What data we collect

Brickheist collects only what's needed to run the site and provide you with a usable account.

• Account — email address, hashed password, verification status, optional marketing consent, and an optional display name used in mail salutations.
• Sessions — IP address and user-agent at login, session token cookie.
• Affiliate clicks — server-side log entry per click (timestamp + product), no personal data, no third-party cookies. Only logged after you accept Functional cookies.
• Analytics — anonymised, aggregated page views via Google Analytics 4 (Consent Mode v2, IP anonymisation). Only sent after you accept Analytics cookies.

Where your data lives

• Postgres database — Hetzner Cloud, Falkenstein, Germany (EU).
• Email delivery — Brevo (sendinblue.com), France (EU). Used to send verification mails, password resets, and (if you opt in) deal alerts. Brevo signs an EU-standard DPA and processes only what's needed to deliver the email.
• Analytics — Google Analytics 4. Aggregated data only; no personal identifiers.

How long we keep it

• Account — until you delete it.
• Active sessions — until you sign out, or 30 days of inactivity.
• Server logs — 90 days, then auto-rotated.
• Affiliate clicks — 24 months for commission reconciliation.

Your rights

Under GDPR you can exercise the following rights from your account page (or by emailing us):

• Access — download a JSON export of everything we hold about you under Account → Download your data.
• Rectification — change name, email, password, or marketing consent under Account.
• Deletion — wipe your account and all associated data under Account → Delete account. Confirmation email sent.
• Objection / Withdrawal — turn off marketing emails any time under Account → Email preferences.
• Portability — the data export is in machine-readable JSON.
• Complaint — you can lodge a complaint with the Danish Data Protection Authority (Datatilsynet).

Cookies

We use four cookie categories:

• Necessary — session, CSRF, consent itself.
• Functional — affiliate-click logging (server-side, first-party, no client cookie).
• Analytics — Google Analytics 4 with Consent Mode v2 and anonymised IP. Sends no data until you accept this category. Opt-in.
• Marketing — ad personalisation. Off by default.

You can change your preferences anytime via the cookie settings link in the footer.

Affiliate links

Brickheist earns a commission when you click through to a retailer and complete a purchase. This does not affect the price you pay. Click logging happens server-side after consent.

Contact

Questions about your data? Email hello@brickheist.com — we reply within 5 working days.