Privacy notice

1. Controller and contact

Controller

R&R Spiele UG (haftungsbeschränkt), trading as Staedy

Address

Emeranstraße 23, 85622 Feldkirchen, Germany

Represented by

Rieke du Toit

Privacy contact

privacy@staedy.com

Fallback

info@rouxdutoit.com

No separate data-protection-officer contact has been designated. We review whether designation is required when our headcount, processing purposes or risk profile changes. Privacy requests go to the address above.

2. Website delivery and security

Cloudflare delivers and protects staedy.com. It processes connection and security data such as IP address, timestamp, requested URL, browser and device information, network signals, and error or abuse indicators.

Purpose: page delivery, rate limiting, diagnosis and protection against automated or malicious requests. Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest is operating a secure and reliable business website. We do not run advertising, behavioural profiling, session replay or audience analytics.

3. Free hotel website check

When you submit a hotel website, Staedy processes the URL and fetches a bounded, read-only sample: the homepage, robots.txt, sitemap and up to four same-origin pages. Requests are limited by size, duration, redirect count and rate. Only publicly reachable HTTP or HTTPS business websites are accepted.

The sampled page text, headings and technical signals are sent through Cloudflare Workers AI using a Cloudflare-hosted model to generate a preliminary positioning read and up to three possible information gaps. Website text is treated as untrusted input; instructions found inside it are not followed. The result is automatically generated and may be incomplete or wrong.

Staedy does not add the sampled page text or generated result to the checkout database. Application logs record only limited operational facts such as whether a check completed, the detected platform, sample count and error category; they are not designed to contain the page text or your email address.

Purposes: provide the check you requested, prevent abuse and diagnose failures. Legal bases: Art. 6(1)(b) GDPR where the check is requested in anticipation of a project, and otherwise Art. 6(1)(f) GDPR, our legitimate interest in demonstrating the service using a proportionate review of public business content.

Please submit only a business website you operate, represent or have a legitimate reason to assess. Public hotel pages can incidentally name owners or staff. Staedy does not seek guest, customer or special-category data and does not intentionally sample booking records or private systems.

4. Business checkout and payment

If you continue after the free result, Staedy collects the work email, first and last name, legal business name, billing street, postal code, city, country, optional VAT ID, hotel website, a random order reference, timestamps, payment status, terms version and the recorded business, authority and terms confirmations.

Purpose: create and administer the requested business order, determine lawful VAT treatment, evidence the contract, reconcile payment, prevent fraud and perform the project. Legal bases: Art. 6(1)(b), (c) and (f) GDPR. Required fields and confirmations are necessary to offer the business-only paid service.

Staedy stores these order details in a Cloudflare D1 database restricted to the EU jurisdiction. To create the payment, Staedy sends Mollie the buyer's first and last name, work email, billing street, postal code, city and country, the €499 amount and a random order reference. The legal business name and VAT ID remain in Staedy's D1 record and are not sent in the Mollie API request.

Mollie collects the selected payment method and associated payment, device, fraud and authentication information directly in its hosted checkout. Staedy receives only the Mollie transaction reference, method and status needed to reconcile the order; Staedy does not receive card numbers, online-banking credentials or payment authentication secrets. Mollie acts as an independent controller for payment-transaction processing under its own privacy notice.

5. Contracted website projects

If a project is agreed, we may process the business identity and contacts; accepted scope, price and document versions; public website evidence; supplied hotel facts and assets; drafts, code, links and technical changes; feedback and approvals; preview, publishing and handoff records; and access records needed for the agreed platform.

Purpose and legal basis: negotiation and performance of the project under Art. 6(1)(b) GDPR. Quality assurance, access security and evidence of approvals may also rely on Art. 6(1)(f) GDPR. We do not publish a change without the approval required by the agreed scope.

Do not send guest records, customer lists, personnel files, health data, payment-card data or passwords by ordinary email. If access is needed, we will agree a restricted route and the minimum permission necessary. If an implementation would require us to process personal data on your behalf, we will define the roles and, where required, conclude an Art. 28 GDPR data-processing agreement before that work begins.

6. Email, invoicing and business records

When you contact us, we process message metadata, content and attachments to answer you, manage a project, establish or defend claims, and maintain authentic business correspondence. Legal bases: Art. 6(1)(b) and, where applicable, Art. 6(1)(f) GDPR.

Business identity, billing address, VAT information, invoice amount, payment status and transaction references are processed for the contract, legal bookkeeping duties and fraud prevention under Art. 6(1)(b), (c) and (f) GDPR. Payment-card and bank-login data are entered only in Mollie's hosted checkout.

7. Cookies and external content

Staedy's site code does not set analytics, advertising or preference cookies and does not use browser local storage or session storage. Cloudflare may use strictly necessary security mechanisms when required to deliver or protect the service. Where access to terminal equipment is strictly necessary for a function you requested, § 25(2) no. 2 TDDDG applies.

Fonts, scripts, styles and product images are served from Staedy's own Cloudflare-hosted origin. Viewing an ordinary page does not cause the browser to fetch Google Fonts or third-party logo hosts. Mollie loads only after the buyer submits the business checkout and is redirected for the requested payment.

8. Providers and international transfers

Cloudflare processes data for hosting, Workers, D1, Workers AI, rate limiting, security logging and email routing. Mollie processes payment-transaction data as an independent controller. Contracted projects may also involve the invoicing provider and, only where included in the agreed method, named AI API providers. The current list and roles are on Service providers.

Cloudflare's network and company are global. The checkout D1 database is configured with the EU jurisdiction, but edge delivery and Workers AI processing are not described as EU-only. Where a restricted transfer occurs, Cloudflare's customer data-processing addendum provides the applicable EU Standard Contractual Clauses and related safeguards. Mollie's applicable transfers and payment intermediaries are described in Mollie's privacy notice. You may ask us for relevant safeguard information.

9. Retention

Sampled public page text and preliminary result

Processed for the live response and not persisted by Staedy in the checkout database.

Checkout order that is not paid

Automatically deleted from the checkout database after 90 days, unless required for a dispute, security investigation or legal claim.

Contracted project records

Kept while needed to perform the project and generally for the applicable statutory limitation period afterwards; transient drafts, credentials and preview access are removed earlier when no longer needed.

Business correspondence

Ordinary enquiries are deleted when no longer needed. Commercial or business letters are retained for the statutory period where required.

Invoices and accounting documents

Retained for the applicable German statutory period, including eight years for booking documents and ten years for the records for which that period applies under § 147 AO.

Application and security logs

Kept only for the operational or incident period available for the service; longer retention is limited to a documented incident or legal obligation.

When a legal hold or statutory duty prevents erasure, we restrict the record to that purpose instead of using it operationally.

10. AI and automated decisions

The free check is an AI-assisted, automatically generated preliminary assessment. It does not determine the €499 price, take payment, publish changes or produce any legal or similarly significant effect. The buyer makes the business-order confirmations, Mollie determines payment status, and people remain responsible for delivery and publishing decisions.

Cloudflare states that Workers AI customer content is not used to train models or improve Cloudflare or third-party services without explicit consent. Staedy does not use submitted content to train a model.

11. Your rights

Subject to the conditions in the GDPR, you may request access, rectification, erasure, restriction, portability, and information about recipients. You may object at any time to processing based on Art. 6(1)(f) GDPR for reasons relating to your situation. Where processing is for direct marketing, the objection is absolute; Staedy does not use checkout details for direct marketing.

Email privacy@staedy.com. We may request proportionate information to verify identity. We respond without undue delay and ordinarily within one month under Art. 12 GDPR.

12. Complaints and breaches

You may complain to any competent supervisory authority. Our lead contact is the Bayerisches Landesamt für Datenschutzaufsicht, Promenade 18, 91522 Ansbach, Germany, www.lda.bayern.de.

We assess personal-data incidents promptly. Where Art. 33 GDPR applies, we notify the competent authority without undue delay and, where feasible, within 72 hours. Where Art. 34 requires it, we also notify affected people without undue delay.

13. Changes

We update this notice when the product, provider list or law changes. A material new purpose is not applied to existing data without the notice and lawful basis required at that time. The version applicable when a project is agreed is recorded with the project documents.

Questions about this page

privacy@staedy.com