Privacy policy
How this site handles personal data — pursuant to Art. 13 GDPR
Controller
Yuli Studio GmbHSebastian-Bauer-Str. 16d
81737 München
Germany
Represented by its managing director, Michael Stark
sayhello@yuli.studio →
The short version
This site runs no analytics, no advertising tools and no tracking of any kind. It sets no cookies. What little processing happens is described below — completely.
Hosting and server logs
yuli.studio is served by Cloudflare, Inc. (101 Townsend St., San Francisco, CA 94107, USA) as hosting and content-delivery provider. When you visit the site, Cloudflare processes the technical data your browser transmits — IP address, date and time of the request, requested URL, referrer, browser and operating system — in server logs, in order to deliver the site reliably and to protect it against attacks. The legal basis is our legitimate interest in a secure, performant website (Art. 6 (1) (f) GDPR). Log data is kept only as long as these purposes require. We have a data processing agreement with Cloudflare; Cloudflare is certified under the EU-US Data Privacy Framework.
No cookies, one local setting
The public site sets no cookies. The only thing it stores in your browser is your theme preference (dark or light) in localStorage — a purely functional setting that is strictly necessary for the feature you chose (§ 25 (2) TDDDG), never leaves your device and stays until you clear your browser storage.
Fonts
All fonts are self-hosted. Visiting this site triggers no requests to third-party font services.
Contact by email
When you write to sayhello@yuli.studio, we process your email address and the content of your message to handle your inquiry (Art. 6 (1) (b) GDPR where it relates to a contract, otherwise Art. 6 (1) (f)). We keep correspondence as long as the matter requires, plus any statutory retention periods.
Client area
The invite-only client area at systems.yuli.studio uses the authentication service Supabase to manage sign-ins. Signing in works via a magic link: we process your email address and login timestamps, and Supabase sets session cookies that are strictly necessary for authentication (§ 25 (2) TDDDG). The legal basis is the provision of the client area you requested (Art. 6 (1) (b) GDPR). Accounts exist only for clients we have invited; account data is deleted when the engagement ends.
Your rights
Under the GDPR you have the right to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21). You may also lodge a complaint with a data protection supervisory authority — for us, the Bavarian Data Protection Authority (BayLDA). We use no automated decision-making or profiling, and you are under no obligation to provide personal data to visit this site.
Last updated · August 2026