Privacy Policy
Toggle your .
1. Controller
The controller responsible for data processing within the meaning of the General Data Protection Regulation (GDPR) is:
Jannis T. Werner
Sonnenallee 127
12059 Berlin
Germany
Email: mail(at)jtw.photography
2. Hosting and server logs
Lovable hosts this website and Cloudflare delivers it. I use my own Supabase project, with its database located in Ireland, for the database, contact-request processing and small image previews. Larger images are stored in Cloudflare R2 with EU storage jurisdiction and delivered through images.jtw.photography. When images load, your browser connects directly to Supabase or Cloudflare depending on the image size. European storage does not mean that all processing, including worldwide delivery and support, takes place exclusively in the EU (see section 9).
These providers process your IP address, browser information, requested address and access time for delivery, operation and security. The legal basis is my legitimate interest in providing a secure, functioning website under Art. 6(1)(f) GDPR. Where needed, technically necessary cookies may be used, such as __dpl for consistent delivery of a deployment or __cf_bm for bot protection (approximately 30 minutes). Necessary storage and access rely on § 25(2) no. 2 TDDDG.
3. Reach measurement and usage analytics
With your consent, I use analytics provided by Lovable to evaluate page views and use of my website. This processes the visited page address including URL parameters, referring page (referrer), time, browser information, browser language and a country inferred from the browser's time zone. Data is sent to an analytics endpoint on the same domain; your IP address is also visible to the receiving service during transmission. A random, pseudonymous session identifier is stored in the session-id cookie to associate visits within a session. It expires 30 minutes after its last renewal. I do not currently use session replay.
Analytics remains disabled until you consent, regardless of your location or browser time zone. The legal bases are Art. 6(1)(a) GDPR and § 25(1) TDDDG. You can withdraw or change consent at any time for the future through “Privacy settings” in the footer. “Decline” disables analytics and removes its known browser identifiers. An active Global Privacy Control (GPC) signal is respected as a decline, including after earlier acceptance. Necessary processing for operation and security under section 2 continues.
4. Contact form
If you use the contact form, the data you provide (name, email address, and message) is stored in the website's database and forwarded to me by email via the delivery service Mailgun. The sender's IP address is stored only as a salted hash value in order to prevent abuse (rate limiting the number of messages). The legal basis for processing is the handling of your inquiry pursuant to Art. 6(1)(b) GDPR. The data is kept until your inquiry has been fully dealt with and is deleted on request.
5. Local storage
After you use the language switch, your preferred language is stored under lang in localStorage. Your analytics choice and the time of that decision are stored under analytics-consent so I can respect your choice. Both entries remain until you change them or clear the website's browser data; they do not expire automatically and are not used for tracking. Storing your requested settings relies on § 25(2) no. 2 TDDDG and Art. 6(1)(f) GDPR. Only when using the protected administration area does Supabase additionally store authentication data in your browser to maintain the session; viewing the public gallery does not require signing in.
6. Fonts
Inter and Instrument Serif, the fonts used for the website's design, are served from the website's own host; Google Fonts is not embedded. The “Edit with Lovable” badge added by Lovable also loads a font from cdn.gpteng.co. This transmits your IP address and necessary connection information to the delivery service used by Lovable to display the platform badge. The legal basis is Art. 6(1)(f) GDPR. See section 9 for Lovable.
7. External links
This website links to my Instagram profile. When you follow such a link, the privacy policy of the respective provider (Instagram) applies; I have no influence over their data processing.
8. Your rights
Within the limits of the law, you have the right to access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20), and the right to object to processing (Art. 21). You also have the right to lodge a complaint with a supervisory authority. The authority responsible for Berlin is the Berlin Commissioner for Data Protection and Freedom of Information (Berliner Beauftragte für Datenschutz und Informationsfreiheit).
9. Providers and international transfers
Recipients are Lovable (hosting and analytics), Supabase (database, image previews, contact processing and administrator sign-in) and Cloudflare (delivery, security and R2 image storage). Email delivery is described in section 4. These services may process data outside the EEA, particularly in the United States and, for Supabase, Singapore. The providers provide for EU Standard Contractual Clauses for relevant transfers; Cloudflare also provides for the EU-US Data Privacy Framework for covered transfers. Details of safeguards and recipients are available in the linked provider documents. You can also request a copy of the applicable safeguards using the contact details in section 1.
Lovable: privacy policy · Supabase: data processing and Standard Contractual Clauses · Cloudflare: data processing and transfers
10. Retention
Section 4 describes contact-request retention; sections 2, 3 and 5 describe browser identifiers and settings. A cookie's lifetime is distinct from retention of data already transmitted. Retention of server-side operational, security and analytics data follows the relevant purpose: service delivery and troubleshooting, investigation of security incidents and evaluation of website use. Lovable's linked privacy policy specifies generally up to 90 days for log data, with longer retention where required by law. Deletion may take effect later in backup copies. You can request access and deletion using the contact details in section 1, subject to statutory retention duties and storage necessary to establish, exercise or defend legal claims.
Last updated: 8 September 2026