Privacy Policy

Version: 29 October 2026

Deutsche Fassung

1. Controller

Florian Mielke
Bleicherwiesen 14
31224 Peine
Germany
Email: [email protected]

The controller is referred to below as “freelance.link”.

2. Scope and roles

This Privacy Policy applies to the website, public profile pages, badges, QR codes and the API and the MCP server of freelance.link, as well as accounts, the waitlist, subscriptions, support and business contacts. freelance.link determines the purposes and means of these processing operations.

3. Website and technical delivery

When the website, a public profile page, a badge embedded on another website or the API is accessed, the systems used process technical request data. This may include the IP address, time, target address, HTTP method, status code, volume of data transferred, referrer, user agent, request ID and security events.

freelance.link processes this data to deliver the Service, defend against attacks, investigate errors and demonstrate secure operation. The legal basis is Article 6(1)(f) GDPR. The legitimate interests are the secure and reliable operation of the Service.

Cloudflare processes network data, including IP addresses and security assessments derived from them, also for its own security and operational purposes as an independent controller. Further information, including the retention criteria, is available in the Cloudflare Privacy Policy.

To measure the reach of the website, freelance.link uses Plausible Analytics of Plausible Insights OÜ as a processor. Plausible processes the page visited, the referrer, browser, operating system and device type derived from the user agent, an approximate location derived from the IP address, scroll depth and active visit time, and clicks on external links, downloads and form submissions without form contents. To count visitors, Plausible creates a daily changing hash from the IP address and user agent; the IP address and user agent are not stored. Plausible does not set cookies. The legal basis is Article 6(1)(f) GDPR. The legitimate interest is the evaluation of website usage in aggregated form.

When a visitor clicks “Get in touch” on a public profile page, freelance.link counts the click together with the profile, the time and whether the visitor came from a waitlist email. IP addresses or other identifiers are not stored with it. The legal basis is Article 6(1)(f) GDPR. The legitimate interest is evaluating whether freelance.link leads to contacts.

4. Account and sign-in

When a person creates and uses an account, freelance.link processes:

  • email address;
  • password hash and email verification status;
  • account, plan and time information;
  • session identifier, IP address and user agent;
  • Google account identifier when signing in with Google;
  • API key.

If the data subject is a party to the contract, the processing serves to enter into and perform the contract under Article 6(1)(b) GDPR. For employees or other representatives of a business customer, it is based on Article 6(1)(f) GDPR. The legitimate interest is entering into, administering and performing the contract with the customer.

An email address and either a password or a Google account are required to create an account. Without this information, freelance.link cannot provide an account.

To protect against automated and abusive sign ups, freelance.link uses Cloudflare Turnstile from Cloudflare, Inc. The legal basis is the corresponding legitimate interest under Article 6(1)(f) GDPR. Cloudflare processes IP addresses and browser and device characteristics on behalf of freelance.link and, as an independent controller, to improve its bot detection. Necessary access to the device is based on section 25(2) no. 2 TDDDG. Registration with email and password is not possible without successful security verification. Further information is available in the Turnstile Privacy Addendum.

When a person signs in with Google, Google sends freelance.link the Google account identifier, the email address, its verification status and, for Google Workspace accounts, the domain. Google Ireland Limited, Ireland, and Google LLC, USA, process sign-in data as independent controllers. Further information is available in the Google Privacy Policy.

5. Profile and public pages

In the account, a person can add a username, first and last name, job title, bio, links, an avatar, projects with start date, end date, workload and a private note. Once the email address is verified, the profile has a username, first and last name, availability is entered, and the account has an active trial or subscription, the profile page, badge and link preview image are publicly accessible, including to search engines. Private notes and the API key are visible only in the account; private notes also through the API with the freelancer's API key and to a connected agent if the freelancer allows it (section 7). The legal bases stated in section 4 apply.

With the API key, the freelancer's own scripts and services receive the data of the public profile, the first free day, the next 26 weeks in days per week, projects with their period, days per week, status and private note, and absences. The API returns only the data of the account the key belongs to. Creating a new key replaces the old one.

Avatars and link preview images are stored in object storage in the EU and delivered from there.

6. Waitlist

On a public profile page, visitors can ask to be notified by email when the freelancer's availability changes. For this, freelance.link processes the email address, the optional details on start month, duration and days per week, the times of sign-up, confirmation and the last notification, and a random identifier for the links in the emails.

Sign-up uses a double opt-in: freelance.link first sends an email with a confirmation link, and only sends notifications after confirmation. The legal basis is consent under Article 6(1)(a) GDPR. The email address is required for notifications; the details are voluntary. The times of sign-up and confirmation serve as proof of consent under Article 7(1) GDPR. To protect the sign-up against automated misuse, freelance.link uses Cloudflare Turnstile as described in section 4. Emails are sent through Amazon SES in Frankfurt, Germany.

The freelancer sees the confirmed email address and the details in their account and decides for each change of availability whether notifications are sent. Where the freelancer uses this data for their own purposes, for example to get in touch, they do so as an independent controller.

Consent may be withdrawn at any time with effect for the future, using the link in every email or by email to [email protected]. Withdrawal erases the email address and the details.

7. Connecting your own agent

Freelancers can connect their own AI agent, such as Claude, ChatGPT, Codex or Cursor, to their account through the Model Context Protocol (MCP). When connecting, the freelancer chooses whether the agent may only read the availability or also change it, and whether it may notify the waitlist. For this, freelance.link processes the name and redirect addresses the agent provides when it registers, the chosen permissions, the times of connecting and disconnecting, and access and refresh tokens, which are stored only as hashes. The legal bases stated in section 4 apply.

Depending on its permissions, the connected agent receives the status and free periods, projects with their period, days per week, status and private note, absences, and the number of people on the waitlist with their optional details on start month, duration and days per week. The agent does not receive email addresses from the waitlist. With the permission to notify, the agent can trigger the notifications described in section 6 on the freelancer's instruction. Where the freelancer retrieves details of people on their waitlist through their agent, they do so as an independent controller as described in section 6.

The agent's provider, such as Anthropic or OpenAI, processes the retrieved data and the conversation with the freelancer as an independent controller under its own terms and privacy notices. freelance.link transfers the data at the freelancer's request and has no influence on how the provider stores or uses it.

A connection expires after 90 days without use. The freelancer can disconnect it at any time under Account → Connections or in their agent, which invalidates its tokens.

8. Subscription and payment

freelance.link processes the plan, trial period, subscription status, and Stripe customer and subscription identifiers. For subscriptions and payments, freelance.link shares the verified email address, the account identifier and the selected plan with Stripe. Payment data is collected in Stripe Checkout, the Billing Portal or Link. freelance.link receives from Stripe only the information required for the subscription, invoice and payment status.

The legal basis is Article 6(1)(b) GDPR if the data subject is a party to the contract. For representatives of a business customer, Article 6(1)(f) GDPR applies; the legitimate interest is billing under the contract and payment processing. Processing under tax law is based on Article 6(1)(c) GDPR.

As part of Managed Payments, Stripe processes data as a controller, in particular for order management, tax handling, fraud prevention and payment support. Where Stripe processes data on freelance.link's instructions, it acts as a processor. Further information is available in the Stripe Privacy Policy.

9. Email, support and business contacts

freelance.link processes contact details, content, attachments and transmission metadata when a person requests support, initiates a business relationship or receives a service email.

Article 6(1)(b) GDPR applies to requests for entering into or performing a contract with the data subject. In other cases, processing is based on Article 6(1)(f) GDPR; the legitimate interests are responding to requests, customer support, troubleshooting and business communication. Communications required by law are based on Article 6(1)(c) GDPR.

Transactional emails are sent through Amazon SES in Frankfurt, Germany. Incoming emails are forwarded by Cloudflare and stored in Microsoft 365 of Microsoft Ireland Operations Limited, Ireland.

10. Cookies and similar storage

The website uses storage for sign-in, security and the functions requested by the user.

Storage Purpose Storage period
Login identifier recognise the signed-in session and allow it to be revoked until sign-out, server-side revocation or account deletion
Application session session protection and technical session functions until the end of the browser session

Storage of the login identifier and application session is based on section 25(2) no. 2 TDDDG. To the extent that the stored values are personal data, the legal bases stated in sections 3 and 4 apply.

Stripe may set cookies in its own Checkout and Billing Portal. Stripe's information applies to these cookies.

11. Recipients

freelance.link transfers personal data only to the extent necessary for the stated purposes. Recipients may include:

  • Render Services, Inc., USA, for hosting of the application and database, logging and backup, with the application, database and backups in Frankfurt;
  • Cloudflare, Inc., USA, for network delivery and protection, bot protection at sign-up and when joining a waitlist, email routing and object storage in the EU;
  • Functional Software, Inc. d/b/a Sentry, USA, for error diagnostics, with data storage in the EU;
  • Stripe Payments Europe, Limited, Stripe Technology Europe, Limited and Stripe Technology Company Limited (Ireland), and Stripe, LLC and Sold through Link, LLC (USA), for subscriptions and payments;
  • Amazon Web Services for sending emails;
  • Microsoft Ireland Operations Limited, Ireland, for email hosting with Microsoft 365;
  • Plausible Insights OÜ, Estonia, for measuring the reach of the website;
  • Google for sign-in with Google;
  • the provider of the agent a freelancer connects, for the data described in section 7;
  • the freelancer whose waitlist a person joins, for the data described in section 6;
  • legal, tax and other advisers, where engaged;
  • public authorities and courts where there is a legal obligation.

12. Transfers to third countries

Some of the recipients named in section 11 have companies or infrastructure outside the European Economic Area or access data from outside it, particularly in the USA.

The EU-US Data Privacy Framework applies to covered transfers to Render Services, Inc., Cloudflare, Inc., Functional Software, Inc., Microsoft Corporation, Stripe, LLC and Google LLC in the USA. Where it does not apply, the EU Standard Contractual Clauses agreed in the respective data processing agreement apply; with Stripe, they have been agreed in the Data Transfers Addendum as a fallback. Sentry may also process data in Canada for operations and technical support; the European Commission's adequacy decision for Canada applies to this processing. For other transfers to countries without an adequacy decision, freelance.link uses EU Standard Contractual Clauses and necessary supplementary measures.

Onward transfers by Stripe, LLC to Sold through Link, LLC are subject to the safeguards under the Data Privacy Framework or the agreed Standard Contractual Clauses, as applicable.

A copy of the agreed safeguards for transfers of personal data to third countries, in particular the EU Standard Contractual Clauses, may be requested at [email protected].

13. Retention and erasure

The following periods and criteria apply to retention and erasure:

  • accounts and operational data: for the term of the contract, including periods without a subscription. After the contract ends, only data required for statutory retention obligations or for the establishment, exercise or defence of legal claims is retained;
  • sessions: until sign-out, server-side revocation or account deletion;
  • connections with an agent: until account deletion; disconnected and expired connections remain stored without valid tokens;
  • unconfirmed waitlist sign-ups: seven days, then erased in the daily erasure run;
  • waitlist entries: until unsubscribing or until the freelancer's account is deleted;
  • counted clicks on “Get in touch”: until the freelancer's account is deleted;
  • usernames of deleted accounts: reserved for twelve months after account deletion, so that nobody else takes over the profile address right away, and then erased in the daily erasure run;
  • application logs at Render: seven days;
  • security events in Cloudflare Security Events: 24 hours;
  • request data in Cloudflare Security Analytics: seven days;
  • event data from reach measurement at Plausible: for as long as it is needed to evaluate website usage, at the latest until freelance.link stops using Plausible;
  • Sentry events: 30 days under the current configuration;
  • contact and support communications: until handling is complete; thereafter only to the extent required by statutory retention obligations or the establishment, exercise or defence of legal claims.

14. Data subject rights

Subject to the GDPR, data subjects may request:

  • access;
  • rectification;
  • erasure;
  • restriction of processing;
  • data portability.

Right to object: Where processing is based on legitimate interests, data subjects have the right to object on grounds relating to their particular situation.

Requests may be sent to [email protected].

Data subjects may lodge a complaint with a data protection supervisory authority. The State Commissioner for Data Protection of Lower Saxony is generally responsible for freelance.link.