Data protection

This Privacy Policy explains what personal data is processed when you visit isla-stud.io, contact us, subscribe to our blog, place orders, create a customer account, or use our services.

As of October 3, 2026

1. Data Controller

Saskia Teichmann
operating under the name isla Studio Teichmann
Marcus-Heinemann-Str. 34
21337 Lüneburg
Germany

Email: hello@isla-stud.io
Phone: +49 4131 99 25 230
Imprint: https://isla-stud.io/impressum/

2. General Principles

We process personal data only to the extent necessary to provide and secure the website, for communication purposes, to carry out precontractual measures and contracts, to fulfill legal obligations, or based on consent. The relevant legal bases are, in particular, Article 6(1)(a), (b), (c), and (f) of the GDPR. In cases where processing is based on legitimate interests, these interests include, in particular, the secure and cost-effective operation of the website, the handling of business inquiries, and the prevention of misuse.

We take appropriate technical and organizational measures to protect the data. Data transmitted via the website is encrypted using HTTPS. We do not engage in automated decision-making or profiling that has legal or similarly significant effects.

3. Hosting and Server Logs

The website, its database, and the services we operate ourselves are hosted on server infrastructure managed by us at netcup GmbH in Karlsruhe, Germany. We have a contract with the hosting provider for data processing on our behalf.

Each time a page is accessed, the server processes technically necessary connection data. This may include the IP address, time, requested URL and file, amount of data transferred, referrer, browser identifier, operating system, and status code. This processing is necessary for the delivery of the website, system stability, error analysis, and the defense against attacks, pursuant to Article 6(1)(f) of the GDPR. The regular access logs are rotated daily and deleted after seven days, unless a security-related incident requires longer, purpose-limited retention of individual records.

4. Cookies, Local Storage, and Consent Management

We use a consent management system on our own website to manage consent and technically necessary settings and to retain evidence of consent. This involves processing a random consent identifier, the version of the consent wording, and the selected services and service groups. Your selection currently remains valid for 120 days. Depending on the current configuration, technically necessary consent cookies may be stored for up to 365 days; local queue entries used to transmit your selection are retained for no more than one day. The legal bases are Art. 6(1)(c) and (f) GDPR. Access to information that is strictly necessary on your device is based on section 25(2)(2) TDDDG.

The language you expressly select is stored for 30 days in the cookie trp_language This storage is necessary to provide the language version you expressly selected (section 25(2)(2) TDDDG; Art. 6(1)(f) GDPR). Translations are stored on our own website. Merely opening a translated page does not transmit any text to a translation service.

Non-essential services are loaded only in accordance with the selections made in the consent banner. Consent can be modified or revoked there at any time, effective for the future. Information about the entries stored in your specific browser, their purposes, and their durations is also available in the cookie settings.

5. Self-hosted audience measurement

With your consent, we analyse use of the website at stats.isla-stud.io in aggregated form. The audience measurement system runs exclusively on our own infrastructure hosted in Germany; no visitor data is transmitted to an external analytics provider for this purpose.

We process the page visited, referral and campaign information, the time of the visit, browser, operating system and device type derived from the user agent, and an approximate geographical region derived from the IP address. The raw IP address and full user agent are not stored. To count visits per day, an identifier is generated from the domain, IP address and user agent using a salt that changes daily; neither the salt nor the identifier can be used across different days. The audience measurement system does not use cookies or a persistent device identifier. The results are used solely to analyse audience reach and website functionality, not for advertising or cross-site profiling.

The legal basis is consent pursuant to Article 6(1)(a) of the GDPR. The service will not load without this consent. Aggregated statistics are stored for as long as they are needed for temporal comparisons and to improve the service. Since neither raw IP addresses nor persistent visitor identifiers are stored, older statistical data cannot be linked to any specific individual.

6. Contact Requests and Internal Contact Management

When you use the contact form or contact us by email or phone, we process the information you provide. In the contact form, this may include your name, email address, company, role, subject, decision-making timeline, message, date and time, and the page you were viewing. Required fields are marked on the form.

Form submissions are sent to our Google Workspace mailbox. The provider for the EEA is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Your name, email address, and the source „Contact Request isla-stud.io“ are also stored in our self-hosted internal contact management system so that we can assign and process requests. This system runs within our own infrastructure; the message is not duplicated there as a CRM note, and it is not shared with any external CRM provider.

Article 6(1)(b) of the GDPR serves as the legal basis when the person making the inquiry is a party to a contract or wishes to become one. If the person is acting as an employee or contact person for a company, processing is carried out in accordance with Article 6(1)(f) of the GDPR; our legitimate interest lies in the reliable handling and documentation of business communications. Mere inquiries without a subsequent contract are generally deleted no later than three years after the last correspondence, unless legal obligations or the assertion, exercise, or defense of legal claims require longer retention. Contract-related communication is subject to the retention periods described in the „Retention Period“ section.

OpenShell Research Agent Guide

When you request the OpenShell Research Agent Guide, you also sign up for short email updates when I publish a new Isla Studio post. I use your first name, last name and email address for this. First, I send you a confirmation link. Only after you open the linked page and confirm your subscription do I send you the guide link and password and activate the blog subscription. Neither happens without your confirmation. Requesting the guide does not authorize personal outreach or promotional emails. I store the wording of your consent and the times of your request, confirmation and guide delivery as proof. I delete unconfirmed guide requests after 48 hours and guide delivery records after 30 days in the next scheduled cleanup. I keep your confirmed blog subscription until you unsubscribe; the next section explains the retention periods. The form uses Cloudflare Turnstile to prevent abuse; see ‘Protection against spam and abuse’.

If you separately agreed to occasional personal contact when you requested the guide previously, that permission remains separate from your blog subscription. I added your first name, last name and email address to my own contact system under the label ‘OpenShell Research Agent Guide’ only after you confirmed that choice. The legal basis is your consent under Article 6(1)(a) GDPR. You can withdraw it at any time by replying to one of those messages or emailing hello@isla-stud.io to withdraw that permission. I will then remove the guide label, unless another purpose or a legal retention obligation requires me to keep it.

Earlier guide requests with a separate, optional choice for blog updates are not retroactively changed to this new subscription. The choices made at the time of each request still apply.

7. Blog Subscription

For the blog subscription, I use your email address, a hash of it, your subscription status, which form you used, the exact wording of your consent, and the times of signup, confirmation, changes and any unsubscribe. When you use the guide form, I also use your first and last name to deliver the guide and match it to your subscription. Your subscription begins only after you confirm it by email. I then send a short email with a link whenever a new Isla Studio post is published. You can unsubscribe through the link in any email. The legal basis for sending and managing these emails is your consent under Article 6(1)(a) GDPR. I process security and delivery logs under Article 6(1)(f) GDPR.

I delete unconfirmed blog signups after 14 days; guide requests have a shorter period of 48 hours. I keep confirmed subscriptions until you unsubscribe or request deletion, unless another obligation takes precedence. I delete delivery logs with status and error codes after 180 days. When you unsubscribe, I remove your name from the blog subscription. I keep your email address, its hash and the confirmation records for up to three years solely to document your previous consent and protect against unfounded claims, then delete them. You may request deletion at any time, subject to any overriding legal duty.

8. Comments, User Accounts, and Security Features

When you post a comment, we process the name and email address you provide, your website if supplied, the comment, the time of submission, your IP address and browser identifier. We use this information to publish and moderate comments and to prevent spam and unlawful content. The legal bases are Art. 6(1)(f) GDPR and, where a comment concerns contractual communication, Art. 6(1)(b) GDPR. Published comments generally remain attached to the relevant post until they are deleted or a valid request for deletion is fulfilled; statutory retention or evidentiary obligations may prevent deletion. We currently do not offer automatic subscriptions to comments.

When registering, logging in, resetting a password, or using a customer account, the master data, contact information, security data, and log data required for authentication and account management are processed. The legal bases are Article 6(1)(b) and (f) of the GDPR. Security logs are stored only for as long as necessary to prevent misuse. Account data is deleted upon termination of the business relationship and after the expiration of statutory retention and statute of limitations periods.

9. Contracts, Store, Downloads, and Licenses

For individual orders and requests, we process, in particular, names, contact information, company name (if applicable), and VAT identification number, billing address, contract and service data, communications, order items, amounts, payment status, downloads, license keys, license terms, and technical provisioning logs. Article 6(1)(b) of the GDPR serves as the legal basis when the data subject is a party to the contract. For contacts at a corporate customer, processing is based on Article 6(1)(f) of the GDPR and our interest in performing the contract with that company. In addition, Article 6(1)(c) of the GDPR applies to commercial and tax law obligations, and Article 6(1)(f) of the GDPR applies to the protection and enforcement of claims.

The shop operates within our own website. Order and licence data is therefore initially stored in our own database. For free downloads, we may process your email address, the product, the time of the download and entitlement data where necessary to provide the download and prevent misuse.

10. Payment Processing

We use Stripe for payments in our online store. Depending on the payment method, Stripe processes, in particular, your name, contact information, billing address, IP and device data, transaction amount, currency, payment status, and the necessary payment details. Full card information is not stored on our server. For the EEA, Stripe Payments Europe, Limited and Stripe Technology Europe, Limited in Ireland are specifically involved. The legal bases are Article 6(1)(b) and (c) of the GDPR, as well as legitimate interests in secure payment processing and fraud prevention pursuant to Article 6(1)(f) of the GDPR. Further information: Stripe Privacy Policy.

The page for voluntary donations may include a link to PayPal. PayPal processes data on its own behalf only after you open this link and use the external service. PayPal is not a standard payment method for the Isla Studio Shop. For more information: PayPal Privacy Policy.

11. Protection Against Spam and Abuse with Cloudflare Turnstile

Contact, guide, and blog subscription forms, comments, login, registration, and password requests and resets are protected by Cloudflare Turnstile. In doing so, Cloudflare processes technically necessary signals, specifically IP address, TLS and browser characteristics, user agent, site key, referring domain, interaction data, and verification data. Form submissions and other input fields are not transmitted to Turnstile. Our server transmits the Turnstile token and the IP address to Cloudflare for verification.

The provider is Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA. The processing is intended to prevent automated and malicious inputs, based on Article 6(1)(f) of the GDPR. Access to the end device is necessary for the explicitly requested secure form or account function (Section 25(2)(2) of the TDDDG). Further information is available in the Turnstile Privacy Addendum.

12. External Content and Links

YouTube videos are not loaded automatically. A connection to YouTube or Google is established only after you explicitly click on the video. In the process, your IP address, browser and device data, the page you visited, and—for logged-in Google users—account information may be processed. The provider for the EEA is Google Ireland Limited. The legal basis for loading the videos is your consent pursuant to Art. 6(1)(a) of the GDPR and § 25(1) of the TDDDG.

Links to LinkedIn, X, Facebook, Xing, GitHub, PayPal, and other external services only establish a connection to the respective provider when clicked. The respective provider is responsible for data processing on those sites. We do not use Shariff-style view counters and do not currently embed SlideShare presentations.

13. Recipients and Transfers to Third Countries

Personal data is disclosed only to recipients that require it for the purposes described above. These include, in particular, our hosting provider, Google Workspace for email, Stripe and the banks or payment services involved, Cloudflare for Turnstile and, where necessary, tax advisers, legal advisers, public authorities and specialist contractors engaged by us. Our internally operated systems are not external recipients.

In the case of Google, Stripe, and Cloudflare, processing outside the European Economic Area—particularly in the United States—cannot be ruled out. To the extent necessary, the transfer is based on an adequacy decision—specifically, the EU-U.S. Data Privacy Framework for certified recipients—or on the European Commission’s Standard Contractual Clauses and supplementary safeguards. Details can be found in the linked privacy policies and in the agreements we have in place.

14. Retention Period

We delete personal data as soon as the purpose for which it was collected no longer applies and there are no legal retention requirements or legitimate interests in providing evidence or defending ourselves that preclude such deletion. Bookkeeping records are typically retained for eight years, and commercial and business correspondence for six years; longer retention periods may apply in individual cases under tax, commercial, or procedural law. The specific retention periods mentioned above apply to server logs, consents, blog subscriptions, and contact inquiries alone. Data required to assert, exercise, or defend legal claims may be retained in a locked format until the applicable statute of limitations expires.

15. Your Rights

In accordance with the statutory requirements, you have the right to access, correct, delete, restrict the processing of, and transfer your data. You may revoke any consent you have given at any time, effective for the future.

Right to Object: You may object to processing based on Article 6(1)(f) of the GDPR for reasons arising from your particular situation. You may object to processing for direct marketing purposes at any time without providing a reason.

To exercise your rights, simply send a message to hello@isla-stud.io. We may request appropriate proof of your identity if this is necessary to protect the data in question.

16. Right to File a Complaint

You have the right to file a complaint with a data protection supervisory authority. The authority with jurisdiction over our headquarters is, in particular:

The State Data Protection Commissioner of Lower Saxony
5 Prinzenstraße
30159 Hanover
https://www.lfd.niedersachsen.de/

17. Changes to This Privacy Policy

We will update this Privacy Policy if there are changes to data processing practices or the legal landscape. The version published on this page is the authoritative one.