PRIVACY INFORMATION
Last updated: 22 October 2026 · Document: privacy-2026-10-22-public-total-r11 · Legal release: tmm-de-legal-2026-10-22-pdf-only-separate-leaderboard-rc11
1. Controller
Too Much Money
David Sewer
Baben Brandheid 60, 21147 Hamburg, Deutschland
Deutschland
support@too-much-money.com
+4915567245530
2. Account and sign-in
For registration, sign-in, sessions and account security, we process email address, account ID, authentication metadata, language and technical session data. With optional Google sign-in, Google sends Supabase the Google user identifier, email address, email-verification status and, where present in the Google account and supplied by Google, display name and profile-image URL. These fields are used only for sign-in, account association, account security and user-friendly account display. The linked Google identity and account fields are generally retained until account deletion or earlier unlinking; statutory records remain unaffected. Recipients are Google as the OAuth provider and Supabase as the authentication service. Legal bases are steps before and performance of a contract (Article 6(1)(b) GDPR) and secure provision of the service (Article 6(1)(f) GDPR).
3. Private profile data and optional leaderboard
Profile name, display name and optional bio are used for account and Trophy personalisation. The profile, bio and trophies remain non-public; no profile or Trophy gallery and no external profile links are offered. The separate leaderboard processes the sum of successfully confirmed purchase prices for this product including applicable taxes and less refunds. Trophy checkout publishes nothing and concludes no leaderboard agreement. Only separate voluntary consent and agreement in the account displays the alias, rank and confirmed purchase-price total publicly. Consent can be withdrawn at any time for the future, immediately removing the entry.
4. Content checks
Display name, profile name and bio may be sent without the account email to Google Cloud Natural Language for additional automated text moderation. The text fields are assessed for toxicity, derogatory content, insult, profanity, sexual content and violence. If confidence exceeds the configured review or restriction threshold, or the review is pending or cannot be completed safely for technical reasons, the input is not approved for Trophy personalisation and the operator is alerted. An automatically affected user receives a specific notice and can request human review through the appeal route. The bio is optional and must not contain health data, political or religious beliefs, sexual-orientation data or other special categories of personal data. External profile links are disabled. The legal basis for the safety review is the legitimate interest in a safe and lawful service (Article 6(1)(f) GDPR).
5. Trophy contract, payment and separate leaderboard
We process account ID, profile snapshot, individual amount, cumulative confirmed purchase-price total including applicable taxes and less refunds, currency, Trophy code, issue and supply time, product version, integrity value, country, language, declarations, document versions, order and Stripe references, and payment, refund and dispute status. The paid contract and its processing concern exclusively the PDF Trophy. The purchase-price total is additionally calculated for the legally separate free leaderboard; after consent there, the alias, rank and this exact total are public. Individual purchase events, payment data and Trophy files remain private. Stripe processes payment, billing, fraud and dispute data; full card details do not reach the application. Legal bases are contract for the Trophy, legitimate interests and contract performance for required payment and evidence data, consent for public alias/rank/total display, legal duties and legal defence.
6. Contract and service emails
Brevo processes recipient address, order or case reference, amount and the required message text for contract, withdrawal, report and appeal confirmations. Anonymised open and click tracking is currently enabled in the Brevo account. Before approval, this measurement must either be disabled or finally assessed as to data scope, legal basis and any required consent. Business support communications are processed through mailbox.org. Legal bases are contract, statutory information duties and handling enquiries.
7. Reports, appeals and withdrawal
Reports use the exact location of the reported alias, category and, where voluntarily supplied, name, contact address, explanation and good-faith declaration. Missing voluntary fields do not prevent receipt. Appeals use account ID, explanation, moderation status and decision. Withdrawal or reversal requests use name, contact address, contract reference, statement, timestamp and - only if voluntarily selected or supplied - the request type or further reasons. A reason is not required for a statutory withdrawal. Processing supports legal duties, contract handling, platform safety and legal defence.
8. Security and operations
Cloudflare processes network and request data required for hosting, CDN, WAF, Turnstile, DNS and encrypted R2 backups. Supabase processes application data, short-lived HMAC-pseudonymised rate-limit keys and audit data. Better Stack receives only public availability/TLS signals and technical heartbeat error codes; user content is not deliberately transmitted. The legal basis is Article 6(1)(f) GDPR.
9. Accounting and business account
Lexware Office processes required receipts, customer/supplier data, tax and business data. Solaris, as the account-holding institution, processes bank transactions, KYC, device and fraud-prevention data. Depending on the flow, processing may involve a processor, separate controller or joint control; the current agreements are recorded in the provider register.
10. Recipients and international transfers
Recipients as required are Supabase, Stripe including Sold through Link, Cloudflare, Brevo, Google, Better Stack, mailbox.org/Heinlein Hosting GmbH, Lexware/Haufe and Solaris and the subprocessors they use. Roles differ by processing operation; Stripe/SMP in particular may act as a separate controller for payment, tax, fraud, dispute and support purposes under Managed Payments. Where data is processed outside the EU/EEA, the relevant provider relies on an applicable adequacy decision, including the EU-US Data Privacy Framework, or safeguards such as EU Standard Contractual Clauses and supplementary measures. Current provider lists and safeguards can be requested from support.
11. Retention
Account and profile data and convenience copies in the private Trophy library are generally kept until account deletion, earlier removal or the end of the service; indefinite cloud storage is not promised. Alias, rank and confirmed purchase-price total are displayed publicly only while leaderboard consent is active and are removed immediately when consent is withdrawn; evidence of consent and withdrawal is generally retained for three years for legal defence. Separate contract, supply, payment and accounting records required by law remain non-public for the statutory periods. Previous profile names remain privately reserved without an active account link until the service ends to preserve unique assignment; necessity is reviewed at least every three years. Closed reports, appeals, moderation decisions and related admin audits are generally deleted three years after closure unless an ongoing legal matter, authority request or longer statutory duty applies. Withdrawal and contract correspondence is generally kept for six years, accounting vouchers for eight years and certain books/records for ten years from the relevant statutory starting point. Cloudflare Worker logs are limited to seven days; expired rate-limit rows are deleted automatically; Brevo transaction logs are configured for one month. Internal delivery and operational evidence without statutory contract relevance is deleted after no more than thirteen months. Encrypted recovery backups rotate and are deleted after no more than 35 days unless a documented security or legal hold requires temporary isolation. Open claims and legal holds delay only the affected deletion.
12. Required data
Email, account and payment data and the labelled checkout declarations are required for registration or purchase; the relevant process is unavailable without them. The bio is optional; external profile links are not currently offered. Reports may be submitted without an account, name or contact address. Specific reasons, a good-faith declaration and reachable contact details help a proper review and response.
13. Rights
Data subjects may request access, correction, deletion, restriction and portability and may object to processing based on Article 6(1)(f) GDPR. Consent can be withdrawn for the future. Export and account deletion are available in the account; other requests go to support@too-much-money.com. Rights of others and statutory retention duties may limit the result.
14. Right to complain
A complaint may in particular be lodged with Der Hamburgische Beauftragte fuer Datenschutz und Informationsfreiheit: https://datenschutz-hamburg.de/service-information/beschwerde-oder-hinweis-einreichen Data subjects may also contact another competent data-protection authority.
15. Device storage and analytics
Strictly necessary storage access supports sign-in, security, checkout protection and language settings. The current legal candidate uses no client-side audience or performance analytics and no marketing trackers. Its HTML responses include the Cache-Control no-transform directive so that Cloudflare does not automatically inject a Web Analytics RUM beacon; the Content Security Policy does not permit the beacon domain either. Separate server-side Cloudflare network, security and aggregated edge metrics may arise while technically delivering the service. Before production approval, a connection from Germany is used to verify that neither the beacon script nor a /cdn-cgi/rum browser transmission is active. Any later activation of non-essential device analytics requires a new review, updated information and prior consent where required.
16. Version and changes
This version describes the functional and provider state documented on the version date. Material changes to purposes, providers, retention, profile publicity or country scope require updated information and a new document version.