Privacy notice

1. Controller

Christoph Mayer, trading as FrameShift Global Consulting, Heimbacher Gasse 17, App. 1, 74523 Schwäbisch Hall, Germany. Email: hello@showworth.app.

No data protection officer has been appointed. The statutory thresholds in section 38 BDSG are not met.

2. Visiting the site

The site is hosted on Cloudflare Workers. Each request produces technical log data: the IP address in shortened form, the time, the page requested, the referrer, and the browser and operating system reported by your device. This data is needed to deliver the page and to defend against attacks. It is not used to identify you and is not combined with anything else.

Legal basis: Article 6(1)(f) GDPR. The legitimate interest is operating the site securely and reliably.

Retention: log data is kept for a short period and then deleted or aggregated.

3. Country detection

The edge server adds the two-letter country code of your request to the page so that the consent banner can present the correct default for your jurisdiction. No additional request is made, nothing is stored, and the country code is not retained after the page is rendered.

Legal basis: Article 6(1)(c) GDPR, since presenting the correct consent default is how we meet our own obligations.

4. Consent record

When you make a choice in the consent banner, that choice is stored in your own browser under the key "sw_consent_v1", using localStorage. It holds the decision, the time, the version of the tracking inventory it applies to, and the region default that was shown. It never leaves your device and it is not a cookie.

You can withdraw or change the decision at any time using the link in the footer, or by clearing site data in your browser.

Legal basis: Article 6(1)(c) GDPR. We are required to be able to demonstrate consent, and storing the record locally is the least intrusive way to do it.

5. The launch notice signup

The form asks for your name and email address, which are required, and optionally your company and telephone number. If you arrived through a campaign link, the campaign parameters in the URL are sent with the form. Your country code is recorded with the submission.

We use this to email you when showworth.app opens, and occasionally after that about how this work gets done. You also receive one confirmation email straight away, so you know the address reached us and can stop there if you would rather not continue.

Legal basis: Article 6(1)(a) GDPR, the consent you give with the tick box. Nothing here rests on any other basis.

How to withdraw: every email carries an unsubscribe link, and your mail programme may show its own unsubscribe button as well. A reply asking to be removed has the same effect. Withdrawing is meant to be as easy as giving consent was, which is what Article 7(3) GDPR requires.

Recipients: the submission is stored in a Cloudflare D1 database located in Western Europe, and the email is sent through Resend.

Retention: your details are kept until you withdraw consent. After that we keep only the record that you withdrew and when, so the request can be shown to have been honoured and so you are not contacted again by mistake. You may ask for erasure at any time.

6. Newsletter

The newsletter is a separate, optional choice. It is never a condition of receiving the example, the box is never pre-ticked, and declining it changes nothing else.

We record whether you granted or declined it and when, because we have to be able to demonstrate consent. Every email carries an unsubscribe link, and withdrawing consent is as easy as giving it.

Legal basis: Article 6(1)(a) GDPR.

7. Spam protection

The form is protected by Cloudflare Turnstile, which checks that a submission comes from a person rather than a script. Turnstile does not use cookies and does not track you across sites. It receives your IP address and limited technical signals from your browser in order to run that check.

We also apply a rate limit, which briefly holds your IP address and the email address you submitted so that the same sender cannot flood the form. These entries expire automatically after one hour.

Legal basis: Article 6(1)(f) GDPR. The legitimate interest is keeping the form usable and free of abuse.

8. Processors and transfers outside the EU

We use the following processors, each under a data processing agreement:

Cloudflare, for hosting, the lead database, the rate limit and Turnstile. The lead database is pinned to Western Europe.

Resend, to deliver the confirmation email to you and the notification to us. Resend sends from infrastructure in the United States.

Cloudflare is a United States company operating European infrastructure, and Resend is based in the United States. Where personal data reaches the United States, the transfer is covered by the European Commission Standard Contractual Clauses under Article 46(2)(c) GDPR, together with supplementary measures. United States authorities may in principle be able to access data held by United States providers, and it is not possible to rule that out entirely. If that risk is unacceptable to you, write to us by post instead of using the form.

9. What we do not do

No analytics software runs on this site. No advertising pixels are loaded. Fonts are served from our own domain rather than from a font provider. The explainer videos play from our own server rather than from a video platform, so no platform learns that you watched one. There is no profiling and no automated decision-making within the meaning of Article 22 GDPR.

If that changes, this notice changes with it, and the consent banner will ask you again rather than assume your earlier answer still applies.

10. Your rights

You have the right to access your data (Article 15), to rectification (Article 16), to erasure (Article 17), to restriction of processing (Article 18), to data portability (Article 20), and to object to processing based on legitimate interests (Article 21). Where processing rests on consent, you may withdraw it at any time with effect for the future.

Write to hello@showworth.app and we will answer within one month.

You also have the right to lodge a complaint with a supervisory authority. The competent authority for us is the State Commissioner for Data Protection and Freedom of Information of Baden-Württemberg, Lautenschlagerstraße 20, 70173 Stuttgart.

11. Changes

This notice is dated 26 July 2026. We update it when the processing changes, and the version of the tracking inventory recorded with your consent decision is what tells the banner whether to ask you again.