Privacy

Last updated 18 October 2026

This page explains which personal data we process when you visit hookloft.com, email us, buy from us or work with us, and what rights you have under the EU General Data Protection Regulation (GDPR).

1. Who is responsible

2. The short version

• The website sets no cookies and uses no analytics or tracking.
• Fonts and videos load from our own site, not from Google or other third parties.
• When you buy, Stripe handles the payment. We use your details to deliver your order and to email you.
• We never sell personal data.

3. Visiting the website

hookloft.com is hosted by Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA. When you open a page, the server processes your IP address, the date and time, the page you asked for, the referring page and your browser and operating system. This is needed to show you the site and to keep it secure. The legal basis is our legitimate interest in running a secure website (Art. 6(1)(f) GDPR). Vercel keeps these logs only for a short time and processes them for us under a data processing agreement. Transfers to the USA are covered by the EU-U.S. Data Privacy Framework and the EU Standard Contractual Clauses.

4. Emailing us

When you email us, we process your address, your name and what you write, to answer you. The legal basis is the contract or the steps before one (Art. 6(1)(b) GDPR), or otherwise our legitimate interest in answering your message (Art. 6(1)(f) GDPR). Our email runs on Google Workspace, provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, under a data processing agreement. Google may process data in the USA, covered by the EU-U.S. Data Privacy Framework and the EU Standard Contractual Clauses.

5. Buying from us

Checkout runs on Stripe, provided to us by Stripe Payments Europe, Limited, 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland. At checkout Stripe collects your email address, name, business name, billing address, tax ID if you give one, your store’s website and your payment details. We receive these details except your full card number. We use them to take payment, deliver the order, send invoices and contact you about the order (Art. 6(1)(b) GDPR), and to meet tax and accounting duties (Art. 6(1)(c) GDPR). Stripe also processes some data as its own controller, for example to prevent fraud and to meet its legal duties. See stripe.com/privacy.

We keep order and invoice records for as long as German tax and commercial law requires, up to 10 years. We delete other order data when it is no longer needed.

6. Making your ads

For an order we process what you send us: the intake form, product pages, reviews, images and clips, the claims you can’t make, and the performance numbers from the read-only access you give us to your ad account. We use this only to make your ads and readouts (Art. 6(1)(b) GDPR).

We make video and voice with third-party AI tools (currently Kie.ai). We send them scripts, prompts and product images, not personal data. When we write scripts from your customers’ reviews, we use the wording, never the reviewers’ names or photos.

7. Businesses we contact

We may contact businesses that could use our service. For this we process business contact details, such as a person’s name, role, business email address and company, which we take from public sources such as company websites and from B2B data providers. The legal basis is our legitimate interest in telling businesses about our service (Art. 6(1)(f) GDPR). You can object at any time by replying or emailing hello@hookloft.com. We then stop contacting you and keep only your email address on a do-not-contact list, so that you are not contacted again. We delete outreach data at the latest 12 months after our last contact, unless you become a client.

8. Your rights

You have the right to:

• get a copy of the personal data we hold about you (Art. 15 GDPR),
• have it corrected (Art. 16) or deleted (Art. 17),
• restrict how we use it (Art. 18),
• receive it in a common format, or have it sent to someone else (Art. 20),
• object to processing based on our legitimate interest, and to direct marketing at any time (Art. 21),
• complain to a data protection supervisory authority, for example in the EU country where you live or work (Art. 77).

To use these rights, email hello@hookloft.com. We don’t make decisions about you by automated means alone.

9. Changes

We update this page when we add a service, for example the client portal. The date at the top shows the current version.