Privacy Policy

1. Privacy at a glance

The following notes give an overview of what happens to your personal data when you visit this website. Personal data is any data that can be used to identify you personally.

2. Controller

The controller responsible for data processing on this website is: Fabian Tausch Unicorn Bakery Am Kellerberg 28 90766 Fürth Germany Email: fabian@unicornbakery.de No data protection officer has been appointed because the requirements of Art. 37 GDPR and Section 38 BDSG (German Federal Data Protection Act) are not met. The owner is the contact person for all data protection matters.

3. Hosting and server log files

This website is hosted by Vercel Inc., 340 Pine Street, Suite 500, San Francisco, CA 94104, USA. The legal basis is our legitimate interest in providing the website securely and reliably (Art. 6(1)(f) GDPR). We have a data processing agreement with Vercel under Art. 28 GDPR. Vercel is certified under the EU-US Data Privacy Framework; the EU Standard Contractual Clauses apply in addition. With every request, Vercel automatically records server log files: IP address, date and time, page requested, referrer URL, browser type and version, and operating system. The log files are deleted automatically when Vercel's log retention period ends (currently about one day on our plan) and are not combined with other data sources.

4. Cookie consent

Analytics and marketing services (Google Analytics 4 and Meta Pixel) are only loaded after you click “Accept” in the banner. Before that, neither their scripts are loaded nor their cookies set. “Decline” is offered with equal weight. The legal basis is your consent (Art. 6(1)(a) GDPR in conjunction with Section 25(1) TDDDG, the German Telecommunications Digital Services Data Protection Act). You can withdraw your consent at any time with effect for the future, via the “Cookie settings” link in the footer of every page or via the button below. When you withdraw, the Google Analytics and Meta cookies are deleted. We store your decision in the cookie “ub-consent” (retention 12 months) and additionally in a localStorage entry of the same name. The cookie is authoritative. When it expires, we ask again. This storage is technically necessary to respect your decision (Section 25(2) No. 2 TDDDG).

5. Analytics and advertising (consent only)

6. Server-side audience measurement

Clicks on our redirect links (e.g. /spotify, /apple, /youtube, /wolt, /newsletter-sponsoring and /go/…) and the submission of certain forms (Concierge, documentary request, needs form, newsletter sign-up) are counted by our server directly in Google Analytics. Only the event name and technical details are transmitted, such as the link target, the referring page without URL parameters, selected categories (e.g. topic or funding stage), language and sign-up source. Form contents such as name, email address or company name are not transmitted. Without your consent, this happens anonymously: each event gets a new random identifier, the identifier from the “_ga” cookie is not used, no cookies are set, and neither your IP address nor browser data is sent to Google, because the request originates from our server. The legal basis is our legitimate interest in measuring the reach of our content (Art. 6(1)(f) GDPR). Only if you have consented do we assign the event to your Analytics profile via the identifier from the “_ga” cookie (Art. 6(1)(a) GDPR). Provider, retention and third-country transfer as for Google Analytics 4 in section 5.

7. Newsletter “Founder Briefing”

We send the newsletter via beehiiv Inc., USA. beehiiv uses SendGrid (Twilio Inc., USA) as a sub-processor for delivery. We have a data processing agreement with beehiiv under Art. 28 GDPR; the transfer to the USA is based on the EU Standard Contractual Clauses. Only your email address is required. After signing up, you can voluntarily add company, funding stage and phone number. Sign-up uses double opt-in: you only receive the newsletter after clicking the confirmation link in the email from beehiiv. beehiiv records the time of sign-up and confirmation as proof. The legal basis is your consent (Art. 6(1)(a) GDPR). In addition to the transfer to beehiiv, our server notifies us of every sign-up with your email address and the sign-up source, by email to our Google Workspace mailbox and in an internal Slack channel (see section 8). beehiiv records on a per-subscriber basis whether and when you open an issue (via an invisible tracking pixel) and which links you click (via redirect links). We use this to improve the newsletter. This measurement is part of your consent to the newsletter. It cannot be withdrawn separately; withdrawal is by unsubscribing. The newsletter contains labelled sponsored content. We do not pass subscriber data to sponsors. Sponsors only receive aggregated figures such as open and click rates. You can unsubscribe at any time via the link in every issue. We store your data until you unsubscribe. After that, your email address remains stored as unsubscribed so that we can respect the unsubscription. We keep the proof of consent for up to 3 years after the subscription ends.

8. Contact forms and enquiries

If you contact us via a form (e.g. Concierge, documentary request, speaking, partner, research allowance), we process your details to handle the enquiry. The legal basis is Art. 6(1)(b) GDPR where the enquiry aims at a contract, otherwise our legitimate interest in responding (Art. 6(1)(f) GDPR). Recipients: • All enquiries are sent by email to our mailbox at Google Workspace (Google Ireland Limited, Ireland). • Concierge, documentary, needs form and partner enquiries are also posted to an internal channel at Slack (Slack Technologies, LLC, USA). • Partner and research allowance enquiries pass through our automation service n8n (n8n GmbH, Berlin). Research allowance enquiries are stored in a database at Notion (Notion Labs, Inc., USA). • Partner enquiries above a certain budget are handled by Daniel Ulmani (Ulmani Ventures), who receives the enquiry by email. After submitting a partner enquiry, we offer a link to book an appointment. It opens in a new tab at Superhuman (Superhuman Labs, Inc., USA) or Pipedrive (Pipedrive OÜ, Estonia), with name, email and company pre-filled. Data only reaches these providers when you click the link. To protect against spam, we keep your IP address in memory for 10 minutes on the partner form to limit repeated requests. If a request is blocked as spam, we record the IP address and a short text excerpt in the server log files (Art. 6(1)(f) GDPR). Retention: we delete enquiries once they have been dealt with, at the latest after 3 years without further contact. Statutory retention obligations remain unaffected.

9. AI podcast search

The podcast search on the home page and the needs assistant at /needs use an AI model from Anthropic PBC, 548 Market St, PMB 90375, San Francisco, CA 94104, USA. Your input is sent to Anthropic's API together with the conversation history. We do not pass on your IP address or cookies. The legal basis is our legitimate interest in a helpful search (Art. 6(1)(f) GDPR). Anthropic processes the data as a processor under the Data Processing Addendum, which is part of its Commercial Terms, and does not use it to train its models. The transfer to the USA is based on the EU Standard Contractual Clauses. We record the text of your search query together with language and time in the server log files to improve the search. These are deleted when Vercel's log retention ends (see section 3). There is no further storage. Please do not enter personal data in the search field.

10. Embedded content and external images

11. Transfers to third countries

The following providers are based in the USA or may transfer data there: • Vercel (hosting): EU-US Data Privacy Framework, plus EU Standard Contractual Clauses • Google (Analytics, YouTube, Google Workspace, favicons): EU-US Data Privacy Framework, plus EU Standard Contractual Clauses • Meta (Pixel): EU-US Data Privacy Framework, plus EU Standard Contractual Clauses • beehiiv (newsletter, incl. SendGrid/Twilio): EU Standard Contractual Clauses • Anthropic (AI search): EU Standard Contractual Clauses • Slack (internal notifications): EU-US Data Privacy Framework, plus EU Standard Contractual Clauses • Notion (research allowance enquiries): EU Standard Contractual Clauses • Superhuman (appointment booking): data only passes when you open the booking link yourself

12. Retention

Unless a specific period is stated in this policy, we delete personal data as soon as the purpose of processing no longer applies. Statutory retention periods, in particular under Section 147 AO (German Fiscal Code) and Section 257 HGB (German Commercial Code) (6 to 10 years), remain unaffected. In that case, processing is restricted.

13. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16 GDPR), erasure (Art. 17 GDPR), restriction of processing (Art. 18 GDPR) and data portability (Art. 20 GDPR). Right to object (Art. 21 GDPR): where we process data on the basis of our legitimate interest (Art. 6(1)(f) GDPR), you may object at any time on grounds relating to your particular situation. We will then no longer process the data unless we can demonstrate compelling legitimate grounds that override your interests, or the processing serves the establishment, exercise or defence of legal claims. You can withdraw any consent given at any time with effect for the future (Art. 7(3) GDPR). The lawfulness of processing carried out before the withdrawal remains unaffected. You have the right to lodge a complaint with a supervisory authority. The authority responsible for us is the Bavarian Data Protection Authority (Bayerisches Landesamt für Datenschutzaufsicht, BayLDA), Promenade 18, 91522 Ansbach, Germany. Please send requests to fabian@unicornbakery.de. We respond within one month.

14. No automated decision-making

We do not use automated decision-making or profiling that has legal effects or similarly significant effects (Art. 22 GDPR).