This is a courtesy translation. In case of doubt, the German version applies.
As of 14.10.2026. This policy describes what actually happens. Anything not stated here does not take place.
Florian Maier, owner of Scale Smart
Hofbauernstr. 13
83700 Rottach-Egern, Germany
Email: info@insidestocks.de
Phone: +49 8022 24455
No data protection officer has been appointed; the legal conditions requiring one are not met.
The pages are delivered by Cloudflare (Cloudflare Germany GmbH, Rosental 7, 80331 Munich, Germany, and Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA). On each request Cloudflare processes technically necessary connection data: IP address, time, the address requested, volume of data transferred, browser and operating system details, and the previously visited page where the browser sends it.
The legal basis is Article 6(1)(f) GDPR. Our legitimate interest is the secure and uninterrupted operation of the pages and the prevention of attacks. No evaluation for advertising purposes takes place, and we do not combine this data with other data.
A data processing agreement under Article 28 GDPR is in place with Cloudflare. Transfer to the United States cannot be ruled out. Cloudflare, Inc. is certified under the EU-US Data Privacy Framework; the EU Commission's standard contractual clauses apply in addition. Despite these safeguards, access by US authorities to such data cannot be excluded.
While Inside Stocks is being tested, the site is accessible only to a closed group. Access runs through Cloudflare Access: you enter your email address and receive a one-time code. This processes your email address, the time of sign-in and a session cookie that remembers the sign-in for the duration of the session. That cookie is technically necessary for access (§ 25(2)(2) TDDDG) and requires no consent. The legal basis is Article 6(1)(b) GDPR where a test agreement exists, otherwise Article 6(1)(f) GDPR, with the interest of not making an unfinished version publicly available.
You can join the waitlist with your email address. We use double opt-in: after you submit, you receive an email with a confirmation link. The sign-up only takes effect once you click it. Without confirmation, the entry is deleted after seven days.
We process: the email address, the time of sign-up, the time of confirmation, the IP address used at sign-up and confirmation, and the language chosen. The IP addresses and times serve as proof that the sign-up came from you; providing that proof is our obligation under Article 7(1) GDPR.
The legal basis for sending emails is your consent under Article 6(1)(a) GDPR. You may withdraw it at any time without giving reasons, via the unsubscribe link in every email or by a message to the address above. Withdrawal takes effect for the future; processing carried out beforehand remains lawful. After withdrawal we delete the address, unless we exceptionally still need it as proof of consent.
Waitlist data is held with Supabase (Supabase, Inc., 970 Toa Payoh North, Singapore, with the data centre in Frankfurt am Main, Germany, operated via Amazon Web Services, region eu-central-1). A data processing agreement is in place with Supabase. Emails are sent via Brevo GmbH, Köpenicker Str. 126, 10179 Berlin.
If you write to us, we process your email address and the content of your message in order to answer it. The legal basis is Article 6(1)(f) GDPR, and for enquiries about a contract also Article 6(1)(b). Our mailboxes run on Google Workspace (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland); a data processing agreement is in place. We keep correspondence as long as there is reason to, then delete it unless a statutory retention obligation applies.
The fonts used are stored on our own server and loaded from there. There is no connection to Google Fonts or any other font service, and no IP address is transmitted to third parties in the process.
We use no analytics tools, no tracking pixels, no advertising networks and no profiling. There is no automated decision-making within the meaning of Article 22 GDPR. The grading of companies does not involve personal data.
We do not sell data and do not pass it on for advertising purposes. Data is passed only to the processors named here, to the extent necessary for operating the service, or where we are legally obliged to do so.
You have the right of access (Article 15 GDPR), rectification (Article 16), erasure (Article 17), restriction of processing (Article 18), data portability (Article 20) and objection to processing based on our legitimate interest (Article 21). You may withdraw consent at any time (Article 7(3)). A message to the address above is enough; no form is required.
You also have the right to lodge a complaint with a supervisory authority. The authority responsible for us is the Bavarian Data Protection Authority (Bayerisches Landesamt für Datenschutzaufsicht), Promenade 18, 91522 Ansbach, Germany. You may also contact the authority where you live or work.
If the technology behind the site changes, this policy changes with it. The date above states the current version. Anyone on the waitlist is informed of material changes in the weekly email.