Privacy notice
Last updated: 30 September 2026
1. Controller
The controller for personal data processing on WichtelPilot is: Christian Hofmann Schönerbergweg 9 86929 Penzing Germany Email: mail@hofmann-christian.de
2. Purpose and scope of processing
WichtelPilot lets users create and manage Secret Santa rounds. We process data only where necessary to provide the platform, enable secure participation, send invitations and communicate about a round. The legal bases are Article 6(1)(b) GDPR for use of the platform and Article 6(1)(f) GDPR for security, error analysis and reliable operation.
3. Processed data
When creating and using a Secret Santa round, we may process names, email addresses, round titles, budgets, dates, wish lists, interests, exclusions, messages and assignment status. For organisers, we also process the account data needed to sign in. Participant email addresses are processed only when an invitation is sent by email.
4. Hosting and technical service providers
WichtelPilot is operated through Hostinger. Our database, authentication and file storage are provided through Supabase. We use Resend to send email and Inngest for scheduled background tasks. Sentry may be used for technical error analysis. Where required, we conclude data-processing agreements with the service providers used.
5. Server logs and security
When you visit the website, technically necessary connection data is processed, in particular IP address, date and time, requested page, referrer, browser and operating-system information. This processing is based on Article 6(1)(f) GDPR and serves secure operation, prevention of abuse and error analysis.
6. Email
If a Secret Santa round is organised by email, we send invitations, reminders and necessary system messages to the stored email addresses. Sending these messages is necessary for the selected Secret Santa round and is performed through Resend.
7. Cookies and analytics
WichtelPilot uses essential cookies for language, security, sign-in and saving your cookie preferences. Optional analytics or marketing technologies load only after your consent. You can change your choice at any time via “Cookie settings” in the footer.
7a. Google Tag Manager and Google Analytics 4
Where set up, and only after your consent (category “Analytics” or “Marketing”), we use Google Tag Manager and Google Analytics 4 for audience measurement. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. The purpose is the statistical evaluation of usage (e.g. pages visited, use of the gift finder, clicks on partner links) to improve our service. No names, email addresses or participant links are transmitted. Cookies (e.g. “_ga”, “_ga_*”) may be set and data such as device and browser information and usage events may be processed; Google Analytics 4 does not log IP addresses. A transfer to the USA is possible and relies on the European Commission's adequacy decision for the EU-US Data Privacy Framework. The legal basis is your consent under Art. 6(1)(a) GDPR and Section 25(1) TDDDG (TTDSG). Without consent, Google Tag Manager is not loaded and no data is sent to Google. Analytics data is retained according to the setting in Google Analytics (maximum 14 months); the cookies last up to 2 years unless deleted earlier. You can withdraw your consent at any time with effect for the future via “Cookie settings” in the footer; the Google cookies are then removed. More information: https://policies.google.com/privacy and https://business.safety.google/privacy/.
8. Optional features
The AI gift finder and affiliate links are optional features. They are processed only if the respective feature is enabled and you use it. OpenRouter is used as a technical interface for AI requests; affiliate links may send necessary tracking parameters to the respective partner. As an Amazon Associate I earn from qualifying purchases; for Amazon search links, our partner tag is sent to Amazon.
9. Retention and deletion
Secret Santa rounds are automatically deleted after their defined runtime expires. The standard period is 30 days; organisers are informed before deletion. Statutory retention obligations remain unaffected.
10. Your rights
You have rights of access, rectification, erasure, restriction of processing, data portability and objection to processing based on legitimate interests. You may withdraw consent at any time with future effect. Please contact mail@hofmann-christian.de. You also have the right to lodge a complaint with a data-protection supervisory authority.