Privacy policy
Summary
This privacy policy applies to mindset.film, including when you access the site via www.mindset.film or via a technical address under mindset-film.pages.dev. Mindset Studio is a project of Typhora Group LLC.
We do not embed any advertising or analytics tools from third parties and do not set any cookies. We measure our audience ourselves on the server, without accessing your device (see Server-side audience measurement). Statistics in the browser only run if you allow them in the banner (see Statistics in the browser). Otherwise your browser's storage only holds the cart, the delivery country and your choice in the banner. In the shop on mindset.film you can buy pieces by Mindset Studio; there are no customer accounts. We only process personal data to the extent necessary to deliver the site, measure our audience, run the statistics if you allow them, handle orders, withdrawals and reviews, operate the contact form, send the newsletter if you sign up for it, and answer emails.
Controller
The controller responsible for the processing of personal data on this site is Typhora Group LLC, 33 N Gould St, Sheridan, WY 82801, USA, with its place of management and establishment in Germany at Barbarossaplatz 2, 50674 Cologne, Germany. Email: hey@mindset.film.
You can reach us at this email address with any questions about data protection. We have not appointed a data protection officer.
Hosting and accessing the site
mindset.film is delivered via Cloudflare Pages, a service of Cloudflare, Inc., USA. The domain's name resolution (DNS), our server functions for the contact form, the withdrawal function, the videos and the audience measurement, our shop service (see Orders in the shop) and our analysis service (see Server-side audience measurement) also run on Cloudflare. Videos, preview images and photos are likewise stored with Cloudflare (the videos in its storage service R2, located in Western Europe) and are delivered via mindset.film. Each request is usually handled by the Cloudflare data centre closest to you. This may be outside the EU, for example when you travel.
With every request, Cloudflare processes the data that your browser sends for technical reasons: IP address, date and time, the requested address including all appended parameters, the type of request, the previously visited page (referrer), browser and operating system (user agent), language setting, cookies sent, the country and network derived from the IP address, and technical data of the encrypted connection.
The purpose is to deliver the site and to protect it against attacks and misuse. The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest lies in providing the site securely and reliably.
Cloudflare processes this data on our behalf (Art. 28 GDPR). We do not have Cloudflare forward any logs to us; what we record ourselves is described under Server-side audience measurement. In our Cloudflare account we see aggregated traffic statistics and, if a protection feature blocks a request, that event including the IP address. Cloudflare displays both only for a limited period that depends on the plan. How long Cloudflare stores access data beyond that for the operation and security of its network is determined by Cloudflare (see next paragraph).
In addition, Cloudflare, acting as an independent controller, derives network data from the traffic, such as error rates and risk scores of IP addresses, in order to protect its network against attacks. Details can be found in Cloudflare's privacy policy: https://www.cloudflare.com/privacypolicy/
The technical address mindset-film.pages.dev redirects to mindset.film. Even with this request, as on all addresses under mindset-film.pages.dev, Cloudflare may give your browser a Network Error Logging (NEL) instruction that we cannot switch off there. Your browser remembers it for up to seven days. Only if a connection to that address fails during this time does it send Cloudflare an error report to a.nel.cloudflare.com: the requested address, the previously visited page, the type of error, the time and the server's IP address. Cloudflare also sees your IP address in the process. Cloudflare is itself responsible for these reports. On mindset.film itself, NEL is switched off.
Server-side audience measurement
So that we know how many people visit mindset.film, where they come from and whether bots or attacks are among them, our server function at Cloudflare records every request for a page, including failed ones. We do not count requests to our interfaces here, for example when you send the contact form, sign up for the newsletter, withdraw from a purchase or use the checkout. We do not access your device for the measurement, do not set a cookie and do not store anything in your browser.
We store the IP address, the time, the requested address without appended parameters, the status code of the response, browser and operating system (user agent), the previously visited page (referrer; for our own pages without appended parameters, for other websites only their address without the path) and the country and network (network operator) derived from the IP address. If your browser sends the Global Privacy Control signal, we do not store your IP address in the process. We do not count files that load successfully, such as images, fonts and scripts, but we do count errors when loading them.
The purpose is to know the reach of the site and where visitors come from (for example Instagram or search engines), to detect bots, errors and attacks and, on that basis, to decide where we advertise Mindset Studio. We only use the full IP address to detect bots and attacks; we analyse reach and origin only with a shortened IP address or without it. We do not combine this data with data from other sources. The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest lies in exactly these purposes. You can object to the measurement at any time (see Right to object), for example by writing to hey@mindset.film or, for future requests, via Global Privacy Control in your browser.
The entries remain in our database at Cloudflare (D1, located in the EU) for at most three days. From there our analysis service, a service of Typhora Group LLC that also runs on Cloudflare, collects them. There, individual requests with the full IP address are kept for at most seven days. After that we shorten the IP address (for IPv4 the last block is removed, for IPv6 only the first three blocks remain), and after 60 days only hourly totals without IP addresses remain. Cloudflare processes the data on our behalf (see Recipients at a glance).
Cookies and browser storage
We do not set any cookies. In the shop, the site keeps your cart in your browser's storage (localStorage), that is which pieces in which version and quantity, and the delivery country you chose for the prices. That way both are still there the next time you load a page. This information stays in your browser; it only reaches us when you request the prices for a delivery country (then only the country) or go to checkout.
The site also remembers your choice in the statistics banner (ms-einwilligung: whether you allowed the statistics and when), so that we do not ask again on every page. After twelve months we ask again.
If you choose a language yourself (via the language suggestion or the language menu) or a currency for the approximate conversion of prices, the site remembers this choice (mindset-sprache, mindset-waehrung) so that it applies on your next visit. Without your choice it stores nothing for this. Our server fetches the exchange rates from the European Central Bank. For this, your browser only contacts mindset.film; the central bank learns nothing about you. Together with the rates, our server tells your browser the country that Cloudflare derives from your IP address. The site uses it only to decide whether it may show prices first in the currency you chose or first in the currency you are billed in. We store nothing in the process. Your browser reuses the response for at most one hour and then fetches it again; clearing the site data in your browser removes it.
All of this is strictly necessary, for the cart that you fill yourself, to respect your choice and to show language and currency the way you chose them (Section 25(2) no. 2 TDDDG); no consent is required for this. You can delete the information at any time by emptying the cart or clearing the site data in your browser. Identifiers are only added if you allow the statistics (see Statistics in the browser).
Until 18 October 2026 the site was password-protected. Anyone who received the access cookie ms_gate back then gets an instruction to delete it on their next visit. After that it is gone.
If Cloudflare classifies a request as suspicious, it may display a security check and set its own technically necessary cookie (cf_clearance) for this purpose, which is valid for 30 minutes. This does not happen in normal operation.
This cookie is strictly necessary to protect the site against attacks and misuse (Section 25(2) no. 2 TDDDG). No consent is required for it.
Statistics in the browser (only with consent)
If you allow the statistics in the banner, the site additionally records how it is used. For this purpose it stores a random visitor identifier in your browser (ms-besucher, localStorage, for at most twelve months, never longer than your consent) and a session identifier (ms-sitzung, sessionStorage, until you close the tab). If you start a purchase, it also remembers the amount until the thank-you page (ms-kauf, sessionStorage). The identifiers let us group requests pseudonymously. We do not combine them with orders, enquiries or newsletter sign-ups.
We record which pages you visit, which website you come from (only its address, without the path) and with which campaign details (utm parameters), the language of the page and the rounded window width, how long you stay on a page and how far you scroll, which products and versions you look at, what you add to or remove from the cart, when you open the cart and go to checkout (number of items, total, currency, delivery country), whether a purchase was completed (total and currency, without the order number), which films you start and how much of them you watch, whether you sign up for the newsletter or send the contact form (without what you entered) which links to other websites and email addresses and which individual marked paths within the site (for example from the shop section of the home page to the shop) you click, and that and when you agreed to the statistics. We also store the time, the country derived from the IP address and the browser and operating system (user agent). We do not store the IP address itself for the statistics.
The purpose is to understand what resonates on mindset.film, where visitors drop off and how we can improve the site and the shop. We analyse the data ourselves, without third-party analytics services. The legal basis is your consent: Section 25(1) TDDDG for storing and reading the identifiers in your browser, and Art. 6(1)(a) GDPR for the further processing.
The events remain in our database at Cloudflare (D1, located in the EU) for at most three days and then in our analysis service at Cloudflare (see Server-side audience measurement). There we delete them after 13 months.
You can withdraw your consent at any time with effect for the future via the “Privacy settings” link at the bottom of every page. The site then immediately deletes the identifiers from your browser and stops sending anything. Without consent the statistics do not run, and the site works just the same.
Contact form
If you write to us via the contact form, we process your name, your email address, your message and the language of the page you are writing from. This is accompanied by the technical data of the request that arises with every request (see Hosting and accessing the site). The purpose is to answer your enquiry.
Your browser sends this information to our server function on Cloudflare. The message is not stored on the site or in any database. The server function sends it as an email via the delivery service Resend to our mailbox hey@mindset.film at checkdomain and enters your email address as the reply address so that we can reply to you directly. It also sends you a short confirmation of receipt via Resend to the address you entered. This confirmation contains nothing of what you typed, only the note that your message has arrived.
So that nobody can misuse the form at scale, we limit how often messages can be sent from one IP address and how many confirmations go to one address. For this, we store in our database at Cloudflare (D1, located in the EU) for each message only a non-reversible short value of your IP address (for IPv6, of the address range, that is the first four blocks) and, if a confirmation is sent, of your email address, each with a timestamp. Without our secret key, neither the IP address nor the email address can be read from it. After 24 hours we no longer use these short values, and they are deleted automatically, usually within one further hour. The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest is to protect the form and other people's mailboxes against misuse.
Resend is a service of Plus Five Five, Inc., San Francisco, USA, and processes the message on our behalf (Art. 28 GDPR). According to Resend, the sent message remains viewable in our Resend account for 30 days. For the transfer to the USA, see Transfers to third countries.
The legal basis is Art. 6(1)(b) GDPR if your enquiry concerns a contract or steps prior to entering into a contract, otherwise Art. 6(1)(f) GDPR. Our legitimate interest is to receive and answer your message.
In the mailbox, the same applies to the message as to an email sent to us, including the spam and virus filter and the retention period: we keep it for as long as we need it to deal with your enquiry and then delete it unless statutory retention obligations apply (see Contact by email).
Contact by email
If you write to us at hey@mindset.film, we store your email in our mailbox at checkdomain GmbH, Große Burgstraße 27/29, 23552 Lübeck, Germany. In doing so, we process your email address, your name if you provide it, the content of your message including attachments, the time and the technical header data of the email in order to answer your enquiry.
Before an email reaches the mailbox, checkdomain's spam and virus filter (secure-mailgate) automatically checks it for malware and unsolicited advertising.
checkdomain GmbH processes this data on our behalf (Art. 28 GDPR). The mailbox and the spam and virus filter run on servers in Germany.
The legal basis is Art. 6(1)(b) GDPR if your enquiry concerns a contract or steps prior to entering into a contract, otherwise Art. 6(1)(f) GDPR. Our legitimate interest is to receive and answer your message and to protect our mailbox against malware and unsolicited advertising.
We keep your message for as long as we need it to deal with your enquiry. We then delete it unless statutory retention obligations apply.
Orders in the shop
If you order in the shop, we process the data we need for the purchase contract: name, delivery address and, where applicable, billing address, email address, phone number if you provide it, the goods ordered, prices, taxes, shipping costs, payment status and the language of the order. The purpose is to accept the order, have it paid for, produced and delivered, and send you the order confirmation with the contract text. The legal basis is Art. 6(1)(b) GDPR. There are no customer accounts; you order as a guest.
We operate our shop service ourselves, on Cloudflare. It stores the orders and sends the order emails via Resend.
Payment is processed by Stripe (Stripe, Inc., USA, and its affiliates). You enter your card and account details directly with Stripe: on the checkout page your browser loads Stripe's payment form from js.stripe.com for this, and Stripe also collects device and usage data in the process to prevent fraud. The payment details never reach us; we only receive the payment status, the payment method and the details needed for refunds. Stripe is itself responsible for processing the payment, preventing fraud and its own legal obligations. Details can be found in Stripe's privacy policy: https://stripe.com/privacy
Below the wallpapers you can give us €1 voluntarily. Only when you tap “Donate €1” there does your browser load Stripe's payment form from js.stripe.com; payment is handled by Stripe as described above, with Apple Pay, Google Pay or card. Our shop service only creates the payment at Stripe, with the amount and the name of the wallpaper; it stores nothing for this, not even an email address. So that nobody triggers it at scale, it briefly counts in memory how often an IP address tries, and forgets this after one hour at most. The legal basis is Art. 6(1)(b) GDPR, because you trigger the payment yourself, and Art. 6(1)(f) GDPR for the limit (protection against misuse).
Production and shipping are handled by Printful (Printful, Inc., USA), on our behalf (Art. 28 GDPR). For this, Printful receives your name, delivery address, the goods ordered and, where needed for delivery, your email address or phone number. Your order is produced at a site that can make the goods and deliver them to you; your name and delivery address go from there to the carrier.
We keep order and invoice data for as long as commercial and tax retention obligations apply, up to ten years (Section 147 German Fiscal Code, Section 257 German Commercial Code). The legal basis for this is Art. 6(1)(c) GDPR. We then delete it.
Reviews
A few days after your order we ask you once by email to review the pieces you bought. For this, our shop service passes your email address, your first name, the order number, the pieces bought and a verification key to the server function on mindset.film, which sends the email via Resend. In our database at Cloudflare (D1, located in the EU) we only store the order number and the time, so that each order gets only one request. We delete this entry after one year.
The legal basis for the request is Art. 6(1)(f) GDPR in conjunction with Section 7(3) of the German Act against Unfair Competition (UWG). Our legitimate interest is to learn how you like the pieces and to show others real experiences with them. You can object to this use of your email address at any time, via the link in the request or by writing to hey@mindset.film, without incurring any costs other than the transmission costs at the basic rates. Via the link we do not store your address, only its check value (SHA-256 hash). We compare it before every request so that we do not ask you again. We keep the check value for as long as we send review requests.
If you write a review, our shop service uses the verification key from the link to check that you bought and paid for the piece from us. We store in our database the stars, title and text, the name you give for it, the language, the order number, the piece reviewed and the time, but no email address. Via Resend we receive the review for checking at hey@mindset.film.
Once we approve it, the stars, title, text, the name you gave and the date appear publicly on the product page, marked “Verified purchase”. So only give a name that may appear publicly, such as your first name; without a name it says “Customer”. The legal basis for publication is the consent you give when submitting (Art. 6(1)(a) GDPR). You can withdraw it at any time by writing to hey@mindset.film. We then take the review off the page and delete it. Otherwise it stays stored for as long as it is on the page. We delete rejected reviews 30 days after the decision.
Withdrawal function
If you withdraw from a purchase using the withdrawal function on mindset.film, we store in our database at Cloudflare (D1, located in the EU) your email address, the details you provide voluntarily (order number, order date, name), the language, the wording of the statement, the date and time of receipt and when we sent you the confirmation. Via Resend we send you the confirmation of receipt required by law and send us a notification to hey@mindset.film.
To prevent the function from being misused to flood other people's mailboxes with confirmations, we limit the number of confirmations per IP address. The same applies as for the contact form: only a non-reversible short value, deleted after 24 hours. We accept your withdrawal itself in any case.
The legal basis is Art. 6(1)(c) GDPR in conjunction with Section 356a German Civil Code and Art. 6(1)(b) GDPR. We keep the withdrawal for as long as claims can be asserted from it, usually three years from the end of the year in which it was received, and longer if it relates to a refund that must be kept for tax purposes.
Recipients at a glance
We do not sell data and do not pass it on for advertising purposes. Only the following service providers receive data, on our behalf (Art. 28 GDPR) and only to the extent the respective function requires:
- Cloudflare, Inc., USA: delivery of the site including videos, preview images and photos, storage for the videos (R2), DNS, the server functions of the contact form and the withdrawal function, the database (D1) for withdrawals, the newsletter, reviews, rate limiting, the audience measurement and the statistics, and the operation of our shop service and our analysis service.
- Plus Five Five, Inc. (Resend), USA: delivery of messages from the contact form to our mailbox, of confirmations of receipt, of the newsletter emails, of review requests and of the emails about your order and your withdrawal.
- Stripe, Inc., USA, and its affiliates: processing of the payment, partly as an independent controller (see Orders in the shop).
- Printful, Inc., USA, with its production sites: production and shipping of your order; the carriers receive your name and delivery address from there.
- checkdomain GmbH, Lübeck, Germany: our mailbox hey@mindset.film including the spam and virus filter.
Cloudflare additionally processes part of the access data as an independent controller (see Hosting and accessing the site).
Transfers to third countries
We process your data in the context of the activities of our establishment in Germany. The GDPR therefore applies to us directly (Art. 3(1) GDPR). Our mailbox at checkdomain is located in Germany; we do not use any service provider in a third country for it.
For the site, the audience measurement, the statistics, the contact form, the newsletter, reviews and the withdrawal function, the only recipients to whom we transfer data in a third country are Cloudflare and Resend. Cloudflare, Inc. and Plus Five Five, Inc., the operator of Resend, are based in the USA and are both certified under the EU-US Data Privacy Framework. We therefore rely on the European Commission's adequacy decision (Art. 45 GDPR). For Cloudflare data centres outside the USA and the EU, the European Commission's standard contractual clauses also apply. They form part of our data processing agreement with Cloudflare (Art. 46(2)(c) GDPR). Our data processing agreement with Resend also contains the standard contractual clauses.
If you order in the shop, we also transfer the necessary data to Stripe and Printful in the USA and to the production site that makes your order; it may be located outside the EU. Stripe is certified under the EU-US Data Privacy Framework (listed as Stripe, LLC); for Stripe we rely on the European Commission's adequacy decision (Art. 45 GDPR). Printful is not certified; for Printful and the production sites outside the EU, the European Commission's standard contractual clauses in Printful's data processing agreement apply (Art. 46(2)(c) GDPR). Where data is needed for delivery to a country outside the EU, the transfer is necessary for the performance of the contract with you (Art. 49(1)(b) GDPR).
You can get a copy of the standard contractual clauses by writing to hey@mindset.film. You can find the entries of Cloudflare and Resend under the Data Privacy Framework in the list at https://www.dataprivacyframework.gov/list.
Your rights
You have the right of access (Art. 15 GDPR), to rectification (Art. 16 GDPR), to erasure (Art. 17 GDPR), to restriction of processing (Art. 18 GDPR) and to data portability (Art. 20 GDPR). To exercise these rights, write to hey@mindset.film.
You can withdraw any consent at any time with effect for the future (Art. 7(3) GDPR): the newsletter via the unsubscribe link in every email, the statistics via “Privacy settings” at the bottom of every page, and both by writing to hey@mindset.film. Processing carried out before the withdrawal remains lawful.
Right to object
Where we process data on the basis of Art. 6(1)(f) GDPR (legitimate interests), you can object at any time on grounds relating to your particular situation (Art. 21 GDPR). We will then no longer process the data unless we demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims. To object, write to hey@mindset.film.
Right to lodge a complaint
You have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is the Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW, the data protection authority of North Rhine-Westphalia), Kavalleriestraße 2-4, 40213 Düsseldorf, Germany, https://www.ldi.nrw.de.
You can, however, also contact any other supervisory authority, in particular in the EU or European Economic Area country where you live or work or where the alleged infringement took place.
No obligation to provide data, no automated decisions
You are under no statutory or contractual obligation to provide us with personal data. Without the technical access data, however, we cannot deliver the site to you, and without your email address we cannot reply to you.
Automated decisions within the meaning of Art. 22 GDPR, including profiling, do not take place.
Changes
We update this privacy policy when the site, our service providers or the legal situation change.
Last updated: November 2026