Legal

Privacy Policy

This policy explains what personal data is processed when you visit mirunavasi.com, use the contact form, subscribe to the newsletter or buy a guide — on what legal basis, who receives it, how long it is kept, and the rights you have under the General Data Protection Regulation (GDPR).

1. Controller

The controller responsible for data processing on this website is:

Miruna Pangerl (“Miruna Vasi”)
Lenaustr. 1
81383 Munich, Germany
Email: hello@mirunavasi.com

2. When you visit this website (hosting and server logs)

This website is hosted by Vercel Inc., 340 S Lemon Ave #4133, Walnut, CA 91789, USA. When you open a page, your browser transmits technical data that Vercel processes in server log files to deliver the site and keep it stable and secure: your IP address, the browser type and version, the operating system, the referring URL, the requested page and the date and time of the request. Legal basis: Art. 6 (1) (f) GDPR — our legitimate interest in the secure and reliable operation of the website. A data-processing agreement pursuant to Art. 28 GDPR applies. Because Vercel is based in the USA, see section 10 on international transfers.

3. Web fonts

The fonts “Cormorant Garamond” and “Jost” are hosted on our own server and delivered directly from this website. No connection to Google or any other third party is made to load fonts, and no data is transmitted to such a provider for this purpose.

4. Web analytics (cookieless)

We use Vercel Web Analytics to understand, in aggregate, how the website is used (for example which pages are viewed and roughly where visitors come from). This service works without cookies and without storing information on your device; it does not create cross-site profiles and does not store your IP address. Legal basis: Art. 6 (1) (f) GDPR — our legitimate interest in measuring and improving the site. Because no information is stored on or read from your device, no consent under § 25 TDDDG is required.

5. Contact and collaboration inquiries

When you send an inquiry through the contact or “Work With Me” form, we process the data you enter — your name, and optionally your company, email address, website or Instagram handle, the type of collaboration and your message — solely to receive and respond to your inquiry. This data is stored in our customer-relationship system (Brevo, see section 9) as a contact and an inquiry record, and a notification and an automatic acknowledgement email are sent. Legal basis: Art. 6 (1) (b) GDPR (steps taken at your request prior to a possible contract) and Art. 6 (1) (f) GDPR (our legitimate interest in handling and documenting inquiries). Providing this data is voluntary, but without at least your name and a valid email address we cannot reply.

6. Newsletter “Partner Notes”

You can subscribe to our newsletter with your email address. We use the double opt-in procedure: after signing up you receive a confirmation email, and you are only added to the list once you click the link in it. To document your consent, the sign-up and confirmation are logged with the timestamp. The newsletter is sent via Brevo (see section 9). Legal basis: Art. 6 (1) (a) GDPR (consent). You can withdraw your consent at any time with effect for the future via the unsubscribe link in every issue or by emailing us; withdrawal does not affect the lawfulness of processing before it.

7. Guides (shop)

The digital guides are sold through Payhip Ltd (United Kingdom). When you buy a guide, the checkout, payment, invoicing and delivery are handled entirely by Payhip — this website only links to the Payhip checkout. For that purchase Payhip processes your data under its own responsibility; Payhip’s privacy policy applies to the transaction. Where we receive data from Payhip about a sale, we process it to fulfil the contract and to meet our commercial and tax record-keeping obligations. Legal basis: Art. 6 (1) (b) GDPR (contract) and Art. 6 (1) (c) GDPR (legal retention obligations). The United Kingdom is covered by an EU adequacy decision (Art. 45 GDPR).

8. Form security and abuse prevention

To protect the forms from automated abuse without using a captcha, submissions pass through a hidden honeypot field, a signed time-based token and a short-term rate limit per IP address. Your IP address is processed only transiently in memory for the rate limit and is not stored for this purpose. Legal basis: Art. 6 (1) (f) GDPR — our legitimate interest in protecting the website and its forms against spam and abuse.

9. Recipients and processors

We only pass personal data to service providers who process it on our behalf under a data-processing agreement pursuant to Art. 28 GDPR, or where we are otherwise legally entitled to. The providers involved are:

  • Vercel Inc. (USA) — hosting and cookieless web analytics (sections 2 and 4).
  • Brevo SAS (Paris, France; with its German subsidiary in Cologne) — contact management, inquiry records and newsletter delivery (sections 5 and 6). Data is processed on servers within the EU.
  • Payhip Ltd (United Kingdom) — checkout and delivery of the guides (section 7).

10. Transfers to third countries

Hosting and analytics involve Vercel Inc. in the USA. These transfers are safeguarded by the EU Standard Contractual Clauses pursuant to Art. 46 (2) (c) GDPR and, where the provider is certified, additionally by the EU–US Data Privacy Framework. Processing by Brevo takes place within the EU. The United Kingdom (Payhip) is recognised by the European Commission as providing an adequate level of protection (Art. 45 GDPR).

11. How long we keep your data

  • Server log data: deleted or anonymised after a short period.
  • Inquiry data: kept for as long as needed to handle your inquiry and any resulting business relationship, and thereafter for the periods required by commercial and tax law (generally up to 6 or 10 years), unless you object earlier and no retention obligation stands in the way.
  • Newsletter: your email address is kept until you unsubscribe. After that it may be kept on a suppression list solely to honour your opt-out, unless you request full erasure.
  • Purchase data held by Payhip: governed by Payhip’s policy and statutory retention periods.

12. Your rights

Under the GDPR you have the right to access your data (Art. 15), to rectification (Art. 16), to erasure (Art. 17), to restriction of processing (Art. 18), to data portability (Art. 20) and to withdraw any consent you have given (Art. 7 (3)). To exercise any of these, email hello@mirunavasi.com.

Right to object (Art. 21 GDPR): where we process your data on the basis of our legitimate interests (Art. 6 (1) (f) GDPR), you have the right to object at any time on grounds relating to your particular situation.

You also have the right to lodge a complaint with a supervisory authority. The authority responsible for us is the Bayerisches Landesamt für Datenschutzaufsicht (BayLDA), Promenade 18, 91522 Ansbach, Germany.

13. Cookies

When you browse this website no cookies are set and no tracking or advertising cookies are used. Analytics runs without cookies (section 4). A cookie is only used for the internal, password-protected editorial login, which is not accessible to visitors.

14. Automated decision-making

We do not use automated decision-making or profiling within the meaning of Art. 22 GDPR.

15. Changes to this policy

We may update this policy to reflect changes to the website or to the services described here. The current version always applies and is published on this page.

Last updated: 15 August 2026.