Privacy policy

Translation for convenience. The German version is legally binding. Effective: 1. November 2026

1. Controller

Alejandro Morillo Diaz, Am Markt 14, 23769 Fehmarn, Deutschland
Email: support@magmacode.io

2. Overview

This website sets no analytics or advertising cookies and uses no tracking services. We only process data needed to run the site, sell the files, handle custom requests and meet legal obligations.

3. Hosting and server logs

The site runs on Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA (Cloudflare Workers). Each request processes technically necessary data: IP address, date and time, requested address, browser identifier and referrer (Art. 6 (1) (f) GDPR). Cloudflare may transfer data to the USA; it is certified under the EU-US Data Privacy Framework. A data processing agreement is in place.

If Cloudflare's bot protection is active, Cloudflare may set a strictly necessary cookie (__cf_bm, lifetime at most 30 minutes) to detect automated traffic (§ 25 (2) no. 2 TDDDG, Art. 6 (1) (f) GDPR). We use no other cookies, analytics or advertising services.

The forms for free downloads, custom requests and withdrawal are protected against automated requests by Cloudflare Turnstile. Turnstile checks technical properties of the browser and connection (e.g. IP address, browser identifier, the result of small computations in the browser) and only tells us "human" or "bot"; it sets no advertising or tracking cookies. Legal basis: Art. 6 (1) (f) GDPR (protecting our email address against spam and abuse) and, for access to your device, § 25 (2) no. 2 TDDDG. Provider is Cloudflare (see above).

To prevent abuse Cloudflare counts requests to our forms and to the order lookup per IP address for 1 minute each, without storing them permanently. We count how many download and confirmation emails go to one email address for at most 2 days (Art. 6 (1) (f) GDPR). For troubleshooting, Cloudflare stores error logs (Cloudflare Workers Logs: time, requested address and error message). These logs are deleted automatically after at most 7 days (Art. 6 (1) (f) GDPR).

4. Purchase and payment (Link / Stripe)

Paid files are sold by Sold through Link, LLC, a Stripe company (USA), via Stripe Managed Payments. For checkout we redirect you to a Stripe/Link payment page where you enter your data (e.g. name, email, billing address, payment details) directly with Stripe/Link. Stripe and Link process this data as independent controllers for the sale, payment, taxes, receipts, fraud prevention and customer support; see Link's privacy notice (link.com/privacy, in particular "Sold through Link") and Stripe's (stripe.com/privacy); contact: dpo@stripe.com. Stripe, LLC is certified under the EU-US Data Privacy Framework; according to Stripe it relies primarily on this adequacy decision (Art. 45 GDPR) and alternatively on Standard Contractual Clauses (Art. 46 (2) (c) GDPR) for transfers to the USA.

After the purchase Stripe sends us your email, country, product, amount and payment status, and possibly your name and billing address. We use these data to provide the files and document the licence granted (Art. 6 (1) (b) GDPR); where retention duties apply, also Art. 6 (1) (c) GDPR.

5. Downloads and emails

After payment we store an order record (order number, email, product, time) and generate time-limited download links. We send the confirmation via Resend (Plus Five Five, Inc., San Francisco, USA) (Art. 6 (1) (b) and (c) GDPR). Email address and message content are transferred to the USA; the provider is certified under the EU-US Data Privacy Framework (Art. 45 GDPR). We do not track email opens or link clicks.

5a. Free downloads and newsletter

For free files you enter your email address. We store it together with the time and the file downloaded in order to send you the download link and prevent abuse (Art. 6(1)(b) GDPR). Data is stored at Cloudflare (Workers KV) and sent via Resend (Plus Five Five, Inc., San Francisco, USA) (see section 5).

You only receive the newsletter if you tick the box and confirm via the link in the email (double opt-in, Art. 6(1)(a) GDPR, § 7(2) UWG). We store the time of sign-up and confirmation as proof. You can withdraw your consent at any time, e.g. via the unsubscribe link in every email or by writing to support@magmacode.io.

Retention: download data is deleted automatically 12 months after the last download. Unconfirmed newsletter sign-ups are deleted after 30 days, confirmed ones when you unsubscribe.

6. Custom design requests

When you use the request form we process your details (name, email, car data, description) and uploaded photos or files to handle the request and prepare a quote (Art. 6 (1) (b) and (a) GDPR). Files are kept in non-public storage (Cloudflare R2). Requests and uploaded files are deleted automatically after 180 days; if an order results, we keep the details needed for it in the order records.

7. Withdrawal function

When you withdraw via the withdrawal function we process name, email, order reference and message to handle the withdrawal and confirm receipt (Art. 6 (1) (c) GDPR). The confirmation contains only the time, a reference and a recognisable order number, not your message. Withdrawal declarations are kept as evidence until the regular limitation period ends (§ 195, § 199 BGB) and deleted automatically 4 years after receipt.

8. Retention

Order records are kept as evidence of the licence granted until the regular limitation period ends (§ 195, § 199 BGB) and deleted automatically 4 years after the purchase. Where commercial or tax law (§ 147 AO, § 257 HGB) requires longer, the data concerned are kept accordingly. Other data are deleted once no longer needed.

9. Your rights

You have the right of access, rectification, erasure, restriction, data portability and objection (Art. 15–21 GDPR) and may withdraw consent at any time. Right to object (Art. 21 GDPR): you may object at any time, on grounds relating to your particular situation, to processing based on Art. 6 (1) (f) GDPR, e.g. by email to support@magmacode.io.

You may lodge a complaint with a data protection supervisory authority, e.g. the one where you live or the one responsible for us (Unabhängiges Landeszentrum für Datenschutz Schleswig-Holstein (ULD), Holstenstraße 98, 24103 Kiel).