome email and the discount code it is your consent (Art. 6(1)(a) GDPR; for advertising by email also section 7(2) no. 2 of the German Act Against Unfair Competition (UWG)). The confirmation email, storing a subscription that has not yet been confirmed, the counts per IP address and the delivery log with the delivery reports are based on our legitimate interest in making sure that a subscription comes from the holder of the address, preventing misuse and being able to trace the sending (Art. 6(1)(f) GDPR). We keep the proof of your consent because we must be able to prove it (Art. 6(1)(c) in conjunction with Art. 7(1) GDPR). After an unsubscription we keep the subscription and the proof until the end of the period stated below in order to defend ourselves against claims and to issue the welcome code only once, as promised; we keep the proof of an unconfirmed request in order to defend ourselves against claims (in each case Art. 6(1)(f) GDPR). The blocking list is based on our legitimate interest in permanently respecting your withdrawal and in not sending advertising to an address about which there is a complaint or to which emails cannot be delivered (Art. 6(1)(f) GDPR).
Withdrawal and objection: You can withdraw your consent at any time with effect for the future (Art. 7(3) GDPR): via the unsubscribe link at the end of the welcome email and every newsletter email, via the unsubscribe function of your email program where it offers one, or with a short email to [email protected]; we then enter your unsubscription by hand, with the same effect as via the unsubscribe link. After that you no longer receive the newsletter. When you unsubscribe in any of these ways, we enter a non-reversible check value of your address in our blocking list; the address itself is not stored there. If Brevo reports to us that one of our emails to you was marked as spam, that your address is permanently undeliverable or invalid, or that Brevo blocks sending to it, we treat this like an unsubscription; you then also no longer receive review requests (section 9d) or reminders about an unfinished cart (section 9e) or about designs (section 9a). If you later confirm a new subscription, we lift the block for the newsletter; the note about this remains in the blocking list. You can object to the use of your data for direct marketing at any time without giving reasons (Art. 21(2) GDPR), and to processing based on our legitimate interest on grounds relating to your particular situation (Art. 21(1) GDPR). Your other rights are set out in section 15, your right to lodge a complaint in section 16.
Retention: We delete a first subscription that you do not confirm 30 days after you first submitted it, even if you entered the address again during that time. Together with it we delete the proof of the request (address, time, wording, version, language and place of sign-up) and remove your address from the delivery log of the confirmation email; if you confirm a subscription with the same address, the proof is kept as long as your proof of consent. We store a confirmed subscription including the proof of consent for as long as you receive the newsletter. After an unsubscription we keep the subscription and the proof of consent until the end of the third calendar year after the year of unsubscription and then delete them. If you sign up again after unsubscribing, while we still keep your earlier subscription, and do not confirm, the confirmation link expires 30 days after the last confirmation email, and we delete the details of this new sign-up (time, wording, version, language and place); we delete the proof of this request together with your earlier subscription, but no earlier than 30 days after the request. We delete the content of the emails after 30 days and the delivery log including Brevo's reports after 365 days (section 14). We keep the check value in the blocking list for as long as we send advertising by email. The count of sign-ups and confirmations per IP address expires after no more than 60 seconds, the count of fetched arithmetic tasks after one hour.
On our site you can buy a gift card. It is a credit with a code that is redeemed in our checkout for goods and shipping.
Data: your email address (required; without it no purchase is possible), your name if you wish, the amount you choose, the language of the page and, if you are signed in, the identifier of your customer account. You can optionally give the name and email address of the recipient and a message of up to 500 characters. Please do not write anything in the message about the recipient's health or other specially protected areas of their life (Art. 9 GDPR); we do not check the message and pass it on with the gift card. For each gift card we also store the code, the remaining credit, the validity, the status, the times of payment and sending, the identifier of the payment at Stripe and, where applicable, an internal note of ours and the time at which we deleted the recipient's details.
Process: When you choose “Continue to payment”, we create the gift card as unpaid and start the payment at Stripe (section 5); only then does the page load Stripe's payment field (section 11.7). From us, Stripe receives the amount, a description, the language and the identifier of the gift card, but neither your email address nor the names from the gift card form nor your message. Whatever you enter in the payment field, or provide to the respective provider for a payment method with redirection, Stripe receives directly, depending on the payment method including your name and your email address (section 5). After payment we activate the code, show it to you on the page and send it by email straight away: to the recipient if you gave their address, otherwise to you. If the code goes to an address other than yours, you receive a confirmation with the code, the recipient's name and address and your message. If a gift card remains unpaid for more than one day, our daily check cancels the open payment at Stripe and then cancels the gift card. If the payment is still being processed, its status cannot be retrieved from Stripe or the payment cannot be cancelled, we do not cancel the gift card and check it again the next day.
What the recipient learns: The email shows your name as you entered it (without a name it says “Someone”), already in the subject line, together with your message. We do not give your email address to the recipient. If you gave an address other than your own, the email states that you gave us this address for the gift and, in a separate paragraph, that the recipient can object to the use of their details at any time and that the gift card stays valid. Anyone who knows the code sees the remaining credit and the validity when entering it in the checkout.
Redemption: You enter the code in the checkout. We record every redemption on the gift card with the amount and the order; on the order and, if a remainder is paid through Stripe, on that payment we record the code and the amount credited. If the credit covers the whole order, no payment is made through Stripe. Sections 5 and 6 apply to the order itself.
Gift cards from us: If we issue a gift card ourselves, for example as a goodwill gesture or for a prize draw, we process the name, email address and, where applicable, a message for the person who receives it, plus an internal note on the occasion (for example the number of an order). Sending via Brevo, retention and the right to object work as for a recipient; if we send the code by email, it also contains the notice of the right to object. The internal note stays with the accounting record.
Purpose and legal basis: We process your details to perform the purchase contract for the gift card and to redeem the gift card (Art. 6(1)(b) GDPR). We process the recipient's name, email address and message on the basis of your and our legitimate interest in delivering the gift the way you want it, and for gift cards from us on the basis of our legitimate interest in delivering the promised gift card (in each case Art. 6(1)(f) GDPR). We process Brevo's delivery reports on the basis of our legitimate interest in knowing whether a gift card has arrived and in resending it if necessary (Art. 6(1)(f) GDPR). Keeping your details as the buyer after the validity has ended, until the end of the third following calendar year, is based on our legitimate interest in being able to attribute queries and refunds relating to the gift card to you and to handle them (Art. 6(1)(f) GDPR). We keep accounting records because of statutory obligations (Art. 6(1)(c) GDPR in conjunction with § 147 of the German Fiscal Code (AO) and § 257 of the German Commercial Code (HGB)). We do not use these details for advertising; buying a gift card does not sign you up for the newsletter.
Recipients: Stripe for the payment (section 5) and Brevo for sending the emails (section 9). Brevo receives the address an email goes to and its content: your name as the sender of the gift, the recipient's name, your message, the amount, the code and the validity, and in your confirmation also the recipient's email address. Brevo reports to us whether an email was delivered. We do not have Brevo report to us whether someone opens the email or follows a link in it, and we do not store this; for the counting image and the links in emails sent via Brevo see section 9. We store these reports in our delivery log with the recipient address, with their type, time and, for a rejection, the reason, without the subject line.
Retention: A gift card is valid until 31 December of the third year after purchase; what counts is the day of payment in German time, and for gift cards from us the day they are issued. For gift cards that were never paid, we delete names, email addresses, message and, where applicable, the identifier of your customer account 30 days after creation, but not before the gift card has been cancelled. For paid gift cards, we delete the recipient's name and email address and the message 90 days after the credit has been fully redeemed, at the latest 90 days after the validity ends. We delete your name, your email address and, where applicable, the identifier of your customer account at the end of the third calendar year after the validity ends (for a purchase in 2026, that is at the end of 2032). The amount, code, status, payment identifier, redemptions, times and our internal note then remain stored without these details as an accounting record. We delete the delivery log of our emails, with the address an email went to and Brevo's reports, after 365 days, and the stored content of the email (without the code) after 30 days. The periods in this paragraph apply to our own database. What Stripe itself retains is governed by Stripe's privacy policy (section 5). Brevo deletes its sending logs in our account after one month and does not store previews of the emails. For visitor measurement during the purchase see section 11.2, for the entries in your browser section 11.7.
Information for the recipient (Art. 14 GDPR): If you have been given a gift card, we received your details from the person who bought it. They are your name and your email address, where provided, the message to you, the amount, code and validity of your gift card, and Brevo's reports on the email to you (delivery; see Recipients). We use these details to deliver the gift card to you, to see whether it has arrived and to resend it on request. The legal basis is Art. 6(1)(f) GDPR: the person giving the gift and we have a legitimate interest in delivering the gift to you the way that person wants. Recipients and retention are described above. Your rights are set out in section 15, your right to lodge a complaint in section 16. You can object to the processing at any time (Art. 21 GDPR); a short email to [email protected] is enough, and the email with which we send you a gift card also points out this right. After your objection we delete your name, your email address and the message to you from the gift card and note there, without your name, that and when we deleted them; after that the code can no longer be resent by email. The code, amount, remaining credit and validity remain, and your gift card stays valid, because it is redeemed with the code alone.
To protect against automated requests we use Cloudflare Turnstile. In doing so, technical data (IP address, browser information) is transmitted to Cloudflare in order to distinguish human users from bots. No cookies are set for tracking purposes. Your browser stores the clearance after a successful check in the entry isakum_bot_freigabe_v1; if Cloudflare checks your browser, it sets the cookie cf_clearance (section 11.7). If the check by Turnstile cannot take place, for example because an ad blocker blocks it, your browser instead solves a small computing task that only our server sets and checks. We count the fetches of such tasks and the requests for a clearance for one hour each per IP address (for IPv6 per /64 network) in our cache; if an address exceeds a limit, we record this with the address (for IPv6 the /64 network) in our server log the first time it happens within that hour. In addition, our server (api.isakum.com) counts the requests per IP address (for IPv6 per /64 network) for one minute at a time in our cache in order to limit their number; if such a limit is exceeded, we record this with the full IP address in our server log every time it happens. (Legal basis: Art. 6(1)(f) GDPR)
This section describes what our pages store in your browser or read from it, how you decide about this, what we measure ourselves and which analytics and advertising services load only with your consent. Storing information on your device and reading it from there (cookies, local storage, session storage, querying device details through browser functions) is governed, in addition to the GDPR, by section 25 of the German Telecommunications Digital Services Data Protection Act (TDDDG): without consent this is only allowed where it is strictly necessary for us to provide a service you have expressly requested (section 25(2) no. 2 TDDDG), for example for the shopping cart, your choice in the cookie notice or signing in to your customer account. Everything else happens only with your consent (section 25(1) TDDDG).
On your first visit a bar appears at the bottom of the screen after about two seconds (in the generator, on the waiting page, in the cart and at checkout after about three seconds) with this question: “May we use cookies and similar technologies to analyse visits (including session recording) and to measure and show ads? Google, Meta, Pinterest and Microsoft receive data and also process it in the USA; Google, Meta and Pinterest match it with their user accounts. Voluntary, and you can withdraw at any time.” Next to it are “Choose”, a link “Privacy” to this policy and two buttons of the same size and design. As long as you have not chosen, none of these services loads and your browser does not connect to them. You can use our shop fully without giving any consent.
Your options:
Your browser stores your choice for 365 days in the cookie isakum_einwilligung. It contains the version of the notice (currently 2), one character each for analytics and advertising, the time and a random identifier of the choice; after that we ask again. A choice made under the earlier version of the notice (until 28 September 2026) no longer applies, because that notice did not name the recipients; we remove the old cookie isakum_consent and the old local storage entry isakum_cookie_consent_v1 on your next visit.
Record: so that we can prove a consent (Art. 7(1) GDPR), the page sends every choice, including a withdrawal, to our server. Only the random identifier of the choice, the version of the notice, the two categories, the language, the route (notice or cookie settings) and the time are stored; no IP address, no visitor ID, no link to a customer account. Your IP address is held for one minute only in a counter against mass submissions. We keep the record until the end of the third calendar year after the year of the choice. The legal basis for consents given is our duty to provide proof (Art. 6(1)(c) in conjunction with Art. 7(1) GDPR); for refusals and withdrawals it is our legitimate interest in being able to prove them as well (Art. 6(1)(f) GDPR).
Withdrawal and changes: with the “Cookie settings” button in the footer of our pages (on the German pages “Cookie-Einstellungen”) you can reopen the bar at any time, directly with the two boxes and your current choice. Withdrawal takes effect for the future; processing up to then remains lawful (Art. 7(3) GDPR). What happens depends on the category. If you withdraw “Advertising”, the page sets Google and Meta to “denied”, tells Clarity that advertising is no longer allowed and deletes the campaign entry isakum_attribution_v1 including advertising click identifiers (gclid, fbclid). If you withdraw “Analytics”, it ends the consent towards Clarity and sets Google’s analytics storage to “denied”. In both cases it deletes the cookies of the withdrawn services under isakum.com (for advertising _gcl_*, _fbp, _fbc, _pin_unauth, _pinterest_*, _epik, _derived_epik; for analytics _clck, _clsk; only when both categories are withdrawn also _ga, _ga_*, _gid, _gat*) as well as their entries in local storage and session storage (for advertising _gcl_*, lastExternalReferrer, lastExternalReferrerTime, entries beginning with _pin or _pinterest; for analytics _cltk; is_eu as soon as either category is missing) and reloads, so that no loaded script keeps running. The same clean-up runs with “Necessary only”. The page cannot remove cookies that the services have set under their own domains (doubleclick.net, clarity.ms, bing.com); you can delete these in your browser settings. The random visitor ID (section 11.7) remains, because it is the key to your designs created as a guest; it is no longer used for visitor measurement after the withdrawal.
The legal basis for all services in the analytics and advertising categories is your consent (Art. 6(1)(a) GDPR, section 25(1) TDDDG). The cookie isakum_einwilligung itself is necessary so that we can respect your choice (section 25(2) no. 2 TDDDG).
So that we can see which pages are used, where the path to purchase breaks off and where errors occur, our site reports events to our own server (api.isakum.com). They are stored in our database on our server in Germany (section 4). They include, among others:
Each event (except reports of errors of our site) includes a random event identifier, the time, the page visited (without the part of the address after “?” or “#”), the page you came from (we store only its domain) and campaign details from the address (utm parameters; if you came through a Google ad, the source “google/cpc”). From the browser identification (user agent) our server derives the device type (mobile, desktop, automation) and the in-app browser (Instagram, Facebook, TikTok, Pinterest, Snapchat or none) and stores only this classification; we store the browser identification itself only in reports of errors of our site. The measurement transmits no sign-in data; events are not linked to any customer account. We do not store your full IP address. Our server uses it on receipt only to filter out requests from our own network and to limit the number of requests, and in shortened form for the daily identifier described below.
Without the “Analytics” consent (before your choice, after “Necessary only” or after a withdrawal) the measurement creates no identifier on your device, reads none (except, with your “Advertising” consent, the campaign entry, see below) and queries no device details; it sends the events without a visitor ID and without a session identifier. If you leave the waiting page before your designs are ready, the open page notes this only in its working memory, not on your device; if you return to the same tab, the measurement counts this as a return. Identifiers from our shop through which an event could be linked to a generation, a payment, an order or a design are removed by your browser and in any case by our server when storing, including from the page path; only identifiers of designs in our public gallery remain. One exception is the review page: from its address we store the internal identifier of the order (not the access key from the link) so that we can see whether the review link of an order was opened; after 90 days the deletion run removes it too. So that we can count the visits of a day, our server forms a daily identifier on receipt: a hash of a random secret that changes every day, your IP address shortened to the network (IPv4 to 24 bits, IPv6 to 48 bits) and your browser identification. The secret is kept in our database only for the current day, is not included in any backup and is deleted on the following day, at the latest by the daily deletion run. After that nobody, including us, can link the identifier to an address, and nobody is recognised across days through the daily identifier.
With your “Analytics” consent the page creates, on the first page view, a random visitor ID in your browser’s local storage (isakum_visitor_id_v1, no expiry; the same identifier also links your designs created as a guest to your browser, section 11.7) and a session identifier in session storage (isakum_analytics_session_v1, until the tab is closed). Both are sent with every event so that we can combine visits and paths over several days; we then form no daily identifier. On page views the page additionally queries screen and window size, pixel density, language, time zone and connection type through browser functions and sends them. If you leave the waiting page before your designs are ready, your browser also stores the time (isakum_generation_wait_left_v1) so that the measurement recognises your return even after the tab was closed; the entry is deleted when you return. Without this consent the waiting page deletes such an entry without reading it. The events then also carry identifiers from the shop: the identifier of your generation on the waiting and result page, the identifier of the design on design pages and the order number when the purchase is completed. After a withdrawal the page sends neither identifiers nor device details and removes the session identifier; the visitor ID remains in storage for your designs but is no longer used for measurement.
With your “Advertising” consent the Google click identifier (gclid, section 11.3) is also sent with every event so that we can attribute purchases to an ad. Without this consent the identifier is left out; if it is in the address, the measurement only notes that the visit came from a Google ad.
90 days after the event a daily deletion run removes all identifiers (visitor ID, session identifier, daily identifier, click identifier, event identifier), replaces identifiers in the page path with a placeholder, keeps only additional details without personal reference (for example device type, step, quantity, amount) and rounds the time to the full hour. The event then remains without identifiers for statistics. Only we see the evaluation in our admin area.
The legal basis for measurement with visitor ID, session identifier, device details and shop identifiers is your consent (Art. 6(1)(a) GDPR, section 25(1) TDDDG), which you can withdraw at any time through “Cookie settings” in the footer. For measurement without identifiers on your device, including the daily identifier and the error reports, the legal basis is our legitimate interest in improving our offer and the path to purchase and in finding errors (Art. 6(1)(f) GDPR); you can object to this processing (section 15).
We advertise with Google Ads and offer our products through Google Merchant Center (Google Shopping). The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; data is also transferred to Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. Google LLC is certified under the EU-US Data Privacy Framework; the transfer is based on the adequacy decision of the European Commission (Art. 45 GDPR). For loading the tag, conversion measurement and remarketing Google is an independent controller (Google Ads Controller-Controller Data Protection Terms); Google processes the enhanced conversions and any report from our server as a processor under the Google Ads Data Processing Terms (Art. 28 GDPR).
Without your “Advertising” consent the Google tag does not load and your browser does not connect to Google’s advertising and measurement services. This applies before your choice, after “Necessary only” and after a withdrawal. We do not operate a Google Analytics account of our own.
With your “Advertising” consent your browser loads the Google tag (gtag.js from googletagmanager.com). It does not load in our admin area, not on the review page (whose address carries a personal access key) and, after a payment, only once the payment identifiers have been removed from the address. The tag runs in Google’s consent mode: the default is “denied”; we then pass on your choice (ad storage, ad user data and ad personalisation according to “Advertising”, analytics storage according to “Analytics”). The tag reports to Google Ads and to the measurement of our Merchant Center account:
In addition, details about browser, device and screen are sent. We do not report gift card purchases or orders paid entirely with a gift card. Google technically receives your IP address. We additionally report certain steps (design started, design ready, cart, checkout started, purchase) as conversions so that Google can measure the success of our ads. Google also adds you to audiences so that we can show you ads later (remarketing); for this the tag reports page views and product views to Google’s remarketing and user list services. Your browser connects to googletagmanager.com, google.com, google.de, googleadservices.com, doubleclick.net and merchant-center-analytics.goog.
Cookies and storage with “Advertising” consent (measured on 19 October 2026): _gcl_au (90 days) on isakum.com, IDE (390 days) and test_cookie (less than one hour) on doubleclick.net and the local storage entry _gcl_ls. If you have also allowed “Analytics”, the tag also sets the cookies _ga and _ga_L7ZDXSKWRR (400 days) for Merchant Center measurement; without “Analytics” it reports to Merchant Center without these cookies.
Enhanced conversions: on the order confirmation page we pass to the tag, only with your “Advertising” consent, the details you entered during this checkout: email address, phone number, first and last name, street and house number, postcode, city and country; the tag converts the email address, phone number, first and last name and street into non-reversible checksums (hashes) before sending and sends postcode, city and country unhashed; Google matches the details with signed-in Google accounts to attribute purchases to ads. Automatic collection is also switched on in our Google Ads account: the tag can itself detect email address, phone number, names and parts of the address in form fields on our pages and transmit them in the same way (as of 19 October 2026).
Click identifier: if you come through a Google ad, the address contains a click identifier (gclid). Without your “Advertising” consent the page keeps it only in the memory of the page currently open; it goes neither into your browser’s storage nor to our checkout nor to our visitor measurement. With the consent your browser stores it in the campaign entry isakum_attribution_v1 (90 days, section 11.7), the visitor measurement carries it (section 11.2), and with an order it goes to our server, which stores it with the order only if consent was given.
Reporting from our server: our system is set up so that it can report purchases to Google through the Google Ads API after payment, and only if you allowed “Advertising” and came through a Google ad: the click identifier, the purchase identifier, order value, currency and the time of the report as well as your email address, phone number, first and last name and street as hashes and city, postcode and country in plain text, each taken from the delivery address of the order. This reporting is currently blocked and not in operation; no purchase is sent to Google this way. In any case we store your choice in the cookie notice with the order, together with its time and version; your choice when submitting the delivery address at checkout, or when the express buttons are set up, is decisive. If you withdraw “Advertising” after that but before paying, the page sets up the payment step again (at checkout you submit the prefilled address once more), and the order carries your withdrawal. Consent you only give after that point does not count for our server’s report on this order. Without “Advertising” there is no report at all, and none for orders through marketplaces (Amazon, eBay, Etsy) or orders paid entirely with a gift card.
Withdrawal: through “Cookie settings” in the footer you withdraw “Advertising”; the page sets the tag to “denied”, deletes the cookie _gcl_au on isakum.com, the entry _gcl_ls and the campaign entry isakum_attribution_v1, and reloads. It removes the cookies _ga and _ga_L7ZDXSKWRR if you also withdraw “Analytics”; if you keep “Analytics”, these two remain until they expire without further use, because the tag no longer loads without “Advertising”. The cookies on doubleclick.net remain; you can delete them in your browser.
The legal basis for loading, cookies, measurement, remarketing, enhanced conversions and the report from our server is your consent (Art. 6(1)(a) GDPR, section 25(1) TDDDG).
Google Customer Reviews: on the order confirmation page we offer to rate your purchase on Google. Only if you click “Yes, offer the Google survey” there does your browser load a script from Google (apis.google.com), and we pass on to Google your email address, the order number, the delivery country and the estimated delivery date; Google then asks you in its own window whether you would like to receive a short survey after delivery. This does not depend on your choice in the cookie notice but only on this click. The legal basis is your consent given by the click (Art. 6(1)(a) GDPR, section 25(1) TDDDG). Google’s privacy information: policies.google.com/privacy and business.safety.google/privacy.
With the Meta Pixel we measure the effect of our ads on Facebook and Instagram and can show ads there to visitors of our site. The provider is Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland; data is also transferred to Meta Platforms, Inc., 1 Meta Way, Menlo Park, CA 94025, USA. Meta Platforms, Inc. is certified under the EU-US Data Privacy Framework; the transfer is based on the adequacy decision of the European Commission (Art. 45 GDPR).
Without your “Advertising” consent the pixel does not load and your browser does not connect to Meta. This applies before your choice, after “Necessary only” and after a withdrawal.
With your “Advertising” consent your browser loads the pixel script from connect.facebook.net (not in our admin area, not on the review page, and on the order confirmation page only once the payment identifiers have been removed from the address). The pixel sends events to Meta (facebook.com):
Each event carries the page address, the previous page, details about browser and screen and the identifiers from the cookies _fbp (90 days) and, if you came through a Meta ad, _fbc (90 days). We do not report gift card purchases or orders paid entirely with a gift card. We have switched off the pixel’s automatic configuration: it does not record clicks on buttons, does not read product details from the page content and reads neither form fields nor any other information on our pages in order to match them with Meta accounts (no automatic advanced matching). It only sends the events listed above with the details we attach to them, plus your device’s time zone; we do not pass contact details such as email address, name or phone number to it. According to the settings of our pixel at Meta, it additionally sends every event to a transmission service for the Conversions API set up by Meta, which runs on Google Cloud (address on run.app), with a fallback address at Amazon Web Services in the USA. In local storage the pixel creates the entries lastExternalReferrer and lastExternalReferrerTime (whether you last came from Facebook, Instagram or elsewhere, and when) and sends this origin along. (As of 19 October 2026.)
After an order, from our server: if you allowed “Advertising”, our server reports the purchase to Meta after payment through the Conversions API: the event purchase, time, order value, currency, the event identifier (the same as in the browser, so that Meta counts the purchase only once), the web address of our order confirmation page, your email address as a hash and the identifiers from _fbp and _fbc, if they were stored with the order with your consent. If the order confirmation page in your browser records the payment, your IP address and the browser identification of this request are also sent; if our payment provider records it first, they are not. Without “Advertising” there is no report, and none for orders through marketplaces or orders paid entirely with a gift card; we store your choice with its time and version with the order (section 11.3).
Withdrawal: through “Cookie settings” in the footer you withdraw “Advertising”; the page sets the pixel to “revoked”, deletes _fbp and _fbc on isakum.com as well as the local storage entries lastExternalReferrer and lastExternalReferrerTime, and reloads.
The legal basis is your consent (Art. 6(1)(a) GDPR, section 25(1) TDDDG).
Joint controllership: we are joint controllers with Meta Platforms Ireland Limited for the collection of data on our site with the pixel and its transmission to Meta (Art. 26 GDPR). The purposes of this joint processing are that Meta uses the data for our ads (building audiences from visitors of our site or excluding them from ads), improves ad delivery, personalises content and ads on and off Facebook and Instagram, and secures and improves its services (Meta Business Tools Terms, section 2). For this we have concluded the Controller Addendum with Meta (facebook.com/legal/controller_addendum). It provides that we give you the information in this section and that Meta fulfils your rights under Art. 15 to 20 GDPR for the data Meta stores after the joint processing. Meta carries out the matching with Meta accounts as well as measurement and analysis for our ads on our behalf under the Meta Business Tools Terms (Art. 28 GDPR); Meta then keeps the event data for at most two years. Meta alone is responsible for further processing after the transmission. Which data Meta processes, on which legal basis and how you can exercise your rights towards Meta is set out in Meta’s privacy policy: facebook.com/privacy/policy.
Only with your “Advertising” consent does your browser load the Pinterest tag (from s.pinimg.com) of Pinterest Europe Ltd., Waterloo Exchange, 3rd Floor, Waterloo Road, Dublin 4, Ireland; data is also transferred to Pinterest, Inc., 651 Brannan Street, San Francisco, CA 94107, USA. Pinterest, Inc. is certified under the EU-US Data Privacy Framework; the transfer is based on the adequacy decision of the European Commission (Art. 45 GDPR). The tag reports every page view to Pinterest (ct.pinterest.com), so that Pinterest can attribute visits to ads and build audiences for ads. It transmits the page visited and the page you came from, details about browser, device and screen, technically your IP address and an identifier from the cookie _pin_unauth (365 days); in session storage the tag creates the entry is_eu. If you came through a Pinterest ad, Pinterest may set further cookies (_epik, _derived_epik). We do not report further events (such as cart or purchase) to Pinterest, and our server reports nothing to Pinterest.
Without consent the tag does not load. On withdrawal the page deletes _pin_unauth, _epik and _derived_epik on isakum.com, the entry is_eu and entries in your browser’s storage beginning with _pin or _pinterest, and reloads. Through the tag, data about your visit is passed on to Pinterest for the purposes of interest-based online advertising. You can also switch off personalised advertising by Pinterest in your Pinterest account settings (pinterest.com/settings) and at optout.aboutads.info. The legal basis is your consent (Art. 6(1)(a) GDPR, section 25(1) TDDDG).
Joint controllership: we are joint controllers with Pinterest Europe Ltd. for the collection of data by the tag and its transmission to Pinterest (Art. 26 GDPR). This is governed by the Joint Controller Addendum, which forms part of Pinterest’s Advertising Services Agreement. Under it, we have agreed with Pinterest Europe that we give you the information in this section and that Pinterest Europe is responsible for fulfilling your rights under Art. 15 to 20 GDPR with regard to the data Pinterest Europe stores after the transmission. You can exercise these rights directly with Pinterest Europe; if you contact us, we will forward your request to Pinterest Europe. Pinterest alone is responsible for further processing. Which data Pinterest processes, on which legal basis and how you can exercise your rights towards Pinterest is set out in Pinterest’s privacy policy: policy.pinterest.com/en/privacy-policy.
Only with your “Analytics” consent does your browser load Microsoft Clarity (from clarity.ms). Clarity is a service of Microsoft Corporation, One Microsoft Way, Redmond, WA 98052, USA; for people in the European Economic Area, Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland, is the controller. Microsoft processes the data as its own controller, independent of us, and under the Clarity terms of use may use it for its own purposes, for example to improve its products, for advertising through Microsoft Advertising and to create user profiles for advertising. Microsoft Corporation is certified under the EU-US Data Privacy Framework; the transfer to the USA is based on the adequacy decision of the European Commission (Art. 45 GDPR). According to Microsoft, Clarity keeps recordings for 30 days; heatmaps, click data, recordings we have marked and a randomly selected sample of recordings for up to 9 months. Clarity records how you use our pages: mouse movements, clicks, scrolling and the page content displayed. This produces session recordings and heatmaps, which we evaluate to improve our pages. Clarity processes your IP address, details about browser, device and screen and identifiers from the cookies _clck (365 days) and _clsk (1 day) as well as the session storage entry _cltk. Clarity does not load in our admin area or on the review page; if you switch to the admin area, the page stops the recording immediately.
If you have also allowed “Advertising”, we pass this on to Clarity as well; Clarity then matches its identifier with Microsoft Bing and Microsoft Advertising (requests to c.clarity.ms and c.bing.com) and sets the cookies MUID (on clarity.ms and bing.com, 390 days), SRM_B (on bing.com, 390 days), MR (7 days), ANONCHK (less than one hour) and SM (until the browser is closed), lifetimes measured on 19 October 2026. Without “Advertising” this matching does not take place and these cookies are not created.
What Clarity does not see: Clarity does not record what you type into text fields or choose in drop-down lists, it only sees that something is there; it does see whether a checkbox or radio button is ticked. In addition, we fully mask areas that show your personal details, text and images: the entire order confirmation page, your customer account, your order overview and order details and the gift card purchase; on the waiting and result page your sentence, your selection, your reference images in the large view, the confirmation of your email address and notes on the content; in the generator the list of your uploaded images, your previous sentence, the conversation with the assistant (your requests and its replies) and its design suggestions. Our Clarity account is also set to the masking level “Balanced”: in the remaining page text Clarity masks words containing digits and email addresses; other text, such as names, and images remain visible.
Withdrawal: through “Cookie settings” in the footer you withdraw “Analytics”; the page ends the recording, deletes _clck and _clsk on isakum.com as well as the session storage entry _cltk, and reloads. The cookies on clarity.ms and bing.com remain; you can delete them in your browser. The legal basis is your consent (Art. 6(1)(a) GDPR, section 25(1) TDDDG). Microsoft’s privacy information: microsoft.com/en-us/privacy/privacystatement.
Listed here are the entries our site and our service providers create in your browser: cookies, local storage entries (they remain until you delete them; where a period is given, we no longer use the entry after it) and session storage entries (they are deleted when the tab is closed). Entries of the admin area, which only we use, are not listed.
Without consent we create the following entries. They serve the functions you use (section 25(2) no. 2 TDDDG); where an entry serves another purpose, this is stated with the entry.
Cookies:
Local storage:
Session storage:
Entries from earlier versions of our site that we no longer create are deleted from your browser each time you open one of our pages: the old consent cookie isakum_consent and the old consent entry isakum_cookie_consent_v1 in local storage (section 11.1), and also in local storage checkout details from earlier versions of checkout (isakum_checkout_address_v1 with email address, name, phone number and address), generations from the earlier creation path (isakum_generation_sessions_v1 and isakum_last_generation_v1), an old cache of the shop settings (isakum_public_settings_cache_v1) and the last chosen size per product (entries beginning with isakum_last_size_v1:).
Service worker: your browser registers our site’s service worker (sw.js) only if you allow notifications; it remains registered until you delete the site data for isakum.com in your browser; if you only revoke the notifications (section 17), it remains without any function. The legal basis is your consent (section 25(1) TDDDG).
With your consent the following are added (section 25(1) TDDDG; lifetimes measured in our shop on 19 October 2026):
Without “Advertising” consent the page keeps campaign details, source and click identifiers from the address only in the memory of the page currently open; none of this goes into your browser’s storage, and click identifiers go neither to checkout nor to the visitor measurement. Campaign details and source (not the click identifiers) are sent by checkout with an order to our server even without this consent, and our server stores them with the order and in the payment details at Stripe (section 5); they describe the advertising source, not your person. What is deleted on withdrawal is described in section 11.1.
We disclose personal data only where this is necessary for the performance of the contract, required by law or necessary for our legitimate interests (for example hosting, bot protection, requests under section 9c and the contacts described in section 9b), or covered by your consent. Data is disclosed to the following categories of recipients:
Personal data is not sold and is not passed on to data brokers or information resellers. Transfers to the USA are based on the adequacy decision of the EU Commission on the EU-US Data Privacy Framework (Art. 45 GDPR) where the recipient is certified under it, otherwise on EU standard contractual clauses (Art. 46(2)(c) GDPR).
We use appropriate technical and organizational measures to protect your personal data against unauthorized access, loss, destruction or alteration. These include:
Personal data is deleted as soon as the purpose of storing it no longer applies. Order data is stored for the duration of the statutory retention periods (as a rule 6, 8 or 10 years under the German Commercial Code (HGB) and the German Fiscal Code (AO)). Generated design images remain in our storage (section 8) as the intellectual property of the operator. Account data is removed when you delete your account, unless statutory retention obligations apply. Email addresses collected solely to notify you about finished designs are deleted no later than 30 days after the first message (section 9a). For cookies and entries in your browser, the periods in section 11.7 apply. Events of our visitor measurement lose their identifiers 90 days after the event (section 11.2). We keep records of your choice in the cookie notice until the end of the third calendar year after the year of the choice (section 11.1), and likewise the time and notice text of your consent to the notification about finished designs, counted from the year in which we deleted your address (section 9a). We keep your sentence, your selection and your conversation with the assistant for a design together with that design for as long as it exists (section 7); we redact the logs of our calls to the AI services that contain your sentence after 90 days. Design pages, your generation page, their texts and earlier addresses of a design page have no fixed deletion period: they remain as long as we offer the design or until you ask for their removal; we store the result of the check for photos, names and sensitive information with the design for as long as it exists; we keep the record of your “Show publicly” consent with your generation for as long as the consent applies, otherwise until the end of the third calendar year after the year of your last change, such as a withdrawal; after that, only a note without wording that no consent exists remains there. We delete earlier versions of texts that our daily run or a revision of our existing designs has rewritten after 30 days. If we remove an earlier address on request or take a page out of search engines on request, we note this on the design with the date and a reference to the request (date and subject or identifier of the email) for as long as the design exists; of a removed address we keep only a check value so that it is not assigned again (section 7b). We delete requests via the form for companies and clubs together with their copies in our admin area (including our replies and draft replies) no later than 365 days after our last reply, or, without a reply, no later than 365 days after receipt; emails about them in our mailbox are not covered by this automatic deletion (section 9c). We delete information from our contacting of creators, editors, clubs and companies no later than twelve months after the last contact; after you decline or object, we reduce it within one week to a blocking note. Records of a collaboration with a delivery are kept until the end of the tenth calendar year after the year of delivery (section 9b). For the review request we delete the delivery log after 365 days and the stored email content after 30 days. We delete reviews that we do not approve, together with the photo and video, 30 days after that decision; a review that we have not decided on 30 days after receipt is also treated as not approved. If you withdraw your consent to a review, we delete the photo and video immediately and the remaining details of the review 30 days later. We delete photos and videos from review forms that were never submitted after 31 days, and the note on an uploaded file together with the review or, if no review is submitted, 31 days after the upload; approved reviews remain stored until you withdraw your consent, until your customer account is deleted or until we delete the order or the reviewed design (section 9d). We replace the stored version of the excerpts from Google reviews with every successful retrieval, every night and, when a page with the review band is opened, at most every twelve hours; if retrievals fail for longer than about 72 hours or if we switch off the review band, we delete names, texts and photos at the latest the following night. We also delete mirrored photos as soon as Google no longer provides them or they could not be renewed for 30 days. We delete a review hidden following an objection immediately together with its photos and keep only its identifier, without a fixed period (section 9d). We delete entries for the reminder about a cart 30 days after checkout was submitted, unconfirmed ones after 8 days; after your order or the second reminder, we remove your email address with its check value, the cart, your visitor ID and the identifier of your customer account from the entry before that. We delete the record of an unconfirmed consent after 8 days and keep the record of a confirmed consent until the end of the third calendar year after the year in which you ticked the box or confirmed your consent, we sent you the last reminder or you withdrew your consent, whichever was latest (section 9e). We delete a first newsletter subscription that you do not confirm 30 days after you first submitted it together with the proof of the request and then remove your address from the delivery log of the confirmation email (if you confirm a subscription with the same address, the proof is kept together with your proof of consent); a confirmed subscription including the proof of consent is kept for as long as you receive the newsletter and, after an unsubscription, until the end of the third calendar year after the year of unsubscription; a new subscription made after that which you do not confirm expires together with its confirmation link 30 days after the last confirmation email, and we delete the proof of this request together with your earlier subscription, but no earlier than 30 days after the request (section 9f). We keep the non-reversible check value of your address in our blocking list for advertising emails for as long as we send advertising by email (section 9f). We delete the stored content of our emails (without access, confirmation, unsubscribe and shipment tracking links and without voucher and discount codes) after 30 days (section 9f); the 365-day period below applies to the delivery log. Gift cards: for gift cards that were never paid, we delete names, email addresses, message and, where applicable, the identifier of your customer account 30 days after creation, but not before cancellation; for paid gift cards, the recipient's name and email address and the message 90 days after the credit has been fully redeemed (at the latest 90 days after the validity ends), and your name, your email address and, where applicable, the identifier of your customer account at the end of the third calendar year after the validity ends; the amount, code, redemptions and times remain stored without these details as an accounting record (section 9g). Further periods: we delete images you upload as a reference 90 days after they were used, unused ones after 24 hours; conversations with the assistant that never led to a design after 90 days; the shortened IP address and the browser identifier of a generation after 90 days; the sign-in log of your customer account after 90 days; the delivery log of our emails after 365 days (Brevo deletes its sending logs in our account after one month); a sign-up for a push notification in the nightly deletion run after it has been sent, at the latest 8 days after the sign-up (section 17). We delete a customer account in which there has been neither a sign-in nor any other use (such as an order or a design) for 730 days, unless an order is still open; we write to you 30 days beforehand.
As a data subject you have the following rights regarding your personal data:
Right to object under Art. 21 GDPR: Where we process data on the basis of our legitimate interest (Art. 6(1)(f) GDPR), for example for visitor measurement without an identifier (section 11.2), you can object at any time on grounds relating to your particular situation. You can object to the use of your data for direct marketing at any time without giving reasons. A short email to [email protected] is enough.
To exercise your rights, please contact: [email protected]
You have the right to lodge a complaint with a data protection supervisory authority about the processing of your personal data. The authority responsible for us is: Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Rheinland-Pfalz Hintere Bleiche 34 55116 Mainz https://www.datenschutz.rlp.de
On the waiting page you can ask to be notified as soon as your designs are ready. This is voluntary and happens only after your explicit consent: we set up the notification only once you allow your browser's prompt. Without consent nothing is stored and nothing is sent; the page works unchanged without notifications. We store only what is technically needed for delivery: the push address (endpoint) assigned by your browser's push service, the two keys of this browser (p256dh and auth) that encrypt the message so that only your device can read it, the identifier of your browser and of the generation so that the message belongs to your designs, and the language of the page and the browser identification (user agent). No name, postal address or email address is collected for this. Delivery is handled by the push service of your browser vendor (for example Google, Mozilla, Microsoft or Apple); the content of the message is encrypted and cannot be read by that service. The legal basis is your consent under Art. 6(1)(a) GDPR. You can withdraw it at any time with effect for the future by revoking notifications for isakum.com in your browser settings. The address concerned is permanently deactivated on our side at the latest on the next delivery attempt and is no longer used.
Last updated: October 2026
This English version is provided for convenience. In case of doubt, the German version prevails.