1. Controller and contact
Panamono GmbH, Am Borsigturm 11, 13507 Berlin, Germany, represented by Christoph Neuhaus. For privacy requests contact hi@christophneuhaus.de or write to this address. Telephone: +49 176 70694013. This notice covers My Money Notebook at https://mymoneynotebook.com.
2. Website delivery, security and contact
To deliver pages, the hosting service processes connection data such as IP address, request time, requested URL, browser/device information and response status. Security logs may help detect abuse. The basis is Article 6(1)(f) GDPR: our legitimate interest in secure, reliable website operation. The proposed hosting architecture uses Cloudflare; the contracting entity, processing locations, processor agreement and actual log retention remain to be confirmed before public hosting.
If you contact us, we process your message and contact details to answer it, under Article 6(1)(b) GDPR for contractual or pre-contractual enquiries, or Article 6(1)(f) for other enquiries. Access is limited to relevant staff and contracted email providers. The email provider and deletion schedule must be confirmed. Records are deleted when no longer needed, subject to applicable statutory retention or legal claims.
3. Calculators, quizzes, search and browser preferences
Calculations and quiz results run in your browser. The search index and fonts are served with this website. Calculator scenario values can appear in URLs: sharing them discloses those values to recipients; URLs may also reach the host in requests. Avoid entering identifiable or confidential financial information. The planned tracking configuration must strip scenario parameters and exclude financial input values and quiz answers.
Local storage holds the selected theme and the optional-tracking-off preference. Storage strictly necessary for a function you request relies on § 25(2) no. 2 TDDDG; related personal-data processing relies on Article 6(1)(f) GDPR where applicable. Optional storage and tracking require your prior consent under § 25(1) TDDDG and Article 6(1)(a) GDPR. See the storage information.
3b. Our own cookieless statistics
To understand which pages, tools and channels help readers, our website server (a Cloudflare Worker operated for us as processor) records page views and a short list of neutral events (for example “quiz started”, “quiz finished”, “newsletter sign-up confirmed”, “partner link clicked”). Stored are the page path, the referring domain, campaign parameters in the link (utm_source, utm_medium, utm_campaign, utm_content), country derived from the connection, device class (mobile, tablet, desktop) and time. Nothing is stored on or read from your device for this purpose. To count unique visits we compute a keyed hash of IP address, browser identification and the current date; the IP address itself is not stored, and because the date is part of the hash, visits cannot be linked across days. Calculator inputs, quiz answers, email addresses and financial details are never part of these records.
When you click a partner link (/go/), we record the offer, the page, the campaign source and your country to measure which content leads to referrals. A click-level reference is passed to the partner only if you consented to affiliate attribution (section 7). Legal basis: Article 6(1)(f) GDPR (our legitimate interest in reach measurement and improving our content). Proposed retention: 13 months, after which records are deleted automatically. You may object at any time via the contact details above.
4. Consent and withdrawal
Planned choices separate audience measurement, session replay, advertising/remarketing, affiliate attribution and external media. Optional purposes start disabled. Refusal leaves educational content and calculators available. The future banner must offer “Reject optional”, “Accept all” and “Manage choices”, with individual service information and no preselected optional purposes.
Once an optional service is configured, a banner offers “Reject optional”, “Accept all” and individual choices for audience measurement, session replay and marketing/affiliate attribution, none preselected. The footer “Privacy preferences” control lets you withdraw or change consent as easily as you gave it. Your choice is stored in local storage (mmn-consent); an affiliate-attribution choice is also stored in the first-party cookie mmn_attr so our redirect can respect it. Withdrawal stops future optional processing; it does not invalidate earlier lawful processing or automatically delete all data already held by providers. You may also contact us to exercise deletion rights.
Consent records must document the choice, time, notice version and purpose/service scope with a minimal identifier. The CMP provider, record retention and preference lifetime are pending. A new service or materially changed purpose requires a new choice. Consent is voluntary; you need not supply optional tracking data to use this website.
5. Planned analytics and session replay
Google Analytics 4
Proposed provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; processing may also involve Google LLC in the United States. With measurement consent, GA4 would process pseudonymous identifiers, visited pages, permitted interaction events, time, device/browser and approximate location information to produce audience reports. Consent Mode v2 is planned in Basic mode: Google tags and measurement requests remain blocked when the relevant consent is absent. Linking to Ads, Google Signals, advertising personalisation and User-ID require separate configuration and disclosure; these are not assumed enabled. Proposed event/user retention: two months, subject to account verification; aggregated reports and cookie lifetimes require separate disclosure. Google privacy information.
Microsoft Clarity
Microsoft Clarity project ys668q98rw is configured for public content pages after separate session-replay consent. The homepage calculator is masked. Calculator, quiz and report-check routes are excluded from replay, as are visits with financial scenario parameters in the URL or referring URL. Privacy preferences let you reject or withdraw this choice.
Proposed provider: Microsoft Corporation, One Microsoft Way, Redmond, WA 98052-6399, USA; confirm the applicable contracting entity. With separate session-replay consent, Clarity reconstructs page interactions, clicks, scrolling and page structure, creates heatmaps and associate visits using identifiers and technical/device data. It may receive IP address and connection information. Financial inputs, calculator results, contact fields and quiz answers must be masked or excluded; masking must be verified before recording. No Clarity script is to load without replay consent, including its limited no-consent mode. Clarity consentv2 must reflect the separate analytics and advertising choices. Actual recording, heatmap and saved-recording retention must be documented from the project settings. Microsoft privacy information.
6. Planned advertising and conversion measurement
With consent for the applicable advertising service, pixels and approved server events would measure campaign results, attribute qualifying actions, build remarketing audiences and support personalised advertising. Data can include pseudonymous browser/click identifiers, IP address, browser/device information, sanitised page URLs, time and permitted conversion events. Providers may link events to existing accounts and use data for their own advertising purposes. We receive reports; their pseudonymous nature does not make the underlying processing anonymous. Each service requires a verified retention period, cookie inventory and responsibility arrangement before activation.
Meta Pixel and Conversions API
Proposed provider: Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland, with possible US processing by Meta companies. Pixel and Conversions API are proposed for Facebook/Instagram attribution and remarketing. Server transmission requires the same valid advertising consent. Automatic advanced matching and contact-list uploads remain disabled unless separately reviewed and disclosed. Applicable joint-controller duties for collection/transmission must be documented; Meta’s subsequent processing is governed by its terms. Meta privacy information and controller addendum.
TikTok Pixel and Events API
Proposed recipients include TikTok Technology Limited, 10 Earlsfort Terrace, Dublin, D02 T380, Ireland, and TikTok Information Technologies UK Limited, One London Wall, London EC2Y 5EB, UK; confirm the current service entities and address in the account terms. Pixel and Events API would support attribution, campaign optimisation and remarketing. Advanced matching is not enabled in this draft. Contract-specific processor, independent-controller and joint-controller roles must be resolved for the actual processing. TikTok privacy information.
Google Ads, including YouTube campaigns
Proposed provider: Google Ireland Limited, with possible Google LLC processing in the USA. Ads conversion tags, conversion linking and remarketing would process permitted events and advertising identifiers after the relevant consent. Consent Mode v2 must keep analytics_storage, ad_storage, ad_user_data and ad_personalization denied until the corresponding choices are granted. Enhanced Conversions and Customer Match require an additional reviewed configuration and notice. YouTube ad campaigns are distinct from loading YouTube videos on this website. Google advertising information.
Microsoft Advertising / Bing UET
Proposed provider: Microsoft; verify the service’s contracting entity. Universal Event Tracking would measure conversions and create remarketing audiences from identifiers, permitted events, page and device information. UET remains blocked before advertising consent and must receive the current consent signal. Clarity consent does not itself authorise Microsoft Advertising. Microsoft privacy information.
7. Affiliate links and attribution
No affiliate partner is active in this edition. Future paid links will state that we may earn a commission when you take a qualifying action. Following an ordinary external link connects you to the destination, which receives connection data and applies its own notice. This does not itself consent to optional tracking on our website.
Planned attribution may involve an affiliate network redirect, publisher/campaign identifiers, click IDs, tracking cookies or server-to-server conversion postbacks containing transaction status and commission data. Each actual network and merchant, responsibility role, data flow and retention period must be named before activation. Optional affiliate measurement is separately consent-gated. Declining it must not silently trigger tracking redirects; provide a verified direct link where available or explain why a tracked offer is unavailable. Our /go/ redirect uses campaign subIDs and country eligibility; first-party click counting is described in section 3b, and a click-level reference is only added with your attribution consent. Security/connection processing is distinct from attribution consent.
8. External media and market data
Historical market charts use data bundled with this site. No external market widget is loaded, no market activation is required, and calculator inputs are not sent to a market data provider. TradingView integration has been removed. Any old market activation setting is unused and is removed when you choose to keep optional tracking off.
YouTube embeds are planned but not integrated. They would use an unloaded placeholder until external-media consent or an informed individual activation. Google receives connection/device information and video interaction data; existing account associations may occur. The youtube-nocookie domain does not eliminate the need to assess data transmission and device access. Media consent must not grant advertising consent.
9. Newsletter and social profiles
Optional newsletter signups are handled through Kit (Kit, Inc.). When you subscribe, our browser submits your email address and optional first name to the Kit form assigned to the selected quiz. Kit also receives connection information such as your IP address. Quiz answers, scores and result categories are not forwarded. Kit sends a confirmation email; subscription requires your confirmation. You can unsubscribe using the link in newsletter emails or contact us to withdraw consent. The purpose is to deliver the My Money Notebook newsletter on the basis of your consent under Article 6(1)(a) GDPR. We do not load a Kit tracking script on quiz pages.
Kit processes subscriber data under its Data Processing Addendum; its privacy policy covers its own service usage data. Processing may involve recipients outside the EEA. The operator review of contractual safeguards, service-specific retention and email-open/click tracking remains pending; no additional advertising audience integration is enabled by this signup. Newsletter consent is not advertising-pixel consent.
Ordinary links to social profiles do not load social plugins here. Platform visits are governed by provider notices. If we operate profiles with audience insights or targeted campaigns, the profile notices must additionally explain the relevant controller roles, insights and targeting.
10. International transfers and service contracts
Planned services may process data outside the EEA. Before activation, identify actual recipients and destinations. Where applicable, transfers require an adequacy decision, or standard contractual clauses with an assessment and supplementary safeguards. EU–US Data Privacy Framework reliance requires verification of the exact US recipient’s active certification and scope; it is not a blanket assurance for all providers. Copies or information about applicable safeguards can be requested from us. Necessary processor agreements and any Article 26 joint-controller arrangements must be completed and their essential allocation of duties explained.
11. Retention, recipients and your rights
Data is retained only for the relevant purpose and applicable legal obligations. The final notice must contain the actual service-specific periods or meaningful criteria; unverified provider defaults are not binding deletion promises. Recipients can include hosting/email/CMP processors, approved analytics and advertising providers, affiliate networks/merchants and public authorities where legally required. Optional providers only receive data when the applicable integration and lawful basis permit it.
Subject to the legal conditions, you have rights of access (Article 15), rectification (16), erasure (17), restriction (18), portability (20) and objection (21) GDPR. You may withdraw consent at any time (Article 7(3)). You may object to processing based on legitimate interests for reasons relating to your situation; objection to direct marketing is available at any time. Contact us using the details above.
You may complain to a supervisory authority, including at your habitual residence, place of work or the place of the alleged infringement. For our Berlin establishment: Berliner Beauftragte für Datenschutz und Informationsfreiheit. No decision producing legal or similarly significant effects based solely on automated processing is planned by us. Advertising audience profiling is described above and must be distinguished from such decisions.
The publication is intended for adults. We do not plan behavioural advertising directed at children. Data protection officer designation requirements, a possible data protection impact assessment and additional target-market privacy rights must be assessed before public launch.