Last updated: October 2026
This privacy policy explains how we process personal data on wurstcircle.com (recipes and guides) and member.wurstcircle.com (books, courses and the member area), and in connection with orders, emails and courses.
1. Controller
wuda GmbH
represented by its managing director Daniel Wulf
Narzissenweg 5
91154 Roth
Germany
Email: daniel@wurstcircle.com
We have not appointed a data protection officer because we are not legally required to. For any privacy question, write to the email address above.
2. Overview and legal bases
We process personal data only as far as needed to run our websites, handle orders and courses, communicate with you or, with your consent, for analytics and advertising. The legal bases are:
- Art. 6(1)(a) GDPR: your consent (e.g. analytics and marketing services, newsletter, embedded videos).
- Art. 6(1)(b) GDPR: performing a contract or steps before one (e.g. order, customer account, course access).
- Art. 6(1)(c) GDPR: legal obligations (e.g. retention duties under tax and commercial law).
- Art. 6(1)(f) GDPR: legitimate interests (e.g. secure and stable operation, fraud prevention, direct marketing to existing customers).
- Section 25(1) TDDDG (German Telecommunications Digital Services Data Protection Act): consent to storing or reading information on your device; Section 25(2) no. 2 TDDDG where this is strictly necessary for a service you explicitly requested.
3. Retention
We keep personal data only as long as the purpose requires or the law obliges us to. Contract and invoice data are kept for up to ten years under German commercial and tax law (Section 257 HGB, Section 147 AO). Specific retention periods are given in the sections below. Data processed on the basis of consent is deleted after you withdraw it, unless another legal basis applies.
4. Your rights
You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20), and you can withdraw any consent at any time with effect for the future (Art. 7(3) GDPR).
Right to object (Art. 21 GDPR): where we process data on the basis of legitimate interests, you can object at any time on grounds relating to your particular situation. You can object to processing for direct marketing at any time without giving reasons; we will then stop using your data for that purpose.
You also have the right to lodge a complaint with a data protection supervisory authority. The authority responsible for us is the Bavarian State Office for Data Protection Supervision (BayLDA), Promenade 18, 91522 Ansbach, Germany.
5. Transfers to third countries
Some of the service providers named below are based in the USA or process data there. Where a provider is certified under the EU-US Data Privacy Framework, the transfer is based on the European Commission’s adequacy decision (Art. 45 GDPR). Otherwise we rely on the European Commission’s standard contractual clauses (Art. 46(2)(c) GDPR). We have concluded data processing agreements (Art. 28 GDPR) with all providers that process data on our behalf.
6. Hosting, delivery and security
Hosting: our websites run on servers of Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany, in Germany. All content, databases and backups are stored there.
Server log files: every request processes technically necessary data (IP address, date and time, page requested, referrer, browser and operating system) to keep the websites secure and stable (Art. 6(1)(f) GDPR). Log files are deleted after 14 days unless they are needed to investigate a specific security incident.
Cloudflare: we deliver our websites through the content delivery network of Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA, which also protects them against attacks (e.g. DDoS, bot traffic). Your requests pass through Cloudflare’s servers; this processes in particular your IP address and technical connection data. Cloudflare may set technically necessary cookies to fend off attacks (e.g. __cf_bm). The legal basis is our legitimate interest in a secure and fast service (Art. 6(1)(f) GDPR; Section 25(2) no. 2 TDDDG).
Emoji graphics: our pages load emoji graphics from WordPress.org servers (Automattic Inc., USA), which transmits your IP address (Art. 6(1)(f) GDPR).
7. Cookies and consent management
We use cookies and similar technologies (e.g. local storage). Technically necessary cookies are set without consent because they are strictly necessary for the service you requested (e.g. cart, login, payment). All other services load only after you have consented in our cookie banner.
Our cookie banner is self-hosted software (CookieConsent) that runs on our own servers; no data goes to a banner provider. We store your choice in the cookie cc_cookie on your device (valid for wurstcircle.com and member.wurstcircle.com, for 12 months) so we do not have to ask again on your next visit. The legal basis is Section 25(2) no. 2 TDDDG and Art. 6(1)(c) GDPR (proof of consent).
The services fall into these categories:
- Necessary: always active (sections 6 and 9 to 11 as far as technically required).
- Statistics: reach and usage analysis (section 13).
- Marketing: advertising and conversion measurement (section 14).
- External media: embedded videos and third-party content (section 16).
Through Google Consent Mode we pass your choice to Google services; without consent they are not loaded. You can change or withdraw your consent at any time with the “Cookie Settings” link in the footer of every page.
8. Contacting us
If you email us, we process your details (name, email address, message) to handle your request (Art. 6(1)(b) or (f) GDPR). Our mailbox is provided by Google Workspace (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland).
Sending email: system emails from our websites (e.g. order confirmations, password emails) are sent through Amazon Simple Email Service (Amazon Web Services EMEA SARL, 38 Avenue John F. Kennedy, L-1855 Luxembourg) with servers in Frankfurt am Main, Germany (Art. 6(1)(b) and (f) GDPR).
9. Comments and ratings
Comments: when you leave a comment, we store your name, email address, website (optional), the comment, the time and your IP address. We keep the IP address for security reasons in case someone posts unlawful content (Art. 6(1)(f) GDPR). Spam is filtered with the Antispam Bee plugin, which runs only on our server. Your email address is not published. If you tick the box under the form, your browser remembers your name, email address and website in cookies for your next comment.
Recipe ratings: when you rate a recipe, we store the rating and your IP address on our server to prevent abuse and multiple ratings (Art. 6(1)(f) GDPR).
10. Store and orders (member.wurstcircle.com)
Order and customer account: to process your order we process your name, billing address, email address, order and payment data, and the IP address from which you ordered (Art. 6(1)(b) GDPR; for the IP address, fraud prevention under Art. 6(1)(f) GDPR). If you create a customer account, these details are also stored in your account; you can ask us by email to delete it at any time. We keep invoice and accounting data because the law requires it (Art. 6(1)(c) GDPR).
Cart and checkout: cart, checkout, order bumps and one-click offers use technically necessary cookies and session storage from WooCommerce and FunnelKit (e.g. wp_woocommerce_session_*, woocommerce_cart_hash, woocommerce_recently_viewed). An order is not possible without them (Section 25(2) no. 2 TDDDG).
Source measurement: with your consent (Statistics), WooCommerce stores how you reached the store (e.g. referrer, campaign parameters, landing page, device type; cookies sbjs_*) and attaches this to your order so we can see which channels work.
Order management: to manage orders and invoices we transfer order data to Billbee (Billbee GmbH, Germany) (Art. 6(1)(b) and (c) GDPR).
Terms: our terms and conditions and withdrawal policy apply to orders.
Delivery of ebooks: after your purchase you receive the download link by email. These emails are sent through ActiveCampaign (section 12), which receives your email address, name and the products you bought for this purpose (Art. 6(1)(b) GDPR).
11. Payment providers
Depending on the payment method you choose, payment is processed by the following providers, to whom we pass the data needed for the payment (name, address, email address, order amount) (Art. 6(1)(b) GDPR). For fraud prevention the providers also collect device and connection data and set the cookies needed for this (Art. 6(1)(f) GDPR; Section 25(2) no. 2 TDDDG).
- Stripe (credit card, Link): Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Dublin, Ireland. Stripe’s script already loads on our product pages so that payment and fraud detection work (cookies
__stripe_mid,__stripe_sid). If you use Link, Stripe stores your payment details for future purchases under its own terms. - PayPal: PayPal (Europe) S.à r.l. et Cie, S.C.A., 22–24 Boulevard Royal, L-2449 Luxembourg. You are redirected to PayPal to pay.
12. Newsletter, free guides and email marketing
Newsletter and free guides: if you sign up for our newsletter or a free guide, we process your email address and, if given, your first name on the basis of your consent (Art. 6(1)(a) GDPR). We use the double opt-in procedure: you receive an email in which you confirm your sign-up. We record the sign-up and the confirmation (time, IP address) so we can prove your consent. You can unsubscribe at any time with the link in every email.
Sign-up forms: some sign-up forms on wurstcircle.com are provided by ConvertBox (ConvertBox, USA). ConvertBox stores in your browser which forms you have already seen and loads scripts and fonts from Fastly (USA) and Bunny Fonts (BunnyWay d.o.o., Slovenia). We load ConvertBox only with your consent (Marketing). Your entries are passed on to ActiveCampaign. Other forms send your entries from our server directly to ActiveCampaign.
ActiveCampaign: for the newsletter, free guides, ebook delivery and customer communication we use ActiveCampaign (ActiveCampaign, LLC, 1 N Dearborn St, Chicago, IL 60602, USA). It stores your email address, name, sign-ups, purchased products, course access and your interactions with our emails (opens, clicks), so we can send content that fits your interests and measure how our emails perform. The legal basis is your consent or, for customers, Art. 6(1)(b) and (f) GDPR.
Emails to customers: if you have bought from us, we pass your email address, name and purchased products to ActiveCampaign and occasionally send you information about our own similar products (Section 7(3) UWG, Art. 6(1)(f) GDPR). You can object to this at any time, without costs other than the transmission costs at basic rates, using the unsubscribe link in every email or by writing to daniel@wurstcircle.com.
13. Analytics (Statistics category)
We use the following services only with your consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG). You can withdraw your consent at any time under “Cookie Settings”.
Google Tag Manager and server-side processing: we use Google Tag Manager (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland) to control the analytics and marketing services below. Data first goes to our own tagging server at data.wurstcircle.com, which runs in Google Cloud in Belgium (europe-west1). There we decide which data goes to which service and can shorten or remove data before passing it on. The tagging server sets the cookies FPID, FPLC and FPAU (up to 2 years). Purchases are logged there for 30 days for troubleshooting.
Google Analytics 4: with Google Analytics (Google Ireland Limited) we analyse how our websites are used (pages viewed, time on page, source, device, purchases including order value and products). It sets cookies (_ga, _ga_*) and uses a pseudonymous identifier. For purchases we also send hashed customer data such as email address and name, plus city, postal code and country. Google Signals is off. Event data is deleted after 2 months; user-level data after 14 months without new activity.
PostHog: with PostHog (PostHog, Inc., 2261 Market St., San Francisco, CA 94114, USA; data processed in the EU, Frankfurt) we analyse how our pages are used: page views, clicks, scroll depth and heatmaps. On our sales pages (wurstcircle.com/sp/ and /lp/) and in the checkout on member.wurstcircle.com we also record sessions (mouse movements, clicks, page changes, technical browser messages) to find usability problems; text typed into form fields is masked and not recorded. Recordings are deleted after 30 days. PostHog sets a cookie (ph_*_posthog, 1 year) for wurstcircle.com and member.wurstcircle.com and uses your IP address only to determine your approximate location (country); the full IP address is not stored. When you buy from us or are logged in to the member area, we link your usage data to your email address; we also report every paid order to PostHog from our server (email address, order number, products, amount, coupons, payment method). PostHog is reached through our subdomain ph.wurstcircle.com.
Affiliate click statistics: clicks on partner links on wurstcircle.com (section 15) are counted on our own server with the link, time and referring page; your IP address is not stored. Click data is deleted after 12 months.
14. Marketing (Marketing category)
We use the following services only with your consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG). You can withdraw your consent at any time under “Cookie Settings”.
Google Ads: we advertise with Google Ads (Google Ireland Limited) and measure whether visitors buy from us after clicking an ad (conversion tracking). The Google tag on our pages uses cookies (_gcl_au, _gcl_aw, test_cookie) and can be used to show our ads to visitors of our websites later on Google and partner sites (remarketing).
Meta Pixel and Conversions API: we use the Meta Pixel and the Conversions API of Meta Platforms Ireland Limited, Merrion Road, Dublin 4, Ireland. They measure how our ads on Facebook and Instagram perform (e.g. page views, product views, cart, checkout, purchase, newsletter sign-up) and let us show ads there to visitors of our websites (Custom Audiences). The pixel sets cookies (_fbp, _fbc, fr). We also send these events directly to Meta from our tagging server, including hashed customer data (email address, phone number, first and last name) and IP address and browser identifier, so Meta can match them. We are jointly responsible with Meta for collecting and transmitting this data (Art. 26 GDPR); the agreement is at https://www.facebook.com/legal/controller_addendum. Meta may transfer the data to the USA.
Campaign parameters: if you arrive through an ad, we keep the ad’s campaign parameters (e.g. utm_*, gclid, fbclid) in your browser for the session and add them to links to member.wurstcircle.com, so a later purchase can be attributed to the right ad.
Purchase measurement if the connection drops: so that a purchase is measured even when the order confirmation page does not load, we store the identifiers of the analytics and advertising cookies with the order. If the confirmation page is not opened within 20 minutes, we send the purchase with hashed customer data through our tagging server to Google Analytics, Google Ads and Meta. This happens only if you consented to Statistics or Marketing.
15. Affiliate links
On wurstcircle.com we link to products at Amazon.com. As an Amazon Associate we earn from qualifying purchases; your price does not change. Amazon.com Services LLC, 410 Terry Avenue North, Seattle, WA 98109, USA, sets cookies to attribute commissions only after you click such a link, on Amazon’s own website. Our server counts the click as described in section 13.
16. Embedded content (External media category)
Videos and third-party content load only after you have consented to “External media” or clicked the individual item (Art. 6(1)(a) GDPR, Section 25(1) TDDDG). Loading them transmits your IP address to the provider, which may set cookies.
- YouTube: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Our recipe and course videos come from YouTube. Until you click play we show only the video’s preview image, which is loaded from YouTube’s image server (
i.ytimg.com); this transmits your IP address to Google but sets no cookies. After you click, YouTube sets cookies such asYSC,VISITOR_INFO1_LIVEandVISITOR_PRIVACY_METADATA. - Vimeo: Vimeo.com, Inc., 330 West 34th Street, New York, NY 10001, USA. Course videos in the member area are provided through Vimeo.
- Google Docs: some course material is embedded from Google Docs (Google Ireland Limited).
Fonts and scripts in the member area: member.wurstcircle.com loads fonts from Google Fonts (Google Ireland Limited) and Bunny Fonts (BunnyWay d.o.o., Slovenia), and its login page loads scripts from Google (Google sign-in) and Meta (Facebook SDK). This transmits your IP address to these providers.
17. Online courses and member area
Course access and account: for access to courses you bought we create a user account on member.wurstcircle.com and process your name, email address, login data and learning progress (Art. 6(1)(b) GDPR). Through the WP Fusion plugin we sync your name, email address, purchases and login times with ActiveCampaign (section 12).
Community: the member area has member profiles and community features that only logged-in members can see. Your profile name and what you post in the community are visible to other logged-in members. Any further profile details are voluntary.
Analytics: if you are logged in to the member area and have consented to Statistics, we link your usage data in PostHog to your email address (section 13).
Deletion: your account stays active as long as you have access to your courses. You can ask us by email to delete it at any time; this also ends your course access.
18. Social media
We run a YouTube channel (Google Ireland Limited). When you visit it or interact with us there, Google processes your data under its own terms. The legal basis for our use is our legitimate interest in communicating with you (Art. 6(1)(f) GDPR).
19. Changes
We update this privacy policy when our data processing or the law changes. The version published here applies.