Privacy notice

1. Controller and contact

Tom Gerling
Sole proprietor trading as Quickly Challenges

Email: contact@quickly-challenges.com
Contact form: quickly-challenges.com/contact

2. Website delivery and hosting

When this website is requested, technically necessary connection data are processed, including IP address, date and time, requested URL, HTTP status, transferred volume, referrer when supplied, user agent and device information. Processing serves delivery and availability, protection against misuse and attacks, and technical error diagnosis. The legal basis is Article 6(1)(f) GDPR; those purposes are our legitimate interests. The website cannot be delivered without these data.

The website is hosted through ChatGPT Sites. OpenAI Ireland Limited, 1st Floor, The Liffey Trust Centre, 117-126 Sheriff Street Upper, Dublin 1, D01 YC43, Ireland, processes hosted data as a processor. OpenAI may use the listed ChatGPT Sites subprocessors, including Cloudflare, Ltd. for content delivery, web hosting and the hosting database infrastructure used by this site.

ChatGPT Sites Data Processing Addendum · OpenAI subprocessor list

ChatGPT Sites does not currently provide selectable data residency. Processing may occur in the EEA and third countries. For transfers of EEA data outside the EEA, the applicable agreement provides for an adequacy decision or EU Standard Contractual Clauses. Technical hosting data are retained only as required for delivery, security, support, error diagnosis and legal duties, and are then deleted or anonymised according to the applicable platform requirements.

3. Local storage and necessary order cookie

The site stores the selected language under quickly-site-locale. The public and Community Studio preview is read-only and does not create drafts. The Complete offline Studio can store up to 20 local drafts, limited to 3 MB in total, under quickly-studio:drafts:v1. These values remain on the device until the user deletes them or clears browser data.

When direct checkout is enabled and deliberately started, the server sets the strictly necessary __Host-quickly-order cookie. It contains a pseudonymous order identifier and a high-entropy access secret, is HttpOnly, Secure and SameSite=Lax, and expires after 31 days. It allows the same browser to retrieve only its payment status and private download after fulfilment. It is not used for advertising, analytics or cross-site tracking.

Storage and access for the language, local drafts and order cookie are limited to functions explicitly requested by the user and are based on Section 25(2) no. 2 TDDDG. The related personal-data processing uses Article 6(1)(b) GDPR for contract steps and Article 6(1)(f) GDPR for secure access and abuse prevention.

4. Offline Studio imports, exports and sharing

The public and Community preview cannot import, change, save, share or export challenge files. In Complete, imported challenge files are read locally in the browser; exports are generated locally and are not uploaded to Quickly. If the user deliberately invokes the device's Web Share function, the selected receiving application or service processes the shared file under its own privacy terms.

5. Contact by email and contact form

Enquiries can be sent by email or through the contact form. We process the sender or reply address, optional name, selected topic, message, language, timestamp, submission identifier and communication metadata. Providing these data is voluntary, but a reachable address and sufficient request details are needed for a response. Contractual or pre-contractual enquiries are processed under Article 6(1)(b) GDPR; other enquiries under Article 6(1)(f) GDPR and our legitimate interest in answering them.

For abuse prevention, the contact endpoint checks origin, a hidden bot field, Cloudflare Turnstile and rate limits. Cloudflare Turnstile from Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA, processes the token, IP address and browser/security signals; the message itself is not sent to Turnstile. HMAC-pseudonymised IP and email rate-limit buckets with counters and expiry are stored in the hosting database, not the message. The legal basis is Article 6(1)(f) GDPR.

Cloudflare Turnstile Privacy Addendum · Cloudflare Data Processing Addendum

After a valid security check, Plus Five Five, Inc. (Resend), 2261 Market Street #5039, San Francisco, CA 94114, USA, transmits the form content as plain-text email to our fixed support mailbox. Resend states that email data are retained for 30 days and that account metadata, logs and API records are stored in the USA even when the Ireland sending region is selected. Transfers use Resend's DPA, EU Standard Contractual Clauses and, where applicable, its EU-US Data Privacy Framework certification.

Resend DPA · Resend subprocessors · Resend region information

STRATO GmbH, Otto-Ostrowski-Straße 7, 10249 Berlin, Germany, provides the receiving mailbox and spam filtering as a processor. According to STRATO's service information, mail data are stored and processed in German data centres. STRATO AVV

6. Direct Complete checkout and order records

Direct sales are technically fail-closed and must remain disabled until the published launch gates and live checkout tests are complete. When a user deliberately starts an enabled checkout, Quickly creates an order record in the hosting environment's Cloudflare D1 database. The record includes order UUID, Stripe Checkout Session and payment-intent identifiers, payment and fulfilment status, US-dollar total, release version/file hash, selected locale, versioned terms, licence and immediate-performance consent text and timestamps, seller snapshot, pseudonymous access-secret hash, customer email, payment time, download expiry and count, delivery-email state/provider identifier, and refund or dispute status. Stripe webhook event identifiers, processing state, retry/lease data and payment revocation records are also stored to process events idempotently and prevent an invalid delivery.

Email, billing address, tax information requested by the enabled checkout and a valid payment method are required to conclude and fulfil the contract. Processing for ordering, payment, contract confirmation and delivery is based on Article 6(1)(b) GDPR. Required commercial, tax, consumer-law and accounting records use Article 6(1)(c) GDPR. Fraud prevention, idempotency, chargeback/refund handling and the establishment, exercise or defence of legal claims use Article 6(1)(f) GDPR and our corresponding legitimate interests.

7. Stripe payment processing

Payment details are entered only on Stripe's hosted Checkout page. Quickly does not receive full payment-card or wallet credentials. Stripe and the applicable Stripe group company receive customer email, billing and tax details, Checkout and payment identifiers, amount and currency, product/order metadata, IP address, device/browser signals and fraud-prevention data. Depending on the processing purpose, Stripe describes itself as our processor or as an independent controller, for example for regulatory, security and fraud-prevention duties. Stripe's own checkout privacy information applies to its independent processing.

Stripe Privacy Center · Stripe Data Processing Agreement

Stripe may process data in the EEA, the USA and other countries in which it or its service providers operate. Stripe describes the applicable adequacy decisions, EU Standard Contractual Clauses and Data Privacy Framework participation in its privacy and data-transfer materials.

8. Contract-confirmation and delivery email

After confirmed payment, Resend receives the purchaser email, order and product details, seller information, total price, release and hash information, full versioned contract/licence/withdrawal text, accepted consent text and timestamps, and the private download link. This is required to provide the contract confirmation on a durable medium and deliver Complete. The download is not released unless the confirmation email has been accepted for delivery. Resend's processing and transfer safeguards are described in section 5.

9. Electronic withdrawal function

The permanently highlighted Withdraw contract processes the consumer's name, order or contract identifier, confirmation email, selected language, the unequivocal withdrawal declaration, notice version, and date/time of receipt. These data are used to identify the contract, process the declaration, meet consumer-law duties and immediately send an acknowledgement on a durable medium. The legal bases are Article 6(1)(b) and (c) GDPR; Article 6(1)(f) GDPR applies to abuse prevention and legal claims.

The form does not automatically decide whether a withdrawal is legally effective and does not reveal whether an entered identifier or email matches an order. A visible success message is shown only when the server has accepted the declaration and the acknowledgement email has been accepted for delivery. Resend receives the declaration, receipt date/time and recipient address for that acknowledgement.

10. Marketplace links

A separately enabled voxel.shop link opens the marketplace only after an intentional click. The marketplace then processes connection, account, checkout, payment and download data under its own privacy information. Marketplace seller tools may provide Quickly with transaction, purchaser, delivery, refund, chargeback and support information needed for contract performance, legal duties and claims. No marketplace link is represented as available before the listing and delivery flow are approved and tested.

11. Retention

• Language and Complete drafts remain locally until the user removes them.
• The private download expires after 30 days; the order cookie expires after 31 days. Expiry does not by itself delete legally required contract records.
• Order, payment, invoice-equivalent, consent, withdrawal, refund and dispute records are retained for the periods required by applicable commercial, tax and consumer law and, where necessary, until related claims expire. Access secrets and technical event/lease data are retained only for secure fulfilment, idempotency and evidence and are deleted or anonymised when no longer needed and no legal duty applies.
• Support correspondence is deleted after the matter is resolved unless retention duties or legal claims require longer storage; Resend's stated email-data retention is 30 days.

12. Disabled services and automated decisions

• No Quickly advertising, behavioural analytics, profiling, newsletter or application telemetry.
• No remotely loaded fonts or media embeds; the contact page loads only the described Turnstile security widget when configured.
• Account, Cloud, server-linking and Discord bot functions remain disabled on the public website until separately deployed and tested. The public Discord invitation is an intentional external link.
• Quickly does not make decisions producing legal or similarly significant effects solely by automated processing. Stripe may use automated payment and fraud-prevention models for its own purposes under its notices.

13. Rights

Subject to the applicable legal requirements, data subjects have rights of access, rectification, erasure, restriction, data portability and objection. They may also lodge a complaint with a supervisory authority. Browser-local drafts must be managed on the relevant device because Quickly does not receive them.

The authority competent for the controller's establishment is the Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen.

Privacy requests may be sent to contact@quickly-challenges.com or through the contact form.