SSM Logo

Legal Information

Privacy Policy

Published legal information for Shapeshifter Media Studio is available in German and English. Where a document states that the German version controls, the German text prevails.

Privacy Policy
Switch language without leaving the page.

Privacy Policy

Version date: 15 September 2026

1. Controller

Shapeshifter Media / Josef Hinterkeuser
Schulstrasse 42a
25368 Kiebitzreihe
Germany
Email: info@shapeshiftermedia.com

2. General information on data processing

We process personal data only to the extent necessary to provide our website, the Shapeshifter Media Studio platform, our contractual services, and to ensure security, communication, billing and compliance with legal obligations.

3. Purposes, categories and legal bases of processing

Website access and technical provision

When our website or platform is accessed, technically required data may be processed, including IP address, date and time of access, visited pages and resources, referrer URL, browser type and version, operating system, and technical status and error data.

This processing is carried out for technical provision, stability, security, error analysis and prevention of misuse.

Legal basis: Article 6(1)(f) GDPR.

Registration and user account

When registering and using an account, we may process first name, last name, email address, password in hashed form, business-related information, role and account status data, and verification and consent information.

This processing is carried out for account creation and administration, authentication, platform use, communication and performance of our contractual services.

Legal basis: Article 6(1)(b) GDPR.

Project, upload and content data

In connection with Shapeshifter Media Studio, we process project data, measurement data, images, graphics, uploads and derived technical results provided by the user.

This processing is carried out to provide platform functions, calculation, visualization, file preparation, documentation and misuse control.

Legal basis: Article 6(1)(b) GDPR.

Payment processing and invoicing

For orders, invoicing and payment handling, we process billing and company data, address data, payment status and order information, and payment-related references.

Legal bases:

  • Article 6(1)(b) GDPR
  • Article 6(1)(c) GDPR

Contact requests

If you contact us by email or otherwise, we process your information to handle your request.

Legal basis:

  • Article 6(1)(b) GDPR where the request is contract-related
  • Article 6(1)(f) GDPR otherwise

Security, prevention of misuse and enforcement of rights

We also process personal data to detect, prevent and pursue misuse, security incidents, fraud, infringements of rights and other impermissible uses.

Legal basis: Article 6(1)(f) GDPR.

Product, usage and conversion analytics

Within Shapeshifter Media Studio, we may process our own first-party product, usage and conversion analytics in order to better understand the use of our website and platform, evaluate the effectiveness of content and campaigns, improve product flows and monitor business development.

This may include in particular event types, timestamps, visited pages or routes, referrer information, UTM parameters, short-link identifiers, session or device-state identifiers, technical context data and, for signed-in users, a link to the relevant user account.

Where non-essential storage technologies or readable identifiers on the end device are used for such analytics purposes and consent is legally required for that use, they are used only on the basis of your prior consent. Any subsequent analysis of the collected data is carried out, where applicable, on the basis of your consent or otherwise on the basis of our legitimate interests in product steering, reach measurement, conversion analysis and misuse control.

Legal bases:

  • Article 6(1)(a) GDPR where consent has been given
  • Article 6(1)(f) GDPR otherwise

Newsletter and email marketing

When you subscribe to one or more of our newsletters, we process the data you provide (in particular your email address and, where provided, your name and country) in order to send you the selected newsletter with information, news and offers relating to Shapeshifter Media.

Subscription uses a double opt-in procedure: after you sign up, we send you an email containing a confirmation link, and we only begin sending the newsletter once you have confirmed via that link. To demonstrate consent, we log the time of the subscription and confirmation and the IP address used.

The legal basis for sending the newsletter is your consent pursuant to Article 6(1)(a) GDPR. You may withdraw your consent and unsubscribe at any time with effect for the future; an unsubscribe link is included at the end of every newsletter email. After you unsubscribe, your email address is added to a suppression list.

For operating and delivering the newsletters we use the processors phpList (newsletter management) and Resend (email delivery).

4. Cookies, local storage and similar technologies

We use technically necessary cookies and comparable storage technologies, in particular for login and authentication functions, session management, security functions, workflow continuity and certain ordering and payment processes.

In addition, Shapeshifter Media Studio may use first-party analytics and conversion technologies, in particular to evaluate reach, campaign performance, product usage, registrations, verifications, invoice-ready profile states, first project creation and first paid orders.

Where non-essential technologies are used for these purposes and consent is legally required, they will only be used on the basis of the required consent.

5. Recipients and categories of recipients

Personal data may be disclosed to hosting and infrastructure providers, technical service providers, payment service providers, email and communication providers, external advisers and authorities or courts where necessary or legally required.

6. Storage period

We store personal data only for as long as necessary for the respective purposes or as required by statutory retention obligations, limitation periods or legitimate interests.

7. Transfers to third countries

Where we use service providers for whom processing outside the European Union or the European Economic Area cannot be ruled out, this takes place only in compliance with the applicable legal requirements.

8. Rights of data subjects

Data subjects have the following rights in particular:

  • right of access
  • right to rectification
  • right to erasure
  • right to restriction of processing
  • right to data portability
  • right to object
  • right to lodge a complaint with a supervisory authority

Where processing is based on consent, such consent may be withdrawn at any time with effect for the future.

9. Obligation to provide data

The provision of certain personal data is necessary for registration, contract conclusion, billing, platform use and security checks. Without such data, we may be unable to provide our services in whole or in part.

10. No automated decision-making in the legal sense

No solely automated decision-making, including profiling within the meaning of Article 22 GDPR, takes place unless expressly stated otherwise in the individual case.

11. Changes to this privacy policy

We reserve the right to amend this privacy policy where this becomes necessary due to legal, technical or organizational changes. The current version available on the website shall apply.