1. Controller
Kaushal Dabhi
c/o Online-Impressum 7387
Europaring 90
53757 Sankt Augustin
Email: hello@stablewerk.com
2. Server logs from hosting
This website is hosted by Vercel Inc. When you access the site, Vercel automatically processes technical connection data (including IP address, page requested, date and time, browser type) to deliver the website reliably and securely. This processing is based on our legitimate interest in operating the website reliably and securely (Art. 6(1)(f) GDPR).
3. Web analytics (Vercel Web Analytics)
We use Vercel Web Analytics to understand how our website is used (e.g. page views, approximate visit origin). The service operates without cookies: visit sessions are identified server-side via a hash of IP address and user agent, not a persistent, re-identifiable identifier. This session data is automatically discarded after 24 hours; there is no cross-site tracking.
Vercel Speed Insights also runs without cookies and records technical performance metrics on page loading; the legal basis is the same as for Vercel Web Analytics.
We additionally track the following custom events: a click on the email contact links ("Request access" / "hello@stablewerk.com"); on the source-of-funds check page, the anonymous start of an analysis and the anonymous generation of a source-of-funds file, each with the number of files loaded; a view of the format specification page; the sending of the contact form, with the page it was sent from, not its content; on the CARF XML validator page, the anonymous run of a check with its result (passed or number of findings) and the loading of the sample file, never file content; and, when a loaded file matches no supported format, solely the column names of its header row (trimmed and sanitised, at most eight), so we know which exchange format to support next. In each case only the fact that the event occurred is recorded, plus the details named here. Neither message contents nor any row or transaction data from loaded files are transmitted; the files used by the source-of-funds check are processed entirely locally in your browser and never leave your machine.
The legal basis is our legitimate interest in understanding and improving how our website is used (Art. 6(1)(f) GDPR).
3a. Web analytics (Plausible)
If enabled: we use Plausible Analytics, a service of Plausible Insights OÜ, Västriku tn 2, 50403 Tartu, Estonia. The data collected covers the page requested, the referring source, device type, browser, operating system and approximate location at country, region and city level. Location is derived from the IP address; the IP address itself is not stored.
Plausible sets no cookies and uses no persistent identifier that could re-identify you across page views or across websites. Because nothing is stored on or read from your device, no consent under section 25(1) TTDSG is required. The legal basis is our legitimate interest in understanding how this website is used (Art. 6(1)(f) GDPR). You may object to this processing at any time.
Processing takes place exclusively on infrastructure within the European Union (Hetzner in Germany, UpCloud in Finland, Bunny in Slovenia). No transfer to a third country takes place. Further information is available from the provider at plausible.io/data-policy.
3b. Google Analytics (only with your consent)
If enabled: in addition we use Google Analytics 4, a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google Analytics uses cookies and similar technologies and also transfers data to Google LLC in the United States. The data collected includes a truncated IP address, pages viewed, time on page, and device and browser details.
The legal basis is solely your consent under Art. 6(1)(a) GDPR and section 25(1) TTDSG. Without your consent Google Analytics is not loaded at all: no Google scripts are fetched and no cookies are set unless you have actively agreed. You may withdraw your consent at any time with effect for the future.
4. What we do not collect
Without your consent this website uses no cookies. There is no newsletter. The "Request access" button leads to the contact form (section 4a). Plain email links open your own email client.
4a. Contact form
On individual pages there is a form for requesting access. It asks for your name, email address, optionally your phone number and your company or firm, and your message. These details are relayed to our mailbox as an email only and are not written to any database; nothing is retained beyond the email itself. Handling thereafter is the same as for any other email to us (see section 5).
To deliver that email we use the service provider Resend (Resend, Inc., USA) as a processor; the message is delivered to a mailbox we operate. The legal basis is Art. 6(1)(b) GDPR (pre-contractual steps) or Art. 6(1)(f) GDPR (legitimate interest in responding to your enquiry). If you would rather avoid a transfer to a US provider, write to us directly at hello@stablewerk.com instead; the address is shown beneath every form.
5. Email contact
If you contact us by email, we process the data you provide (e.g. your email address, name, message content) to handle your enquiry. The legal basis is Art. 6(1)(b) GDPR (pre-contractual steps) or Art. 6(1)(f) GDPR (legitimate interest in responding to your enquiry), depending on the content of your enquiry.
If you explicitly ask us by email to receive the "crypto bookkeeping update", we store your email address for that purpose and send you the issues as plain emails. The legal basis is your consent (Art. 6(1)(a) GDPR). You can stop at any time, an informal reply is enough; your address is then removed from the list. There is no delivery tracking (no open or click measurement) and your address is not shared. Alternatively, the blog is available as an RSS feed, which involves no data collection at all.
6. Recipients and third-country transfers
For hosting and web analytics we use Vercel Inc. (USA). This transfer is based on the EU Standard Contractual Clauses or an equivalent adequacy mechanism. Further information is available from Vercel at vercel.com/legal/privacy-notice. For the audience measurement described in section 3a we additionally use Plausible Insights OÜ (Estonia); that processing takes place entirely within the EU and is not a third-country transfer.
7. Retention
Analytics session data is automatically deleted after 24 hours. Server logs are retained by Vercel for a limited period as part of normal operations. Emails you send us are kept for as long as necessary to handle your enquiry and to meet any applicable statutory retention obligations.
8. Your rights
You have the right to access (Art. 15 GDPR), rectification (Art. 16 GDPR), erasure (Art. 17 GDPR), restriction of processing (Art. 18 GDPR), data portability (Art. 20 GDPR), and objection to processing based on Art. 6(1)(f) GDPR (Art. 21 GDPR). To exercise these rights, an informal email to hello@stablewerk.com is sufficient. You also have the right to lodge a complaint with a data protection supervisory authority.
Last updated: October 2026