Legal
Privacy Policy
Last updated · October 8, 2026
The short version: SupplementPrices has no accounts and no sign-up. You can read the whole site without giving us anything. The one thing you can hand us is an email address — voluntarily, for price-drop alerts — and it is used for exactly that, sent double-opt-in through Amazon’s EU email service, with a one-click unsubscribe in every message. Our servers keep ordinary access logs. Analytics run only if you allow them, on PostHog’s EU cloud. Clicking through to Amazon hands you over to Amazon, who decide for themselves what they collect. We do not sell data and there is no advertising network on this site.
1. Controller (Art. 13(1)(a) GDPR)
Dr. Jan Philip Wahle and Lars Benedikt Kaesberg
Siedlungsweg 24, 37124 Rosdorf, Germany
Email: [email protected]
A Data Protection Officer is not required under Art. 37 GDPR and Section 38 BDSG. Questions go to the contact address above.
2. What we do not do
There is no registration, no login, no newsletter, no contact form, no comment function and no payment on this site. Beyond the email address you may volunteer for price alerts (section 10), we do not ask for your name, email address, postal address, date of birth, health information or payment details, and we have no way to receive them from the site. We do not sell or rent personal data, we run no advertising network, we build no cross-site profiles, and we do not use fingerprinting.
3. Server logs
The site is hosted by Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany, acting as our processor under Art. 28 GDPR. Every request produces a log entry containing the IP address, date and time, the requested URL, the HTTP status and transferred volume, the referring page, and the browser and operating system reported by your client.
Purpose: delivering the site, keeping it available, defending against attacks and abuse, and investigating faults. Legal basis: Art. 6(1)(f) GDPR — our legitimate interest in operating a secure, functioning website. These logs are not merged with analytics data and are not used to identify you. Retention: only as long as needed for operations, security and troubleshooting, and thereafter for any period the law requires.
4. Choosing your Amazon storefront
The site compares prices in ten Amazon stores, and it has to open on one of them. To pick a sensible one it reads a single header, CF-IPCountry, which our CDN adds to the incoming request: the two-letter country your IP address resolves to, and nothing more precise — no city, no coordinates, no identifier. It is used for the length of that one request, to decide which store to show you, and is neither written to your device nor stored, logged separately or attached to any analytics event.
The guess is always overridable, and overriding it is the point of the country list at the top of every page: pick a store there and your choice is kept in the sp_store cookie and used from then on instead. Legal basis: Art. 6(1)(f) GDPR — our legitimate interest in showing you a store that actually delivers to you, in your language and currency. If you would rather not be located at all, a VPN or the country list gives you the same result, and blocking the cookie leaves the site fully usable.
5. Cookies and analytics
Nothing optional is stored on your device until you allow it. On your first visit a banner asks whether analytics may run; until you answer, no analytics cookie and no analytics local-storage entry is written, and the analytics SDK does not start at all. Your answer itself is remembered in a first-party cookie (sp_consent), which is strictly necessary under Section 25(2) No. 2 TDDDG — remembering “no” is the only way to stop asking.
If you accept, we use PostHog (PostHog, Inc.) on its EU cloud, so event data is stored in the European Union. Events are sent through a path on our own domain (/px) that forwards them to PostHog’s EU endpoint; PostHog receives the request’s IP address and derives an approximate location from it. PostHog acts as our processor under Art. 28 GDPR.
Legal basis: your consent, Art. 6(1)(a) GDPR together with Section 25(1) TDDDG. You can withdraw it at any time with one click on the Cookie Policy page, with effect for the future; withdrawal stops the SDK and deletes what it stored. The full list of entries, their purposes and their lifetimes is on that page.
6. What the analytics events contain
If — and only if — you allowed analytics, we record:
- Page and catalogue views, with the filter state that produced them: marketplace, category, subtype, form, sort order, page number, and how many results were returned.
- Searches, meaning the term you typed and how many results it found. A term that finds nothing tells us which category is missing, which is the main reason this is measured. Please do not type personal information into the search box; it is a product search, and what you type is recorded.
- Outbound clicks on an Amazon link: which listing, its position in the ranking, its price and computed unit price, and the filters that were active. This is the only event that can earn money and therefore the one the site actually depends on.
- Technical context supplied by the SDK: a random device identifier, session identifier, approximate location derived from the IP address, browser, operating system, screen size, referring URL and campaign parameters.
We do not identify you. No person profile is created, because the site never calls PostHog’s identification function — the random device identifier is not linked to a name, an email address or an account, since there are none. Purpose: understanding which categories and countries are used, which searches fail, and which listings are clicked, so the catalogue and the rankings can be improved.
7. Clicking through to Amazon
Product links lead to an Amazon marketplace and carry our Associates tracking tag. Once you follow such a link you are on Amazon’s site: Amazon sets its own cookies, applies its own privacy notice, and acts as an independent controller for everything that happens there. We have no access to your Amazon account, your basket, your orders or your payment details. From the Associates program we receive only aggregated, anonymous reports — clicks, ordered items and commission — with no information about who you are. Please read the privacy notice of the respective Amazon marketplace for their side of it. Legal basis for the affiliate link itself: Art. 6(1)(f) GDPR, our legitimate interest in financing a free site.
8. The product catalogue
Listings, prices, doses and the derived metrics are stored in a database operated through Supabase, Inc. as our processor. Apart from the price alert subscriptions described in section 10, that database holds product data only — no other personal data about visitors, because the site has no accounts whose records could go there. Product data is retrieved from the Amazon Product Advertising API and from public product pages; label data is additionally read out with the help of a language model via OpenRouter, Inc. Whether a listing is a supplement, and which category it belongs to, is decided with the Decisions classifier of OpenAI Ireland Ltd., 1st Floor, The Liffey Trust Centre, 117–126 Sheriff Street Upper, Dublin 1, D01 YC43, Ireland, which processes this text on our behalf under its data processing addendum (Art. 28 GDPR). It receives public product text only — listing and search-result titles, brand, product details, bullet points and descriptions — and returns a classification. OpenAI does not use this data to train its models and keeps it for abuse monitoring for up to 30 days; it may transfer it to affiliates and sub-processors outside the EEA, in particular in the United States, on the basis of standard contractual clauses or an adequacy decision (section 12). All of this is a batch process over product listings that runs on our servers, separately from any visit, and it never involves visitor data.
9. Contact by email
If you write to [email protected], we process your email address, any name you give, and the content of your message in order to answer it. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in responding to correspondence), or Art. 6(1)(b) GDPR where your message concerns a contractual or pre-contractual matter. We keep the thread until the matter is settled and then delete it, unless a statutory retention period applies.
10. Price alert emails
The bell next to a listing or a category lets you ask for an email when its price drops. If you use it, we store the email address you enter, what it watches (the listing or the category and storefront), the language of the page you subscribed on, the last price you were shown, and — as proof that the consent was real — the time and IP address of the signup and of the confirmation click. Nothing is sent to that address except one confirmation email and, once you have confirmed, the alerts themselves: the subscription only becomes active when you press the link in the confirmation email (double opt-in), and an unconfirmed request sends nothing further.
Legal basis: your consent, Art. 6(1)(a) GDPR and Section 7(2) UWG. You can withdraw it at any time with effect for the future: every email carries a one-click unsubscribe for that alert and for all alerts to your address, and mail clients that support one-click unsubscribe (RFC 8058) can do it without opening a page. The emails are dispatched through Amazon Web Services (Amazon Simple Email Service, US East region), acting as our processor under Art. 28 GDPR; that transfer to the United States is covered by the safeguards described in section 12, including the EU–US Data Privacy Framework, under which Amazon Web Services is certified. The subscription records themselves live in the same Supabase database as the catalogue and are readable only by our server-side code, not by the public API the site reads from.
The address is used for the alerts you asked for and for nothing else — no newsletter, no advertising, no disclosure to third parties beyond the processors named here. After you unsubscribe we keep the minimal record of the subscription and its withdrawal, because being able to prove what was consented to and when is itself a legal obligation; it is not used to contact you again.
11. Recipients
Personal data is disclosed only to the processors named above — our hosting provider, PostHog for consented analytics, Supabase for the database, and Amazon Web Services for sending the price alert emails you asked for — each bound by a data-processing agreement under Art. 28 GDPR, and to public authorities where we are legally obliged to do so. OpenRouter and OpenAI (section 8) receive public product text only, never personal data about you. Amazon is not a processor but an independent controller for what happens on its own site.
12. Transfers outside the EU
Analytics data stays in the European Union on PostHog’s EU cloud. Where a processor is established outside the EEA or uses sub-processors there, the transfer is covered by the European Commission’s standard contractual clauses, by an adequacy decision, or by another safeguard under Chapter V GDPR. Following an Amazon link is your own transfer to Amazon, under Amazon’s terms.
13. Retention
Server logs: as long as required for operation and security. Analytics events: for as long as they are useful for product decisions, and in any case only while your consent stands. Email correspondence: until the matter is settled. Price alert subscriptions: while the alert is active, and after an unsubscribe the minimal consent-and-withdrawal record described in section 10. Statutory retention obligations — commercial and tax records in particular — override these periods where they apply.
14. Your rights
Under the GDPR you have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20), and the right to object to processing based on legitimate interests (Art. 21). Where processing rests on consent, you may withdraw it at any time with effect for the future (Art. 7(3)) — for analytics, on the Cookie Policy page; for price alerts, through the unsubscribe link in any alert email.
Because the site has no accounts, we usually hold nothing that identifies you and may be unable to link a request to a record; in that case Art. 11(2) GDPR applies. We will never ask you for a password or for payment details in order to handle a request. Reach us at [email protected].
15. Right to lodge a complaint
You may complain to a supervisory authority, in particular in the Member State of your habitual residence, your place of work, or the place of the alleged infringement. The authority competent for us is:
Die Landesbeauftragte für den Datenschutz Niedersachsen
Prinzenstraße 5, 30159 Hannover, Germany
Phone: +49 511 120-4500
Email: [email protected]
Web: lfd.niedersachsen.de
16. Data security
Connections are encrypted with TLS (HTTPS) throughout. Database access is restricted to server-side code, administrative access is limited and authenticated, and dependencies are patched routinely. No system is perfectly secure, but the design keeps the attack surface small: there is no user data to lose.
17. No automated decisions about you
The rankings on this site and the classification of listings are computed automatically, but they concern products, not people. There is no automated decision-making producing legal or similarly significant effects concerning you within the meaning of Art. 22 GDPR, and no profiling for advertising purposes.
18. Children
The site is aimed at adults and is not directed at children. We knowingly collect no data from children.
19. Changes to this policy
We update this policy when the law, our tools or our practices change. The current version is always at this URL, and the date at the top says when it last changed.