Privacy policy

Version: 19 October 2026

Controller

Finn Kehrbaum, Ickstattstraße 34, 80469 München, Germany, hello@agentstackpicks.com. Supervisory authority: Bayerisches Landesamt für Datenschutzaufsicht (BayLDA), Promenade 18, 91522 Ansbach, Germany.

Hosting and server logs

This website (Agent Stack Picks) runs on servers of a hosting provider in the EU, with which we have a data processing agreement (Art. 28 GDPR). When you visit, the server processes your IP address, the time, the requested page, the status code, the referrer and browser information as technically necessary. Logs serve security and debugging (Art. 6(1)(f) GDPR) and are deleted after 7 days. Server backups are kept for at most 14 days; copies they contain are deleted with the backup.

Counters for AI and search bots

In addition we count, per day, domain and page category (for example home page, robots.txt, content page), how many requests identify themselves in the user-agent header as a known AI or search engine bot (for example GPTBot or Googlebot). Only these counters are stored: no IP addresses, no user-agent strings, no full URLs. They are plain counts without personal reference.

Contact form

If you use the contact form, you send us your name (optional), email address and message. We forward them by email to our mailbox through our email delivery provider in the EU (data processing under Art. 28 GDPR) and do not store them in a database; we delete the correspondence when the matter is settled. To limit abuse, a self-hosted proof-of-work check (no cookies, no third party) validates the submission, and salted hashes of your IP address and your email address are kept for two days for rate limiting. Legal basis: Art. 6(1)(b) and (f) GDPR.

Cookies

This website sets no cookies and loads no third-party content. It stores information on your device only if you object to the visitor statistics with the switch (entry “umami.disabled” in local storage, see visitor statistics).

Cookie-free audience measurement

We count page views and clicks on links labelled as product or partner links with our own cookie-free counter on our server. Per day we store only the date, this website, the page path, the domain of the referring site (without path, if any) and the event type (page view or click on a labelled link), as counters. No IP addresses, user agents, identifiers or profiles are stored, and visitors cannot be recognised. The counter honours Do Not Track and Global Privacy Control and the objection switch (see visitor statistics). Separately, a salted hash of the IP address is used briefly to limit requests against abuse (two days); it is never linked to the counters. Legal basis: Art. 6(1)(f) GDPR (improving our offer). You can object by email.

Visitor statistics (Umami, no cookies)

To see which pages are read and where visitors come from, we run the open-source analytics tool Umami ourselves, on servers of our hosting provider in the EU (see Hosting). No external analytics provider is involved and no data is passed to third parties. When you open a page, your browser loads our measurement script from this domain and sends: the page path (without query string and fragment; only the campaign parameters utm_source, utm_medium, utm_campaign, utm_term and utm_content are appended, if present), the referring page (for other websites only their domain, for this website only the path), the page title and the time (timestamp). Our server derives from the request: browser, operating system and device type (from your browser's User-Agent header) and your approximate location (country, region, city; from your IP address, using a database on our server). Umami does not store your IP address; it uses it only for that derivation and for a visitor identifier. Like every request, however, the measurement request appears in the server logs, which are deleted after 7 days. The visitor identifier is a salted hash of IP address, User-Agent and site that changes every day. It groups your visits to this website on one day, but cannot recognise you on another day or on other websites. Page views and events are stored with this identifier; the statistics are therefore pseudonymous, not anonymous. As events we record: clicks on copy buttons (which block), downloads (file name and format), clicks on links to other websites (target domain only), clicks on feed links and on highlighted buttons (their label only), a submitted contact form (without its content). In addition we record coarse page signals without content: the scroll depth reached (25, 50, 75 or 100 percent), the active reading time of a page (30, 60 or 180 seconds, only while the tab is visible and active) and a visit to the “page not found” error page (without further details). These are numbers and fixed labels, never anything you typed and never identifiers. Our measurement script sets no cookies, writes nothing to your device and reads no device properties such as screen size or language. Before each measurement it only checks whether your browser sends “Do Not Track” or “Global Privacy Control” and whether you objected with the switch below; if so, we do not measure at all.

Legal basis: Art. 6(1)(f) GDPR (our interest in understanding and improving our websites; we protect your interests through the daily-changing identifier, by not using cookies or device properties and by running it on our own servers). The statistics are deleted after 14 months.

Objection: you can object to the measurement at any time and without giving reasons, most easily with the switch below; it takes effect immediately for this website in this browser. “Do Not Track” and “Global Privacy Control” in your browser work the same way. You can also object by email to hello@agentstackpicks.com (Art. 21 GDPR). Because the statistics contain no names, email addresses or IP addresses, we cannot attribute stored entries to you (Art. 11 GDPR); we will then reply with how to use the switch or the browser signals. At your express request the switch stores an entry (“umami.disabled”) in your browser's local storage, which applies until you reset it or clear the site data. Our measurement scripts read it only to honour your objection, and the switch only to show its state (§ 25(2) no. 2 TDDDG). If your browser blocks local storage, we do not measure either.

Redirects (/go/…)

If you click a link of the form /go/…, we count the click per day, link and referring page (without IP address and without identifier) and redirect you. Affiliate links are labelled on the page. The destination's own privacy notice applies there.

Email enquiries

If you write to us by email, we process your enquiry including your address to answer it (Art. 6(1)(b) or (f) GDPR). Emails and form messages are kept in our mailbox at an email provider in Switzerland (the EU Commission has issued an adequacy decision for Switzerland). We delete the correspondence when the matter is settled, unless a statutory retention duty applies.

Right to object (Art. 21 GDPR)

If we process your personal data on the basis of Art. 6(1)(f) GDPR (legitimate interests), you have the right to object at any time, on grounds relating to your particular situation, to this processing. We then stop processing unless we can show compelling legitimate grounds that override your interests, rights and freedoms, or the processing serves to establish, exercise or defend legal claims. An email to hello@agentstackpicks.com is enough.

Your rights

You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18) and data portability (Art. 20). Your right to object (Art. 21) is described in the section above. Providing your data is not required by law or contract; without the technically necessary connection data, however, the website cannot be displayed. We make no solely automated decisions (Art. 22 GDPR). You can complain to a supervisory authority, in Bavaria the BayLDA. Write to hello@agentstackpicks.com.