Privacy policy
Last updated: 2 November 2026
We take the protection of your personal data seriously. This policy explains which data we process when you visit scheff.co, use the advisor or buy the guide, why we do so and what rights you have under the EU General Data Protection Regulation (GDPR).
1. Controller
SCHEFF
Germany
Email: the email address in our legal notice
We are not required to appoint a data protection officer.
2. Hosting and server logs
This website runs on the network of Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA (Cloudflare Workers). When you open a page, your browser automatically sends technical data: IP address, date and time, page requested, referrer, browser and operating system. Cloudflare processes this data to deliver the website, protect it against attacks and keep it stable. We use the data only in anonymous, aggregated form and do not combine it with other data.
Legal basis: Art. 6(1)(f) GDPR (our legitimate interest in a secure and reliable website). We have a data processing agreement with Cloudflare. Cloudflare is certified under the EU-US Data Privacy Framework; transfers to the USA are based on the adequacy decision of the European Commission (Art. 45 GDPR) and additionally on standard contractual clauses. Log data is deleted after a short period, usually within 30 days.
3. Fonts
We use the fonts Inter and Newsreader. They are delivered from our own domain. Your browser does not connect to Google or any other font provider, and no data is passed to them.
4. SCHEFF Advisor (AI chat)
The advisor on our home page answers questions about saving, investing and the guide. What you type is sent to our server and processed by Cloudflare Workers AI to generate an answer. We do not use your messages to identify you and do not create profiles. The first question of a conversation may be stored in anonymous form for up to 7 days so that the same question can be answered again without new processing. Please do not enter personal data such as names, account numbers or health information.
Legal basis: Art. 6(1)(f) GDPR (our legitimate interest in answering your request) and, where your question concerns a purchase, Art. 6(1)(b) GDPR. Answers are generated automatically and may contain errors; they are not advice.
5. Purchase and payment (Stripe)
When you buy the guide, you are taken to a checkout page of Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Dublin, Ireland. Stripe processes your name, email address, billing address, payment details and the purchase. Depending on the payment method you choose, Apple Pay, Google Pay, PayPal or Klarna may also process data as independent controllers; their own privacy policies apply. Stripe may transfer data to Stripe, Inc. in the USA; this transfer is based on the EU-US Data Privacy Framework and standard contractual clauses.
From Stripe we receive your email address, name, amount, payment status and order ID. We store this order record to deliver the guide, provide your download link, handle refunds and meet our accounting duties. Legal basis: Art. 6(1)(b) GDPR (contract) and Art. 6(1)(c) GDPR (legal retention duties under German commercial and tax law). Order records are kept for the statutory retention periods (up to 10 years) and then deleted. More information: stripe.com/privacy.
If you reached us through a partner link, the partner code is stored with your order so that the partner can receive a commission. It does not identify you to the partner. Legal basis: Art. 6(1)(f) GDPR.
6. Email delivery
After your purchase we send your download link by email. For sending we use Resend (Plus Five Five, Inc., USA). Resend processes your email address and the content of the email on our behalf under a data processing agreement; transfers to the USA are based on standard contractual clauses. Legal basis: Art. 6(1)(b) GDPR. We do not send newsletters or advertising without your separate consent.
7. Local storage and cookies
We do not use tracking, analytics or advertising cookies. The website stores a small preference in your browser's local storage, for example the template format you selected. It never leaves your device and is only used to provide the function you asked for (§ 25(2) no. 2 TDDDG). You can delete it at any time in your browser settings.
8. External links
Links to other services, for example our Instagram profile, are plain links. Data is only transferred to these providers when you click a link and open their page; their privacy policies then apply.
9. Your rights
You have the right to access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21). To exercise them, simply write to the email address in our legal notice.
You also have the right to lodge a complaint with a data protection supervisory authority, for example the authority responsible for us: Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Rheinland-Pfalz, Hintere Bleiche 34, 55116 Mainz, Germany.
10. Security
All connections to this website are encrypted with TLS. Payment details are entered only on Stripe's checkout page and never reach our server.
11. Changes
We update this policy when our website or the law changes. The current version is always available on this page.