Privacy Policy

1. Controller

The controller responsible for processing your personal data on impulsly.com and in the Impulsly service is:

Buuk Publishing GmbH & Co. KG
Hortensienstraße 26
40474 Düsseldorf, Germany
Phone: +49 211 53804066
Email: info@buchbuddy.de

2. What Impulsly is about

Impulsly sends you short impulses on topics you choose yourself, via WhatsApp. For this we only process the data needed to run the service. We do not sell data, do not show third-party advertising, and do not use tracking or analytics tools.

3. What data we process

When you sign up for and use Impulsly, we process:

• your phone number (it is your user account – there is no password) and your first name,
• your topic selection and your settings (frequency, time of day, daily limit),
• your time zone, so impulses reach you at the right time (it is taken from your browser during onboarding),
• a delivery log (which impulse was sent to you when, and whether you reacted) – to avoid duplicate sends and to control sending frequency,
• for paid plans, the data needed for billing (see section 7),
• only if a topic you chose requires it and you provide it voluntarily: last name, date of birth or gender (providing it is always optional).

Legal bases: Art. 6(1)(b) GDPR (provision of the service); for voluntary information Art. 6(1)(a) GDPR (consent).

4. WhatsApp (Meta)

Impulses are delivered via the official WhatsApp Business Cloud APIof Meta Platforms Ireland Limited, Merrion Road, Dublin 4, Ireland (“Meta”). Your phone number and the message contents are transmitted through Meta's systems; processing on servers of Meta Platforms, Inc. in the USA is possible. Meta is certified under the EU-U.S. Data Privacy Framework; EU standard contractual clauses apply in addition.

We only send you impulses after your explicit sign-up (opt-in), which we document. You can stop receiving them at any time – by messaging our WhatsApp number or via your settings. Your own use of WhatsApp is governed by WhatsApp's privacy policy.

Legal basis: Art. 6(1)(b) GDPR; for the opt-in Art. 6(1)(a) GDPR.

5. Signing in via WhatsApp (login)

Instead of a password, you sign in by sending us a prepared WhatsApp message containing a one-time code. Your phone number serves as proof of identity. After a successful sign-in we set a session cookie (see section 9).

6. Database & storage location

We store your data in a database at Supabase (Supabase, Inc.) with servers located in Frankfurt am Main, Germany. A data processing agreement including EU standard contractual clauses is in place with Supabase.

7. Payment (Stripe)

We bill paid plans via Stripe (Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Dublin, Ireland). Stripe processes the data needed for payment (e.g. name, email address, payment details) under its own responsibility; data may be transferred to Stripe, Inc. in the USA (certified under the EU-U.S. Data Privacy Framework). Your full payment details (such as card numbers) never reach our servers.

Legal bases: Art. 6(1)(b) GDPR (contract performance) and Art. 6(1)(c) GDPR (commercial and tax law obligations).

8. Hosting & delivery scheduling

The website is hosted by Vercel (Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA; certified under the EU-U.S. Data Privacy Framework). When you visit the website, Vercel processes technically necessary connection data (including IP address, time, page accessed) in server logs. We serve fonts from our own servers; no connection to Google or other font services is established when you load a page.

For the scheduled selection and delivery of impulses we use n8n Cloud, an automation service of n8n GmbH, Novalisstraße 10, 10115 Berlin, Germany. For this purpose n8n accesses the database mentioned in section 6; a data processing agreement is in place with n8n GmbH.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in secure, stable operations).

9. Cookies

We only use one technically necessary session cookie (“impulsly_session”) that keeps you signed in. It is valid for a maximum of 30 days and is deleted when you log out. We do not use tracking, analytics or marketing cookies – which is why there is no cookie banner to click away here.

Legal bases: Section 25(2)(2) of the German TDDDG, Art. 6(1)(b) GDPR.

10. Retention & deletion

We store your data for as long as your Impulsly account exists. After that we delete it as soon as it is no longer required for the purposes described here and no statutory retention obligations (in particular 10 years for accounting records, 6 years for commercial and business correspondence under German law) stand in the way.

You can trigger the deletion of your data yourself at any time – via a WhatsApp message with the word DELETE or by email. Details are on our data deletion page.

11. Your rights

You have the right, vis-à-vis us, to:

• access to your stored data (Art. 15 GDPR),
• rectification of inaccurate data (Art. 16 GDPR),
• erasure (Art. 17 GDPR),
• restriction of processing (Art. 18 GDPR),
• data portability (Art. 20 GDPR),
• withdrawal of any consent given, with effect for the future (Art. 7(3) GDPR).

Right to object (Art. 21 GDPR): Where we process data on the basis of legitimate interests, you may object at any time on grounds relating to your particular situation.

Simply contact info@buchbuddy.de. You may also lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), e.g. the authority responsible for us: Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen, Kavalleriestraße 2–4, 40213 Düsseldorf, Germany, poststelle@ldi.nrw.de.

12. Data security

All connections to our website and between our systems are TLS-encrypted. Access to your data is restricted to the minimum necessary for operations.

13. Changes to this privacy policy

We update this privacy policy when the service or the legal situation changes. The version published here applies.

Last updated: July 2026