Legal
Privacy Policy
Last updated · August 29, 2026
The short version: SupplementPrices has no accounts, no sign-up and no forms. You can read the whole site without giving us anything. Our servers keep ordinary access logs. Analytics run only if you allow them, on PostHog’s EU cloud. Clicking through to Amazon hands you over to Amazon, who decide for themselves what they collect. We do not sell data and there is no advertising network on this site.
1. Controller (Art. 13(1)(a) GDPR)
Dr. Jan Philip Wahle and Lars Kaesberg
Siedlungsweg 24, 37124 Rosdorf, Germany
Email: [email protected]
A Data Protection Officer is not required under Art. 37 GDPR and Section 38 BDSG. Questions go to the contact address above.
2. What we do not do
There is no registration, no login, no newsletter, no contact form, no comment function and no payment on this site. We do not ask for your name, email address, postal address, date of birth, health information or payment details, and we have no way to receive them from the site. We do not sell or rent personal data, we run no advertising network, we build no cross-site profiles, and we do not use fingerprinting.
3. Server logs
The site is hosted by Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany, acting as our processor under Art. 28 GDPR. Every request produces a log entry containing the IP address, date and time, the requested URL, the HTTP status and transferred volume, the referring page, and the browser and operating system reported by your client.
Purpose: delivering the site, keeping it available, defending against attacks and abuse, and investigating faults. Legal basis: Art. 6(1)(f) GDPR — our legitimate interest in operating a secure, functioning website. These logs are not merged with analytics data and are not used to identify you. Retention: only as long as needed for operations, security and troubleshooting, and thereafter for any period the law requires.
4. Cookies and analytics
Nothing optional is stored on your device until you allow it. On your first visit a banner asks whether analytics may run; until you answer, no analytics cookie and no analytics local-storage entry is written, and the analytics SDK does not start at all. Your answer itself is remembered in a first-party cookie (sp_consent), which is strictly necessary under Section 25(2) No. 2 TDDDG — remembering “no” is the only way to stop asking.
If you accept, we use PostHog (PostHog, Inc.) on its EU cloud, so event data is stored in the European Union. Events are sent through a path on our own domain (/px) that forwards them to PostHog’s EU endpoint; PostHog receives the request’s IP address and derives an approximate location from it. PostHog acts as our processor under Art. 28 GDPR.
Legal basis: your consent, Art. 6(1)(a) GDPR together with Section 25(1) TDDDG. You can withdraw it at any time with one click on the Cookie Policy page, with effect for the future; withdrawal stops the SDK and deletes what it stored. The full list of entries, their purposes and their lifetimes is on that page.
5. What the analytics events contain
If — and only if — you allowed analytics, we record:
- Page and catalogue views, with the filter state that produced them: marketplace, category, subtype, form, sort order, page number, and how many results were returned.
- Searches, meaning the term you typed and how many results it found. A term that finds nothing tells us which category is missing, which is the main reason this is measured. Please do not type personal information into the search box; it is a product search, and what you type is recorded.
- Outbound clicks on an Amazon link: which listing, its position in the ranking, its price and computed unit price, and the filters that were active. This is the only event that can earn money and therefore the one the site actually depends on.
- Technical context supplied by the SDK: a random device identifier, session identifier, approximate location derived from the IP address, browser, operating system, screen size, referring URL and campaign parameters.
We do not identify you. No person profile is created, because the site never calls PostHog’s identification function — the random device identifier is not linked to a name, an email address or an account, since there are none. Purpose: understanding which categories and countries are used, which searches fail, and which listings are clicked, so the catalogue and the rankings can be improved.
6. Clicking through to Amazon
Product links lead to an Amazon marketplace and carry our Associates tracking tag. Once you follow such a link you are on Amazon’s site: Amazon sets its own cookies, applies its own privacy notice, and acts as an independent controller for everything that happens there. We have no access to your Amazon account, your basket, your orders or your payment details. From the Associates program we receive only aggregated, anonymous reports — clicks, ordered items and commission — with no information about who you are. Please read the privacy notice of the respective Amazon marketplace for their side of it. Legal basis for the affiliate link itself: Art. 6(1)(f) GDPR, our legitimate interest in financing a free site.
7. The product catalogue
Listings, prices, doses and the derived metrics are stored in a database operated through Supabase, Inc. as our processor. That database holds product data only — it contains no personal data about visitors, and the site has no user records to store in it. Product data is retrieved from the Amazon Product Advertising API and from public product pages; label data is additionally read out with the help of a language model via OpenRouter, Inc. This is a batch process over product listings that runs on our servers, separately from any visit, and it never involves visitor data.
8. Contact by email
If you write to [email protected], we process your email address, any name you give, and the content of your message in order to answer it. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in responding to correspondence), or Art. 6(1)(b) GDPR where your message concerns a contractual or pre-contractual matter. We keep the thread until the matter is settled and then delete it, unless a statutory retention period applies.
9. Recipients
Personal data is disclosed only to the processors named above — our hosting provider, PostHog for consented analytics, and Supabase for the product database — each bound by a data-processing agreement under Art. 28 GDPR, and to public authorities where we are legally obliged to do so. Amazon is not a processor but an independent controller for what happens on its own site.
10. Transfers outside the EU
Analytics data stays in the European Union on PostHog’s EU cloud. Where a processor is established outside the EEA or uses sub-processors there, the transfer is covered by the European Commission’s standard contractual clauses, by an adequacy decision, or by another safeguard under Chapter V GDPR. Following an Amazon link is your own transfer to Amazon, under Amazon’s terms.
11. Retention
Server logs: as long as required for operation and security. Analytics events: for as long as they are useful for product decisions, and in any case only while your consent stands. Email: until the matter is settled. Statutory retention obligations — commercial and tax records in particular — override these periods where they apply.
12. Your rights
Under the GDPR you have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20), and the right to object to processing based on legitimate interests (Art. 21). Where processing rests on consent, you may withdraw it at any time with effect for the future (Art. 7(3)) — for analytics, on the Cookie Policy page.
Because the site has no accounts, we usually hold nothing that identifies you and may be unable to link a request to a record; in that case Art. 11(2) GDPR applies. We will never ask you for a password or for payment details in order to handle a request. Reach us at [email protected].
13. Right to lodge a complaint
You may complain to a supervisory authority, in particular in the Member State of your habitual residence, your place of work, or the place of the alleged infringement. The authority competent for us is:
Die Landesbeauftragte für den Datenschutz Niedersachsen
Prinzenstraße 5, 30159 Hannover, Germany
Phone: +49 511 120-4500
Email: [email protected]
Web: lfd.niedersachsen.de
14. Data security
Connections are encrypted with TLS (HTTPS) throughout. Database access is restricted to server-side code, administrative access is limited and authenticated, and dependencies are patched routinely. No system is perfectly secure, but the design keeps the attack surface small: there is no user data to lose.
15. No automated decisions about you
The rankings on this site are computed automatically, but they rank products, not people. There is no automated decision-making producing legal or similarly significant effects concerning you within the meaning of Art. 22 GDPR, and no profiling for advertising purposes.
16. Children
The site is aimed at adults and is not directed at children. We knowingly collect no data from children.
17. Changes to this policy
We update this policy when the law, our tools or our practices change. The current version is always at this URL, and the date at the top says when it last changed.