mymirah

Back to privacy overview

Website Privacy Notice

This notice applies when you visit https://mymirah.app and when you contact us. The app has a separate app privacy notice.

Controller

Sigfried Payam Ewert
Maienweg 105
22297 Hamburg
Germany

Email: support@mymirah.app

Further details are in the legal notice.

Hosting

The website is hosted on IONOS Webhosting Plus by IONOS SE, Elgendorfer Straße 57, 56410 Montabaur, Germany. When you open a page, IONOS processes in particular your IP address, the requested page or file, the time of access and, depending on the browser, information about the browser, the operating system, and the previously visited page.

The purposes are delivery, fixing faults, and protection against abuse. The legal basis is Art. 6(1)(f) GDPR. IONOS is our processor for this. A data processing agreement covers this web hosting and the mailbox support@mymirah.app.

These access data are separate from visitor statistics (WebAnalytics), from technical server logs, from our files that limit form requests, from the form’s error log, and from the contents of support emails. The retention period of one category does not apply to the others.

The website code does not write its own page-request logs. In the service description annexed to the data processing agreement (Annex 1, version 3.0, March 2026), IONOS states that log files for hosting products, including web hosting, are stored for a maximum of seven days, and that email log files are stored for a maximum of 28 days after they are created. Separately, IONOS states that visitor data of its web hosting products are stored for eight weeks (information on that processing).

Under the data processing agreement, the agreed processing takes place in the EU or the EEA unless a transfer to a third country is necessary to provide the service. IONOS must then comply with Articles 44 et seq. GDPR.

IONOS WebAnalytics

According to IONOS’s product information, WebAnalytics is enabled by default in the hosting product. It is used for statistics and technical optimization. IONOS describes collection through server logs or a counting pixel, without cookies, and anonymization of the IP address immediately after transmission. We have not made our own setting for it. This website’s code contains no counting pixel of its own and no other analytics tool.

For the evaluation of server logs created when the page is delivered, we rely on Art. 6(1)(f) GDPR. We do not rely on that basis for a counting pixel. The absence of cookies does not, by itself, mean that no consent is required.

Contact

You can reach us at support@mymirah.app or through the contact form. The form processes the details on our web space and sends them as email to that mailbox. The website sets the sender, recipient, and subject. Your address is used only as the reply address. There is no separate message database.

  • Email address, topic, and message are needed so that we can reply.
  • Name and subject are optional.
  • The language of the website is included so that we can sort the request.
  • A hidden field is used to detect spam.

You are not legally required to give us data.

Please do not send health information, information about your sex life, information about religious beliefs, journal entries, or screenshots of such content. We do not need them for an ordinary request. Sending the message is not consent. Art. 6(1)(f) GDPR alone does not support processing of such information. If it nevertheless arrives, we limit ourselves to recognizing it as far as necessary. We remove or redact that information. If we still need the request, we ask for a version without it. If something must be kept for a specific legal claim, we limit that to the claim.

Legal bases: Art. 6(1)(b) GDPR if the request concerns a contract or steps before a contract; otherwise Art. 6(1)(f) GDPR, to answer the request. Statutory retention: Art. 6(1)(c) GDPR. A specific legal dispute: Art. 6(1)(f) GDPR.

We keep the message and our replies for as long as that is required to handle the request. After it is finished, we delete them unless a statutory retention duty or a specific legal claim stands in the way. The mail server does not delete them by itself. For email services, IONOS describes storage of at most seven days after deletion (Annex 1, version 3.0, March 2026).

Limiting misuse of the form

The website limits requests and messages per sender and the number of messages per day. The form is then blocked for a while. You can still email us.

We do not store the IP address. We store a hash of a secret key and the address, for IPv6 from the leading part (/64), together with timestamps. For the daily limit we also store timestamps that are not tied to a sender. Someone who knows the key and an address can match the hash. It is pseudonymous. Entries count as expired after 24 hours and are removed the next time the form is called. Without another call they can remain longer. The browser’s origin is checked and not stored.

The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest is to protect the form against spam, automated mass requests, and overload, and to keep it available.

Error log

We log faults of the form outside the public web directory: the date and time in UTC and a technical code, not names, addresses, IP addresses, or message text. The cleanup program removes entries that are at least 30 days old. It is intended to run once a day; an entry can therefore remain for about one further day. It does not clean the files that limit requests. IONOS’s own logs are separate.

The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest is to recognize and fix faults of the contact form.

Language

The website does not set cookies and does not store a language choice. At https://mymirah.app/ the start page reads your browser’s language list only in your browser, stores nothing, and opens the matching language version, otherwise English. The list is not sent to the server. The server only sees which address is opened afterwards. A direct address such as /en/contact/ remains the page you opened. Changing the language in the menu opens the same subpage in the other language and stores nothing.

Reading the browser list on the start page relies on § 25(2) no. 2 TDDDG and Art. 6(1)(f) GDPR. Our legitimate interest is to open the requested start page in a language the browser indicates.

Fonts, images, and scripts

Fonts, images, and scripts are loaded from this website. The site does not embed Google Fonts, videos, maps, or social-media content, and it has no analytics or advertising integration of its own. IONOS WebAnalytics is separate from that.

Stores

The home page shows the store badges as images from this website. The images are not links. Opening the page therefore does not connect to Apple or Google in order to load a badge.

Recipients

The processor for hosting and the mailbox is IONOS SE. The provider handles requests. Other recipients arise when you yourself use another service, such as your email provider.

Automated decisions

We do not make an automated decision with legal effect within the meaning of Art. 22 GDPR. The rate limit only rejects requests for a time.

Your rights

Subject to the statutory conditions, you have the right of access, rectification, erasure, restriction, and data portability (Arts. 15, 16, 17, 18, and 20 GDPR). Where we rely on Art. 6(1)(f) GDPR, you may object on grounds relating to your particular situation (Art. 21 GDPR). We then stop the processing unless compelling legitimate grounds override your interests or the processing is for legal claims.

An email to support@mymirah.app is enough. In justified cases we may ask for details to check your identity. You delete the language entry yourself in the browser. A hash may be impossible to link to a person.

You may lodge a complaint with a supervisory authority (Art. 77 GDPR), including outside Hamburg. For the controller, this is in particular:

The Hamburg Commissioner for Data Protection and Freedom of Information
Ludwig-Erhard-Str. 22
20459 Hamburg

Email: mailbox@datenschutz.hamburg.de
https://datenschutz-hamburg.de/

That office is not the controller’s data protection officer.

Changes

The version published here applies.

Last updated: 29 September 2026