Privacy Policy

1. Controller

The controller responsible for data processing on this website is:

Stefanie Grube


Siebachstr. 115
50733 Köln
Germany
Email: hi@steffigrube.com

2. Overview of Processing

We only process personal data of our users to the extent necessary to provide a functioning website, our content, and our services (in particular the AELYS membership). Processing of personal data regularly takes place only with the consent of users or on the basis of legitimate interests or contract fulfillment (Art. 6 (1) lit. a, b, f GDPR).

3. Hosting (Squarespace)

This website is hosted by Squarespace, Inc., 225 Varick Street, New York, NY 10014, USA. Squarespace processes server log files (including IP address, date and time of access, page requested, browser type, referrer URL). This processing is based on our legitimate interest in the secure and stable provision of the website (Art. 6 (1) lit. f GDPR).

As Squarespace is a US-based company, personal data may be transferred to the USA. Squarespace is certified under the EU-US Data Privacy Framework and/or relies on the European Commission's Standard Contractual Clauses to ensure an adequate level of data protection.

4. Payment Processing (ThriveCart / Stripe)

When you join an AELYS membership, the data required for payment processing (including name, email address, payment details) is transmitted to our checkout provider ThriveCart LLC and the underlying payment processor Stripe, Inc., 354 Oyster Point Blvd, South San Francisco, CA 94080, USA. This processing takes place to fulfill the membership contract (Art. 6 (1) lit. b GDPR). Payment data (e.g. card details) is processed exclusively by Stripe and never passes through our own systems.

Data may be transferred to the USA in this context; both providers rely on Standard Contractual Clauses and/or certification under the EU-US Data Privacy Framework to ensure an adequate level of data protection.

5. Community Platform (Circle)

Upon successfully joining, members receive access to our community on Circle, where profile data, posts, and messages within the community are processed. This is based on contract fulfillment (Art. 6 (1) lit. b GDPR). Circle's own privacy notices apply in addition.

6. Newsletter (Flodesk)

If you sign up for our newsletter, we use the email address you provide, and where applicable your name, to send you regular updates about AELYS. Sign-up happens via double opt-in: after signing up, you'll receive a confirmation email that you must confirm. The legal basis is your consent (Art. 6 (1) lit. a GDPR). We use the provider Flodesk Inc., USA, to send these emails. You can withdraw your consent at any time via the unsubscribe link in every email or by messaging us.

7. Getting in Touch

If you contact us by email or via a contact form, we process the data you provide (including name, email address, message content) to handle your inquiry. The legal basis is Art. 6 (1) lit. b or f GDPR (pre-contractual measures or our legitimate interest in responding to inquiries).

8. Google Fonts

On individual pages of this website, the font "Cormorant Garamond" is loaded from a Google server. In doing so, your IP address is transmitted to Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. This only happens with your prior consent given through our cookie banner (Art. 6 (1) lit. a GDPR). For more information, see Google's privacy policy at policies.google.com/privacy.

9. Cookies

This website uses cookies. Strictly necessary cookies are used on the basis of Art. 6 (1) lit. f GDPR (legitimate interest in the functionality of the website). All other cookies (e.g. for analytics or marketing) are only set with your consent via our cookie banner (Art. 6 (1) lit. a GDPR). You can withdraw your consent at any time via the cookie settings.

10. Retention Period

We retain personal data only for as long as necessary for the respective purposes, or as required by statutory retention obligations (e.g. commercial and tax record-keeping obligations of up to 10 years for invoicing data).

11. Your Rights

You have the right, at any time, to:

  • request information about the personal data we process about you (Art. 15 GDPR)

  • request correction of inaccurate data (Art. 16 GDPR)

  • request deletion of your data (Art. 17 GDPR)

  • request restriction of processing (Art. 18 GDPR)

  • request data portability (Art. 20 GDPR)

  • object to processing (Art. 21 GDPR)

  • withdraw any consent given, with effect for the future

You also have the right to lodge a complaint with a data protection supervisory authority. The competent authority is the Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (North Rhine-Westphalia State Data Protection Officer).

12. Updates to This Policy

This privacy policy is current as of September 2026. As our website evolves or legal requirements change, it may become necessary to update this privacy policy.