Privacy Policy
Last updated: 7/30/2026
1. Overview
The protection of your personal data is of particular concern to us. We process your data exclusively on the basis of the statutory regulations (GDPR, TKG 2021).
2. Controller
The party responsible for data processing on this website is:
Slowdown Moments e.U.
Am Steinfeld 21, 8020 Graz
Email: office@slowdown-moments.at
3. Data Collection and Purpose
- Account Data: When you register, we collect your email address, name, and encrypted password.
- Usage Data: We track your video playback progress.
- Log Data: Server logs collect IP addresses for security.
We process your usage and progress data (content viewed, sessions, streaks) solely to provide and personalise the service. We do not derive health data or draw conclusions about your state of health from it, and we do not treat this data as a special category of personal data within the meaning of Art. 9 GDPR.
4. Sub-processors
To operate our platform we rely on carefully selected service providers acting as sub-processors (Art. 28 GDPR). A data-processing agreement is in place with each one. The overview below sets out each provider's purpose, location and legal basis:
| Service | Purpose | Location / transfer | Legal basis |
|---|---|---|---|
| Supabase | Authentication and database | EU / USA | Contract (Art. 6(1)(b)) |
| api.video | Video hosting and delivery | EU (FR) | Contract (Art. 6(1)(b)) |
| Mux | Audio streaming | USA | Contract (Art. 6(1)(b)) |
| Stripe | Subscription payments | EU / USA | Contract (Art. 6(1)(b)) |
| Sentry | Error monitoring (personal data scrubbed server-side) | EU | Legitimate interest (Art. 6(1)(f)) |
| PostHog | Product analytics (consent only) | EU Cloud | Consent (Art. 6(1)(a)) |
| Upstash | Rate limiting and webhook idempotency | USA | Legitimate interest (Art. 6(1)(f)) |
| Vercel | Hosting and delivery (CDN) | USA / global | Legitimate interest (Art. 6(1)(f)) |
| Google Analytics | Web analytics, if configured (consent only) | EU / USA | Consent (Art. 6(1)(a)) |
For providers based in or owned by a US parent, any transfer to third countries relies — depending on the provider — on the EU-US Data Privacy Framework adequacy decision (Art. 45 GDPR) or on Standard Contractual Clauses (Art. 46 GDPR). The configured hosting region is kept within the EU wherever the service supports it.
5. Cookies and Local Storage
We use cookies and local storage for three clearly-scoped purposes. You can review or revoke your consent at any time via the "Cookie settings" link in the footer.
Strictly necessary
Required to operate the site; no consent needed (GDPR Art. 6(1)(b) and (f)). Supabase authentication cookies (sb-access-token, sb-refresh-token) keep you signed in. Cloudflare Turnstile sets short-lived cookies (cf_chl_*) to block bots on auth forms. Local storage holds your cookie decision (sd_cookie_consent) and your light/dark theme preference (slowdown-theme).
Functional (legitimate interest)
For service reliability we use Sentry (Sentry GmbH, EU hosting) to log anonymised errors. Sentry does not set cookies; personal data (email, IP, auth headers) is scrubbed server-side before events are sent. Legal basis: legitimate interest (GDPR Art. 6(1)(f)).
Analytics (only with your consent)
With your consent we collect usage statistics via PostHog (PostHog Inc., EU hosting) and – if configured – Google Analytics (Google Ireland Ltd.). These services load only after you click "Accept all". Legal basis: consent (GDPR Art. 6(1)(a)).
Managing your cookie settings: click "Cookie settings" in the footer at any time to review or change your choice.
6. Your Rights
In principle, you have the rights to information, correction, deletion, restriction, data portability, revocation and objection. Supervisory authority: Austrian Data Protection Authority.
7. Contact
If you have any questions regarding your personal data, please contact us at: office@slowdown-moments.at