Privacy Policy

Last updated: 1 November 2026

This English translation is provided for convenience only. Only the German version is legally binding.

The protection of your personal data is important to us. This policy informs you about which data we process when you use chi-me.eu, the library, the memberships, the gift function, the newsletter and our social media channels, and what rights you have.

1. Controller
2. Summary
3. Hosting and server log files
4. Customer account and sign-in
5. Library, web book and downloads · Visitor statistics
6. Buying and paying for a membership
7. Giving a membership as a gift
8. Newsletter
9. Contact by email
10. Social media
11. Storage on your device, no cookies
12. Children
13. Recipients and transfers to third countries
14. Storage period
15. Your rights
16. Right to lodge a complaint
17. Changes

1. Controller

Represented by: Gerald F. Schwaiger, MAS MBA, Managing Director
Email: info@chi-me.eu

We have not appointed a data protection officer because we are not obliged to do so.

2. Summary

• We use no third-party analytics or advertising services (no Google Analytics, no Meta pixel) and set no cookies. For simple visitor statistics we count page views ourselves, without cookies and without IP addresses (section 5a).
• Fonts, images, audio and videos come from our own server. No third-party content is loaded unless you click on an external link yourself.
• For the customer account we use Supabase (servers in Frankfurt am Main), for payment Stripe or Link, for the newsletter Hostinger Reach.
• Links from our social media channels may contain a campaign suffix (e.g. ?utm_source=pinterest). From this we only see which channel visitors come from; no profile of you is created.

3. Hosting and server log files

The website and our email inboxes are operated by Hostinger International Ltd., 61 Lordou Vironos Street, 6023 Larnaca, Cyprus. A data processing agreement pursuant to Art. 28 GDPR is in place with Hostinger. Delivery may take place via Hostinger's content delivery network.

When you visit the website, the server automatically processes technical data transmitted by your browser (server log files): IP address, date and time, page or file accessed including URL parameters, amount of data transferred, status code, browser type and operating system, and the previously visited page (referrer), if your browser transmits it.

The processing is necessary to deliver the website, ensure its stability and security and prevent misuse. The legal basis is Art. 6 (1) (f) GDPR (legitimate interest). The log files are not combined with other data, are only stored for as long as necessary for these purposes and are then automatically deleted by the host.

4. Customer account and sign-in

You can sign in with your email address for the library and the memberships. We send you a sign-in link by email for this (no password). We process:

• email address, an internal identifier, time of registration and of the most recent sign-ins, and the IP address at sign-in (security log);
• your membership level (Happy, Kira or CHI-ME's World), its validity and the customer number at the payment service, so that we can assign a payment to your account;
• for a subscription: the place of residence you select before purchase and the country of your billing address. This determines how an annual membership renews after the first year (see terms, section 5). For this purpose we also transmit the place of residence to Stripe.

The technical service provider is Supabase Inc., 970 Toa Payoh North #07-04, Singapore 318992. Database, sign-in and file storage run in a data centre in Frankfurt am Main (Germany). A data processing agreement pursuant to Art. 28 GDPR is in place with Supabase; EU standard contractual clauses have been agreed for possible access from third countries. We send the sign-in emails via our own mailbox noreply@chi-me.eu at Hostinger.

The legal basis is Art. 6 (1) (b) GDPR (contract or pre-contractual measures, also for the free account). We process the IP address in the security log on the basis of Art. 6 (1) (f) GDPR to prevent misuse.

You can have your account deleted at any time by email to info@chi-me.eu. Please cancel any ongoing subscription in the customer portal beforehand.

5. Library, web book and downloads

When you open a book, our server checks your membership level and provides the book pages, audio and downloads (PDF, audiobook, colouring pages) via time-limited links from protected storage at Supabase. The data mentioned in sections 3 and 4 is processed. We do not analyse which books or pages you read. The legal basis is Art. 6 (1) (b) GDPR.

The audiobook and the read-aloud function use pre-generated audio files. The reading voices and the illustrations are created with the help of AI (see imprint). Your data is not transmitted to AI services for this.

5a. Visitor statistics without cookies

To understand which pages are used and which channels visitors come from, we count page views with our own small counter. When a page is called up, your browser sends the following to our database at Supabase (Frankfurt, see section 4): the page accessed, where applicable an event (e.g. “sample book opened”, “newsletter link clicked”, “payment page opened”), the name of the website you came from (hostname only, e.g. instagram.com), campaign parameters in the link (utm_…), the page language and whether the device is “mobile” or “desktop”.

We store no IP address, no browser identifier, no cookies and nothing in your browser. The entries cannot be attributed to any person and are not linked to account or purchase data. If your browser sends “Do Not Track” or “Global Privacy Control”, nothing is counted. The legal basis is Art. 6 (1) (f) GDPR (legitimate interest in data-minimising audience measurement). We delete the entries after 13 months.

6. Buying and paying for a membership

For purchases we use Stripe Managed Payments. When you click “Buy”, you are forwarded to a Stripe payment page. The seller and payee (“Merchant of Record”) is Link, a company of the Stripe group; the purchase appears as “Sold through Link”. Link or Stripe (for customers in the EEA: Stripe Technology Europe Ltd., 1 Grand Canal Street Lower, Dublin 2, Ireland) handles payment, taxes, invoices, refunds and payment support and processes your payment data for this under its own responsibility. The privacy notices of Link and Stripe apply.

We do not receive your card or account details. From Stripe we receive: email address, name and country (if provided), plan purchased, amount, payment status, term and cancellation status, and a customer and transaction number. If you have redeemed a promotional code, we also see which code and which discount was used. We use this to activate your membership, apply the correct renewal rule, answer questions and fulfil our statutory accounting obligations. The legal bases are Art. 6 (1) (b) GDPR (contract) and Art. 6 (1) (c) GDPR (statutory retention obligations).

Stripe and Link may also process data in the USA. Stripe is certified under the EU-US Data Privacy Framework and additionally uses EU standard contractual clauses.

7. Giving a membership as a gift

If you give a membership as a gift, in addition to the payment data (section 6) we process the recipient's email address, the desired start date, the name you give as sender and your message. The recipient later signs in with exactly this email address; only then is the membership used. We do not send the recipient any email ourselves. Please only pass on the address if you can assume that the person agrees.

The legal basis is Art. 6 (1) (b) GDPR (contract with you) and, with regard to the recipient, Art. 6 (1) (f) GDPR (legitimate interest in being able to assign the gift). We delete the message and sender name no later than three months after the end of the gifted term.

8. Newsletter

We offer our newsletter (news about CHI-ME, new stories, freebies such as the free colouring book) via Hostinger Reach, a service of Hostinger International Ltd. (address see section 3). The form is not embedded on our website: only when you click the newsletter link does the sign-up form open on a Hostinger page. There you enter your email address (and optionally your first name).

We use the double opt-in procedure: you receive an email in which you confirm the sign-up. We store the time of sign-up and confirmation as well as the IP address transmitted, in order to be able to prove consent. After signing up you receive some welcome emails and then the regular newsletter. Hostinger Reach can record whether an email was opened and a link was clicked; we only use this information in aggregated form to improve the newsletter.

The legal basis is your consent (Art. 6 (1) (a) GDPR). You can withdraw it at any time with effect for the future, via the unsubscribe link in every email or by message to info@chi-me.eu. After unsubscribing we delete your address from the mailing list; we keep proof of the earlier consent for up to three years (Art. 6 (1) (f) GDPR).

9. Contact by email

If you write to us by email, we process your email address, your name (if given) and the content of your message in order to answer your enquiry. The legal basis is Art. 6 (1) (b) GDPR if your enquiry relates to a contract, otherwise Art. 6 (1) (f) GDPR. We delete the message as soon as the enquiry has been dealt with and no retention obligations apply.

10. Social media

We are present as “CHI-ME Geschichten” on Instagram and Facebook (Meta Platforms Ireland Ltd., Merrion Road, Dublin 4, Ireland), Pinterest (Pinterest Europe Ltd., Palmerston House, Fenian Street, Dublin 2, Ireland) and YouTube (Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland).

• On our website there are no social media plugins, embedded posts or pixels. The channels are only linked. Only when you click a link do you leave our website; the privacy policy of the respective platform then applies.
• On the platforms the operators process your data under their own responsibility, often also in the USA. If you interact with our posts (e.g. comment, message, “like”), we see your public profile name and your post and process it in order to reply. The legal basis is Art. 6 (1) (f) GDPR (communication with interested parties).
• Statistics: the platforms provide us with aggregated statistics on the reach of our posts (e.g. Page Insights on Facebook and Instagram). We are jointly responsible with Meta for these statistics (Art. 26 GDPR); the agreement and your rights can be found at Meta under “Page Insights Controller Addendum”. You can exercise your rights most effectively directly with the platform; we will forward requests if necessary.
• Scheduling: we schedule posts with Metricool (Metricool Software S.L., Spain). Metricool accesses our accounts and their statistics, not data of visitors to our website.

We target advertisements on the platforms only by general characteristics (e.g. region, interests). We do not upload customer lists and do not use conversion tracking on our website.

11. Storage on your device, no cookies

We do not set cookies. Only when you sign in does the website store a sign-in token in your browser's local storage (localStorage), so that you remain signed in until you sign out. This is strictly necessary for the service you requested (§ 25 (2) no. 2 German TDDDG and Art. 5 (3) of the ePrivacy Directive); consent is not required for this. Signing out or deleting the website data in your browser removes the token.

12. Children

Our stories are intended for children, but the offer is aimed at parents and other adults. Account, purchase and newsletter are reserved for adults. We deliberately do not collect data from children. If you believe that we hold data about your child, please contact us; we will then delete it.

13. Recipients and transfers to third countries

Your data is only received by the service providers named in this policy, insofar as necessary for the respective purpose, and in individual cases by tax advisers, authorities or courts if we are legally obliged to do so. We do not sell data. Insofar as data may reach countries outside the EEA (Supabase, Stripe/Link, social media platforms), this takes place on the basis of an adequacy decision (e.g. EU-US Data Privacy Framework) or EU standard contractual clauses.

14. Storage period

15. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on our legitimate interest (Art. 21). You can withdraw consent given at any time with effect for the future (Art. 7 (3)). An informal message to info@chi-me.eu is sufficient.

Providing your data is neither legally nor contractually required. Without an email address, however, you cannot create an account, buy a membership or receive the newsletter. We do not use automated decision-making within the meaning of Art. 22 GDPR.

16. Right to lodge a complaint

You can lodge a complaint with a data protection supervisory authority. The authority responsible for us is the Commissioner for Personal Data Protection, 15 Kypranoros Street, 1061 Nicosia, Cyprus (dataprotection.gov.cy). You can also contact the supervisory authority at your place of residence.

17. Changes

We adapt this policy when our offer, the services used or the legal situation change. The version published here applies.