Imprint & Privacy

Hosting and access data

This website is delivered via Cloudflare, Inc. (101 Townsend St, San Francisco, CA 94107, USA). When you visit, Cloudflare processes technically necessary access data such as IP address, time, requested page and browser information to deliver the site securely and quickly. The legal basis is my legitimate interest in secure and stable operation (Art. 6 (1) (f) GDPR).

Cloudflare is certified under the EU-US Data Privacy Framework; transfers to the USA are based on the European Commission’s adequacy decision (Art. 45 GDPR).

No cookies

This website itself sets no cookies and uses no advertising services. Fonts are served locally; no data is sent to Google or other font providers. The booking calendar, loaded only on request, is additionally covered under “Booking with Cal.com”.

If you switch between light and dark design, your choice is stored only in your browser (localStorage). It never leaves your device and can be deleted in your browser settings.

Three short films are hidden on the German homepage. Once you play one, your browser remembers which films you have seen (localStorage), so “Ihre Fundstücke” is right on your next visit. Nothing else is stored, and no identifier. It never leaves your device. You can delete it under “Ihre Fundstücke” with “Zurücksetzen”.

Reach measurement (Plausible Analytics)

To understand how people find and use this site, I use the open-source software Plausible Analytics. I run it myself on my own server at Hetzner Online GmbH in Germany (stats.tristankennedy.art); it is not a cloud analytics service. Plausible sets no cookies and stores nothing on your device; there is no cross-site tracking and no use for advertising. That is also why there is no cookie banner here.

Only aggregated statistics are recorded: visited pages, referrer source and campaign parameters, country and region, device class and browser, and time on page and scroll depth. I also count individual interactions, such as clicks on “Book an intro call” or on links to other websites, opening the contact form, starting the short film, using the deadline calculator and successfully sending an enquiry – without their content.

No personal profiles are created. The IP address and browser identifier (user agent) are used only briefly to derive a daily-rotating anonymised identifier and are not stored. Only the page path and campaign parameters (utm_*, ref, source) are sent; every other part of the address is removed first. No names, email addresses or message contents are recorded.

The script and the measurements pass through this website’s own domain, and therefore through Cloudflare (see “Hosting and access data”), and are forwarded from there directly to my Plausible server. Data is not shared with third parties. The legal basis is my legitimate interest in privacy-friendly reach measurement (Art. 6 (1) (f) GDPR).

Contact form and email

If you write to me via the form, I process your details (name, email address, optionally business, topic, budget range and message) to answer your enquiry (Art. 6 (1) (b) GDPR). The message is delivered via the email service Resend (Resend, Inc., USA) to my Google mailbox (Google Ireland Ltd.). Both providers are certified under the EU-US Data Privacy Framework.

To protect against automated submissions, the form uses Cloudflare Turnstile. Your IP address is sent to Cloudflare to verify that the request comes from a human (Art. 6 (1) (f) GDPR). No cookies are set.

If sending is temporarily unavailable, your own email app opens with your message instead. The same applies if you email me directly.

I delete enquiries once they are dealt with, unless statutory retention obligations apply.

Letters to practices and businesses

I occasionally introduce my services by letter, mainly to physiotherapy, occupational therapy and speech therapy practices. For this I process the owner’s name, the business name and address, and public details from its website, such as opening hours and services. The details come from publicly available sources, mainly the business’s website and business directories.

The legal basis is my legitimate interest in direct marketing (Art. 6 (1) (f) GDPR, Recital 47). I keep the details until it is clear there is no interest, at most six months after the last contact.

Some letters include a personal demo of my AI front desk for practices, which I set up with these public details. How the demo is made, where it runs, what it keeps and when it is deleted is described in its own privacy notice, on the demo’s page.

You can object to the use of your details for advertising at any time (Art. 21 (2) GDPR). A short message to hello@tristankennedy.de is enough. So that I don’t write to you again, I then keep only a do-not-contact note.

Booking with Cal.com

The Cal.com calendar (Cal.com, Inc., USA) is loaded only when you choose “Load calendar & choose a time”. This gives your consent to the connection (Art. 6 (1) (a) GDPR). Cal.com receives technical access data such as your IP address and browser information. If you book, Cal.com also processes the details you enter there and your chosen appointment to carry out the booking (Art. 6 (1) (b) GDPR). Data may be processed in the USA. Further details are available in Cal.com’s privacy policy: https://cal.com/privacy.

You can close the contact window at any time to end the embedded connection. This does not affect processing that has already taken place. Alternatively, you can open Cal.com in a new tab or write to me via the contact form or email without loading the calendar.

Links to other websites

This site links to projects I have built, and to Cal.com (Cal.com, Inc., USA) for booking a call. When you follow such a link, you leave this website and the privacy policy of that site applies.

Your rights

You have the right to access, rectification, erasure and restriction of processing of your data, to data portability and to object to processing (Art. 15–21 GDPR). Just send me an email.

You can also lodge a complaint with a data protection authority, for example the Berlin Commissioner for Data Protection and Freedom of Information.