Privacy Policy

Last updated: 8 August 2026

1. Controller

Andreas Schevzik, trading as Ivy Cross
Tulpenstraße 20
92706 Luhe-Wildenau
Germany
Email: [email protected]

2. Website access and server logs

When you visit this website, technical information may be processed to deliver and secure the site. This may include your IP address, date and time of access, requested URL, referring page, browser, operating system, device information, and response status.

The legal basis is Article 6(1)(f) GDPR. The legitimate interests are reliable website delivery, security, error diagnosis, and protection against abuse. Logs are retained only for as long as needed for those purposes or legal obligations.

3. Hosting and delivery network

Hostinger

The website is hosted through Hostinger. Hostinger processes website and server data on our behalf to provide hosting, storage, security, and technical operation. Depending on the contracted service, data may be processed by Hostinger group companies and service providers in and outside the EEA. Hostinger describes its processing and safeguards in its privacy policy.

Cloudflare

Cloudflare is used for DNS, content delivery, performance, and protection against malicious traffic. Requests to this website therefore pass through Cloudflare systems. Cloudflare may process IP addresses, request metadata, security signals, and necessary cookies. Processing is based on Article 6(1)(f) GDPR and our legitimate interests in secure and reliable delivery. Information about Cloudflare's processing and international-transfer safeguards is available in its privacy policy.

4. Reader list and free story

If you request Before Nightspell or join the Ivy Cross reader list, we process your email address and, if you provide it, your name. We may also process the signup source, consent and confirmation timestamps, IP address used for signup or confirmation, delivery status, bounces, link clicks, and unsubscribe activity.

The legal basis for sending the free story, book news, and release updates is your consent under Article 6(1)(a) GDPR. We use double opt-in so that the subscription is activated only after confirmation. Consent records may be retained to demonstrate that consent was obtained.

You can withdraw your consent at any time by using the unsubscribe link in any email or contacting us. Withdrawal does not affect processing carried out before withdrawal. Limited suppression data may be retained so that your opt-out continues to be respected.

MailerLite

We use MailerLite to provide signup forms, manage the subscriber list, send automated and campaign emails, and record delivery and engagement events. For customers in the EEA, the service is provided by MailerLite Limited, 88 Harcourt Street, Dublin 2, D02 DK18, Ireland. MailerLite acts primarily as a processor on our behalf.

MailerLite uses service providers and may process data outside the EEA. Its data-processing terms provide safeguards including adequacy mechanisms and Standard Contractual Clauses where required. See MailerLite's privacy policy and Data Processing Addendum.

MailerLite open tracking is disabled for the launch automation. MailerLite may still record operational delivery events, bounces, unsubscribes, and link clicks. If open tracking or additional analytics is enabled later, this policy and the consent information must be updated first.

Google reCAPTCHA

The signup form uses Google reCAPTCHA to distinguish legitimate submissions from automated abuse. When the form is loaded or used, Google may process technical and interaction data such as your IP address, browser and device information, referring page, and your interaction with the reCAPTCHA service. reCAPTCHA also sets the necessary _GRECAPTCHA cookie for its risk analysis.

This processing is based on Article 6(1)(f) GDPR and our legitimate interest in protecting the reader list and website from spam and abuse. Google may process data outside the EEA using the safeguards described in its terms. See Google's Privacy Policy and Terms of Service.

5. Contact by email

If you contact us, we process the information you provide to answer your message. Depending on the context, the legal basis is Article 6(1)(b) GDPR for pre-contractual or contractual communication or Article 6(1)(f) GDPR for other inquiries. Messages are deleted when they are no longer needed, subject to legal retention obligations.

6. Cookies and similar technologies

The site and its infrastructure may use technologies required for security, network delivery, form operation, and consent handling. No separate advertising or behavioral-analytics service is intentionally used at launch. Optional services that require consent must not be activated before an appropriate consent mechanism and this policy are updated.

7. Recipients and international transfers

Personal data is shared only where necessary with contracted providers, including Hostinger, Cloudflare, MailerLite, and Google for reCAPTCHA, or where required by law. Where data is processed outside the EEA, we rely on an applicable adequacy decision or appropriate safeguards such as the European Commission's Standard Contractual Clauses.

8. Retention

We retain personal data only for as long as required for the stated purpose or applicable legal obligations. Newsletter data is generally retained until you unsubscribe or withdraw consent. Technical logs and correspondence follow the periods required for security, support, and legal retention. Backup copies may persist temporarily until routine deletion cycles complete.

9. Your rights

Subject to the legal requirements, you may request access, rectification, erasure, restriction, data portability, or objection. Where processing relies on consent, you may withdraw it at any time. To exercise these rights, email [email protected].

You may also complain to a data-protection supervisory authority. The authority responsible for private-sector data protection in Bavaria is the Bayerisches Landesamt für Datenschutzaufsicht, Promenade 18, 91522 Ansbach, Germany. Its website is www.lda.bayern.de.

10. Changes

This policy will be updated when the website, newsletter tools, processing purposes, or legal requirements change. The current version is published on this page.