Who is responsible
One Page Love is operated by Some Studio UG (haftungsbeschränkt), Charlottenstraße 1, 10969 Berlin, Germany — the controller for the purposes of the GDPR. Full company details are on our Legal Notice. For anything on this page, email [email protected].
Browsing the site
Server logs. Our host records the usual technical request data, including IP address, browser user agent and the page requested. This is used to keep the site running and to defend it against abuse, on the basis of our legitimate interest (Art. 6(1)(f) GDPR). Logs are short-lived and are not used to build a profile of you.
Analytics. We use Plausible Analytics, which is cookieless, sets no identifiers, and collects no personal data. There is nothing here to opt out of because nothing about you is stored.
Content delivery. Cloudflare serves the site and its images. As a network provider it necessarily processes your IP address in order to route and protect the request.
Search. Searches run on our own infrastructure. Queries are logged in aggregate to improve results; we do not attach them to you.
The newsletter
If you subscribe to the Love Letter, your email address is stored and sent by Kit (formerly ConvertKit), based in the United States. We use it only to send the newsletter, on the basis of your consent (Art. 6(1)(a) GDPR). Every edition carries a one-click unsubscribe link, and unsubscribing takes effect immediately. Kit records whether emails were opened or clicked so we can tell whether an edition worked.
Submitting a website
Submitting a site sends us the URL along with the name and email address you provide. We use these to review the submission and to contact you about it — that is, to take steps at your request (Art. 6(1)(b) GDPR). Submission alerts are relayed into our internal Slack workspace, and any email we send you in reply goes out through Resend. If your site is published, the public listing shows the information you asked us to publish, not your email address.
API and MCP access
Requesting an API or MCP key stores your email address, the key itself, and a log of the requests made with it. This is needed to provide the service and to enforce rate limits (Art. 6(1)(b) and (f) GDPR). Ask us and we will revoke a key and delete the record.
Payments
Paid products — template licences and author subscriptions — are processed by Lemon Squeezy. Your card details go directly to the payment provider and never reach our servers; we receive only what we need to fulfil the purchase and to meet our accounting obligations (Art. 6(1)(b) and (c) GDPR). Where we send you to a checkout from a submission, your name and email address are passed along so the form arrives pre-filled.
We are moving payments to Stripe. This page will name Stripe once that switch is live.
Transfers outside the EU
Kit, Lemon Squeezy and Stripe are based in the United States. Those transfers rely on the European Commission's Standard Contractual Clauses and, where applicable, the EU–US Data Privacy Framework.
What we don't do
We do not sell, rent or trade your data. We run no advertising cookies and no cross-site tracking. We do not build advertising profiles.
Your rights
Under the GDPR you may request access to your data, correct it, have it deleted, restrict or object to its processing, and receive a copy in a portable format. Where processing rests on consent you can withdraw that consent at any time, without affecting what was done beforehand. Email [email protected] and we will respond within one month.
You also have the right to complain to a supervisory authority. Ours is the Berliner Beauftragte für Datenschutz und Informationsfreiheit.
How long we keep things
Newsletter subscriptions are kept until you unsubscribe. Submission records are kept for as long as the entry is published, since they are the provenance of a public listing. API records are kept while the key is active. Payment records are kept for as long as tax law requires.
Changes
If this policy changes materially we will say so here. Last updated August 2026.