Privacy Policy

Typhora Group LLC
Limited Liability Company (LLC), formed in Wyoming, United States
33 N Gould St, Sheridan, WY 82801, United States
Email: hey@typhora.group

Place of management and establishment in Germany: Barbarossaplatz 2, 50674 Cologne, Germany

This website is purely an information and brand presence. Without your consent no cookies are set and no analytics or advertising services are loaded. If you consent to analytics or marketing, Google Analytics and Google Ads are added (section 6). Independently of that, the site stores only two things in your browser: your cookie choice in local storage, so the notice does not reappear on every visit (section 6), and, if you switch it, your light/dark setting in session storage. The light/dark setting applies only to the current visit and is discarded when you close the tab. Both are technically necessary and carry no personal reference. Beyond that, personal data is processed only to the extent technically necessary (see server log files) or when you actively get in touch.

When the website is accessed, the hosting provider Cloudflare (see hosting) automatically processes data transmitted by your browser:

• IP address
• date and time of access
• requested file / URL and volume of data transferred
• referrer URL (the page visited before)
• browser type and operating system (user agent)

Purpose: technical delivery, stability and security of the website. Legal basis: Art. 6 (1) (f) GDPR (legitimate interest in secure, functioning operation). The controller does not create log files of its own and does not combine this data with other data sources. How long Cloudflare keeps it is set out in Cloudflare's privacy policy.

Cloudflare also asks your browser to report failed connections (Network Error Logging). Only errors, such as a dropped connection, are reported, with address, time and type of error, and only to Cloudflare. Successful requests are not reported.

The website, the contact form and the database for enquiries run at Cloudflare, Inc. (101 Townsend St., San Francisco, CA 94107, USA; Cloudflare Pages and Cloudflare D1). Cloudflare delivers the site through a worldwide network of data centres and processes the data named above on behalf of the controller as a processor (Art. 28 GDPR). Data is thereby transferred to the USA and to other third countries. The transfer is based on the adequacy decision for the EU-US Data Privacy Framework (Art. 45 GDPR) and otherwise on the European Commission's standard contractual clauses (Art. 46 (2) (c) GDPR) in Cloudflare's data processing agreement.

The contact form on the start page transmits your entries (name, email address, message and the selected subject and company) to an endpoint at typhora.group/api/contact. It runs as a function at Cloudflare (see hosting) and is operated by the same controller; no third-party form service is involved.

Your IP address and the time of submission are also processed, solely to prevent abuse (limiting the number of submissions per sender, detecting automated submissions). The message is stored in the database at Cloudflare, which runs and stores its data exclusively in the European Union, and delivered by email to the controller. You also receive an automatic confirmation with a copy of your message at the address you entered. Delivery uses the service provider Resend (operator: PLUS FIVE FIVE, San Francisco, USA) as a processor (Art. 28 GDPR), which processes the email address and dispatch data on the controller's behalf. Data is thereby transferred to the USA; the transfer is based on the adequacy decision for the EU-US Data Privacy Framework (Art. 45 GDPR).

Legal basis: Art. 6 (1) (b) GDPR (pre-contractual communication) and (f) (legitimate interest in responding and in protection against abuse). Retention: until your enquiry has been dealt with conclusively and no retention obligations remain. Providing the data is voluntary; without an email address and a message the enquiry cannot be answered. An informal email to hey@typhora.group works just as well.

This site uses Google Analytics 4 (measurement ID G-JYS9K0RKYV) and, building on it, Google Ads including remarketing, both only to the extent you have consented in the cookie banner, where “Analytics” and “Marketing” can be agreed to separately.

With consent to analytics, cookies (including _ga) are stored on and read from your device and usage data is processed: pages viewed, time spent, click paths, origin (referrer, campaign parameters), approximate location derived from the IP address, device, operating system, browser and page language.

With consent to marketing, the following is added: Google Signals (cross-device analysis for users signed in to Google who have personalised advertising enabled), the building of remarketing audiences, measurement of ad conversions, and the transmission of advertising identifiers to Google. Without this consent, advertising identifiers are technically suppressed (ads data redaction).

Without your consent the Google script is not loaded at all: no request goes to Google and no cookie is set.

The provider is Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland); data is also transferred to Google LLC in the USA. The transfer is based on the adequacy decision for the EU-US Data Privacy Framework (Art. 45 GDPR), supplemented by standard contractual clauses. Google processes some of the data as a controller in its own right; see Google's privacy policy for details.

Legal basis: your consent under Art. 6 (1) (a) GDPR and § 25 (1) TDDDG. Withdrawal: at any time via the Cookies link in the footer, where the selection can also be changed later; withdrawal takes effect for the future. Retention: the Google cookies expire after 24 months at the latest, the event data in GA4 after a maximum of 14 months; your choice itself is held in your browser's local storage.

If you get in touch by email, the details you provide (e.g. name, email address, content of the message) are processed solely in order to deal with your enquiry. The legal basis is Art. 6 (1) (b) GDPR (pre-contractual/contractual communication) and (f) (legitimate interest in responding). The data is deleted once the enquiry has been dealt with conclusively and no retention obligations remain.

You have the following rights vis-à-vis the controller:

• access (Art. 15 GDPR)
• rectification (Art. 16 GDPR)
• erasure (Art. 17 GDPR)
• restriction of processing (Art. 18 GDPR)
• data portability (Art. 20 GDPR)
• objection to processing (Art. 21 GDPR)

An informal message to hey@typhora.group is enough to exercise them.

Without prejudice to any other remedy, you have the right to lodge a complaint with a data protection supervisory authority, in particular in the EU Member State of your residence, your place of work or the place of the alleged infringement. Because management and the establishment are in Cologne, the competent authority for the controller is the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia (LDI NRW).

November 2026. This privacy policy is updated as required.