Privacy

Privacy information for the Freiheydt portfolio website. Updated: 28 October 2026.

Who is responsible?

Christian Heydt. Contact details are in the legal notice. For privacy questions, use the contact form.

Visiting this website

Fonts and images are served from this website. Optional Google Analytics and Microsoft Clarity are loaded only after your respective consent. Microsoft may use Clarity data for its own purposes, including advertising. A necessary browser record stores your shared choice for the Freiheydt, Skip & Stay and Talori websites for 180 days. These websites share one choice on https://www.freiheydt.com; old product-only decisions are not extended automatically.

When you visit this website, technical connection data such as your IP address, the time of access, the requested URL and browser information are transmitted to the web server. The hosting service processes technical connection data to operate the website, maintain stability and prevent abuse. Log retention depends on the hosting configuration, operational necessity and applicable obligations; this notice does not promise an unverified fixed retention period.

Optional website analytics

Your separate, voluntary Google Analytics choice covers the Freiheydt, Skip & Stay and Talori websites, operated by Christian Heydt. We measure visits and selected app, store and Figma-link clicks to understand which content helps visitors. Each website uses its own Analytics property. The provider and processor is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; the existing account uses Google’s data processing terms.

Only after consent, Google processes pseudonymous cookie/session identifiers, timestamps and technical usage data such as browser, operating system, language and approximate country. IP addresses are processed to establish the connection; Google states that individual EU user IP addresses are not stored. We send only fixed, canonical page addresses and selected public item identifiers. We do not send contact form contents, search terms, URL parameters or fragments, or incoming referrer URLs. Google Signals, advertising personalisation, automatic form/search measurement and session recordings are not enabled. Legal notice and privacy pages are not analysed.

The portfolio uses first-party cookies freiheydt_ga and freiheydt_ga_*. The product sites use skipstay_ga / skipstay_ga_* and talori_ga / talori_ga_* on their own paths. Cookie lifetime is at most 180 days without renewal on each visit; browsers may delete them sooner. User and event data retention is two months, without extending it for new activity. Aggregated standard reports are not covered by this period.

The legal bases are Article 6(1)(a) GDPR and section 25(1) TDDDG. Google may process data in the USA. Transfers to certified Google LLC rely on the EU–US Data Privacy Framework; Google’s terms also include applicable standard contractual clauses. See Google’s privacy notice and transfer safeguards.

Your choice, scope, version, time and expiry are stored under freiheydt.websites.analytics-consent.v2 in this browser, for up to 180 days, to implement and document the decision (section 25(2)(2) TDDDG and Article 6(1)(c) together with Article 7(1) GDPR). You can decline or withdraw for all three websites at any time using Cookie settings in the footer. Further measurement stops and known analysis cookies are removed. Withdrawal does not affect previously lawful processing. Different browsers/devices and cleared, blocked or expired storage require a new choice. A direct visit does not require a second banner when a valid shared decision already exists.

Optional Microsoft Clarity

With separate consent, Clarity records clicks, scrolling, page transitions and technical browser/device data to improve these websites. Inputs and personal status messages are masked; form contents are not recorded; support, contact and legal pages are excluded. One shared project connects visits across Freiheydt, Skip & Stay and Talori. Microsoft acts as an independent controller and may also use data for its own purposes, including advertising and product improvement. Processing may include the USA. _clck: up to 1 year; _clsk: up to 1 day. Recordings: 30 days; heatmaps/click data and labeled or favorited sessions: 9 months. No Microsoft request without consent. Withdrawal through Cookie settings stops further recording and removes known first-party Clarity cookies. Prior lawful processing remains unaffected.

Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, D18 P521, Ireland. Art. 6(1)(a) GDPR; § 25(1) TDDDG.

Clarity uses pseudonymous browser/session identifiers, timestamps, IP/approximate location, browser/OS/language, display dimensions and reconstructed page interactions. URLs and referrers with unrecognised query parameters are excluded. Microsoft is an independent controller, not our processor. Its terms permit its own advertising, product-improvement and non-personal AI-development purposes. We send advertising storage consent as denied; this does not change Microsoft’s contractual role. See Microsoft Privacy Statement and Clarity Terms for purposes, recipients and international transfers, including processing in the USA. This website uses no Microsoft Ads integration.

Contact form

If you send a message, I process your email address, subject, message and optional name to answer your enquiry. These details are transmitted to this website’s server and passed to the hosting mail service. Providing an email address and message is necessary to use this contact channel; your name is optional. Please do not include sensitive information that is unnecessary for your enquiry.

Enquiries relating to a contract or steps before entering into one are processed under Article 6(1)(b) GDPR. Other enquiries are processed under Article 6(1)(f) GDPR, based on my interest in answering messages. Enquiries are retained for as long as needed to handle them and to meet applicable retention obligations.

To limit spam, the server uses short-lived signed form tokens, an invisible trap field and request limits. The request-limit identifier is derived from your IP address using a secret key; the raw IP address is not stored in those limit files. Those temporary files are removed during later requests once they are more than one day old. This does not change the hosting service’s separate technical logs. No external CAPTCHA or form provider is used.

External links

LinkedIn and Figma are only contacted when you open their links. Their own privacy notices apply when you visit them. No content from these services is embedded in this portfolio.

App websites

The apps have their own privacy notices: Skip & Stay and Talori.

Your rights

You can use the contact form for questions about access, correction, deletion, restriction, portability or objection. You can also lodge a complaint with a data protection supervisory authority.