Privacy Policy

Last updated: 2 October 2026

This English text is a courtesy translation. Only the German version is legally binding.

1. Controller

Dr. Johannes Hangl
Kapellenstr. 28, 83527 Haag i.OB, Germany
Email: info@presales-handbook.com

No data protection officer is appointed, because there is no obligation to appoint one.

2. Overview and legal bases

You can read this site without signing up. I process personal data only where it is needed to run the site or for a service you use yourself. The legal bases under the General Data Protection Regulation (GDPR) are:

• Art. 6 (1) (a) GDPR: your consent.
• Art. 6 (1) (b) GDPR: a contract with you or steps before one.
• Art. 6 (1) (c) GDPR: a legal obligation, for example retention duties.
• Art. 6 (1) (f) GDPR: a legitimate interest, named in each section.

Each section states how long data is kept.

3. Hosting and server log files

The site runs at Hostinger International Ltd., 61 Lordou Vironos Street, 6023 Larnaca, Cyprus. Hostinger processes data as a processor under Art. 28 GDPR. On every request the web server stores technical access data: IP address, date and time, requested address, referrer and browser identifier (user agent). The purpose is secure and stable operation. Legal basis: Art. 6 (1) (f) GDPR. My legitimate interest is delivering the site and detecting attacks. Log files are deleted after 30 days at the latest.

4. Security reports and error logs

Your browser reports violations of the site's Content Security Policy to the server. A report contains the affected page, the blocked address and technical details of the browser. Application errors are logged too. Legal basis: Art. 6 (1) (f) GDPR. My legitimate interest is detecting errors and attacks. The entries are kept with the server logs and deleted with them.

5. Protection against abuse

I limit how often forms and security reports can be sent. For this, an identifier is kept for about one hour: your IP address, or a hash of your email address for course exam submissions. It is stored at Upstash, Inc. (USA), or in the memory of the web server when Upstash is not available. Legal basis: Art. 6 (1) (f) GDPR. My legitimate interest is protecting the forms from spam and attacks.

6. Counts

I count a few things per month:

• visits that come from an AI assistant (only the host name is kept, such as chatgpt.com)
• clicks on links in the welcome emails
• started toolkit downloads
• new newsletter confirmations per language

The counts are stored at Upstash and expire after about 13 months. They are plain totals with no IP address, cookie or user agent. Legal basis: Art. 6 (1) (f) GDPR. My legitimate interest is understanding which offers people use.

7. Newsletter

If you subscribe, you get one presales idea a week, five welcome emails in your first weeks, and now and then news about my book and my course. I use double opt-in: you are added only after you click the link in the confirmation email.

I process your email address, the language, the form you signed up on, and the time of sign-up and confirmation as proof of your consent. Resend, Inc. (USA) sends the emails and manages the addresses as a processor. Legal basis: your consent, Art. 6 (1) (a) GDPR.

You can withdraw consent at any time: through the unsubscribe link in every email or by writing to info@presales-handbook.com. After you unsubscribe, your address stays on Resend's suppression list so that you get no more emails. Legal basis for that: Art. 6 (1) (f) GDPR. My legitimate interest is honouring your objection for good. I keep the proof of consent while you are subscribed and for up to three years after (standard limitation period, § 195 BGB).

8. Contact form and email

If you write to me through the contact form or by email, I process your name, email address and message to answer you. Messages from the form are delivered to my mailbox through Resend, Inc. (USA). Legal basis: Art. 6 (1) (b) GDPR where a contract is concerned, otherwise Art. 6 (1) (f) GDPR. My legitimate interest is answering requests. I delete the message once your request is settled, unless a legal retention duty requires otherwise.

Feedback form

The "Feedback" button lets you report a bug or send an idea. I process your message, the type of report, the page you were on and the language. If you want, your email address is added. I do not store your IP address or browser identifier for this.

I store the message as an issue in a private repository at GitHub, Inc. (USA), a Microsoft company. Your email address does not go to GitHub. Legal basis for the report: Art. 6 (1) (f) GDPR. My legitimate interest is fixing errors and improving the site. I delete an issue once I no longer need it to maintain the site.

The email address is optional. I store it in the database at Hostinger (see section 3) and use it for two mails only: the acknowledgement and the note that the report is resolved. Resend, Inc. (USA) sends both. I delete the address after the second mail, or after 12 months at the latest. Legal basis: your consent under Art. 6 (1) (a) GDPR. You can withdraw it at any time, for example by emailing me.

9. Online course PreSales Mastery

Course data is stored in a MySQL database at Hostinger (see section 3). Legal basis: Art. 6 (1) (b) GDPR unless stated otherwise.

Purchase

When online enrolment is open, you pay through Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Dublin 2, Ireland. Stripe also processes your payment data as a controller in its own right. I store your email address, a hash of it, the Stripe payment and customer identifiers, amount and currency. I keep accounting records as long as German tax and commercial law requires (§ 147 AO, § 257 HGB). Legal basis for that: Art. 6 (1) (c) GDPR.

I also store when the order confirmation with the terms and the withdrawal notice was sent to you. The record holds the order id and a hash of your email address, not the address itself. It shows that the confirmation was sent (Art. 6 (1) (b) and (c) GDPR). I keep it for as long as your course access exists. If you ask me to erase your course data, it is erased with it.

Access and sign-in

Your course access is stored with your email address for as long as the access exists. To sign in, I email you a link. It works once and expires after 30 minutes. For this, your email address is stored with the link. Used and expired links are deleted. After you sign in, the site sets the ph_course and ph_course_in cookies for 30 days (see the cookie policy).

Lesson progress

Which lessons you opened last and which you marked as done is stored with a hash of your email address for as long as your access exists. That lets you pick up where you left off on any device. Your answers to the check questions at the end of a lesson are not stored.

Exam and certificate

Final exam results (score, pass or fail, number of questions) are stored with a hash of your email address for as long as your access exists. If you pass, I create a certificate with the name you enter, the score and the date. The certificate page is public for anyone who has the link, so you can share it, for example on your profile. To change the name or have the certificate deleted, write to info@presales-handbook.com.

10. Google Analytics

Only if you accept in the cookie notice, I use Google Analytics 4 by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google collects pseudonymous usage data, such as pages viewed, time on page, approximate location, device and browser. Google Analytics 4 does not store full IP addresses. It sets the cookies _ga and _ga_<ID> for up to two years. Data may be transferred to Google LLC in the USA (see section 14). Legal basis: your consent, Art. 6 (1) (a) GDPR and § 25 (1) TDDDG. You can withdraw it at any time through the Cookie settings link in the footer. This deletes the analytics cookies.

11. YouTube videos

Videos are embedded so that nothing loads from YouTube before you press play. Only then does your browser load the video through youtube-nocookie.com from Google Ireland Limited. Google receives your IP address and technical data, and YouTube may use cookies or similar techniques. Data may be transferred to Google LLC in the USA. Legal basis: your consent by the click, Art. 6 (1) (a) GDPR and § 25 (1) TDDDG.

12. Amazon links

Links to my book and to book recommendations lead to Amazon. They are affiliate links with a partner tag. This site collects no data for them. When you click a link, Amazon (Amazon Europe Core S.à r.l., Luxembourg, and affiliated companies) processes your data under its own privacy notice and can record that you came from this site. I receive only aggregated sales reports with no details about you. Legal basis: Art. 6 (1) (f) GDPR. My legitimate interest is funding the free content.

13. Fonts

The fonts are served from this site's own server. No connection to Google is made.

14. Recipients in third countries

Some service providers are based in the USA or transfer data there:

• Resend, Inc. (USA): newsletter and delivery of form messages
• GitHub, Inc. (USA), a Microsoft company: feedback reports, without email address
• Upstash, Inc. (USA): abuse protection and counts
• Google LLC (USA), through Google Ireland Limited: Google Analytics and YouTube
• Stripe, Inc. (USA), through Stripe Payments Europe, Ltd.: payments

Transfers rely on the European Commission's adequacy decision for the EU-US Data Privacy Framework (Art. 45 GDPR) where the provider is certified under it. Otherwise the European Commission's Standard Contractual Clauses apply (Art. 46 (2) (c) GDPR). You can ask me for a copy.

15. Your rights

You have the right to:

• access (Art. 15 GDPR)
• rectification (Art. 16 GDPR)
• erasure (Art. 17 GDPR)
• restriction of processing (Art. 18 GDPR)
• data portability (Art. 20 GDPR)
• withdraw consent with effect for the future (Art. 7 (3) GDPR)

Write to info@presales-handbook.com.

You can also lodge a complaint with a supervisory authority (Art. 77 GDPR). The competent authority is the Bavarian Data Protection Authority (Bayerisches Landesamt für Datenschutzaufsicht, BayLDA), Promenade 18, 91522 Ansbach, Germany.

16. Obligation to provide data

You are not obliged to provide data. Without an email address, however, I cannot send you the newsletter, answer you or give you course access.

17. No automated decisions

There is no automated decision-making and no profiling under Art. 22 GDPR.

18. Changes

I update this policy when the site or the law changes. The version with the date above applies.